argand-site-registry/docs/TRUST.md

Trust and evidence policy

What the implementation enforces

Inputs use reviewed source adapters and explicit manifests. URL normalization, PSL parsing and stable identities are deterministic. Fact provenance, conflicting evidence and source-specific popularity remain separate. Names and similar hostnames never silently join entities. Invalid URLs and malformed imports fail validation; a partial import does not replace a complete source selection.

Destination and identity decisions bind exact evidence fingerprints, including names, assertions and normalization context. Reviews expire within 90 days. Changed evidence invalidates earlier approvals. Resolution abstains on ambiguity, ties, missing approval or ineligible claims; regional scopes must explicitly match. Reviewer decisions are signed under a dedicated SSH namespace and the local writer retains their exact decision/signature bytes in the append-only review log.

Generations bind the database, license document and attribution to a completion receipt. Consumers provide a trusted hash or verify an external publisher key. Release signing re-verifies every stored decision against an external reviewer trust file. Activation checks publisher signatures, re-verifies every review against a separately supplied reviewer trust file and refuses rollback that loses distributed revocations. Reviewer validity epochs are evaluated at decision time for retained history while new decisions must pass the trust policy at append time. Updates build candidates and cannot approve, sign or activate them.

What a publisher must establish

The reviewer name and evidence locator in a decision are operator assertions. The CLI authenticates exact decision bytes to an allowed SSH signer and validates their structure and evidence binding; it does not retrieve the cited evidence or prove website ownership. Protect the writer database and signing key with separate operating permissions. Restrict who can author decisions and require human review before release signing.

Publish dated evidence supporting the exact entity, URL, relationship, role and country/locale. Prefer independently corroborated primary evidence with immutable capture identifiers. Record contrary evidence and uncertainty. TLS, DNS control, registrable-domain spelling, redirects, sameAs or popularity alone cannot establish every identity or role claim. Future crawler observations remain inputs to review. Confidence values are assertion scores, not calibrated probabilities.

Choose expiry based on volatility, within the enforced maximum. Do not renew blindly on a timer. Expired approval should lead to abstention until evidence is reviewed. Disclose editorial conflicts and use an independent reviewer for a disputed claim when possible. The implementation is a local single-writer tool with externally authenticated reviewer keys; it does not provide accounts or an enforced quorum.

What consumers must preserve

Authenticate a release before opening it. Consumers that rely on reviewer separation must use release::verify_signed or activate with independently distributed publisher and reviewer trust files; a receipt pin alone delegates the whole release decision to whoever distributed that pin. Keep the full receipt pin and required attribution with caches and exports. Use resolve for reviewed destinations, keep null as abstention, and enforce application-specific malware/content/navigation policy separately. A verified signature authenticates the publisher, not the truth of every assertion. An official website may later be compromised.

Deliver revocations to every active consumer and derived catalogue, and bound cache lifetimes. The resolver checks review expiry at query time; a detached cached URL does not recheck itself. Preserve the current review history during rollback. Copying SQLite rows or the JSONL export into a second resolver can bypass these checks; use the native API or CLI for admission decisions.

Community changes

Treat public submissions as untrusted evidence. Do not execute submitted content or copy review decisions into production automatically. Source allowlist and attribution changes need both implementation tests and documented rights review. Reject unknown sources until those checks are complete. Every publisher may apply stricter admission rules, and must state its actual review and incident procedures.