# The Registry Is Not Thinking In Graphs: Trust Is A Confidence Computed From Independent Evidence, Not A Verdict Issued By An Oracle

**version** v0.33.63
**date** 27 August 2026
**from** Human (project lead)
**to** Engineering, Architecture, AppSec, Strategy, the PKI/registry team

**type** Strategy brief

*Produced from a voice memo recorded after reading* A Key Means Nothing Alone *(site v0.1.36/37), restructured into the corpus format by the site agent with its substance preserved and its instruction to read graphs.sgit.ai executed. Everything marked as the project lead's position below is from the memo; everything marked as the corpus's is a verbatim quotation with its source; everything else is the site agent's reading and is labelled as such. The memo's own framing: "the crewing work has gone a bit of a tangent, and I want us to take a step back and reimagine a lot of these things a little bit differently."*

---

## What This Is

The registry has been built as an **oracle** and it should have been built as a **node**. The project lead's position, stated in the memo and traceable to a founder sentence in this family's corpus from **4 June 2026**, is that meaning and trust both arrive through connectivity: a key on its own conveys nothing, and what makes it usable is the graph of independent evidence you can reach from it. **Trust is therefore a spectrum, computed by the consumer from the evidence they can collect and corroborate, and specific to the use case** — the assurance needed to accept a message is not the assurance needed to accept a contract — rather than a verdict handed down by a body of truth. The registry's job is not to be believed; it is to be **one more place that stores evidence and clues**, and to make the consumer's own computation cheaper. This brief records the reframe, shows where the shipped register currently contradicts it, and proposes the changes that follow. Three of the contradictions are computed from the repository rather than argued. The sharpest is that **rule 2, the estate's most-praised design move, is contradicted by the earliest graph-native sentence in this family's corpus, which is a sentence about PKI**; the most embarrassing is that the philosophy this site's book is *named after* is not linked from this site's front door, which is the mechanical explanation for the whole drift. New in this brief: the memo's worked example mapped onto the corpus's confidence ladder, and a proposed change to the verifier's return shape that is small, backward-compatible, and would move the register from issuing verdicts to reporting evidence.

## 1 · The Reframe, In The Project Lead's Words

> *"I think the problem with the registry is that the registry is not thinking in graphs and is not thinking in terms of the meaning through connectivity and trust through connectivity."*

> *"The trust that we have is depending on the evidence that we can collect, not necessarily some oracle of body of truth. So if you think about it, the registry that we're creating should not be trusted by default, which is, I think, the mistake that exists on the analogy. Like, in a way, we don't want to be the source of truth for a lot of this stuff. We are just one more place that can store evidence and clues for the reader or the consumer to make a decision based on how much trust to give."*

> *"Trust is a spectrum."*

> *"A lot of it is context specific. The authentication and the value that I need to receive a message is very different than I need to receive a contract, or is very different than I receive something that is mission critical."*

Three consequences follow immediately, and each is a change of shape rather than of degree:

1. **The consumer computes, the registry supplies.** A verdict is the wrong output. An evidence set with its provenance is the right one.
2. **The answer depends on what the answer is for.** A single global threshold is a category error, because the required assurance is a property of the use case, not of the subject.
3. **Continuous, not once.** *"There's a degree of continuous checks and continuous verifications and continuous following the rabbit hole, which we can cache quite a bit, but it's very important that that is the anchor of the trust."* Trust is a re-computation with a cache, not a stored fact.

## 2 · The Corpus Already Publishes This, And It Is Older Than This Site

This is the part that makes the brief a correction rather than a proposal. **graphs.sgit.ai is the canonical home of the philosophy, it says so, and it names this site as the place the philosophy should have landed.** Its network chapter has a section headed *"pki.sgit.ai: a key means nothing alone"* — which is where this site's book title comes from — and it carries the founder's own sentence, dated 4 June 2026, before the PKI estate existed:

> A public key in isolation does not give you anything; it is the graph it is connected to
>
> — *graphs.sgit.ai*, `v1/content/network.md`, § pki.sgit.ai: a key means nothing alone

Four named concepts follow from it, all published, all with locators, and none currently implemented in the register:

**The confidence ladder**, also called *the confidence spectrum*. Six rungs — no edges, local edges, typed definitions, anchor nodes, external references, rich multi-hop paths — and *"the answer is always computable from the graph: count the edges, measure the depth of traversal to anchor nodes, assess the authority of the nodes reached."* This is the memo's *trust is a spectrum*, already formalised and already computable.

