argand-site-registry/docs/FORMATS.md

Versioned formats

Version 0.5 uses writer schema 5 and argand.site-rules/v4. Schema identifiers are independent from the crate version. Unknown schemas and rules fail closed.

Artifact	Current schema	Purpose
Source manifest	argand.site-source/v3	Exact source object, integrity proof, lineage, parser bound and typed coverage
Generation receipt	argand.site-registry/v3	Compact runtime plus content-addressed audit references
Active/audit JSONL	argand.site-export/v2	Source-bearing assertions with selection state
Compact audit JSONL	argand.site-export/v3	Verified external history with bundle references and tombstones
Cold audit bundle	argand.site-audit-bundle/v2	Source manifest and ordered record/fact history
Audit verification	argand.site-audit-verification/v1	Streaming bundle verification totals
Audit retention checkpoint	argand.site-audit-retention/v1	Signed no-delete retention set
Benchmark report	argand.site-benchmark/v1	Source-pinned operation and resource evidence
Evaluation report	argand.site-evaluation/v2	Resolver judgments, latency, and active source lineage
Evidence bundle	argand.site-evidence-bundle/v1	Exact evidence signed by reviewer votes
Vote	argand.site-vote/v1	Authenticated approve/revoke decision
Review policy	argand.site-policy/v1	Threshold, groups, revocation, and separation rules
Observation batch	argand.site-observation-source/v1	Pinned JSONL object and rights
Observation	argand.site-observation/v1	Normalized subject-bound observation
Observer capture	argand.site-observer-capture/v1	Cache-only replay input
Emergency revocations	argand.site-revocations/v1	Cumulative publisher-signed offline block overlay
Active pointer	argand.site-current/v2	Signed generation pin plus revocation continuity
Diff	argand.site-diff/v4	Typed change stream across generations

Source manifest v3 adds explicit integrity, lineage, and an optional maximum_record_bytes parser ceiling to v2 typed coverage. Integrity always contains the locally computed SHA-256 and may also carry a source-bound provider checksum. Lineage names the direct provider, upstream datasets, transformations, and a conservative independence group. A missing legacy lineage serializes as unknown and never becomes evidence of independence.

Coverage is one of full, partition, or delta. A delta names its exact base, positive consecutive sequence, and superseded source IDs. A full source cannot compose with active partitions. Overlap, gaps, cycles, missing bases, cross-provider supersession, and mixed legacy/typed frontiers fail the build.

Generation v3 uses runtime_layout: "compact-v1". Its local SQLite database keeps the selected source manifests, active facts and projections, review/policy state, and the evidence needed by runtime queries. Each complete source history is first written to an external JSONL object. The receipt binds its SHA-256, length, source, record/fact counts, selected state, attribution digest and coverage digest. verify-audit re-hashes and parses every object before an audit export or retention checkpoint. The separate retention signature namespace is argand-site-registry-audit-retention; every checkpoint contains deletion_authorized: false. Generation v2 remains supported with embedded history for compatibility.

The normal export emits selected active facts only and excludes rejected facts. Every assertion has selection_state: "active". Audit export includes active, superseded, and rejected facts; rejected assertions include their reason. Both modes redact Curlie descriptions by default and neither represents approved navigation routes. Use resolve for admission.

Votes bind the subject kind and fingerprint, evidence-bundle digest, policy digest, reviewer, decision, reason, asserted review time, optional expiry, exact role/locale/country scope, and revocation supersession IDs. Exact JSON bytes are signed with OpenSSH namespace argand-site-registry-vote. Writer accepted_at is separate and cannot be supplied by the reviewer.

Policy fields define base thresholds for names, edges, and equivalences; maximum approval and observation ages; reviewer groups; publisher separation; source and drift holds; and optional stricter risk_thresholds for source_conflict and dangerous_drift. Unknown fields and risk classes fail closed.

Emergency feeds retain every authenticated revocation ID across policy epochs, active state, any explicit superseding quorum, and a refresh deadline no more than seven days after the effective time. Exact JSON bytes use OpenSSH namespace argand-site-registry-revocations. A feed can overlay a cached generation only when rules, policy, and reviewer trust-root digests match. Feed continuity rejects dropped subjects or vote IDs. A feed from another compatible generation may only add blocks. Removing a block requires the exact full generation so the consumer can recompute the signed superseding quorum; expired feeds fail closed.

Legacy source manifests remain readable as isolated (source, scope) streams. Legacy 0.3 reviews remain available only through the explicit compatibility policy. New strict builds use votes and a receipt-bound reviewer trust root.

The contract decisions are recorded in ADR 0001, ADR 0002, ADR 0003, ADR 0004, and ADR 0005.