Reputation Scoring

Run a local report

Pass the subject’s public key in bare hexadecimal form. The CLI reads your configured local stores, so set the receipt database and policy for the tenant whose evidence you inspect.

# Local evidence for one subject
chio --json --receipt-db receipts.sqlite3 reputation local \
  --subject-public-key <64-hex> \
  [--since <unix>] [--until <unix>] [--policy policy.yaml]

# A presented passport compared with local evidence
chio --json --receipt-db receipts.sqlite3 reputation compare \
  --subject-public-key <64-hex> --passport passport.json \
  [--local-policy policy.yaml] [--verifier-policy verifier.yaml]

The trust control plane also serves /v1/reputation/local/{subject_key} and /v1/reputation/compare/{subject_key}. chio reputation local|compare lists every argument.

Scoring inputs

The local corpus

The caller supplies LocalReputationCorpus. The scorer performs no network lookup and owns no tenant store; the calling service decides which tenant’s records it loads.

Receipt integrity checks require a trusted kernel key, a matching content-addressed receipt ID, a valid signature, and a valid action hash. The scoring function authenticates receipts only; the caller vouches for the capability, usage, and incident records it supplies and scopes incidents to the subject, because the scorer evaluates every supplied incident.

compute_local_scorecard

The Rust entry point takes a subject key, an explicit evaluation time, the corpus, and a configuration. Fixed inputs, including now, produce the same scorecard.

compute_local_scorecard(
    subject_key: &str,
    now: u64,
    corpus: &LocalReputationCorpus,
    config: &ReputationConfig,
) -> LocalReputationScorecard

Read effective_weight_sum and the observation counts beside the composite; they show how much evidence the result used.

Scoring model

Metric definitions and default weights

The eight default weights sum to 1.00. An unavailable metric is omitted from the weighted mean.

• boundary_pressure · weight 0.20 · field deny_ratio from compute_boundary_pressure in score.rs. The unweighted mean of each policy hash’s decay-weighted deny ratio. The metric contributes 1.0 - deny_ratio, so less pressure scores higher.
• resource_stewardship · weight 0.10 · field fit_score from compute_resource_stewardship in score.rs. 1.0 - |average_utilization - target_utilization| across grants with a positive max_invocations cap. Utilization is capped at one; missing usage counts as zero.
• least_privilege · weight 0.15 · field score from compute_least_privilege in score.rs. Per capability, used_tools / grants counts distinct allowed tool uses, multiplied by a constraint factor 0.5 + 0.5 * constrained_ratio and an operation factor 0.5 + 0.5 * non_delegate_ratio, then decay-weighted across capabilities.
• history_depth · weight 0.10 · field score from compute_history_depth in compare.rs. The mean of three ratios, each capped at one: receipts against history_receipt_target, span in days against history_day_target, and active days over span days.
• tool_diversity · weight 0.05 · field specialization.score from compute_specialization in compare.rs. Normalized Shannon entropy over decayed per-tool weights. The scorecard field is specialization while the weight key is tool_diversity, and the contribution is capped at diversity_cap where it is folded in.
• delegation_hygiene · weight 0.15 · field score from compute_delegation_hygiene in compare.rs. The mean of the scope-reduction, expiration-reduction, and budget-reduction rates across delegations the subject issued against their parents.
• reliability · weight 0.15 · field score from compute_reliability in compare.rs. Decayed allow weight over allow plus canceled plus incomplete. Denials are excluded from the denominator, so a denied request counts against boundary pressure alone.
• incident_correlation · weight 0.10 · field score from compute_incident_correlation in compare.rs. 1.0 - incident_penalty * weighted_incidents, clamped into [0, 1]. Unknown when incident_reports is None.

Default configuration

Trust and time configuration

Populate the Rust configuration through ReputationConfig::with_trusted_kernel_keys before using receipt history. The capability authority supplies its signing key and trusted peer keys when it evaluates issuance. With no trusted kernel keys, every receipt fails integrity validation, while other supplied records can still produce known metrics; inspect the component counts to tell missing receipt trust from missing history.

The 30-day history target and the 30-day half-life are separate parameters, and neither imposes a rolling 30-day cutoff. The caller chooses the corpus. The control-plane report’s since and until bounds filter receipts inclusively, while capability snapshots and budget usage stay the loaded current records.

Decay uses 2^(-age / half_life). The Rust scorer treats a zero half-life as no decay; HushSpec policy validation requires at least one day. History depth also weighs activity across the observed span, so reaching the count and day targets fixes two of its three terms.

Scorecard fields

Interpret the scorecard

• subject_key and computed_at: the evaluated subject and the explicit scoring time.
• Component metric records: values and counts such as receipts, policies, capped grants, distinct tools, and delegations observed.
• composite_score: the known weighted mean, or Unknown.
• effective_weight_sum: the sum of the weights that contributed.

The local report adds issuance-oriented fields such as effectiveScore and probationary status. Adequate history, permission, and a verified identity each come from their own record, never from a high composite alone.