**Weight by independence, not by count.**

> Ten citations of one source are one source.
>
> — *graphs.sgit.ai*, `v2/books/fsg-universe/content/06__provenance-correction-and-time.md`

This is the memo's DNS example stated as a method. The reason *"I only trust the website if the DNS record, which I can get independently from TLS, actually matches"* carries weight is that DNS and TLS are **independent paths to the same claim**. Two corroborations through the same authority are one corroboration.

**Enrichment, not enforcement.**

> When confidence is low the remedy is more edges, never more validation rules.
>
> — *graphs.sgit.ai*, `v2/books/fsg-universe/content/05__confidence-evidence-and-reality.md`

The register's answer to low confidence is currently a validator, four rules and a walk that terminates in a gate. The corpus's answer is more edges. *Site-agent reading:* these are not compatible positions with different emphases; they are opposite reflexes, and the register has consistently taken the enforcement one.

**The anchor node**, which is the shape `roots.json` should have had:

> It is well connected, well maintained, well known, and it has no authority at all. It is a meeting point, not a standard.
>
> — *graphs.sgit.ai*, `v2/books/fsg-universe/content/04__anchors-scopes-and-bridges.md`

## 3 · The Worked Example, Mapped

The memo asks for specific examples on the grounds that *"that puts everything in a lot more context."* Its example is receiving a message from somebody at a company. Mapped onto the ladder, with each rung a thing a consumer can actually go and get:

| # | What the consumer can reach | Independent of | Rung |
|---|---|---|---|
| 1 | The URL resolves; TLS terminates at that host | — | local edge |
| 2 | The DNS record, fetched **independently of TLS**, matches | the TLS path | + independent corroboration |
| 3 | The site publishes a company key; the message verifies under it | — | typed definition |
| 4 | The site publishes a people page: names, canonical IDs, emails, per-person public keys | — | anchor node reached |
| 5 | A registry entry, a third-party attestation, a prior signed exchange | each other | external references |
| 6 | Several of the above, corroborating through **different authorities** | each other | rich multi-hop |

Two properties of this table matter more than its contents.

**Nothing in it is binary, and no row is required.** A consumer accepting a newsletter stops at row 2. A consumer accepting a contract wants rows 4 and 6. The same subject, the same evidence, two correct and different answers — which is exactly what the current verifier cannot express.

**Every row is something the consumer fetches, not something the registry asserts.** The registry's contribution is at most row 5, one of six, and it is *"just one more place that can store evidence and clues."*

*Site-agent reading, offered for disagreement:* this table is also the answer to the attestation question the site has published unresolved since v0.1.x. That question is posed as *should the registry accept third-party attestations, given that attestations are what made the old system valuable and what made it attackable.* Under the ladder the question dissolves, because an attestation stops being a claim the registry vouches for and becomes an **edge the consumer weights by the independence of its source**. A flood of 150,000 attestations from one origin is one edge under independence weighting, which is the 2019 attack answered by arithmetic rather than by a size bound. Rule 3 stops being the load-bearing defence.

## 4 · Where The Shipped Register Contradicts This, Computed

Four findings. The first three are computed from the repository at v0.1.37; the fourth is a design reading.

**4.1 · `roots.json` is a gate, and the walk terminates in it.** The published verification walk requires the issuer to appear in `roots.json`, and the register ships exactly one root. So every answer the register produces is *"this chain terminates in the one authority I already told you to trust."* That is the oracle shape, and it is the opposite of an anchor node, which by definition *has no authority at all*.

**4.2 · The verifier returns a verdict, and the evidence is narrative.** It already returns a `basis` array — which is better than it looks, and is the seed of the right design — but the array is prose, and the verdict is computed by the gate rather than from the evidence. Executed at v0.1.37:

```
$ python3 tools/registry_tool.py verify sha256:df2bb4d93af69e6a repo.pull-request.create
  "answer": "YES",
  "basis": [ "subject is a FIXTURE: private key published — signatures verify and prove nothing",
             "issuer is a declared root of this registry", … ]
```

`answer: YES` is doing the work; `basis` is doing the explaining. Under the reframe those should swap: the evidence set is the product, and any verdict is the consumer's, computed against their own threshold.

