Listrar registry
Methodology
Every statement on a Listrar record is produced by a rule you can read here. Where a rule cannot reach a conclusion, the record says so rather than guessing — "Not available", "Not assessed", "Not verified", "Not determined" are real answers, and the most common ones.
Three separate axes
A record carries three independent statements, and no value spans them. Record status says where the record sits in this registry's lifecycle. Data verification says how well its claims are substantiated. Legal assessment says whether a regulatory assessment exists and how complete it is. An active record with self-declared data and no assessment is an ordinary state, not a contradiction. Crucially: active does not mean lawful, and verified does not mean compliant.
How a verification tier is assigned
Each claim sits on a five-step ladder: unverified, self-declared, document-backed, verified, independently verified. A claim reaches the top step only when a named external body — a certification body, test laboratory, auditor or registry authority — is recorded against it. A tier is only as good as its evidence: when supporting evidence expires, the claim degrades to its next-strongest live source rather than keeping a tier it no longer earns. The record-level summary reports the WEAKEST claim, not the strongest, so one verified figure cannot stand in for a page of self-declarations.
How applicability is determined
A requirement applies only when at least one of its applicability rules matches all four dimensions of a product's context: jurisdiction, product category, operator size and date. Deny by default — a requirement with no applicability rules on record never applies. Every outcome is stored with its reason and the rule that decided it, so a record can answer why a regulation does NOT apply, not only why one does.
What an assessment status means
Legal assessment reports the state of the assessment, never a verdict. "Not assessed" means nobody has run one. "Assessment pending" means applicability is known but no assessment has been made. "Partially assessed" means a run did not cover every applicable requirement. "Evidence incomplete" means it covered them but gaps remain. "Assessment available" means an assessment exists and can be read — it does not mean the product is lawful. Listrar does not decide that.
How the content hash is computed
Each record's content is serialised to canonical JSON — object keys sorted, no insignificant whitespace — and hashed with SHA-256, published as hexadecimal. The record's own integrity block is excluded from its input, since that is where the resulting hash is written back. Every other field is in scope, timestamps included. The algorithm and the canonicalization are published on the record itself, so a third party can recompute the digest from the published record alone and compare.
How the version chain works
Every content-affecting change appends an immutable entry recording what the record then contained, and each entry pins its predecessor's content hash. A verifier can walk the chain from its root; an altered or removed entry breaks the walk. A save that changes nothing appends nothing, so the history does not fill with entries recording that nothing happened.
What the verification checklist checks
Five checks run against a record: that it carries a Listrar registry identifier; that its content has been hashed; that every version links to its predecessor's hash; that at least one verification is current and unrevoked; and that regulatory applicability has been evaluated and dated. They verify the RECORD — its integrity and provenance. They do not verify that the data is accurate, and they do not assess legal compliance.