Vouch

lastmod 2026-02-09created 2026-02-091 edits

Trust management system for open-source contributors

About

Open source has traditionally operated on a trust and verify model
With the spread of AI tools, the barrier to entry for contributions has effectively disappeared, and the existing implicit trust model no longer works
An open-source trust management system designed so that one can participate only after trust is explicitly vouched for before contributing
Trusted contributors can vouch for other users, and malicious actors can be explicitly blocked with denounce (to condemn/accuse)
- Denounces are kept as public records that other projects can refer to
- Who vouches/denounces and by what criteria is up to each project
- The system does not enforce particular values; policy decisions are up to the community
All trust data is version-controlled alongside the code as a single plain-text file (VOUCHED) in the repository, ensuring transparency and portability
In the long term, a structure for sharing trust information by forming a Web of Trust across projects
- Downstream projects choose whether to accept upstream projects' judgments as-is
- Projects that vouch/denounce indiscriminately can naturally be excluded from the trust network
Easily integrates with GitHub Actions, and can be managed with keywords like lgtm and denounce in issue or PR comments
Ghostty switched its contribution model to a vouch-based system
Implemented with inspiration from the Pi project; currently experimental

Local file
- vouch.nu check <user>: check a user's vouch/denounce status
- vouch.nu add <user>: vouch for a user
- vouch.nu denounce <user>: denounce a user
GitHub integration
- vouch.nu gh-check-pr <pr>: check the PR author's status and handle automatically
- vouch.nu gh-manage-by-issue <issue> <comment>: vouch/denounce based on issue comments

author Zer0 sitemap