**4.3 · Rule 2 is contradicted by the corpus's earliest graph-native sentence, which is about PKI.** This is the sharpest finding in the brief. The site's rule 2 — *revocation is a signed append, not a deletion* — is presented across the estate, and in the book's Chapter 2, as the elegant resolution of the tension between append-only and withdrawal. The corpus, dated **21 February 2026**, says the opposite about the same subject:

> Revocation is the absence of trust, not the presence of a revocation entry.
>
> — *graphs.sgit.ai*, `v1/content/network.md`, quoting the corpus of 21 February 2026

And it names the failure mode of the shipped design explicitly:

> A revocation list is an implementation of that idea, and a poor one: it can only tell you about the revocations it happens to know about.
>
> — *graphs.sgit.ai*, `v1/content/network.md`

Under connectivity, trust is a path and revocation is that path no longer existing. A register that models revocation as a positive signed statement can only report the revocations it holds, and its silence is indistinguishable from an absence of revocation — which is precisely the assurance a consumer most needs and the one it cannot give. *Site-agent reading:* rule 2 is not wrong as a **record-keeping** rule; an append with an `effective_from` is genuinely better than deletion, and it preserves *was it valid last Tuesday*, which matters. It is wrong as a **trust** rule. The correction is that a revocation entry is evidence that a path was cut, never the definition of the path's absence, and a consumer who has not re-walked the path recently holds a cached result rather than a current one.

**4.4 · The philosophy is not reachable from this site.** Computed at v0.1.37: `pki.sgit.ai/llms.txt` and `pki.sgit.ai/index.html` mention `graphs.sgit.ai` **zero times**, and the *Related sites* section lists `nhi.sgit.ai` and `sgit.ai` only. The graphs estate tracks the reciprocal link as **ask N2** and diagnoses the cost in its own words: *a document nothing links to is, for a reader who follows links, a document that does not exist.* The canonical home of *meaning through connectivity* — the phrase this site's book is named after — is invisible from this site's front door. *Site-agent reading:* this is the mechanical cause of the drift the memo is reacting to, and it is the cheapest thing in this brief to fix.

## 5 · What Changes

Proposed, not decided. Each is small enough to build and none requires abandoning what shipped.

**5.1 · `roots.json` becomes `anchors.json`, and anchors carry no authority.** An anchor is a well-known meeting point a consumer *may* weight. The register stops requiring one and starts reporting which were reached, by which path, and how independent those paths were. Consumers who want the old behaviour keep it by setting their own threshold to *must reach anchor X*.

**5.2 · The verifier returns a confidence, an evidence set and the gaps — and any verdict is the caller's.** Concretely, and backward-compatibly, since `basis` already exists:

```jsonc
{
  "question": "may <subject> exercise <capability>?",
  "rung": 2,                          // the corpus's six-rung ladder, computed
  "evidence": [                       // typed, not narrative
    {"claim": "identity", "via": "self-signed statement", "independence": "none",
     "weight": 0, "note": "proves possession, nothing else"},
    {"claim": "mandate",  "via": "issuer record → anchor(fixture-operator)",
     "independence": "same-origin", "weight": 0,
     "note": "FIXTURE: private half published — this edge conveys nothing"}
  ],
  "independent_paths": 0,             // weight by independence, not by count
  "gaps": [                           // the gaps ARE the output
    "no DNS-independent corroboration of the issuer",
    "no third-party attestation from any origin",
    "no prior signed exchange with this subject",
    "no real root: every path terminates in published private material"
  ],
  "verdict": null,                    // the CONSUMER computes this
  "sufficient_for": {"newsletter": false, "contract": false, "mission_critical": false}
}
```

*Site-agent reading:* `independent_paths: 0` is the single most honest number the register could publish about itself today, and it is computable now. Ten of eleven records are fixtures signed by a fixture root: every path terminates in the same published private key, so under *ten citations of one source are one source* the whole register currently carries **one** origin.

**5.3 · The gaps become a first-class output**, per the corpus: *"An absence that is stated can be counted, queried, assigned and closed. An absence that is hidden silently supports whatever rests on it."* The register already ships `views/expected-verifications.json`; a `views/gaps.json` is the same move applied to what is missing.

**5.4 · Enrichment over enforcement, as a standing rule.** When a consumer's confidence is low, the register's response is *here are the edges you could go and get*, never a stricter validator. This reverses the reflex that produced the four rules, the walk and the validator, and it should be written down as a decision so the reflex is visible next time.

