argand-site-registry/docs/FORMATS.md

Versioned formats

Version 0.4 uses writer schema 5 and argand.site-rules/v4. Schema identifiers are independent from the crate version. Unknown schemas and rules fail closed.

Artifact	Current schema	Purpose
Source manifest	argand.site-source/v2	Exact source object plus typed coverage
Generation receipt	argand.site-registry/v2	Hash-bound immutable generation contract
Active/audit JSONL	argand.site-export/v2	Source-bearing assertions with selection state
Evidence bundle	argand.site-evidence-bundle/v1	Exact evidence signed by reviewer votes
Vote	argand.site-vote/v1	Authenticated approve/revoke decision
Review policy	argand.site-policy/v1	Threshold, groups, revocation, and separation rules
Observation batch	argand.site-observation-source/v1	Pinned JSONL object and rights
Observation	argand.site-observation/v1	Normalized subject-bound observation
Observer capture	argand.site-observer-capture/v1	Cache-only replay input
Emergency revocations	argand.site-revocations/v1	Cumulative publisher-signed offline block overlay
Active pointer	argand.site-current/v2	Signed generation pin plus revocation continuity
Diff	argand.site-diff/v4	Typed change stream across generations

Source manifest v2 coverage is one of full, partition, or delta. A delta names its exact base, positive consecutive sequence, and superseded source IDs. A full source cannot compose with active partitions. Overlap, gaps, cycles, missing bases, cross-provider supersession, and mixed legacy/typed frontiers fail the build.

The normal export emits selected active facts only and excludes rejected facts. Every assertion has selection_state: "active". Audit export includes active, superseded, and rejected facts; rejected assertions include their reason. Both modes redact Curlie descriptions by default and neither represents approved navigation routes. Use resolve for admission.

Votes bind the subject kind and fingerprint, evidence-bundle digest, policy digest, reviewer, decision, reason, asserted review time, optional expiry, exact role/locale/country scope, and revocation supersession IDs. Exact JSON bytes are signed with OpenSSH namespace argand-site-registry-vote. Writer accepted_at is separate and cannot be supplied by the reviewer.

Policy fields define base thresholds for names, edges, and equivalences; maximum approval and observation ages; reviewer groups; publisher separation; source and drift holds; and optional stricter risk_thresholds for source_conflict and dangerous_drift. Unknown fields and risk classes fail closed.

Emergency feeds retain every authenticated revocation ID across policy epochs, active state, any explicit superseding quorum, and a refresh deadline no more than seven days after the effective time. Exact JSON bytes use OpenSSH namespace argand-site-registry-revocations. A feed can overlay a cached generation only when rules, policy, and reviewer trust-root digests match. Feed continuity rejects dropped subjects or vote IDs. A feed from another compatible generation may only add blocks. Removing a block requires the exact full generation so the consumer can recompute the signed superseding quorum; expired feeds fail closed.

Legacy source manifests remain readable as isolated (source, scope) streams. Legacy 0.3 reviews remain available only through the explicit compatibility policy. New strict builds use votes and a receipt-bound reviewer trust root.

The contract decisions are recorded in ADR 0001, ADR 0002, ADR 0003, ADR 0004, and ADR 0005.