VEX Issuer Directory and Trust

Issuer trust is a first-class input to VEX decisioning in VEX Lens. The issuer directory defines who a statement is from, how its identity is verified, and how much policy should weigh it.

Audience: operators and policy authors configuring which VEX publishers VEX Lens trusts, and at what confidence. For the consensus algorithm that consumes these weights, see consensus-overview.md.

Issuer Identity

An issuer can be identified by:

• Stable provider IDs — connector/provider identifiers supplied by Excititor.
• Cryptographic identity — certificate chain, key identifiers, and transparency inclusion proof, when available.

Tenants may define allowlists for acceptable issuer identities and map issuers into trust tiers.

Trust Tiers and Weights

Trust is commonly expressed as:

• Tier label (e.g., vendor, distro, internal, untrusted)
• Weight/confidence used by consensus/policy to break ties and set posture
• Verification requirements (e.g., signature required for not_affected gating)

Offline Trust

Offline deployments must be able to verify issuer identity without network access:

• Trust roots and allowlists are bundled in the Offline Kit
• Signature verification and transparency proofs are evaluated against bundled material

References

• VEX Consensus Guide
• Excititor architecture — raw VEX ingestion and provenance hints
• VEX Lens architecture — consensus inputs, storage, and trust weighting
• Issuer Directory owner manifest