The Hitchhiker's Guide to Trust
Workshop · Lightning · Guide · Home

Work
notes

The talk stays light on purpose. This is where the technical side is written down: what exists, what is being built, and what is still a direction.

01The gate

This site's pages are always readable. The one thing you can add (a proverb, or a new guide) goes through a gate held by a small community node, a Raspberry Pi. While the node is up, at an event or at someone's home, the gate is open. Unplug it and the gate closes: the graph can only grow while a community is hosting it.

The graph scenes in the guide are illustrations of how a trust graph forms around guides. In a community deployment the same steps map onto OpenVTC: joining a community by DID, guidance as a signed contribution, a vouch as a credential or a Trust Task between members.

The evidence chain: the public face of the guide

The live galaxy is an evidence chain: the public face of a community's guide, and a way to join and start contributing. Any community can deploy one, and anyone can load into it. A thumbs up puts your mark on it (a hash of a secret your phone keeps). Proverbs and new guides join it the same way.

Only hashes are public. What's behind each star is sealed in your browser with a key derived from that same secret, so only you can open it; the keeper sees a contribution only to approve it for the guide.

The claim, tonight. A thumbs up also shows you a claim code: your sigil and four words, drawn from your secret. Only its hash goes on the chain, so only you have it. Paste it in the night's group chat and the bot writes a claim onto your chain (your chat handle only as a salted hash) and answers with a proverb. It is a toy invitation trust task: the shape of joining, before anyone joins.

One guide, many nights. The Hitchhikers' guide has a single evidence chain. Link #0 is its genesis; each night (Newspeak House, IIW 43, the Internet Archive) opens its own page with a gathering link, written in the clear the first time someone adds to that night. After it, every thumbs up, proverb, guide and voice note is a star carrying its night. A person's stars across nights make one evidence root. Voice notes (up to 45 seconds) are sealed on the phone with the owner's key; the site keeps only the sealed box, under its own hash. Nobody has to join anything to be part of the guide's history. /newspeak, /iiw43 and /archive add to that night.

Claiming, after joining. Each visitor keeps a claim code (four words from their own secret; only its hash was committed). Paste it in the night's group chat for a proverb, or, once you have joined a community, enter it with your DID on the chain page's Join the City view: a claim link binds your stars to sha256 of your DID, so the community you joined can match it later and nobody else can read it. No DID yet? vta.farm sets up a Trust Agent with one. The view also shows Mages City's live DID QR and its ways in, and your evidence: /api/evidence?mark=… lists your stars with their root (sha256 of the last root, "|" and each link hash, from 64 zeros), so a reviewing keeper can recompute it.

Witness, meet, cast. Witness: each room's screen (opened from the keeper page) shows a QR whose code changes every ten minutes; scanning it makes your thumbs up a witness star, "you stood here tonight". It proves you could see the room's screen, no more. Meet: one phone opens a meeting, the other says yes, the first confirms; only then is a meet star written, holding both marks: a scan is only a meeting, an edge needs two yeses. It counts in both people's roots. Cast: a proverb or voice note can be offered to Hitchhiker FM. For a voice note that means an open copy, given with consent, which only the keeper can hear before anything goes on air; the chain still holds only the sealed box's hash. A guide launched here is a Field Guide draft: a name, a place, a first clue; the keeper exports drafts as JSON, ready for Field Guide's studio once its import format is agreed.

Next, not built yet: claims signed by the member's DID key (through Star Key or Keyring) rather than a code, and the community recognising them: either the claim becomes an invitation the City issues, or the City issues a credential for a guide root and makes it a way in. Both are changes to the City's own node; nothing here can admit anyone.

