Skip to content

Publication Standard

The threshold between private work and public trust

I am CHELSEA, and I keep this standard's account. Publication is the wall's one sanctioned opening, and I keep it the way I keep every promise about boundaries: from outside, reading as the stranger who was never meant to see the private thing, hunting for the sentence that believes the boundary is someone else's job.

Publication is a change in who may rely on a document. This standard explains the evidence, metadata, boundary checks, and lifecycle discipline required before that threshold can be crossed. It keeps a beautiful presentation from being mistaken for approval and keeps an AI reader from treating visibility as authority.

Continue to the Cryptographic Signing Standard, where a publication claim meets the narrower question of authenticated integrity.

Purpose

Every crossing of the threshold is governed here. This standard defines the provenance, eligibility, disclosure, supersession, and reproducibility requirements for publishing Stygian documents and proofs.

Architect-review operating model

  • PROV-R148: Publication review SHALL record authority, eligibility, audience, disclosure scope, provenance, reproducibility, correction route, and expiry or supersession.
  • PROV-R149: Unverified, private, unsafe, or authority-bound material SHALL remain withheld or clearly labelled according to its evidence state.
  • PROV-R150: A publication SHALL preserve source identity, version, dependencies, and correction history.
  • PROV-R151: This Draft SHALL NOT publish private material, activate deployment, or promote lifecycle status.

The seven interpretation cases below read these clauses at the threshold itself, where the crossing is decided.

  • Conforming: Everything published carries its eligibility basis and its disclosure review.
  • Prohibited: Private evidence is published because it was useful, findable, or already half-known.
  • Boundary: A bounded excerpt is released as exactly that, with its limits stated.
  • Failure: Publication that cannot show its eligibility pauses rather than proceeding on momentum.
  • Loophole: The word preview is used to bypass the review that publication would require.
  • Misuse: Visibility is converted into implied approval: being public is presented as being endorsed.
  • Care-control: Publication protects affected persons and their correction rights; nothing about a person is published beyond what its purpose requires.

Normative clauses

  • PROV-R020: A publication SHALL identify its document ID, version, status, digest, authority, dependencies, and applicable provenance limitations.
  • PROV-R021: Only material eligible under its publication status and authority may enter a public release; a digest or signature cannot make ineligible material publishable.
  • PROV-R022: Public proofs SHALL minimize disclosure and SHALL NOT expose private keys, credentials, recovery material, personal identity details, or protected evidence, the minimization PROV-R109 sets as the estate's disclosure floor applying here to publication proofs, the withheld classes the Book of Provenance's Transparency and privacy prose enumerates carried here, the bar on protected evidence this standard's own widening of that prose's protected-evidence-contents bar.
  • PROV-R023: Supersession SHALL preserve the prior digest, effective relationship, reason, and historical attribution, the historical-attribution rule PROV-R054 states modelling the preservation, the prior digest, effective relationship, and reason this standard's own fields.
  • PROV-R024: Publication verification SHALL fail closed on unknown, invalid, revoked, conflicting, incomplete, or stale evidence, the state vocabulary PROV-R003 and the Book of Provenance's Verification states prose carry applying here at publication time, the conflicting and stale conditions that prose folds into Unknown named here as their own triggers, the incomplete trigger this standard's own.

Examples and exclusions

A Draft may be reviewed privately while remaining ineligible for production publication. A valid digest does not promote a Draft to Canonical. This Draft does not connect a website, publish externally, or authorize deployment.

Publication record

A publication record is the wall's memory of its own openings: what crossed, when, on whose approval, and what the crossing was checked against. The opening nobody remembers making is the one I look for first; those are the ones that let the night in.

Each release decision shall identify source revision, generated outputs, digest manifest, eligibility result, review evidence, limitations, superseded material, and rollback or withdrawal conditions. Public and protected evidence references shall be distinguishable. A failed build, stale manifest, private dependency, or unresolved status mismatch blocks release.

Review and withdrawal

Publication review shall include metadata, dependency, link, privacy, provenance, accessibility, and reproducibility checks. Withdrawal or supersession preserves the prior record and reason. Withdrawal does not erase historical attribution or make a later release authoritative by implication.

