1.9 KiB
ADR 0003: Signed votes, sticky revocations, and publisher separation
Status: Accepted, 2026-09-13.
Reviews are immutable signed votes compiled under a receipt-bound policy epoch. The reference policy requires two reviewer identities, two independent groups, and two physical SSH keys. One revocation blocks the exact subject until every approval in a fresh quorum explicitly references all active revocation IDs. Publisher identity and key must be separate from every reviewer vote. Changing the policy epoch never clears a retained revocation; a fresh quorum under the new policy must explicitly supersede it.
Trusted writer acceptance time bounds validity. Reviewer timestamps cannot backdate eligibility or extend an approval beyond 90 days after acceptance.
Risk-class thresholds may raise the base name, edge, or equivalence quorum for
source_conflict and dangerous_drift. The reference policy also holds those
edges in disputed or probationary state until the underlying risk clears.
Emergency feeds are cumulative, use the separate
argand-site-registry-revocations SSH namespace, retain superseded revocation
IDs, and can be applied to a compatible pinned generation before its replacement
arrives. Cross-generation feeds only add blocks. Reinstatement requires the exact
full generation containing the signed superseding quorum, and feed artifacts must
be refreshed at least every seven days.
Rejected alternatives
Latest-decision-wins lets one later approval erase a revocation. Counting aliases of one key as separate reviewers does not provide independence. Letting a release publisher contribute approvals collapses review and publication into one actor.
Compatibility
Legacy decisions remain available only under the explicit v0.3 compatibility policy. Strict receipts bind the policy and reviewer trust-root digests. A policy change creates a new epoch and old approvals become stale rather than being silently reinterpreted.