Announcing the Open Trust Alpha

Every governance system eventually builds a registry of who it trusts, and nearly every one builds something closed. Open Trust is our attempt at the other thing: trust graphs whose rules are declared as EAS attestations, so any application can resolve them without asking anyone's permission. It's in alpha, and holders.vote is the first client.

Everyone Builds This Eventually

A membership. A committee. A vendor registry. Confirmed Humans. A contributor allowlist. A grant reviewer pool. A list of who's allowed to open a proposal without spamming everyone. Every governance system arrives at some version of this, usually late, usually under deadline, and almost always as a table in its own database.

Each one encodes something real: a community's accumulated judgment about who it trusts, and for what. And each one dies inside the application that built it. The reviewer pool a grants program spent two years curating is worth nothing to the DAO next door — not because the judgment doesn't transfer, but because there's no way to read it. So the DAO next door builds its own, from scratch, and that one dies there too.

We made the long argument for fixing this in May: web2 spent two decades trying to compute trust and mostly failed, crypto finally has the primitives to do it properly, and the whole thing only works if the standard is owned by no one. We ended that post saying our role was to contribute an implementation. This is that implementation.

What Open Trust Is

Open Trust is a platform for creating trust graphs intended to be shared across applications. A trust graph is three things: a set of addresses, the vouches between them, and the rules that turn those vouches into weighted scores. The bet is on the third part. Publish the rules somewhere anyone can read them, and the graph stops being a feature of one product.

It works in three steps:

• Declare. You choose the identity keys, the root policy, where vouches are permitted to come from, and the scoring algorithm. Those choices are frozen into EAS attestations, and those attestations become the graph's identity. The rules live in immutable attestations rather than in an editable database — which is the only reason anyone else has grounds to rely on them.

• Vouch. Vouches are EAS attestations, offchain or onchain. Whichever venues a graph's declaration permits, they all arrive in the same index. Withdrawal is a first-class operation rather than an afterthought: you can stop vouching for someone and have it actually propagate, which is precisely the thing PGP's web of trust never managed.

• Serve. Query weights for one address or for thousands, ranked and deterministic. The same snapshot renders as an explorable graph, so you can trace the path that produced a score instead of taking the number on faith.

The payoff isn't in that feature list. It's that because the rules are declared publicly and the computation is specified, an application can resolve a graph on its own. No integration to negotiate, no bilateral agreement, no API relationship with us. Trust earned in one place can count in another because both places are reading the same declared thing.

The First Client: holders.vote

holders.vote is the first application consuming Open Trust, and it uses it for two things, both optional:

• Membership for private communities. A community can let a trust graph decide who's in, instead of maintaining an invite list by hand and re-litigating it every time someone new shows up.

• Personal filtering, by opacity. Rather than a global moderation verdict applied to everyone, you can use your own position in the graph to fade what you see. Nothing is deleted and no admin decided it for you; it's dimmed relative to you. Two people can look at the same page and reasonably see different things, because they trust different people.

Both are opt-in, which matters: a trust graph should be something a community reaches for, not something imposed on it.

What matters more is the seam between the two systems. Open Trust serves scores. holders.vote decides what to do with them. holders.vote has no privileged access — it reads the same public API anyone else can, against a graph declared the same way anyone else's would be — and Open Trust has no special knowledge of holders.vote.

That separation is deliberate, and it's load-bearing. The failure mode we're trying to avoid is the one every marketplace reputation score hit: a graph that only works inside the app that built it. If holders.vote couldn't swap its graph out for a different one, or if another application couldn't read the same graph holders.vote reads, we'd have rebuilt the silo with extra steps. Keeping the two at arm's length is the cheapest way to stay honest about that.

What Works Today

It's alpha. Concretely, what works:

• Offchain and Onchain EAS attestations, signed in the browser
• Vouching and withdrawal, with the declared rules enforced
• Genesis roots, and root changes where a declaration permits them
• Two scoring algorithms: hop decay and EigenTrust
• A graph explorer with path tracing
• A REST API, documented with OpenAPI 3.1

What doesn't work yet: lots. There are bugs, and room to change the API materially.

Owned by No One

Here's the uncomfortable part, and we'd rather say it than have it pointed out.

Open Trust is run by one company today. Measured against the standard we set for ourselves in May — open schema, reproducible computation, multiple independent implementations, credible neutrality — that's a failure state, not a milestone. One implementation is a product. Many implementations are a standard. We have the start of a draft.

What makes the alpha defensible is where the security actually comes from, which is not from trusting Agora to behave. A graph's rules are frozen in attestations we can't quietly edit. The computation is specified, so anyone can recompute a score and check ours against it. The schemas aren't ours to gate. If we turned into a bad actor tomorrow, the graphs would still say exactly what they say, and someone else could serve the ones who vouched onchain.

That property is the whole thing we're trying to protect, and it's the reason to keep the first client separate rather than wiring it straight in. We said in May that Agora has no interest in owning this graph and that no one should, ourselves included. Contributing the first implementation is the start of making that true — not evidence that it already is.

Try It

Open Trust is live in alpha at opentrust.agora.xyz. You can declare a graph, issue vouches, explore the result, and pull scores from the API. The API reference is there, along with a fuller account of what works and what doesn't — worth reading before you depend on any of it.

If you're working on governance, identity, or reputation, we'd genuinely like to compare notes. Most of all on what the open standard should look like, and on what a second implementation would need from us in order to exist.