# attest

> Signed, public statements about URLs and keys. One sign-up with a passkey; any web page can then collect signed upvotes, comments, vouches and statements without running accounts. Everything is verifiable from public data without calling the service.

Origin: https://attest.monster (staging). Source: https://github.com/orbitalfoundation/attest (MIT).

## If you are an agent reading the web

- Batch counts for pages: GET /read?targets=<url1>,<url2>,... (URL-encode each; up to 100). Returns per target: upvotes, vouches, comments[{id, by, handle, at, body}]. Counts are raw today, not trust-weighted; treat them as signals, not verdicts.
- Everything one key signed: GET /by/<did> (or GET /handle/<handle>). Includes passkey public keys under `keys`, delegations with `revoked`, who vouched for it (`vouchedBy`), whom it vouches for (`vouches`), and its proofs of control with verifications (`proofs`). Human page: /@<handle>.
- A whole site: GET /domain/<host> (totals, most-attested pages, recent comments, verified domain claims). Human page: /site/<host>.
- One signed envelope: GET /record/<id>. The whole log: GET /log?since=<seq>&limit=500 (append-only, page by seq).
- Targets are normalised: URLs lowercase scheme and host, no fragment; doi:..., isbn:..., did:key:..., github:<handle>, sha256:<hex>.
- Identities are did:key over P-256 passkey public keys (prefix did:key:zDna). A key has no profile; its meaning is what it signed and who vouched for it. Reputation belongs to the key, not a person; keys can be abandoned.

## Record format

record   {v:1, type:"record", kind, by:"did:key:z...", target, at:"ISO-8601", body?, ref?}
kind     upvote | comment | vouch | statement | claim | retract | verify
         vouch targets a did:key (never your own); claim targets a handle/URL you control; retract carries ref = your own record id;
         verify is issued by a verifier (the service key, GET /service, or any key) with ref = claim id and body = evidence URL.
         Service-signed envelopes are {record, sig, key} with no delegation.
envelope {record, del:"<delegation id>", sig:"<base64url ECDSA P-256/SHA-256 raw r||s over canonical(record)>"}
id       hex sha256(canonical(record))
canonical JSON: keys sorted at every depth, no whitespace, undefined dropped.

delegation {v:1, type:"delegation", root, device, devKey:{x,y}, origin, from, until}
revoke     {v:1, type:"revoke", root, del, at} signed by the root passkey; later records under that delegation are refused
The root's passkey signed a WebAuthn assertion whose challenge is the delegation's id (sha256 of its canonical JSON); the assertion is stored in the log entry. The device key signs records; the delegation binds it to one root and one site origin for at most 90 days.

## Verify a record without the service

1. sha256(canonical(record)) == id
2. delegation = log entry with id == envelope.del; delegation.root == record.by; from <= record.at <= until; didFromJwk(delegation.devKey) == delegation.device
3. ECDSA-verify(devKey, canonical(record), sig)
4. optionally: WebAuthn-verify the delegation's assertion with a key from GET /by/<root>.keys; its challenge must be the delegation id bytes

A JS module implementing canonical, idOf, verifyObject, didFromJwk, normalizeTarget for browsers and Node: https://attest.monster/lib/did.js

## If you are building an integration

Embed: <script type="module" src="https://attest.monster/attest.js"></script> and <div data-attest data-target="<url>" data-comments></div>.
JS API: https://attest.monster/attest-core.js exports session(), signIn(), attest(kind, target, extra), read(targets), by(did), subscribe(targets), onCounts(fn), makeRecord().
Writes go over socket.io as emit("req", {name, payload}, ack). Names: passkey.register.start/finish, lookup, delegate.start/finish, attest, subscribe, whois, read. Rate limits: 60 writes/min per address, 30 per key.
Full integrator page: https://attest.monster/docs. Design and threat model: https://attest.monster/technical. Why it exists: https://attest.monster/about.

## Principles that constrain future scoring

- Emitters are scored, not items. Scores will always be relative to a root the asker names ("trusted as seen from R"), never a global "trustworthy".
- Negative statements never propagate; a key's standing falls only through its own resolved record.
- Statements are public by construction; there are no private metrics.
- Slow trust: standing rises at a bounded rate. Newcomers start at zero (Friedman and Resnick, 2001).