61 lines
3.8 KiB
Markdown
61 lines
3.8 KiB
Markdown
# Versioned formats
|
|
|
|
Version 0.4 uses writer schema 5 and `argand.site-rules/v4`. Schema identifiers
|
|
are independent from the crate version. Unknown schemas and rules fail closed.
|
|
|
|
| Artifact | Current schema | Purpose |
|
|
| --- | --- | --- |
|
|
| Source manifest | `argand.site-source/v2` | Exact source object plus typed coverage |
|
|
| Generation receipt | `argand.site-registry/v2` | Hash-bound immutable generation contract |
|
|
| Active/audit JSONL | `argand.site-export/v2` | Source-bearing assertions with selection state |
|
|
| Evidence bundle | `argand.site-evidence-bundle/v1` | Exact evidence signed by reviewer votes |
|
|
| Vote | `argand.site-vote/v1` | Authenticated approve/revoke decision |
|
|
| Review policy | `argand.site-policy/v1` | Threshold, groups, revocation, and separation rules |
|
|
| Observation batch | `argand.site-observation-source/v1` | Pinned JSONL object and rights |
|
|
| Observation | `argand.site-observation/v1` | Normalized subject-bound observation |
|
|
| Observer capture | `argand.site-observer-capture/v1` | Cache-only replay input |
|
|
| Emergency revocations | `argand.site-revocations/v1` | Cumulative publisher-signed offline block overlay |
|
|
| Active pointer | `argand.site-current/v2` | Signed generation pin plus revocation continuity |
|
|
| Diff | `argand.site-diff/v4` | Typed change stream across generations |
|
|
|
|
Source manifest v2 coverage is one of `full`, `partition`, or `delta`. A delta
|
|
names its exact base, positive consecutive sequence, and superseded source IDs.
|
|
A full source cannot compose with active partitions. Overlap, gaps, cycles,
|
|
missing bases, cross-provider supersession, and mixed legacy/typed frontiers fail
|
|
the build.
|
|
|
|
The normal export emits selected active facts only and excludes rejected facts.
|
|
Every assertion has `selection_state: "active"`. Audit export includes active,
|
|
superseded, and rejected facts; rejected assertions include their reason. Both
|
|
modes redact Curlie descriptions by default and neither represents approved
|
|
navigation routes. Use `resolve` for admission.
|
|
|
|
Votes bind the subject kind and fingerprint, evidence-bundle digest, policy
|
|
digest, reviewer, decision, reason, asserted review time, optional expiry, exact
|
|
role/locale/country scope, and revocation supersession IDs. Exact JSON bytes are
|
|
signed with OpenSSH namespace `argand-site-registry-vote`. Writer `accepted_at`
|
|
is separate and cannot be supplied by the reviewer.
|
|
|
|
Policy fields define base thresholds for names, edges, and equivalences; maximum
|
|
approval and observation ages; reviewer groups; publisher separation; source and
|
|
drift holds; and optional stricter `risk_thresholds` for `source_conflict` and
|
|
`dangerous_drift`. Unknown fields and risk classes fail closed.
|
|
|
|
Emergency feeds retain every authenticated revocation ID across policy epochs,
|
|
active state, any explicit superseding quorum, and a refresh deadline no more
|
|
than seven days after the effective time. Exact JSON bytes use OpenSSH namespace
|
|
`argand-site-registry-revocations`. A feed can overlay a cached generation only
|
|
when rules, policy, and reviewer trust-root digests match. Feed continuity rejects
|
|
dropped subjects or vote IDs. A feed from another compatible generation may only
|
|
add blocks. Removing a block requires the exact full generation so the consumer
|
|
can recompute the signed superseding quorum; expired feeds fail closed.
|
|
|
|
Legacy source manifests remain readable as isolated `(source, scope)` streams.
|
|
Legacy 0.3 reviews remain available only through the explicit compatibility
|
|
policy. New strict builds use votes and a receipt-bound reviewer trust root.
|
|
|
|
The contract decisions are recorded in [ADR 0001](adr/0001-typed-source-coverage.md),
|
|
[ADR 0002](adr/0002-granular-trust-subjects.md),
|
|
[ADR 0003](adr/0003-votes-revocations-and-publishers.md),
|
|
[ADR 0004](adr/0004-active-and-audit-views.md), and
|
|
[ADR 0005](adr/0005-full-delta-release-identity.md).
|