argand-site-registry/docs/VALIDATION.md

Validation

Version 0.2.0 release validation, 2026-09-13

Implementation commit: e83f43d00f38fb1a8973316fc045ac4139069aaa, signed by Nic Weyand. This release hardens immutable generation reads and authenticated review evidence, adds typed diffs and explicit resolution outcomes, and exposes read-only audit and evaluation commands. Schema version 2 preserves legacy review history but requires cryptographically authenticated decisions for release signing.

Linux x86_64 with Rust/Cargo 1.98.1, Python 3.14.7 and two Cargo build jobs passed:

• Rust formatting, all-target compilation, Clippy with warnings denied, strict API documentation and all 32 Rust tests.
• All eight Python source-release tests, Python and shell syntax checks, ShellCheck, documentation links, and native CLI/Rust/Python consumer parity.
• Adversarial checks for unsigned SQLite WAL injection and generation symlinks, unauthenticated or tampered reviewer evidence, reviewer identity and trust-file mismatch, approval invalidation, revocation-only diffs, ambiguous identities, confusable domain queries, malformed evaluation cases and observation scope.
• cargo audit --deny warnings with no vulnerabilities, unmaintained packages, unsound packages or yanked dependencies reported.

The warm local acceptance run took 16.39 seconds with 1,140,856 KiB peak process RSS. It produced 32 passing Rust tests and eight passing Python tests. These are single-machine development measurements, not provider-scale import or serving capacity claims.

Hosted Forgejo Actions run 1 passed the exact implementation commit in 3 minutes 43 seconds. The repository-scoped runner used image argand-site-registry-ci@sha256:9dfad38312b7384839893225cd01835a6e8cb24c75e870fc959e460590be9c3d, built from the digest-pinned Rust 1.98.0 image declared in ci/Dockerfile. The workflow fetched the public commit without credentials, ran acceptance, compared two deterministic source archives and receipts, verified the receipt pin, then reran acceptance from extracted source. The runner has no production mounts, signing material or dataset-publishing authority.

No provider data was acquired, no reviewer decision or dataset generation was created, and no Argand integration or production route was changed during this release validation.

Initial standalone validation, 2026-09-12

Implementation commit: 2a0fe1714b8ffb2e80203722bcb7987c630f432d, signed by Nic Weyand. The subsequent completion documentation changes no runtime or packaging code.

The baseline is Argand commit 47911062b00d87f215ba61c41965faf8a7f4b7f7. All extracted Rust, migration and provider-license bytes match UPSTREAM.json. The extracted operator README changes only its working-directory instruction. New files provide independent build metadata, examples, policy and release tooling. The lockfile shrank from 642 packages to 246 with no new dependency versions.

Acceptance

Linux x86_64, Rust/Cargo 1.98.1, Python 3.14, two Cargo build jobs. Passed:

• Rust formatting, all-target compilation and Clippy with warnings denied.
• All 23 Rust tests, zero failures or ignored tests; strict API documentation.
• Eight Python source-release tests, Python syntax checks, shell syntax and ShellCheck for the check script and every workflow shell step.
• Native all-five-source fixture import, idempotency, alias lookup, explicit identity joining, signed approval/activation, revocation and rollback refusal.
• Identical native CLI, Rust library example and Python example lookup envelopes, including provenance, attribution and multiple regional properties. Every consumer refused an incorrect generation pin.
• Two source archives and receipts from the implementation commit were byte-for-byte identical. Receipt pin: 811af8fe2fd1e747b7745a44dba24e2397c01b43381e11846753e284caf6a275.
• Full acceptance rerun from the verified archive outside the Git checkout, then from /tmp to exclude the developer's ancestor Cargo configuration. Neither extracted copy had a .git directory or accessed Argand's source tree.

The primary check took 28.24 seconds with 566,388 KiB peak process RSS after the initial compiler check. A separate optimized build took 84.15 seconds with 602,340 KiB peak RSS. The archive check under /tmp took 101.64 seconds with 569,228 KiB peak RSS, including recompilation. These are local single-run toolchain measurements, not serving-latency or full-provider capacity claims. Build output, fixtures, disposable keys and detailed logs were retained outside the repository.

The final initial inventory was reviewed for credentials, private paths, datasets, unrelated files and provenance loss. Source archives exclude private-key and dataset extensions, symlinks, submodules, traversal paths and uncommitted changes. Tests exercise receipt/archive tampering, duplicate JSON keys, unsafe members and no-clobber output. All documentation links resolve locally.

Operational state at initial publication

The code was independently buildable. The public Forgejo repository required signed commits and restricts direct pushes and merges to the maintainer; review rules applied to administrators. CI workflow commands were validated locally. Actions was disabled pending a dedicated isolated runner, so the initial validation made no hosted CI run or automatically produced remote artifact claim.

No provider dataset was newly acquired, no production approval was fabricated, and no dataset timer, public Navigate route or registry generation was promoted. Argand's live source/build window remained with its beta agent. Its embedded registry dependency has not been replaced; docs/CONSUMERS.md describes cutover.