Updates

trust-security/hyper-p2p-trust-graph/.gitignore

@@ -0,0 +1,2 @@
+node_modules/
+*-storage/

trust-security/hyper-p2p-trust-graph/CHANGELOG.md

@@ -0,0 +1,19 @@
+# Changelog
+
+<!-- legacy: v0.1.0 -->
+
+- Initial release.
+<!-- legacy: v0.2.0 -->
+
+- Production-grade docs, validation, and expanded tests.
+<!-- legacy: v0.3.0 -->
+
+- Wave 6: presence-tier API tables, architecture wire section, validation test.
+
+<!-- legacy: v0.3.1 -->
+
+- Wave 7: correct protocol in docs, getStats(), wire tables, category README.
+## [0.3.2] - 2026-05-21
+
+### Changed
+- Exhaustive documentation pass (api, architecture, README) per DOC_STANDARDS.md.

trust-security/hyper-p2p-trust-graph/README.md

@@ -0,0 +1,43 @@
+# hyper-p2p-trust-graph
+
+Production trust & security module: Hyperswarm discovery + Protomux when `topic` is set.
+
+**Category:** Trust & security
+
+**Composes with:** `hyper-p2p-attestation-chain`, `hyper-p2p-reputation-system`
+
+**Protocol:** `trust-graph/v1`
+
+## When to use
+
+Multi-peer apps that need trust & security over a shared Hyperswarm topic.
+
+## When not to use
+
+Single-process tools with no P2P topic (use local APIs only or skip `ready()`).
+
+## Quick start
+
+```js
+const { HyperP2PTrustGraph } = require('hyper-p2p-trust-graph')
+const topic = process.argv[2] // 64-char hex or string
+const mod = new HyperP2PTrustGraph({ topic, enableBackgroundTimers: false })
+await mod.ready()   // joins swarm when topic set
+// ... application logic ...
+await mod.close()
+```
+
+## Docs
+
+- [docs/api.md](docs/api.md) — constructor, methods, events, errors
+- [docs/architecture.md](docs/architecture.md) — wire types, state, composition
+- [../_shared/PRODUCTION.md](../../_shared/PRODUCTION.md) — production checklist
+- [../_shared/DOC_STANDARDS.md](../../_shared/DOC_STANDARDS.md) — documentation standards
+
+- Integration: [`../../real_tests/integration/`](../../../real_tests/integration/) — `trust-graph-two-node.js`
+
+## Test
+
+```bash
+npm install && npm test
+```

trust-security/hyper-p2p-trust-graph/docs/api.md

@@ -0,0 +1,99 @@
+# API: hyper-p2p-trust-graph
+
+**Protocol:** `trust-graph/v1`
+
+**Export:** `HyperP2PTrustGraph`
+
+## Overview
+
+Production trust & security module: Hyperswarm discovery + Protomux when `topic` is set.
+
+## Constructor
+
+```js
+const mod = new HyperP2PTrustGraph(opts)
+```
+
+| Option | Type | Default | Description |
+|--------|------|---------|-------------|
+| `topic` | varies | null | topic |
+| `keyPair` | KeyPair | random Ed25519 | keyPair |
+| `decay` | number | 0.95 | decay |
+| `maxDepth` | number | 4 | maxDepth |
+
+## Methods
+
+### `addEdge(from, to, weight = 1)`
+
+- **Returns:** `value`
+- **Throws:** — (none documented in method body)
+
+### `decaySweep(—)`
+
+- **Returns:** `value`
+- **Throws:** — (none documented in method body)
+
+### `trustScore(from, to)`
+
+- **Returns:** `value`
+- **Throws:** — (none documented in method body)
+
+### `edges(—)`
+
+- **Returns:** `value`
+- **Throws:** — (none documented in method body)
+
+### `toJSON(—)`
+
+- **Returns:** `value`
+- **Throws:** — (none documented in method body)
+
+### `merge(remote)`
+
+- **Returns:** `value`
+- **Throws:** — (none documented in method body)
+
+### `ready(—)`
+
+- **Returns:** `Promise`
+- **Throws:** — (none documented in method body)
+
+### `getStats(—)`
+
+- **Returns:** `object`
+- **Throws:** — (none documented in method body)
+
+### `close(—)`
+
+- **Returns:** `Promise<void>`
+- **Throws:** — (none documented in method body)
+
+## Events
+
+| Event | Payload |
+|-------|---------|
+| `closed` | no payload |
+| `decay` | pruned |
+| `edge` | edge |
+| `merge` | updated |
+
+## getStats()
+
+Returns `{ ...this._stats }` — typically `ops`, `errors`, and module-specific counters (`created`, `relays`, `open`, `peers`, etc.).
+Library-only modules may include `mode: 'local'`.
+
+## Errors
+
+Stable message substrings: see [`../_shared/ERROR_CODES.md`](../../_shared/ERROR_CODES.md).
+
+## P2P
+
+When `topic` is set, `ready()` joins Hyperswarm and opens Protomux `trust-graph/v1`.
+
+## Testing
+
+```bash
+npm install && npm test
+```
+
+Integration: [`../../real_tests/integration/trust-graph-two-node.js`](../../../real_tests/integration/trust-graph-two-node.js)