Feed deltas and marketplace tiers

A ReputationFeed consumes caller-supplied observations and returns a ScoreDelta: a feed ID, a numeric value, and the count of observations consumed. The struct carries no signature or issuer proof, so authenticating the observation source is the caller’s responsibility.

ScoreDelta::from_value clamps the value to the supported nonnegative range; negative and non-finite inputs become zero. The supplied feeds are arena_survival and cross_provider_equality, and they run outside the kernel’s admission path. compose_deltas takes the maximum delta in place of a sum, and an empty slice returns None. tier_from_deltas applies these thresholds:

The highest satisfied tier wins. Two different feed ID strings count as two feeds whether or not independent organizations or verified issuers stand behind them. The CLI compares the tenant’s tier with each catalog entry’s reputation_floor for both listing visibility and installation eligibility.

/// Composed-score floor for `tier_1`.
pub const TIER_1_THRESHOLD: f64 = 0.50;

/// Composed-score floor for `tier_2`.
pub const TIER_2_THRESHOLD: f64 = 0.75;

/// Composed-score floor for `tier_3`.
pub const TIER_3_THRESHOLD: f64 = 0.90;

/// Per-feed minimum delta required for `tier_3`. Every shipped feed
/// MUST clear this value independently for the publisher to reach the
/// highest tier; this is the Sybil-resistance mitigation: a flood of
/// arena rounds alone cannot promote a publisher past `tier_2`.
pub const TIER_3_PER_FEED_THRESHOLD: f64 = 0.80;

Behavioral profile signals

The behavioral-profile guard is advisory: it tracks deviations from a workload’s baseline and always returns an allowed decision. Its runtime evaluate path observes call rate from a bounded receipt window, and other supported metrics arrive through observe_sample.

On a fresh time window, anomaly detection requires enough baseline samples and an absolute z-score above the configured threshold; same-window evaluation follows a separate path. The runtime guard discards the observation outcome. An explicit caller can inspect the observation result or the baseline; anomaly evidence reaches neither the decision nor the local scorecard on its own.

/// Default EMA smoothing factor. Equivalent to a ~10-sample window.
pub const DEFAULT_EMA_ALPHA: f64 = 0.2;
/// Default sigma threshold above which a window is flagged.
pub const DEFAULT_SIGMA_THRESHOLD: f64 = 2.0;
/// Default rolling window length in seconds.
pub const DEFAULT_WINDOW_SECS: u64 = 60;
/// Default number of historical windows used to prime the baseline
/// before the guard starts emitting signals. Guarantees the z-score
/// has enough history to be meaningful.
pub const DEFAULT_BASELINE_MIN_WINDOWS: u64 = 3;

/// Metric captured per (agent, window).
#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
pub enum BehavioralMetric {
    /// Total receipts per window.
    CallRate,
    /// Denies per window.
    DenyRate,
    /// Distinct tool names per window.
    UniqueTools,
    /// Approximate parameter entropy per window.
    AvgParameterEntropy,
}

Compliance score

The kernel’s compliance score evaluates supplied deny rate, revocation rate, velocity anomalies, policy-coverage gaps, and attestation age on a 0 to 1,000 scale, with default maximum deductions of 300, 300, 150, 150, and 100. With any revocation, the default score ceiling is 499. The calculation is separate from the eight-component reputation composite and from a signed compliance certificate; Compliance Certificates covers the signed session record.

/// Maximum possible compliance score.
pub const COMPLIANCE_SCORE_MAX: u32 = 1000;

/// Weight (maximum-deducted points) for the deny-rate factor.
pub const WEIGHT_DENY_RATE: u32 = 300;
/// Weight for the revocation factor.
pub const WEIGHT_REVOCATION: u32 = 300;
/// Weight for the velocity-anomaly factor.
pub const WEIGHT_VELOCITY_ANOMALY: u32 = 150;
/// Weight for the policy-coverage factor.
pub const WEIGHT_POLICY_COVERAGE: u32 = 150;
/// Weight for the attestation-freshness factor.
pub const WEIGHT_ATTESTATION_FRESHNESS: u32 = 100;

/// Default staleness threshold (seconds) beyond which the attestation
/// freshness factor is fully deducted. Ninety days mirrors the default
/// receipt-retention window in [`crate::receipt_store::RetentionConfig`].
pub const DEFAULT_ATTESTATION_STALENESS_SECS: u64 = 7_776_000;

Implementation sources

• crates/trust/chio-reputation/src/model.rs, score.rs, and compare.rs: corpus, configuration, metric formulas, and weighted mean.
• crates/platform/chio-control-plane/src/issuance/reputation.rs and scope.rs: report loading, probation, score ranges, and issuance ceilings.
• crates/trust/chio-reputation/src/feed.rs and tier.rs: unsigned feed deltas and tier predicates.
• crates/products/chio-cli/src/market.rs: tenant-tier checks for catalog listing and installation.