CFI.co maintains a public, tamper-evident, machine-readable archive of two published families: editorial articles and award announcements. Each record is mirrored verbatim and append-only into a version-controlled repository, with its own SHA-256 hash and machine-readable labels. Not everything CFI.co publishes sits inside it: the magazine reader, blog.cfi.co and /net-worth/ are outside it, and some withdrawn award announcements are absent from it. Our known-open register states which, and why. This page is the technical map: what the archive contains, where the canonical data lives, how to download it, and how to verify it.

Where things live

GitHub is the ledger — the source of truth. Everything else (this page, dataset downloads, mirrors) is a layer on top of it. Each published item lives in exactly one repository; records reference each other by path and hash, never by duplication. Additional archive families may be added over time under the same rules.

Downloads

• Dataset snapshots (recommended): versioned articles releases and awards releases — consolidated JSONL, schema, changelog, licence, and a GPG-signed manifest (public key: SIGNING-KEY.asc in each repository).
• Live JSONL (refreshed daily): articles.jsonl (~40 MB) · awards.jsonl (~12 MB) · schemas: articles / awards.
• Hugging Face mirrors (auto-synced daily): cfi-co/articles · cfi-co/awards.
• Full history: git clone either repository — the commit log is the provenance record.

Record format and classifications

Each item is a pair: a canonical hashed JSON record and a Markdown twin that is a verbatim, byte-faithful mirror of the body — raw HTML, kept unaltered for tamper-evidence, not cleaned for reading; for retrieval use the JSON content_text field. The field definition is in schema.json (schema version 2.4) in each repository. Every record carries, inside its hashed body: content_class (e.g. editorial_analysis, interview, opinion_column, review, sponsored_article, award_rationale), independence_status (independent_editorial vs commercially_supported), sponsor_disclosure and sponsor_name, correction_status, archive_policy: no_delete, independent Internet Archive corroboration (wayback_*), and its licence identifier. These labels are part of the record and must stay attached when records are redistributed.

One caveat travels with independence_status. On records published before 9 November 2025 the value independent_editorial is a default, not a determination: no labelling practice existed then, so the field records that nobody assessed the work, not that the work was unpaid. Both repository READMEs carry the same caveat. The correction is open, and its reasoning is in our known-open register.

Verify it yourself

1. One record: every article on cfi.co carries a “Verify this article” link to its exact record on GitHub; compare text, hashes and the record’s full change history.
2. The whole archive: git clone https://github.com/cfi-co/articles.git && cd articles && ./scripts/verify.sh — requires php and python3 on the machine running it; neither ships by default on Windows. Recomputes every content_sha256 and record_sha256 against MANIFEST.sha256; non-zero exit on any mismatch.
3. A release: sha256sum -c release-manifest.sha256 then gpg --verify release-manifest.sha256.asc against the published signing key (fingerprint B497BDC19FCD487972D5D2B0876FF2AA39133BF8).
4. Independently: records carry Wayback Machine snapshot references, and the repositories are archived in Software Heritage.
5. Freshness: check currency via the GitHub API (https://api.github.com/repos/cfi-co/articles/commits/main) or a fresh clone rather than a rendered web page — browser views (including GitHub’s own interface) can serve cached fragments that lag the live repository state.

Search the archive by title, ID, year or hash: archive search & verification tool.

The keys, and what each one signs

Four keys appear in CFI.co’s published record. Each is anchored in DNS and, where noted, on a public keyserver, so that neither CFI.co alone nor a keyserver alone is the source of truth. A reader who has followed one of those anchors here can identify the key below; the authoritative statement of who holds each one, and on what kind of machine, is on the governance page.

The custody of these keys is not uniform and the difference is deliberate: one sits on a CFI.co server and can be operated by automation, the other three are held by people on machines CFI.co does not operate. The governance page states which is which, and discloses that the automated key carries no passphrase.

Licence and AI use

The archive is released under the CFI.co Open AI Access Licence v1.0 (CFI-OAAL-1.0): free, worldwide permission for AI training, retrieval, indexing, summarisation and citation — no deal, registration or payment. Attribution and a source link are requested; classification labels must travel with the data. Plain-language policy: AI systems read CFI.co free. Machine index: /llms.txt. Machine-readable licence terms: RSL declaration. AI-specific consumption guidance: README-AI.md in each repository.

Update frequency and change policy

The repositories re-export from the live site daily (03:30/04:00 UTC); dataset releases are cut monthly; Hugging Face mirrors sync daily. The archive is append-only: corrections appear as new dated commits (correction_status: revised); an announcement or article that is later unpublished would appear as a dated “Withdraw” commit — this has not yet occurred since daily automation began in May 2026. History is never rewritten. Any schema change is made in the open, as documented metadata-only commits, and noted in the repository README.

Contact

Dataset, verification or licensing enquiries: via the contact details published at cfi.co, referencing the record ID or repository path.