**5.5 · Close ask N2.** Link `graphs.sgit.ai` from this site's front door, `llms.txt`, nav and the *Related sites* section, named as the canonical home of the philosophy. One release.

## 6 · What Does Not Change, And What The Memo Does Not Say

Stated because a reframe that quietly discards working things is how estates lose ground.

**Rule 1 stands, entirely.** *Only the owner writes to their own record* is a topology rule, not a trust rule, and connectivity does not weaken it — a graph where anyone may append to anybody's node is the 2019 failure with more steps.

**Rule 4 stands.** *Every entry is signed by something you can check* is what makes an edge weighable at all. Under the ladder it is more important, not less, because an unsigned edge cannot be attributed and an unattributable edge cannot be weighted for independence.

**The commit-graph record model stands.** Immutable signed statements with history in the substrate is exactly the right substrate for evidence that must be re-walkable.

**The published-fixture discipline stands, and the memo endorses it in passing** — *"if we publish the private key and public key of an actor of a particular type, all we're saying is that this agent is trying to be a librarian, which is okay."* Under the reframe a role key is a claim with an independence weight of zero, which is a coherent thing for a register to hold rather than an embarrassment to apologise for. The book's costume framing survives; what changes is that the zero becomes a computed number instead of a caveat in prose.

**The grant/mandate/delta vocabulary is untouched** by this brief. The memo is about the registry's trust model, not about the layer above it.

## 7 · What This Costs

| Cost | Note |
|---|---|
| A computed confidence is harder to explain than YES | And a YES that means *the arithmetic completed* is the thing the book spends a chapter warning about. The trade is honesty for legibility, which this estate has taken before |
| Independence is hard to compute and easy to fake | Two anchors under one operator are one anchor. Getting this wrong produces confident numbers, which is worse than no numbers |
| Continuous re-walking has a cost the design must carry | The memo concedes it and names the mitigation — *"which we can cache quite a bit"* — but a cache with no staleness model is a stored trust value, and the reframe's whole objection is to stored trust values |
| Six rungs is somebody's ladder | The corpus says so itself: a ladder presenting itself as *the* ladder is the schema-first move at one remove. It should ship as *one* formula, overridable |
| The register gets less useful-looking | An evidence set with `independent_paths: 0` is a weaker artefact than a YES, and it is the same artefact described accurately |

## 8 · Open Questions For The Project Lead

1. **Does the register keep a verdict at all**, as an opinion clearly labelled as one, or only ever an evidence set? The memo leans to the latter; a verdict with a named threshold may be more usable.
2. **Who defines the use-case thresholds** — *newsletter*, *contract*, *mission critical*? If the register ships them it is being an oracle again, one level up.
3. **Does this supersede rule 2, or qualify it?** The site-agent reading in §4.3 is that it qualifies it — records still append, trust still re-walks — but that is a reading, and the two sentences are in genuine tension.
4. **Is the attestation question closed by §3?** If independence weighting answers the flood, the site's central open question has an answer and should be published as one.
5. **Does the confidence ladder belong to graphs.sgit.ai, with this site consuming it**, exactly as GM-D32 settled that RiskMandate consumes the block stylesheet? That is the same shape and probably the same answer.

---

## Honest Tensions In This Brief

| Tension | Note |
|---|---|
| Written by the party being criticised | The site agent built the register this brief says is the wrong shape, and wrote the book that inherited the error. Every finding in §4 names a fetchable artefact so it can be checked rather than taken |
| A reframe arriving after an MVP shipped | Nothing here says the register should not have been built. It says the next version is a different shape, and the register is four days old, which is the cheapest moment this correction will ever be available |
| The memo is first thoughts, transcribed | It is explicitly *"a memo... I want us to take a step back"*, and its transcript is marked possibly incomplete. Where this brief has extended it, the extension is labelled as the site agent's reading |
| Quoting one sibling estate as authority | graphs.sgit.ai names itself the canonical home of the philosophy, which is a claim it makes about itself. It is also the only place the philosophy is written down, which is the condition this brief is complaining about |

---

*CC BY 4.0. Sources: the project lead's voice memo of 27 August 2026; `graphs.sgit.ai` v1 `content/network.md` and v2 `books/fsg-universe/content/04–06`; this repository at v0.1.37. Every quotation above is verbatim and was re-read out of the source it names.*