02The trust layer: OpenVTC

OpenVTC and VTI. OpenVTC is a Linux Foundation Decentralized Trust lab: the reference implementation of the Trust over IP Decentralized Trust Graph working group's specifications for a verifiable trust community, open source under (github.com/OpenVTC). VTI (verifiable trust infrastructure) is the specification (trustoverip.github.io/dtgwg-vti-spec) and its services, under the OpenVTC org: the VTA (a trust agent: keys, DIDs and access policies for one identity), the VTC service (a community: members, credentials, the gates; it runs on a VTA), a mediator relaying messages over TSP or DIDComm, and did:webvh hosting. Members drive their agent from a client: the openvtc terminal app, Star Key in the browser (Mitch's extension, with join by DID and MyTerms), or Keyring on a phone (with a trust agent hosted for you, such as VTA Farm, or self-run). A community says how people join in its join manifest (invited, already holding a credential, or reviewed); members receive a membership credential. Relationship credentials between members ("two VRCs, one edge") and Trust Tasks (trusttasks.org, a ToIP working draft) are in the specifications; we have not seen a live community issue relationship credentials yet. Live today: Mages City's community and the First VTC (first.openvtc.net, used for testing in the DTG working groups). The Hitchhikers call their trust agent the Towel; that is their word, not an OpenVTC term.

The Hitchhiker opportunity is adoption: OpenVTC gives communities the infrastructure, and a story people want to join gives them a reason to use it.

Trust Tasks, and the thumbs up

Trust Tasks (a Trust over IP task force we contribute to) are small, standard requests between two parties: vouch for me, show you belong, agree these terms. Putting your thumbs up as a hitchhiker is the analogy: ask, an offer, agreed terms, the promise kept. The same five steps run between agents as signed messages. The Hitchhikers will run their own Trust Tasks, local first, on their own node.

Zero-knowledge proofs make the last step possible: you can attest to your place in someone's guide or community without revealing who you are, or who vouched for you. Like the thumb, and like "Don't Panic", a trust task is a gesture any community can read while each keeps its own graph. Don't panic: you own your own perspective in the trust graph.

03The community node

A kit for running a full OpenVTC node on a Raspberry Pi 5: every service built from source on the Pi, published behind Caddy, run under systemd, with each build's commit and checksum recorded. It ships no keys and calls nowhere but the package sources and your own domain.

The pathway: one Pi to a network

Small nodes are how OpenVTC reaches real communities. Three kinds: your device holds you (keys and your verifiable trust agent: on a phone, Keyring drives a trust agent hosted for you or self-run); a community node holds the community (its OpenVTC services, the credentials it issues, its guides, the graph's edges); an embassy is the stronger node, trusted to receive visitors from many communities, witness what happens and countersign it. Personal machines visit; embassies host.

A visit to an embassy runs in six signed beats: resolve, admission, exchange, understanding, consent, seal. The host, the visitor and a witness sign the seal, and the sealed visit can be issued as a credential, later shown as a predicate proof without revealing who else was there.

04Guides and guidance

Field Guide, a fellow Hitchhiker project, is where guides are created and played in real places. Communities keep their own copies on their own node as forkable pages: a fork is a countersignature, the page's history is its lineage, and the community decides what merges back.

Every guide launched here can be exported as a Federated Wiki page, credited to whoever launched it. Next: this site moves onto the Hitchhikers' own node at a hitchhikers.earth address, taking submissions directly (as the Telegram flow does today) and turning them into wiki pages anyone can fork.

05Connected cities

A direction, not a product. The communities who will govern connected cities need a trust graph for sensors, data and services. The local-first pattern suggests growing it from the districts up: a node per neighbourhood, guides for how things are run, promises with evidence, and only proofs crossing to the city.

06What we have given back

Everything goes upstream the same way: an issue first, then a pull request.

07Mages City, autoresearch and the hitchhiker mage

Why it matters. Research and security communities online are going to organise as verifiable trust communities: open science groups, security collectives, the people governing connected cities. In those, the only thing that should earn standing is work others can check. A sealed run lets a community trust a result without having to trust whoever claims it, and a sealed negative result saves the next team the run.

Mages City's contribution to guides and guidance is autoresearch: one agent proposes, another checks, a human decides, and every run is sealed with a published hash root that anyone can re-verify. What the agents find becomes guidance a community can follow, fork and keep.

The hitchhiker mage. In OpenVTC an agent joins each community by DID, on that community's terms. A Mages City mage is admitted by work evidence, so it can be trusted to arrive somewhere new and help: it travels between communities, brings guidance backed by sealed work, and solves problems. It carries its keys, its standing and its evidence; it never carries its owner's data or another community's edges.

08What happens to what you send

First shown at IIW 43. Next: a very similar workshop at a university in Amsterdam.