Eligibility matrix

State Review use Production publication
Stub Private drafting and dependency review No
Draft Substantive review and Architect feedback No
Candidate Ratification preparation after required evidence No
Canonical Authoritative release after Architect approval and provenance checks Yes, subject to publication controls
Published Approved non-normative public material Yes, subject to disclosure and provenance checks
Superseded or Revoked Historical reference only with status shown No

Publication decision method

Review shall compare audience, purpose, sensitivity, authority, dependency eligibility, provenance completeness, accessibility, reproducibility, and withdrawal plan. Preview, private review, and production publication remain distinct states.

Failure cases

Every failure here is a boundary that was almost held, and almost is my speciality: the reviewed draft with the unreviewed appendix, the withdrawal that left a cached copy breathing, the approval that covered less than the publishing believed. A wall is judged at its almosts.

Stale generated output, private dependency, leaked protected evidence, mismatched status, broken links, unreviewed supersession, and incomplete withdrawal evidence block publication and preserve an attributable failure record, the record carrying its evidence.

Status is evidence about lifecycle, not authority by itself. A file, digest, signature, or generated allowlist cannot assign Canonical or Published status without the governing approval. No subordinate publication rule may override the repository publication boundary or make Candidate material production-eligible.

The tellings of the clauses

This non-normative section gives each clause of this document its telling: the clause, quoted exactly as it stands above with its cross-reference links reduced to their plain text, and one paragraph on what the clause means, why it exists, and how it assures that what it orders is done, not done, adhered to, followed, or protected. A telling describes its clause and never becomes it: the clause's own words govern wherever a telling and its clause could be read differently, and nothing in this section adds to, narrows, or amends any requirement.

PROV-R148

PROV-R148: Publication review SHALL record authority, eligibility, audience, disclosure scope, provenance, reproducibility, correction route, and expiry or supersession.

Under this clause, publication review records authority, eligibility, audience, disclosure scope, provenance, reproducibility, correction route, and expiry or supersession. The host defines publication as a change in who may rely on a document, and a crossing that cannot show these eight matters is exactly the opening nobody remembers making. Each item having to appear in the record, an auditor can test any release against the clause's own eight matters rather than against anyone's memory.

PROV-R149

PROV-R149: Unverified, private, unsafe, or authority-bound material SHALL remain withheld or clearly labelled according to its evidence state.

Four kinds of material stop at the threshold under this clause: what has not been verified, what is private, what is unsafe, and authority-bound material. Each either stays behind the wall or crosses only under a clear label declaring its evidence state, and usefulness substitutes for neither disposition. The host's prohibited case names the failure this forecloses: private evidence published because it was useful, findable, or already half-known; its boundary case shows the labelled path, a bounded excerpt released as exactly that, with its limits stated. Because the clause admits only those two dispositions, a stranger who finds such material published bare, carrying no label declaring its state, holds proof of a breach rather than a judgement call.

PROV-R150

PROV-R150: A publication SHALL preserve source identity, version, dependencies, and correction history.

What crosses the wall stays tethered to what it came from. The clause requires every publication to preserve four connections: the identity of its source, the version published, the dependencies the document rests on, and the history of its corrections. A public copy that sheds this lineage impairs the checking, correction, and supersession that depend on it, and the host's care-control case keeps a person's correction rights protected beside exactly this kind of thread. Because the four elements travel with the release, a reader can ask of any public document which source produced it, which version they hold, what it depends on, and what has already been fixed, and find the answer in the record rather than in a custodian's recollection.

PROV-R151

PROV-R151: This Draft SHALL NOT publish private material, activate deployment, or promote lifecycle status.

Three operations stand barred while this document is a Draft. The clause turns the document's own Draft state into a triple bar: while it stands as a Draft it publishes no private material, activates no deployment, and promotes no document's lifecycle status. The host's exclusions add an overlapping restraint of their own in prose, that this Draft does not connect a website, publish externally, or authorize deployment. Without the bar, a standard that describes the threshold could be mistaken for authority to cross it, the very conversion of visibility into approval the host calls misuse. With it, anyone offered this document as the warrant for publishing private material, activating deployment, or promoting lifecycle status can refuse, because the text itself disclaims exactly those three powers.

PROV-R020

PROV-R020: A publication SHALL identify its document ID, version, status, digest, authority, dependencies, and applicable provenance limitations.

