argand-site-registry/docs/FORMATS.md

# Versioned formats

Version 0.6 uses writer schema 5 and `argand.site-rules/v4`. Schema identifiers
are independent from the crate version. Unknown schemas and rules fail closed.

The Common Crawl domain-rank adapter is new in 0.6, so no older v4 store can
contain one of its source manifests. Its replacement scope is
`candidate-domains:<sha256>`, where the digest covers the canonical JSON encoding
of the sorted set of registrable domains derived from retained complete website
assertions. Retained superseded evidence may enlarge this conservative set but
cannot create a route or make a retired assertion active.
The importer authenticates and validates every graph row but persists only the
selected domains. A changed identity frontier therefore produces a new immutable
source identity instead of silently reusing a stale projection.

| Artifact | Current schema | Purpose |
| --- | --- | --- |
| Source manifest | `argand.site-source/v3` | Exact source object, integrity proof, lineage, parser bound and typed coverage |
| Generation receipt | `argand.site-registry/v3` | Compact runtime plus content-addressed audit references |
| Active/audit JSONL | `argand.site-export/v2` | Source-bearing assertions with selection state |
| Compact audit JSONL | `argand.site-export/v3` | Verified external history with bundle references and tombstones |
| Cold audit bundle | `argand.site-audit-bundle/v2` | Source manifest and ordered record/fact history |
| Audit verification | `argand.site-audit-verification/v1` | Streaming bundle verification totals |
| Audit retention checkpoint | `argand.site-audit-retention/v1` | Signed no-delete retention set |
| Benchmark report | `argand.site-benchmark/v1` | Source-pinned operation and resource evidence |
| Evaluation report | `argand.site-evaluation/v2` | Resolver judgments, latency, and active source lineage |
| Evidence bundle | `argand.site-evidence-bundle/v1` | Exact evidence signed by reviewer votes |
| Vote | `argand.site-vote/v1` | Authenticated approve/revoke decision |
| Review policy | `argand.site-policy/v1` | Threshold, groups, revocation, and separation rules |
| Observation batch | `argand.site-observation-source/v1` | Pinned JSONL object and rights |
| Observation | `argand.site-observation/v1` | Normalized subject-bound observation |
| Observer capture | `argand.site-observer-capture/v1` | Cache-only replay input |
| Emergency revocations | `argand.site-revocations/v1` | Cumulative publisher-signed offline block overlay |
| Active pointer | `argand.site-current/v2` | Signed generation pin plus revocation continuity |
| Diff | `argand.site-diff/v4` | Typed change stream across generations |

Source manifest v3 adds explicit `integrity`, `lineage`, and an optional
`maximum_record_bytes` parser ceiling to v2 typed coverage. Integrity always
contains the locally computed SHA-256 and may also carry a source-bound provider
checksum. Lineage names the direct provider, upstream datasets, transformations,
and a conservative independence group. A missing legacy lineage serializes as
unknown and never becomes evidence of independence.

Coverage is one of `full`, `partition`, or `delta`. A delta
names its exact base, positive consecutive sequence, and superseded source IDs.
A full source cannot compose with active partitions. Overlap, gaps, cycles,
missing bases, cross-provider supersession, and mixed legacy/typed frontiers fail
the build.

Generation v3 uses `runtime_layout: "compact-v1"`. Its local SQLite database keeps
the selected source manifests, active facts and projections, review/policy state,
and the evidence needed by runtime queries. Each complete source history is first
written to an external JSONL object. The receipt binds its SHA-256, length, source,
record/fact counts, selected state, attribution digest and coverage digest.
`verify-audit` re-hashes and parses every object before an audit export or retention
checkpoint. The separate retention signature namespace is
`argand-site-registry-audit-retention`; every checkpoint contains
`deletion_authorized: false`. Generation v2 remains supported with embedded
history for compatibility.

The normal export emits selected active facts only and excludes rejected facts.
Every assertion has `selection_state: "active"`. Audit export includes active,
superseded, and rejected facts; rejected assertions include their reason. Both
modes redact Curlie descriptions by default and neither represents approved
navigation routes. Use `resolve` for admission.

Votes bind the subject kind and fingerprint, evidence-bundle digest, policy
digest, reviewer, decision, reason, asserted review time, optional expiry, exact
role/locale/country scope, and revocation supersession IDs. Exact JSON bytes are
signed with OpenSSH namespace `argand-site-registry-vote`. Writer `accepted_at`
is separate and cannot be supplied by the reviewer.

Policy fields define base thresholds for names, edges, and equivalences; maximum
approval and observation ages; reviewer groups; publisher separation; source and
drift holds; and optional stricter `risk_thresholds` for `source_conflict` and
`dangerous_drift`. Unknown fields and risk classes fail closed.

Emergency feeds retain every authenticated revocation ID across policy epochs,
active state, any explicit superseding quorum, and a refresh deadline no more
than seven days after the effective time. Exact JSON bytes use OpenSSH namespace
`argand-site-registry-revocations`. A feed can overlay a cached generation only
when rules, policy, and reviewer trust-root digests match. Feed continuity rejects
dropped subjects or vote IDs. A feed from another compatible generation may only
add blocks. Removing a block requires the exact full generation so the consumer
can recompute the signed superseding quorum; expired feeds fail closed.

Legacy source manifests remain readable as isolated `(source, scope)` streams.
Legacy 0.3 reviews remain available only through the explicit compatibility
policy. New strict builds use votes and a receipt-bound reviewer trust root.

The contract decisions are recorded in [ADR 0001](adr/0001-typed-source-coverage.md),
[ADR 0002](adr/0002-granular-trust-subjects.md),
[ADR 0003](adr/0003-votes-revocations-and-publishers.md),
[ADR 0004](adr/0004-active-and-audit-views.md), and
[ADR 0005](adr/0005-full-delta-release-identity.md).