argand-site-registry/docs/VALIDATION.md

# Validation

## Version 0.3.0 security validation, 2026-09-13

Implementation commit: `9705b01fe4bca201220c22aed7aab10c17abbf1d`, signed by
Nic Weyand. This release closes the version 0.2 mutable-path, reviewer-trust,
resource-bound, compatibility and disclosure findings while preserving the
source/provenance/review architecture. Writer stores migrate to schema version 3
and `argand.site-rules/v3`.

Linux x86_64 with Rust/Cargo 1.98.1 and Python 3.14.7 passed:

- Formatting, locked all-target compilation, Clippy with warnings denied, strict
  API documentation, all 38 Rust tests and all eight Python source-release tests.
- Native CLI, reusable Rust and Python consumer parity across the all-five-source
  fixture, signed approval, activation, revocation and rollback refusal.
- Regression checks for post-open SQLite mutation, exact-stream import cleanup,
  consumer reviewer-trust mismatch, reviewer validity epochs, v1 current-generation
  activation, metadata-bound identity decisions, Curlie diff redaction and CrUX
  job identity.
- `cargo audit --deny warnings` against 1,243 RustSec advisories reported no findings
  in the 246 locked dependencies.

[Hosted Forgejo Actions run 4](https://git.argand.org/nicweyand/argand-site-registry/actions/runs/4)
passed the exact implementation commit in the isolated registry runner. It ran the
offline acceptance, produced two byte-identical source archives and receipts,
verified the receipt pin, extracted the archive without Git metadata and reran the
complete acceptance from that source tree. The runner had no dataset, reviewer,
signing or activation authority.

No provider data was acquired, no review or destination was promoted, and no
Argand source, build cache, service or public route was changed during this work.

## Version 0.2.0 release validation, 2026-09-13

Implementation commit: `e83f43d00f38fb1a8973316fc045ac4139069aaa`, signed by
Nic Weyand. This release hardens immutable generation reads and authenticated
review evidence, adds typed diffs and explicit resolution outcomes, and exposes
read-only audit and evaluation commands. Schema version 2 preserves legacy
review history but requires cryptographically authenticated decisions for release
signing.

Linux x86_64 with Rust/Cargo 1.98.1, Python 3.14.7 and two Cargo build jobs passed:

- Rust formatting, all-target compilation, Clippy with warnings denied, strict
  API documentation and all 32 Rust tests.
- All eight Python source-release tests, Python and shell syntax checks,
  ShellCheck, documentation links, and native CLI/Rust/Python consumer parity.
- Adversarial checks for unsigned SQLite WAL injection and generation symlinks,
  unauthenticated or tampered reviewer evidence, reviewer identity and trust-file
  mismatch, approval invalidation, revocation-only diffs, ambiguous identities,
  confusable domain queries, malformed evaluation cases and observation scope.
- `cargo audit --deny warnings` with no vulnerabilities, unmaintained packages,
  unsound packages or yanked dependencies reported.

The warm local acceptance run took 16.39 seconds with 1,140,856 KiB peak process
RSS. It produced 32 passing Rust tests and eight passing Python tests. These are
single-machine development measurements, not provider-scale import or serving
capacity claims.

[Hosted Forgejo Actions run 1](https://git.argand.org/nicweyand/argand-site-registry/actions/runs/1)
passed the exact implementation commit in 3 minutes 43 seconds. The repository-scoped
runner used image `argand-site-registry-ci@sha256:9dfad38312b7384839893225cd01835a6e8cb24c75e870fc959e460590be9c3d`,
built from the digest-pinned Rust 1.98.0 image declared in `ci/Dockerfile`. The
workflow fetched the public commit without credentials, ran acceptance, compared
two deterministic source archives and receipts, verified the receipt pin, then
reran acceptance from extracted source. The runner has no production mounts,
signing material or dataset-publishing authority.

No provider data was acquired, no reviewer decision or dataset generation was
created, and no Argand integration or production route was changed during this
release validation.

## Initial standalone validation, 2026-09-12

Implementation commit: `2a0fe1714b8ffb2e80203722bcb7987c630f432d`, signed by Nic Weyand.
The subsequent completion documentation changes no runtime or packaging code.

The baseline is Argand commit `47911062b00d87f215ba61c41965faf8a7f4b7f7`.
All extracted Rust, migration and provider-license bytes match UPSTREAM.json.
The extracted operator README changes only its working-directory instruction.
New files provide independent build metadata, examples, policy and release tooling.
The lockfile shrank from 642 packages to 246 with no new dependency versions.

## Acceptance

Linux x86_64, Rust/Cargo 1.98.1, Python 3.14, two Cargo build jobs. Passed:

- Rust formatting, all-target compilation and Clippy with warnings denied.
- All 23 Rust tests, zero failures or ignored tests; strict API documentation.
- Eight Python source-release tests, Python syntax checks, shell syntax and
  ShellCheck for the check script and every workflow shell step.
- Native all-five-source fixture import, idempotency, alias lookup, explicit
  identity joining, signed approval/activation, revocation and rollback refusal.
- Identical native CLI, Rust library example and Python example lookup envelopes,
  including provenance, attribution and multiple regional properties. Every
  consumer refused an incorrect generation pin.
- Two source archives and receipts from the implementation commit were byte-for-byte
  identical. Receipt pin: `811af8fe2fd1e747b7745a44dba24e2397c01b43381e11846753e284caf6a275`.
- Full acceptance rerun from the verified archive outside the Git checkout, then
  from `/tmp` to exclude the developer's ancestor Cargo configuration. Neither
  extracted copy had a `.git` directory or accessed Argand's source tree.

The primary check took 28.24 seconds with 566,388 KiB peak process RSS after the
initial compiler check. A separate optimized build took 84.15 seconds with
602,340 KiB peak RSS. The archive check under `/tmp` took 101.64 seconds with
569,228 KiB peak RSS, including recompilation. These are local single-run toolchain
measurements, not serving-latency or full-provider capacity claims. Build output,
fixtures, disposable keys and detailed logs were retained outside the repository.

The final initial inventory was reviewed for credentials, private paths, datasets,
unrelated files and provenance loss. Source archives exclude private-key and dataset
extensions, symlinks, submodules, traversal paths and uncommitted changes. Tests
exercise receipt/archive tampering, duplicate JSON keys, unsafe members and
no-clobber output. All documentation links resolve locally.

### Operational state at initial publication

The code was independently buildable. The public Forgejo repository required
signed commits and restricts direct pushes and merges to the maintainer; review
rules applied to administrators. CI workflow commands were validated locally.
Actions was disabled pending a dedicated isolated runner, so the initial
validation made no hosted CI run or automatically produced remote artifact claim.

No provider dataset was newly acquired, no production approval was fabricated,
and no dataset timer, public Navigate route or registry generation was promoted.
Argand's live source/build window remained with its beta agent. Its embedded
registry dependency has not been replaced; docs/CONSUMERS.md describes cutover.