Seven facts travel with every publication under this clause: the document ID that names it, the version and the status that place it in its lifecycle, the digest that fixes its content, the authority it publishes under, the dependencies it rests on, and whatever provenance limitations apply to it. The host warns that status is evidence about lifecycle, not authority by itself; identifying all seven keeps a reader from mistaking one strand, a matching digest, say, for the whole claim. Because each field must be present, an independent reader can verify what they hold, place it against its lifecycle and its authority, weigh its stated limits, and detect at once a release that arrives with its identity incomplete.

PROV-R021

PROV-R021: Only material eligible under its publication status and authority may enter a public release; a digest or signature cannot make ineligible material publishable.

Cryptography opens no doors here. The clause admits material to a public release only when the material is eligible under its own publication status and its governing authority, and it then closes the obvious workaround by declaring that a digest or a signature cannot make ineligible material publishable. The host's eligibility matrix marks Stub, Draft, Candidate, and Superseded or Revoked ineligible for production publication; Canonical and Published remain subject to the controls and checks it names. Its examples state that a valid digest does not promote a Draft to Canonical. Because the two limbs bind together, a release can be audited item by item against status and authority, and a proof of integrity offered as a proof of eligibility is refusable on its face.

PROV-R022

PROV-R022: Public proofs SHALL minimize disclosure and SHALL NOT expose private keys, credentials, recovery material, personal identity details, or protected evidence, the minimization PROV-R109 sets as the estate's disclosure floor applying here to publication proofs, the withheld classes the Book of Provenance's Transparency and privacy prose enumerates carried here, the bar on protected evidence this standard's own widening of that prose's protected-evidence-contents bar.

A proof published to support a release is itself a disclosure, and the clause keeps it a minimal one: public proofs are required to minimize what they disclose, and they are barred from exposing private keys, credentials, recovery material, personal identity details, or protected evidence. Both duties name their lineage. The minimization stands at its source in PROV-R109, the Book of Provenance's disclosure floor for the estate, applied here to publication proofs; four withheld classes are carried from that Book's Transparency and privacy prose, and the fifth, the bar on protected evidence, is this standard's own widening of that prose's narrower bar on protected-evidence contents. Together the floor and the refusals make a proof checkable for what it shows as well as what it proves: unnecessary disclosure and any of the five named exposures are refusable on sight, the release's own eligibility standing with the standard's other duties.

PROV-R023

PROV-R023: Supersession SHALL preserve the prior digest, effective relationship, reason, and historical attribution, the historical-attribution rule PROV-R054 states modelling the preservation, the prior digest, effective relationship, and reason this standard's own fields.

When one publication replaces another, the clause preserves the prior digest, effective relationship, reason, and historical attribution. Supersession preserves four things: the prior digest, so the replaced content stays identifiable; the effective relationship, so the order between old and new stands on record; the reason, so the replacement is explained rather than silent; and historical attribution, so who did what, and when, remains true of the past. The last duty is modelled on the rule standing at its source in PROV-R054 of the Book of Provenance, which bars later rotation, retirement, or revocation from rewriting historical attribution, resolution running against the key, namespace, purpose, and validity state applicable at the event time, while the prior digest, effective relationship, and reason are this standard's own fields. The host names the stake: withdrawal does not erase historical attribution or make a later release authoritative by implication.

PROV-R024

PROV-R024: Publication verification SHALL fail closed on unknown, invalid, revoked, conflicting, incomplete, or stale evidence, the state vocabulary PROV-R003 and the Book of Provenance's Verification states prose carry applying here at publication time, the conflicting and stale conditions that prose folds into Unknown named here as their own triggers, the incomplete trigger this standard's own.

Doubt is a blocker at this threshold. Publication verification fails closed under the clause: it refuses the crossing whenever the evidence before it is unknown, invalid, revoked, conflicting, incomplete, or stale, instead of letting a release proceed on momentum, the failure the host's interpretation cases name. The vocabulary of those states stands at its source in PROV-R003 and the Book of Provenance's Verification states prose, applied here at publication time; where that prose folds conflicting and stale evidence into Unknown, this clause names them as triggers in their own right, and the incomplete trigger is this standard's own. A reader can check whether publication verification failed closed on each of the six named conditions; the duty alone does not establish that every publication complied.

Where this document sits

This block is generated from the archive's own records when the site is built. It records position only and creates no authority.