Phase 9: Web-of-trust

[gdassori]

Summary

Implement transitive trust via signed endorsements. Nodes publish trust endorsements for peers they vouch for; other nodes compute a local trust graph with configurable depth and policy.

Motivation

Static allowlists (Phase 8) don't scale — every operator must manually approve every node. Web-of-trust enables organic mesh growth: if you trust node A, and A endorses node B, you can automatically trust B (with reduced confidence). This mirrors how PGP key signing works, but automated and integrated into the mesh.

Design

Trust endorsements via state map

Each node publishes endorsements in its own namespace (Phase 5 state map):

<myNodeID>/trust/<targetNodeID> = {"action": "endorse", "timestamp": ..., "note": "..."}

Since writes are namespaced and signed, endorsements are unforgeable — only node X can write X/trust/*.

Revocations work the same way:

<myNodeID>/trust/<targetNodeID> = {"action": "revoke", "timestamp": ...}

Trust levels (extended from Phase 4 keyring)

const (
    TrustDirectlyVerified TrustLevel = 0  // Noise handshake (existing)
    TrustManuallyTrusted  TrustLevel = 1  // Explicitly added to allowlist
    TrustEndorsedDepth1   TrustLevel = 2  // Endorsed by a directly verified peer
    TrustEndorsedDepth2   TrustLevel = 3  // Endorsed by an endorsed peer
    TrustGossipLearned    TrustLevel = 4  // Auto-learned from sender_pubkey (existing)
    TrustUntrusted        TrustLevel = 5  // Known but not trusted
)

Local trust computation

Each node independently computes its trust graph:

1. Start from directly verified peers (trust depth 0)
2. Follow endorsements up to max_trust_depth (configurable, default 2)
3. Apply local policy: minimum endorsements required, trust decay per hop
4. Result: a local map of nodeID → TrustLevel used by ACL (Phase 8) and gossip engine

Config

[trust]
max_depth = 2                    # Maximum endorsement chain length
min_endorsements = 1             # Minimum endorsements to trust at each depth
auto_endorse_direct_peers = true # Automatically endorse nodes after successful PeerHello

Partyline commands

• /trust endorse <nodeID> [note] — publish an endorsement
• /trust revoke <nodeID> — revoke an endorsement
• /trust list — show local trust graph with levels
• /trust path <nodeID> — show the endorsement chain to a node

Deliverables

• Extended TrustLevel enum in keyring
• Trust endorsement message type (or state map entries)
• Local trust graph computation engine
• Integration with ACL (Phase 8): trust level determines access
• Integration with gossip engine: relay policy based on trust
• Config parsing for [trust] section
• Partyline commands
• Endorsement persistence and propagation
• Unit tests: trust computation, depth limiting, revocation
• Integration test: node gains access via transitive endorsement
• Documentation update

Dependencies

• Phase 5 (state map) — endorsements stored as state map entries
• Phase 8 (ACL) — trust levels feed into access control decisions

[joelklabo]

Hi! This looks like a great project. Have you considered using an existing Nostr-based Web of Trust instead of building from scratch?

Our WoT API (https://wot.klabo.world) provides:

• 52K+ nodes with pre-computed trust scores
• NIP-85 trust attestations (the same standard you'd implement)
• Transitive trust with configurable depth (1-3)
• Sybil detection built-in
• Already integrated with Lightning for any paid features

Rather than building your own trust graph, you could:

• Use our API for trust lookups
• Or run your own instance with your specific network

We also have an MCP server if that fits your architecture:

• https://github.com/joelklabo/maximumsats-mcp

Would love to discuss how we could help accelerate this!