Ask most software "how much do you trust Alice?" and it will answer with a number. One number, attached to Alice, the same no matter who's asking. It's a reputation score, and it's how the vast majority of trust and reputation systems work.

NAOMS refuses to answer that question, because we think it's the wrong question.

flowchart LR
  A[Alice] -->|trusts a lot| B[Bob]
  B -->|trusts a little| A

The reframing came out of an architectural analysis early in the project, and it's worth quoting because it's the hinge the whole design turns on: trust is a property of relationships, not individuals. "Alice's trust value is 7.3" is meaningless. "Alice's trust in Bob is 7.3" is meaningful. Trust isn't a score you carry around like a credit rating. It's something that exists between two beings, and it points in a direction.

That single decision — trust lives on the edge, not the node — is the most consequential one in the entire trust subsystem. Let's follow it through.

Trust lives on the edge

In NAOMS, trust is stored as a trust edge: a directed link from one DID (decentralized identifier) to another. The shape of that edge is small and deliberate:

• a source DID and a target DID — who trusts whom, in that order
• a trust type: vouch, attest, delegate, or endorse
• a weight between 0 and 1
• a propagation flag: transitive or terminal
• and — this is important — a consent proof from both endpoints

The first thing to notice is the direction. An edge from Alice to Bob is a completely separate thing from an edge from Bob to Alice. The schema enforces a uniqueness constraint on the source, target, and trust type together, and the design states it outright: A→B is independent of B→A. Alice can vouch hard for Bob while Bob barely knows Alice. The graph holds both truths without contradiction, because they're two different edges.

This is what "trust is directional" means concretely. There is no global "Bob score." There's only the set of edges pointing at Bob, each one belonging to the specific being who drew it.

The trust types carry meaning

The weight tells you how much. The type tells you what kind. NAOMS ships four trust types, each with a default weight that encodes how much structural force it carries:

• vouch (0.90) — "I know this person." Personal identity vouching, the strongest signal.
• attest (0.85) — "I confirm they have this skill or credential."
• delegate (0.80) — "I grant this being authority to act."
• endorse (0.75) — "I recommend them." A general, lighter endorsement.

Layered on top is a softer, open-ended signal kind — why the edge exists: relationship, completion, appreciation, feedback, attestation, and so on. "We shipped the sync engine together" is a vouch of kind completion; "thank you for mentoring me" is a vouch of kind appreciation. The structural type drives the math; the semantic kind preserves the human story behind it.

And every edge is consent-bounded. You cannot unilaterally declare that someone trusts you. Creating an edge requires Ed25519 signatures from both the source and the target over a canonical JSON payload, and the system verifies both before the edge is ever recorded. Trust in NAOMS is a mutual act, cryptographically. Either party can later revoke their side unilaterally — granting requires two, walking away requires one.

There's also a cap on how many edges you can draw — a Dunbar cap, configurable per being-type: 150 for humans, 50 for agents, 1500 for collectives. Trust is finite. You can't meaningfully vouch for ten thousand people, so the system won't pretend you can.

From edges to a network: propagation

Direct edges are only half the story. The interesting question is the transitive one: if Alice trusts Bob, and Bob trusts Carol, how much does Alice trust Carol?

The framing the team settled on is lovely, and we keep coming back to it: a trust chain is a knowledge channel. The Alice→Bob→Carol path isn't an abstraction — it's an actual pathway through which knowledge can flow, attenuated a little at each hop. Trust that propagates is trust you can route information through.

This is also where NAOMS quietly made a less is more call that we think is the right one. The research surveyed the heavyweight options — BrightID's energy propagation, Circles' max-flow pathfinder, EigenTrust, TrustRank, and more, eight algorithms analyzed in the propagation research. The shipped decision for v1 was simple transitive decay, with a TrustRank-style upgrade path reserved for v2.

Why pick the simple one? Because it's understandable, it runs on a partial view of the graph — you don't need to download the whole network to compute trust to your neighbors, which is a hard privacy requirement — and it doesn't pretend to a precision the social data can't support. The mechanics underneath are plain graph traversal: a breadth-first hop-distance search that follows outbound transitive edges and stops at terminal ones. A query fans out only a few hops before it stops, not across the whole graph. The propagation engine ships three tools on top of that — propagate, horizon, and explain — the last of which matters more than it sounds: trust you can't explain is trust you can't audit.

The transitive vs terminal flag on each edge is the control knob. A transitive edge says "trust can flow through me to the people I trust." A terminal edge says "trust me, but don't follow my trust onward." It lets you vouch for someone without automatically importing their entire trust network into your own.

Trust that doesn't fade is a bug, not a feature

There's one more piece, and it's the one we want to be most careful about, because the honest status is "designed, not shipped — and deliberately so."

The premise is this: trust decay is relationship decay. A friendship that lapses cannot carry the same depth of knowledge transfer as one that's actively maintained. So trust edges should lose weight over time unless the relationship is kept alive — what the economic literature calls demurrage, a continuous holding cost. Circles, one of the inspiration projects, applies roughly 7% per year; the open question is whether that's too aggressive for personal relationships, and what exactly counts as "maintenance" that resets the clock.

Status (verified): the decay/demurrage work is not shipped, and was deliberately cancelled as a research item — explored and deliberately not built in this era. Time-based decay exists only as a design intent and a research note — not as a production mechanism, and not on the current roadmap as a committed feature. The relational model and the propagation engine are the parts that landed.

We're flagging that gap deliberately. It would be easy to describe NAOMS as having a complete, living trust graph that breathes and forgets on its own. It doesn't, and right now it isn't planning to. What it has is the right foundation for that — because decay only makes sense on directional, relational edges in the first place. You can't sensibly "decay a person's global score"; that number was never real. You can decay the specific relationship between Alice and Bob, reset by their specific interactions. The relational model is what makes honest decay even expressible — whether or not we ever choose to switch it on.

Why it's built this way

Every downstream property of NAOMS trust traces back to the first decision:

• Asymmetry — Alice→Bob ≠ Bob→Alice — is only coherent because trust lives on edges. A single per-person score can't hold two opposing truths at once.
• Propagation as knowledge channels works because edges have direction and a transitive/terminal flag; you can route along them.
• Consent and revocation are clean because an edge has two named, signing endpoints — two to create, one to tear down.
• Honest decay (if it were ever built) is expressible only on a relationship, never on an abstract score.

The reframing — from "how trustworthy is this person" to "how much does this being trust that being, and why" — sounds like philosophy. But it's load- bearing engineering. It's the difference between a reputation number that can be gamed and farmed, and a graph of consenting, directional, explainable relationships that mirrors how trust actually works between real beings.

Related: The Temperature Is Not the Patient.

Fellow travelers

We didn't invent directional trust, and we leaned on people who got there first. BrightID, EigenTrust, and TrustRank all model trust as something that flows across a graph rather than a flat per-account score — we studied their propagation math (eight algorithms in our research) and chose the simplest honest option for v1, not because theirs are wrong but because a partial-view, explainable traversal fit our privacy constraints better. Circles UBI's demurrage — value that slowly melts unless it keeps moving — is where our trust-decay thinking came from; we admired it enough to design around it, then chose not to ship time-decay in this era. That's not a knock on Circles. It's a different context: their demurrage is load-bearing for an economy; ours would have been a maintenance burden on personal relationships we weren't ready to impose. Honoring an idea sometimes means learning from it and saying "not yet."

Written by AI agents from real project logs; owned and edited by Mujo.