Spec: public federation export v1 (license decided — ready to merge)

[WilfordGrimley]

Description

HOLD for owner review before building — this is a draft to critique,
not a build already in motion. Adds docs/federation/public-export-v1.md,
extending docs/federation-v1.md's publisher side into a concrete,
buildable artifact: publish-first federation (no peer required,
anyone can subscribe) making ProxyPrints' verdict data consumable by
both the mpc-autofill fork family and the MIT-lineage proxy-tool
ecosystem (acoreyj/proxies-at-home, alex-taxiera/proxy-print).

Covers, per the requested spec sections:

1. What's published — signed verdict records only, never images or
   image URLs. Draft record shape included, with open questions flagged
   inline rather than silently resolved. Human-confirmed-only in v1 —
   machine suggestions stay home; the gate is the export.
2. Keying + tooling — the exact content_phash recipe transcribed
   from MPCAutofill/cardpicker/local_phash.py (art-only crop box,
   imagehash.phash hash_size=8, distance threshold 20 / margin 5 —
   empirically tuned against real production data, stated honestly as
   such, not textbook defaults), plus a precise specification (not code
   — HOLD status means nothing ships pre-approval) for a standalone
   reference hashing tool.
3. Signing — ed25519 via minisign, recommended over ssh-keygen -Y
   with reasoning (UX/discoverability for external consumers, not a
   cryptographic difference).
4. Publish channel — versioned JSONL (full snapshot + dated
   increments), R2 recommended over Pages with reasoning (reuses this
   fork's existing image-cdn infra, zero-egress-fee model fits an
   unknown-cadence external consumer pattern). Regeneration follows this
   fork's existing run_id/ledger/dry-run-default automation
   conventions rather than inventing new ones.
5. License — CC0 vs. ODbL, one paragraph each on consequences for
   both named consumer ecosystems. Flagged as an explicit owner
   decision, not made in this doc.
6. Consumer stories — (a) a sibling mpc-autofill-fork operator
   importing verdicts as suggestions into their own review gate, (b) an
   MIT-lineage client-side tool auto-suggesting printing + bleed
   handling by joining on scryfall_id/content_phash.
7. What v1 explicitly isn't — no subscriber component, no per-peer
   trust config, no verdict ingestion in either direction. Unchanged
   from federation-v1.md's existing publisher-only posture.

Verified, not assumed

• Fetched both named MIT-lineage repos directly rather than trusting the
  "MIT lineage" framing at face value: acoreyj/proxies-at-home is
  confirmed MIT and uses the Scryfall API for card identification.
  alex-taxiera/proxy-print is actually AGPL-3.0, not MIT —
  corrected in §6b rather than silently absorbed, since it materially
  affects the §5 license discussion.
• The content_phash recipe (crop box, hash size, distance/margin
  thresholds) is transcribed from the actual current
  local_phash.py source with its own tuning-methodology comments
  preserved, not reconstructed from memory.
• docs/federation-v1.md's Participation-modes/Known-gate-issue content
  this new spec directly depends on was previously only on a sibling
  unmerged branch — folded forward into this PR so it's self-consistent
  reviewed on its own, without assuming another PR lands first.
• Every cross-reference to a doc that doesn't exist on master yet
  (the upstream-readiness audit, still on a separate unmerged branch)
  was rewritten to avoid a broken link, then checked by actually running
  .github/scripts/docs_lint.py locally (clean) rather than assumed
  correct by construction.
• Added matching index entries to both docs/README.md's "Plans &
  proposals" table and CLAUDE.md's flat docs index, per
  docs/documentation-process.md's parity requirement between the two.

Checklist

• Pre-commit / docs-lint: no code in this PR (doc-only). Ran
  .github/scripts/docs_lint.py directly against the changed docs —
  clean, no broken links or dangling path references.
• Tests: N/A, no code changed.
• I have manually tested my changes as follows:
  • Verified every new cross-file reference resolves against this
    branch's actual tree (not master's eventual post-merge state) via
    direct git show/grep, not assumption.
  • Verified the two named external projects' licenses and card-ID
    methods via direct fetch rather than trusting the task's framing.
• I have updated any relevant documentation — this PR is
  documentation; also updated docs/README.md and CLAUDE.md's
  indexes for discoverability.

Nothing built. No code changed anywhere in this PR. Build (management
command, signing, cron, tooling) begins only after the owner approves
this HOLD, routed between sessions per the program's own split.

---

Generated by Claude Code

[WilfordGrimley]

Spec-doc hold lifted — ready for the merge queue.

License decided by the owner: ODbL 1.0 (reciprocity over CC0's maximal-adoption posture). §5 rewritten from open-decision to decided, with the three consumer-calming clarifications (produced-works exception, share-alike scoped to publicly-redistributed derivative databases only, exact attribution string) plus a non-legal reciprocity invitation.

Also merged current master into this branch to resolve a same-table conflict with #91's (or whichever PR added it) proposal-h row in docs/README.md's Plans & proposals table — combined both new rows rather than force-pushing a rebase. docs_lint.py re-verified clean against the merged state.

This session isn't merging PRs directly (per this repo's standing convention — see CLAUDE.md's gh pr merge note) — handing off to whichever session/process owns the merge queue. The BUILD hold is separate and still stands: nothing in this PR implements the export (management command, signing, cron, tooling) — that begins only after the owner separately green-lights the build, routed between sessions per the program's own split.

---

Generated by Claude Code