trust-security/hyper-p2p-trust-graph/docs/architecture.md

@@ -0,0 +1,43 @@
+# Architecture: hyper-p2p-trust-graph
+
+**Category:** Trust & security
+
+```mermaid
+flowchart LR
+  App[Application] --> Mod[HyperP2PTrustGraph]
+  Mod --> Mux[Protomux trust-graph/v1]
+  Mux --> Swarm[Hyperswarm]
+```
+
+## Sequence (P2P)
+
+```mermaid
+sequenceDiagram
+  participant App
+  participant Mod as Module
+  participant SW as Hyperswarm
+  participant Peer
+  App->>Mod: ready(topic)
+  Mod->>SW: join(topic)
+  SW->>Peer: connection
+  Mod->>Peer: gossip / Protomux
+  Peer-->>Mod: onmessage
+  Mod-->>App: emit(event)
+```
+
+## Wire messages
+
+| type | fields | direction | behavior |
+|------|--------|-----------|----------|
+| `edge` | edge | gossip | Handled in onmessage / gossipSend |
+
+## State model
+
+- In-memory `Map` / `Set` structures for hot path
+- Optional Hyperbee/Hypercore persistence when `storageDir` or `memoryOnly` is configured
+- `close()` tears down swarm, timers, and clears ephemeral state
+
+## Composition
+
+Composes with: `hyper-p2p-attestation-chain`, `hyper-p2p-reputation-system`.
+

trust-security/hyper-p2p-trust-graph/examples/basic.js

@@ -0,0 +1,10 @@
+require('bare-process/global')
+const { HyperP2PTrustGraph } = require('../index.js')
+
+async function main () {
+  const g = new HyperP2PTrustGraph()
+  g.addEdge('alice', 'bob', 0.95)
+  console.log('trust', g.trustScore('alice', 'bob'))
+  await g.close()
+}
+main().catch(console.error)

trust-security/hyper-p2p-trust-graph/index.js

@@ -0,0 +1,133 @@
+require('bare-process/global')
+const EventEmitter = require('bare-events')
+const b4a = require('b4a')
+const { initModuleSwarm, gossipSend } = require('../../_shared/p2p-bare.js')
+
+const PROTOCOL = 'trust-graph/v1'
+
+class HyperP2PTrustGraph extends EventEmitter {
+  constructor (opts = {}) {
+    super()
+    this._stats = { ops: 0, errors: 0 }
+
+    this.topic = opts.topic || null
+    this.keyPair = opts.keyPair || require('hypercore-crypto').keyPair()
+    this.peerId = b4a.toString(this.keyPair.publicKey, 'hex')
+    this.decay = opts.decay ?? 0.95
+    this.maxDepth = opts.maxDepth ?? 4
+    this._edges = new Map()
+    this.swarm = null
+    this._peerMsgs = null
+  }
+
+  _edgeMap (from) {
+    const k = typeof from === 'string' ? from : b4a.toString(from, 'hex')
+    let m = this._edges.get(k)
+    if (!m) {
+      m = new Map()
+      this._edges.set(k, m)
+    }
+    return m
+  }
+
+  addEdge (from, to, weight = 1) {
+    const f = typeof from === 'string' ? from : b4a.toString(from, 'hex')
+    const t = typeof to === 'string' ? to : b4a.toString(to, 'hex')
+    const w = Math.max(0, Math.min(1, Number(weight)))
+    const edge = { from: f, to: t, weight: w, at: Date.now() }
+    this._edgeMap(f).set(t, edge)
+    if (this._peerMsgs) gossipSend(this, { type: 'edge', edge })
+    this.emit('edge', edge)
+    return edge
+  }
+
+  decaySweep () {
+    let n = 0
+    for (const [, targets] of this._edges) {
+      for (const [to, edge] of targets) {
+        edge.weight *= this.decay
+        if (edge.weight < 0.01) {
+          targets.delete(to)
+          n++
+        }
+      }
+    }
+    if (n) this.emit('decay', { pruned: n })
+    return n
+  }
+
+  trustScore (from, to) {
+    const start = typeof from === 'string' ? from : b4a.toString(from, 'hex')
+    const goal = typeof to === 'string' ? to : b4a.toString(to, 'hex')
+    if (start === goal) return 1
+    const queue = [{ node: start, score: 1, depth: 0 }]
+    const visited = new Set([start])
+    let best = 0
+    while (queue.length) {
+      const { node, score, depth } = queue.shift()
+      if (depth >= this.maxDepth) continue
+      const edges = this._edgeMap(node)
+      for (const [target, edge] of edges) {
+        const next = score * edge.weight * this.decay
+        if (target === goal) best = Math.max(best, next)
+        if (!visited.has(target) && next > 0.05) {
+          visited.add(target)
+          queue.push({ node: target, score: next, depth: depth + 1 })
+        }
+      }
+    }
+    return best
+  }
+
+  edges () {
+    const out = []
+    for (const [, m] of this._edges) {
+      for (const edge of m.values()) out.push(edge)
+    }
+    return out
+  }
+
+  toJSON () {
+    return { edges: this.edges(), decay: this.decay }
+  }
+
+  merge (remote) {
+    if (!remote || !remote.edges) return 0
+    let n = 0
+    for (const edge of remote.edges) {
+      const cur = this._edgeMap(edge.from).get(edge.to)
+      if (!cur || edge.at > cur.at) {
+        this._edgeMap(edge.from).set(edge.to, edge)
+        n++
+      }
+    }
+    if (n) this.emit('merge', { updated: n })
+    return n
+  }
+
+  async ready () {
+    if (this.swarm || !this.topic) return this
+    await initModuleSwarm(this, {
+      keyPair: this.keyPair,
+      topic: this.topic,
+      protocol: PROTOCOL,
+      onmessage: (data) => {
+        if (data && data.type === 'edge' && data.edge) this.merge({ edges: [data.edge] })
+      }
+    })
+    return this
+  }
+
+
+  getStats () {
+    return { ...this._stats }
+  }
+
+  async close () {
+    if (this.swarm) await this.swarm.destroy().catch(() => {})
+    this.swarm = null
+    this.emit('closed')
+  }
+}
+
+module.exports = { HyperP2PTrustGraph, PROTOCOL }

