nicweyand
e83f43d00f
All checks were successful
Standalone registry checks / check (push) Successful in 3m43s
68 lines
3.9 KiB
Markdown
68 lines
3.9 KiB
Markdown
# Trust and evidence policy
|
|
|
|
## What the implementation enforces
|
|
|
|
Inputs use reviewed source adapters and explicit manifests. URL normalization,
|
|
PSL parsing and stable identities are deterministic. Fact provenance, conflicting
|
|
evidence and source-specific popularity remain separate. Names and similar
|
|
hostnames never silently join entities. Invalid URLs and malformed imports fail
|
|
validation; a partial import does not replace a complete source selection.
|
|
|
|
Destination and identity decisions bind exact evidence fingerprints, including
|
|
names, assertions and normalization context. Reviews expire within 90 days.
|
|
Changed evidence invalidates earlier approvals. Resolution abstains on ambiguity,
|
|
ties, missing approval or ineligible claims; regional scopes must explicitly
|
|
match. Reviewer decisions are signed under a dedicated SSH namespace and the local
|
|
writer retains their exact decision/signature bytes in the append-only review log.
|
|
|
|
Generations bind the database, license document and attribution to a completion
|
|
receipt. Consumers provide a trusted hash or verify an external publisher key.
|
|
Release signing re-verifies every stored decision against an external reviewer
|
|
trust file. Activation checks publisher signatures, rejects structurally incomplete
|
|
review proofs and refuses rollback that loses distributed revocations. Updates
|
|
build candidates and cannot approve, sign or activate them.
|
|
|
|
## What a publisher must establish
|
|
|
|
The reviewer name and evidence locator in a decision are operator assertions.
|
|
The CLI authenticates exact decision bytes to an allowed SSH signer and validates
|
|
their structure and evidence binding; it does not retrieve the cited evidence or
|
|
prove website ownership.
|
|
Protect the writer database and signing key with separate operating permissions.
|
|
Restrict who can author decisions and require human review before release signing.
|
|
|
|
Publish dated evidence supporting the exact entity, URL, relationship, role and
|
|
country/locale. Prefer independently corroborated primary evidence with immutable
|
|
capture identifiers. Record contrary evidence and uncertainty. TLS, DNS control,
|
|
registrable-domain spelling, redirects, `sameAs` or popularity alone cannot
|
|
establish every identity or role claim. Future crawler observations remain inputs
|
|
to review. Confidence values are assertion scores, not calibrated probabilities.
|
|
|
|
Choose expiry based on volatility, within the enforced maximum. Do not renew
|
|
blindly on a timer. Expired approval should lead to abstention until evidence is
|
|
reviewed. Disclose editorial conflicts and use an independent reviewer for a
|
|
disputed claim when possible. The implementation is a local single-writer tool
|
|
with externally authenticated reviewer keys; it does not provide accounts or an
|
|
enforced quorum.
|
|
|
|
## What consumers must preserve
|
|
|
|
Authenticate a release before opening it. Keep the full receipt pin and required
|
|
attribution with caches and exports. Use `resolve` for reviewed destinations, keep
|
|
null as abstention, and enforce application-specific malware/content/navigation
|
|
policy separately. A verified signature authenticates the publisher, not the truth
|
|
of every assertion. An official website may later be compromised.
|
|
|
|
Deliver revocations to every active consumer and derived catalogue, and bound cache
|
|
lifetimes. The resolver checks review expiry at query time; a detached cached URL
|
|
does not recheck itself. Preserve the current review history during rollback.
|
|
Copying SQLite rows or the JSONL export into a second resolver can bypass these
|
|
checks; use the native API or CLI for admission decisions.
|
|
|
|
## Community changes
|
|
|
|
Treat public submissions as untrusted evidence. Do not execute submitted content
|
|
or copy review decisions into production automatically. Source allowlist and
|
|
attribution changes need both implementation tests and documented rights review.
|
|
Reject unknown sources until those checks are complete. Every publisher may apply
|
|
stricter admission rules, and must state its actual review and incident procedures.
|