v0.0.9

The release that can stop a redirect without killing the identifier. A delegate's
resolver goes down, a wrong URL goes out, a takedown is requested — each wants stopping
quickly, and yet 404 would be a lie and 503 makes a permanent identifier look broken.
What stops is redirection only; resolution and descriptions carry on. It also
documents running several arkhe instances together (closed PIDs and open PIDs included),
and replaces CI with local scripts for checking and publishing.

Added

• Redirection can be held, with a deadline (arkhe hold add, arkhe hold list,
  arkhe hold release, PUT /api/hold and /api/hold/release, ark:hold, and a
  Held redirects page in the admin interface).

  Only redirection stops; resolution does not. A 404 would be a lie — the
  identifier exists — and a 503 makes the identifier look broken. The answer is 200
  and the description. There are three grains (ark, shoulder, naan) and the
  narrower one wins. A deadline is required (capped by ARKHE_HOLD_MAX_DAYS): being
  temporary is not left to anyone's memory. That something is held is published, in
  ?json and in /.well-known/ark.

• A guide to running several arkhe instances
  (Running several arkhe): dividing
  by NAAN, dividing by shoulder under one NAAN, and putting an arkhe inside a closed
  network whose namespace alone is known above — plus the option of connecting nothing.
  What may be divided is the namespace, never the authority over a single namespace:
  splitting the ledger moves several invariants out of the code and into the hands of
  operators, so the guide tabulates which ones. It also states why a delegate must
  produce check digits (resolution verifies the check digit before it looks at the
  shoulder delegation) and what does not exist yet — no endpoint for importing an ARK
  minted elsewhere, no CLI for shoulder.redirect, no cross-ledger listing or audit.
  Twelve Mermaid diagrams.

• Closed PIDs and open PIDs, on the same page: how to hand out identifiers for
  material that cannot be published, so that when the embargo lifts, publication is one
  change of target — written out as ledgers and commands. What is divided is the
  shoulder, never the shape of the identifier: if the shape changed, every reference
  handed out while it was closed would die at the moment of publication. What outsiders
  can see is set out in three levels (invisible / described / with a door), and the
  most common one — "available on request" — is built by pointing url at the
  application form. It also states that arkhe does no access control: a closed PID
  is closed because its target is, not because arkhe turns anyone away.

• STATUS.md, collecting the
  version, the state of the checks and the known gaps in one place. Procedure lives in
  AGENTS.md, current position in STATUS.md — kept apart because duplicating them
  guarantees one of the two goes stale.

• Checks and publishing consolidated into local scripts; GitHub Actions removed.
  .github/workflows/{ci,docs,release}.yml are gone and the same work moved into three
  scripts under scripts/ — nothing that was being watched is watched any less.

  • check.sh — sync (--frozen) → ruff → pytest → a disposable PostgreSQL with the
    migrations round-tripped (plus alembic check) → OpenAPI drift → mkdocs --strict
  • deploy-docs.sh — check, build, publish to gh-pages
  • release.sh — version match, changelog sections in both languages, check.sh,
    dist/; it creates a tag and a GitHub release only with --publish

  One system rather than two. Split between a laptop and CI, a change that "passes on
  one side" appears and before long nobody looks at the other side. A check whose
  tooling is missing prints SKIP instead of passing quietly — "it passed because it
  wasn't installed" is the dangerous outcome. deploy-docs.sh takes over what checkout
  did in CI: it stops on uncommitted changes and warns when HEAD is not on the remote,
  both to prevent content that is on the site but cannot be traced in the repository,
  which is exactly what loosens when publishing happens from a laptop. Dependabot's
  github-actions ecosystem was dropped along with the workflows it watched.

Fixed

• The committed OpenAPI specs had fallen behind the implementation
  (docs/assets/openapi-*.json still said version: 0.0.1). The published spec was
  regenerated on every build, so nothing shipped wrong, but the repository disagreed with
  itself. The check script caught this on its first run, and now fails when the two
  drift apart.

• The icons in "Where to start" on the front page were not rendering — the literal
  string :material-api: was being published, because pymdownx.emoji, the extension
  that turns those into SVG, was not configured. An unknown shortcode passes through as
  plain text, so nothing warns and mkdocs build --strict cannot catch it.

• The README's link to the ER diagram pointed at a location the page had moved from
  (docs/data-model.md); reference pages live under docs/reference/. The test count
  quoted there was updated too.

---

日本語の変更履歴
· Full Changelog: v0.0.8...v0.0.9