trust-security/hyper-p2p-trust-graph/package.json

@@ -0,0 +1,23 @@
+{
+  "name": "hyper-p2p-trust-graph",
+  "version": "0.3.1",
+  "description": "Transitive trust graph with decay for Bare/Pear P2P.",
+  "main": "index.js",
+  "type": "commonjs",
+  "license": "Apache-2.0",
+  "scripts": { "test": "brittle-bare test/test.js" },
+  "dependencies": {
+    "bare-events": "^2.8.0",
+    "bare-process": "^4.4.0",
+    "b4a": "^1.6.7",
+    "hypercore-crypto": "^3.0.0",
+    "protomux": "^3.0.0",
+    "compact-encoding": "^2.0.0"
+  },
+  "peerDependencies": { "hyperswarm": "^4.0.0", "bare": ">=1.0.0" },
+  "devDependencies": { "brittle": "^3.0.0" },
+  "imports": {
+    "process": { "bare": "bare-process", "default": "process" },
+    "events": { "bare": "bare-events", "default": "events" }
+  }
+}

trust-security/hyper-p2p-trust-graph/test/test.js

@@ -0,0 +1,45 @@
+require('bare-process/global')
+const test = require('brittle')
+const { HyperP2PTrustGraph } = require('../index.js')
+
+test('trust-graph: edge and score', async (t) => {
+  const g = new HyperP2PTrustGraph()
+  g.addEdge('a', 'b', 0.9)
+  g.addEdge('b', 'c', 0.8)
+  t.ok(g.trustScore('a', 'c') > 0)
+  await g.close()
+})
+
+test('trust-graph: merge', async (t) => {
+  const a = new HyperP2PTrustGraph()
+  const b = new HyperP2PTrustGraph()
+  a.addEdge('x', 'y', 1)
+  b.merge(a.toJSON())
+  t.ok(b.trustScore('x', 'y') > 0)
+  await a.close()
+  await b.close()
+})
+test('hyper-p2p-trust-graph: close without leak', async (t) => {
+  const m = new HyperP2PTrustGraph()
+  await m.close()
+  t.pass()
+})
+test('hyper-p2p-trust-graph: validation rejects invalid input', async (t) => {
+  const m = new HyperP2PTrustGraph()
+  try {
+    if (typeof m.addNeighbor === 'function') m.addNeighbor(null)
+    else if (typeof m.buildCircuit === 'function') m.buildCircuit([])
+    else if (typeof m.grant === 'function') m.grant(null, -1)
+    else if (typeof m.enqueue === 'function') m.enqueue('bad', null)
+    else if (typeof m.reportSample === 'function') m.reportSample(null, -1, -1)
+    else if (typeof m.fanout === 'function') m.fanout(null, 0)
+    else if (typeof m.probe === 'function') m.probe(null)
+    else if (typeof m.resolve === 'function') m.resolve(null)
+    else if (typeof m.acquire === 'function') m.acquire(null)
+    else throw new Error('no validation hook')
+    t.fail('expected throw')
+  } catch (err) {
+    t.ok(err instanceof Error)
+  }
+  await m.close()
+})