From 0a5449d24ffcd94c336fd86a5ab7ac81140894a0 Mon Sep 17 00:00:00 2001
From: SkateSpots <skatespots>
Date: Wed, 7 Oct 2026 10:18:09 +0700
Subject: [PATCH] =?UTF-8?q?docs(AGENTS):=20park=20identity/conflict=20idea?=
 =?UTF-8?q?s=20until=20there=20are=20users=20(triggers=20+=20Stash?=
 =?UTF-8?q?=E2=89=A0key-recovery=20note)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 AGENTS.md | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/AGENTS.md b/AGENTS.md
index 6327001..d74bb3c 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -2357,6 +2357,36 @@ world-readable (plain Nostr) vs both; (2) one host community with a channel per
 event vs a community per event; (3) is a Concord **private channel** (zero infra)
 enough for private events, or is MLS worth requiring a coordinator?
 
+## Identity & conflict — parked until there are users (2026-10-07)
+
+Owner decision: **build nothing here yet.** Zero users — revisit organically
+rather than guessing. Thesis on the table (not acted on): internet toxicity is
+downstream of **centralized identity + centralized conflict resolution**; the fix
+is identity at a lower level + **plural, viewer-applied filtering**. A full idea
+list was discussed this session but is deliberately **NOT started**.
+
+**Keep the door open (cheap):** admin keys and relay sets must stay *data you can
+swap*, not constants. Hardcoded `ADMIN_PUBKEYS` is fine now — converting it later
+is a small refactor, not a trap.
+
+**Trigger 1 — first time you want to hide/remove something, or an admin key is
+compromised:** add **labeler choice** (users subscribe to signed moderator lists;
+ship a *default* that is forkable, not baked in) + **show who decided** (signed
+verdicts + author right-of-reply). Today: NIP-32 `hidden`/`verified`/`cleared`
+from a hardcoded admin set = one key is the single point of capture.
+
+**Trigger 2 — first shop or coach (stranger-trust, not just friends):** add
+**social re-vouch** (a new key claims succession of an old key, endorsed by N ≥
+known contacts, optional cooling period — no crypto shares) + **issuer-signed**
+credentials (a federation/body key signs certs; users choose which issuers to
+trust). Re-vouching rebuilds *trust only* — it can't move old addressable events,
+the NIP-05 handle, zaps, or account age, and it can't help a shop/coach/stranger.
+
+**Do NOT sell Stash backup as key recovery.** `src/lib/stashBackup.ts` password
+mode survives key loss but restores **only the gear list**; nip44 mode +
+multi-device sync need the key. The key *is* the identity (npub, spots, crew,
+passes, handle, rep). PoW is anti-spam friction, **not** identity.
+
 ## Nostr Protocol Integration
 
 This project comes with custom hooks for querying and publishing events on the Nostr network.