The registry trust model
Immutability, digests, review evidence, and why a client trusts a resolution.
The registry is the source of truth for immutable Feed Package releases. Its job is to make "what exactly is running on this device" a question with one answer.
Immutable, digest-addressed releases
A package version is released once. Its runtime artifacts are digest-addressed, and a resolution pins the exact closure: package, Lexicons, bindings, transform bundle, surfaces, and verification artifacts, each by digest. Two resolutions with the same digest are the same bytes. A device that has a resolution can verify every artifact it downloaded and run offline.
Runtime and review are separate planes
A release has a runtime graph and review evidence, bound together by an attestation but never mixed:
- Runtime is what devices download. It contains no fixtures, no expectations, no evidence.
- Review is what reviewers see: sanitized fixtures, expectations, presentation examples, evidence sidecars. Private by construction; it never leaves the review plane.
Publication verifies that each evidence sidecar's digest matches the committed fixture bytes, so a fixture cannot drift after it was approved.
Three operations, three humans
Publishing creates a candidate evaluation. Approval records that a named reviewer reviewed exactly those digests. Promotion moves the stable tag. Each names every digest it covers and is a dry run until confirmed with a stage. No single command puts code in front of users, and no approval can be reused on a different build.
Trust flows to clients, not from them
Explore is a trusted projection over promoted releases: blocked and revoked releases are excluded, and what it offers is followable. Electron obtains authenticated delivery of the exact resolution and caches it, verified, for offline use. The web client renders the persisted View from that resolution. None of them consult a mutable tag at render time.
What review evidence proves, and does not
A passing validation summary proves the package is consistent: it executes, deterministically, over approved fixtures, and produces the committed records and presentation. It does not prove the fixture was clean, that the records mean the right thing, or that the preview reads well. Those are what the human gates are for; see Publish, review, approve, promote.