argand-site-registry/docs/FORMATS.md

# Versioned formats

Version 0.5 uses writer schema 5 and `argand.site-rules/v4`. Schema identifiers
are independent from the crate version. Unknown schemas and rules fail closed.

| Artifact | Current schema | Purpose |
| --- | --- | --- |
| Source manifest | `argand.site-source/v3` | Exact source object, integrity proof, lineage, parser bound and typed coverage |
| Generation receipt | `argand.site-registry/v3` | Compact runtime plus content-addressed audit references |
| Active/audit JSONL | `argand.site-export/v2` | Source-bearing assertions with selection state |
| Compact audit JSONL | `argand.site-export/v3` | Verified external history with bundle references and tombstones |
| Cold audit bundle | `argand.site-audit-bundle/v2` | Source manifest and ordered record/fact history |
| Audit verification | `argand.site-audit-verification/v1` | Streaming bundle verification totals |
| Audit retention checkpoint | `argand.site-audit-retention/v1` | Signed no-delete retention set |
| Benchmark report | `argand.site-benchmark/v1` | Source-pinned operation and resource evidence |
| Evaluation report | `argand.site-evaluation/v2` | Resolver judgments, latency, and active source lineage |
| Evidence bundle | `argand.site-evidence-bundle/v1` | Exact evidence signed by reviewer votes |
| Vote | `argand.site-vote/v1` | Authenticated approve/revoke decision |
| Review policy | `argand.site-policy/v1` | Threshold, groups, revocation, and separation rules |
| Observation batch | `argand.site-observation-source/v1` | Pinned JSONL object and rights |
| Observation | `argand.site-observation/v1` | Normalized subject-bound observation |
| Observer capture | `argand.site-observer-capture/v1` | Cache-only replay input |
| Emergency revocations | `argand.site-revocations/v1` | Cumulative publisher-signed offline block overlay |
| Active pointer | `argand.site-current/v2` | Signed generation pin plus revocation continuity |
| Diff | `argand.site-diff/v4` | Typed change stream across generations |

Source manifest v3 adds explicit `integrity`, `lineage`, and an optional
`maximum_record_bytes` parser ceiling to v2 typed coverage. Integrity always
contains the locally computed SHA-256 and may also carry a source-bound provider
checksum. Lineage names the direct provider, upstream datasets, transformations,
and a conservative independence group. A missing legacy lineage serializes as
unknown and never becomes evidence of independence.

Coverage is one of `full`, `partition`, or `delta`. A delta
names its exact base, positive consecutive sequence, and superseded source IDs.
A full source cannot compose with active partitions. Overlap, gaps, cycles,
missing bases, cross-provider supersession, and mixed legacy/typed frontiers fail
the build.

Generation v3 uses `runtime_layout: "compact-v1"`. Its local SQLite database keeps
the selected source manifests, active facts and projections, review/policy state,
and the evidence needed by runtime queries. Each complete source history is first
written to an external JSONL object. The receipt binds its SHA-256, length, source,
record/fact counts, selected state, attribution digest and coverage digest.
`verify-audit` re-hashes and parses every object before an audit export or retention
checkpoint. The separate retention signature namespace is
`argand-site-registry-audit-retention`; every checkpoint contains
`deletion_authorized: false`. Generation v2 remains supported with embedded
history for compatibility.

The normal export emits selected active facts only and excludes rejected facts.
Every assertion has `selection_state: "active"`. Audit export includes active,
superseded, and rejected facts; rejected assertions include their reason. Both
modes redact Curlie descriptions by default and neither represents approved
navigation routes. Use `resolve` for admission.

Votes bind the subject kind and fingerprint, evidence-bundle digest, policy
digest, reviewer, decision, reason, asserted review time, optional expiry, exact
role/locale/country scope, and revocation supersession IDs. Exact JSON bytes are
signed with OpenSSH namespace `argand-site-registry-vote`. Writer `accepted_at`
is separate and cannot be supplied by the reviewer.

Policy fields define base thresholds for names, edges, and equivalences; maximum
approval and observation ages; reviewer groups; publisher separation; source and
drift holds; and optional stricter `risk_thresholds` for `source_conflict` and
`dangerous_drift`. Unknown fields and risk classes fail closed.

Emergency feeds retain every authenticated revocation ID across policy epochs,
active state, any explicit superseding quorum, and a refresh deadline no more
than seven days after the effective time. Exact JSON bytes use OpenSSH namespace
`argand-site-registry-revocations`. A feed can overlay a cached generation only
when rules, policy, and reviewer trust-root digests match. Feed continuity rejects
dropped subjects or vote IDs. A feed from another compatible generation may only
add blocks. Removing a block requires the exact full generation so the consumer
can recompute the signed superseding quorum; expired feeds fail closed.

Legacy source manifests remain readable as isolated `(source, scope)` streams.
Legacy 0.3 reviews remain available only through the explicit compatibility
policy. New strict builds use votes and a receipt-bound reviewer trust root.

The contract decisions are recorded in [ADR 0001](adr/0001-typed-source-coverage.md),
[ADR 0002](adr/0002-granular-trust-subjects.md),
[ADR 0003](adr/0003-votes-revocations-and-publishers.md),
[ADR 0004](adr/0004-active-and-audit-views.md), and
[ADR 0005](adr/0005-full-delta-release-identity.md).