Conformance — dtp-wot/1

Status: draft · 2026-09-30

Three runtimes must answer the same question the same way:

Sharing code covers the two TypeScript runtimes. The corpus proves the Rust engine and guards the TypeScript package against regressions.

Corpus layout#

TrustGraph/corpus/
  manifest.json          { "corpus": "dtp-wot-corpus/1", "model": "dtp-wot/1", "cases": [...] }
  protocol/              signed event  → verdict + normalized record
  model/                 records + claims + own evidence + ops → query expectations
  generators/            seeded random-graph generators (perf and fuzz)

Protocol cases#

Input: one signed Nostr event (seven NIP-01 fields) plus the scope profile. Expected: valid / invalid with error codes, eligible for the profile, and the normalized record (§2.1 of wot-model.md). Covers d recomputation, one-subject rule, hints, v / score grammar, x/y, content limits, and scope eligibility.

Model cases#

{
  "id": "walk-threshold-blocks-hop",
  "model": "dtp-wot/1",
  "tags": ["walk", "threshold"],
  "profile": "x.com",
  "records": [
    { "addressKey": "32009:@alice:…", "id": "@e1", "pubkey": "@alice",
      "kind": 32009, "created_at": 100, "subjectType": "p",
      "subject": "@bob", "context": "identity", "value": 1, "scopeRank": 1 },
    { "addressKey": "32009:@bob:…", "id": "@e2", "pubkey": "@bob",
      "kind": 32009, "created_at": 110, "subjectType": "i",
      "subject": "user:id:11348282", "context": "identity", "value": 1,
      "scopeRank": 2, "hintPubkey": "@carol" }
  ],
  "claims": [{ "pubkey": "@carol", "twitterId": "11348282" }],
  "ownEvidence": [],
  "ops": null,
  "queries": [
    {
      "type": "trust",
      "input": {
        "rootPubkey": "@alice",
        "subject": { "type": "i", "value": "user:id:11348282" },
        "context": "identity", "now": 1000, "bounds": { "maxDepth": 4 },
        "followTrustThreshold": 75, "followTrustRed": 25, "format": "default",
        "bindingMode": "strict"
      },
      "expect": { "connected": true, "degree": 2, "trust": 1, "distrust": 0,
                  "resolution": "trusted", "statements": ["…"] }
    }
  ]
}

• @name placeholders expand to deterministic hex (sha256("name")) in both runners, so cases stay readable.
• claims are (pubkey, twitterId) pairs from winning kind 10011 events; ownEvidence entries are { root, iKey, pubkey, source: "bio" | "post" } and apply only to their root.
• ops (optional) is an explicit sequence of apply / remove / claim / unclaim / own / unown. When omitted: records, then claims, then own evidence, in order.
• type is one of trust, rating (resolver), lookup-incoming, lookup-outgoing, lookup-counts, neighborhood (lookups), frontier. Lookup cases list the expected items in full order, including page boundaries (pages: [{ limit, expectItems, expectNextCursor: bool }]); the opaque cursor value itself is not compared.
• Every bind-* case lists expectations for both binding modes (expect.lenient, expect.strict), built from the situation table in identity-binding.md §5.

Canonical comparison#

Before comparing, both runners:

1. drop computedAt, graphVersion, node label, and heap-index ids;
2. sort statements / claims by (distance, createdAt desc, eventId);
3. sort sourceEventIds;
4. key pathView nodes by subject (type:value) and edges by eventId;
5. compare averageScore with absolute tolerance 1e-9.

Properties#

Both runners execute these over every model case and over generated graphs:

A gap:Gn tag marks a case whose gap is still open in the @dtp/trust-graph heap. A tagged case carries two expectations per query:

• expectModel is what this spec requires. A runner for a model-correct implementation (the Rust runner) asserts it, and reports the case as gap fixed rather than as a failure of the heap.
• expectCurrent is what the TypeScript heap does today. The TypeScript runner asserts it, so the heap stays pinned: a change in its behaviour fails the case until the owner updates the gap.
• A runner never asserts expect on a gap case (the lint forbids expect beside expectModel). When a gap is fixed in the heap, its cases drop the tag and expectCurrent, and expectModel becomes expect. Case ids (gap-g1-…) are kept for traceability; the tag alone says a gap is open.
• Where the gap setup hides a rule that holds anyway, a companion case without the tag pins that rule for both runners (for example context-neutral-occupies-its-bucket-connected next to context-neutral-occupies-its-bucket).

Generators and order-independence properties skip gap cases until the gaps are closed.

Differential fuzzing#

A seeded generator produces graphs (node count, fan-out distribution, value mix, contexts, npub hints, claims, own evidence, x/y windows) and random queries in both binding modes. The TypeScript runner writes canonical JSON; the Rust runner compares. Nightly CI runs 10 000 seeds; any mismatch is minimized and committed as a regression case.

Seeding the corpus#

Port the extension's existing graph tests before writing new ones:

Large realistic datasets (for example the local test-relay playback exports) stay out of the public corpus when they contain X display chrome. Use them for local benchmarks only.

Runners and CI#

One API: the session suite#

The corpus proves the model. The session suite proves the two servers expose exactly the same API (resolver-api.md):

• Scripted WebSocket sessions (corpus/sessions/*.json): a configuration, a list of events to push with EVENT, then messages to send and the expected messages back — OK prefixes, AUTH flows under each access setting, REQ answers, every DTP operation, DTP-ERR codes, pushes, NIP-09 deletions, guardrail responses (using node and record budgets, not time).
• The same suite runs against a started Personal Server and a started Global Server with identical configuration. Each server's answers must match the scripted expectations, so the two transcripts agree after canonicalization (drop instanceId, graphVersion, numeric node ids, timestamps the server chose).
• Numbers compare by value. Frames are parsed as JSON and numbers match within 1e-9, so a server may write 1.5e-6 where another writes 0.0000015 (JavaScript and Rust format small floats differently). No step compares number text.
• Order. Frames of one step arrive in the listed order unless the step says unordered (for example an OK and the DTP-PUSH it causes). Arrays whose order is implementation-local (neighborhood nodes and edges) use the $unordered matcher. DTP-PUSH frames are matched only by steps that expect one; other pushes are ignored.
• Capability gating. A session or step may list requires: an operation name that must appear in dtp.capabilities, or fixed:Gn for a gap the server must not list in dtp.gaps. The runner reads both with info before the first step. An unmet step asserts its otherwise frames (for graph.field: DTP-ERR unsupported), or is skipped when it has none. The walk-budget session (requires: ["fixed:G10"]) needs the server started with the session's config limits.
• A server may not ship an operation, field, error code, or default that the suite does not cover on both.
• The suite also checks the admin telemetry JSON and /metrics of both servers against the shared schema and metric list (telemetry.md).

Known gaps#

Differences between the extension heap (AttentionX src/graph/trust, locked) and this model. Decision D3 allowed fixing them in the @dtp/trust-graph package only; the package records each divergence from the AttentionX origin in packages/trust-graph/DIVERGENCE.json. The AttentionX copy keeps every gap until the extension shim (TG-8) adopts the package.

The table keeps the original description of each gap in the AttentionX heap.

The package fixed them in the order G2, G3, G1, G4, G6, G8, G10, G12, G7. What remains: G9 (a publish rule outside the heap, for the extension) and G5 (protocol-layer key normalization).

Budget cases in the corpus (gap-g10-*) use node and record budgets only, never time, so both runners get identical completeDepth and results.