Part 3 · The product is the trust
Trust Standard & Review Pipeline
Evidence-bound tiers, isolated scanning, A0–A4 autonomy classes, and reversible distribution. A badge states what was tested — not that an app is safe.
Canonical spec v1.2 · 30 August 2026
Trust tier model
| Tier | Meaning | Limits |
|---|---|---|
| Listed | Identity and baseline submission completeness verified. | No positive security claim. |
| Verified Baseline | Current release passes mandatory automated controls and policy review for its risk class. | Time- and version-bound. Scope visible. |
| Verified Plus | Adds enhanced manual review, device testing, provenance, and incident commitments. | Not a warranty. Residual findings disclosed. |
| Restricted / Suspended | New installs or operation limited. | Reason class, time, user action, appeal path where lawful. |
In this codebase the stored values remain listed / verified / audited so existing publisher rows keep working. On the site, audited maps to Verified Plus. Tiers are earned, never bought.
Evidence labels
- Verified — observed by Aether within a stated scope, release, date, method, and expiry.
- Declared — asserted by the publisher and not independently validated unless the listing says otherwise.
- Inferred — derived from observed evidence; never displayed as verified.
- Reported — submitted by a user or third party and not established as fact pending review.
Verification pipeline
- Intake: normalize URL, bind origin, capture manifest, DNS/TLS, declared data/AI fields.
- Passive: headers, certificates, known-bad destinations, secrets in client bundles, manifest quality.
- Static when artifacts exist: SBOM, licenses, secret scan. Otherwise publish an observed resource inventory — not an SBOM.
- Dynamic: isolated browser crawl, permission prompts, offline/install tests. Default-deny egress.
- Agent: Trust Manifest, tool enumeration, confirmation rules, budget caps, kill switch.
- A live origin has no single permanent hash. Integrity is a content-addressed evidence bundle for a declared release and test context.
Autonomy classes
| Class | Behavior | Public MVP |
|---|---|---|
| A0 Inform | No external side effect. | Eligible after baseline review |
| A1 Recommend | Proposes actions; user executes. | Eligible after claim checks |
| A2 Confirmed action | Side effect only after per-action confirmation. | Eligible with receipts and undo where feasible |
| A3 Bounded delegation | Acts inside time/scope/cost limits. | Enhanced review only |
| A4 Continuous autonomy | Material actions without per-action confirmation. | Not public-MVP eligible |
Required well-known files on a listed origin: /.well-known/aether.json (origin binding), agent-trust-manifest.json plus .jws for agents, and publisher JWKS. Aether’s own platform-trust-manifest.json is never fetched from a publisher origin.
Policy stance
- Sameness rule: reject thin chat boxes on a public model unless the publisher shows a distinct dataset, workflow, or audience.
- Honesty rule: undeclared tracking, tools, or training use is a trust incident.
- Velocity rule: origins may update anytime; material capability, data, payment, or autonomy changes require re-review.
- Containment: warn → stop new installs → suspend commerce → quarantine → delist. Critical trust actions should reach read paths within five minutes.