research-source-acquisitionlisted

# Research Source Acquisition Acquire exactly one approved source as untrusted bytes. Keep it in quarantine until separate security, quality, and scholarly gates promote it. Version 1.1.2 preserves verification compatibility with 1.1.0 and 1.1.1 acquisition manifests while emitting 1.1.2 for every new manifest and verification receipt. ## Read the contract Read [`references/rights-record-contract.md`](references/rights-record-contract.md) before creating a rights record or invoking the downloader. Use [`references/rights-record-v1.schema.json`](references/rights-record-v1.schema.json) for authoring assistance; rely on the CLI for authoritative evidence checks. ## Preserve these invariants - Require a rights record with D1 or higher, `download: true`, an `asset_url` exactly equal to `--url`, and `approved_redirect_urls` as an explicit exact URL list. - Bind every asset record to one absolute candidate-registry path, registry SHA-256, candidate ID, item page, structured downloadable URL, exact three rights layers, and a terms run for that same candidate. - Permit only HTTPS and exact repeated `--allow-host` values. Never add wildcards or broaden the list merely because a redirect was blocked. - Reject URL userinfo, credential-like query parameters, local hostnames, and every DNS result that is not globally routable. - Default to zero redirects. When a reviewed redirect is necessary, require its exact URL in the rights record, re-resolve it, and pin the connec