An experimental open-source tool called Vouch is testing whether maintainers can manage project participation through explicit community trust instead of treating every contribution as equally credible. Created by Mitchell Hashimoto, the system requires people to be vouched for before they can interact with project areas selected by its operators. It also supports denouncements that can be used to block participation.
Vouch does not dictate who deserves either status. Each adopting community defines who may approve or denounce someone, which actions require approval and what consequences follow. That makes the project a general policy mechanism rather than a universal reputation score. Its implementation is designed to work with any software forge, while providing ready-made integration for GitHub through actions and a command-line interface.
The trust list is stored in one plain-text file using a minimal format called Trustdown, with the usual filename `VOUCHED.td` or `.github/VOUCHED.td`. Hashimoto says the format can be parsed with standard POSIX tools or common programming languages without adding libraries. A formal specification may come later, after real-world use has stabilized the design.
The command-line component is implemented as a Nushell module. Its status check uses distinct exit codes for vouched, denounced and unknown accounts. For GitHub, it can obtain credentials from the `GITHUB_TOKEN` environment variable or from the GitHub CLI. The supplied actions can check a contributor when an issue or pull request is opened and then allow, skip or close the interaction according to project policy.
Maintainers can also manage status through issue comments. By default, collaborators with admin, maintain, write or triage authority can use configurable keywords to vouch for or denounce a person. Projects may instead name specific managers in a separate trusted list. Bots and existing collaborators can be skipped, preserving normal workflows for already recognized participants.
Hashimoto presents the experiment as a response to falling submission costs. In his account, contributing historically required enough familiarity and effort to filter out much low-quality work. Code-generating tools can now produce plausible submissions without demonstrating equivalent understanding, increasing review pressure on maintainers. Vouch seeks to make the trust that already exists in open-source communities visible and enforceable.
The project draws on a related approach used by the Pi project and is being tried in Ghostty. Its main trade-off is social rather than technical: explicit gates may reduce unwanted workload, but their fairness depends entirely on transparent local rules and responsible managers. Hashimoto describes the system as experimental, and feedback from those early deployments will determine how both the software and its proposed trust-file format develop.
