Reputation systems in decentralized networks — Nostr, Bluesky, Farcaster, all of them — face the same structural problem. They aggregate trust scores linearly. Take the average. Weight by recency. Maybe normalize. But trust is not a linear quantity. It has algebraic structure that linear averaging systematically destroys.
Three properties of real trust aggregation violate linear averaging:
We need an algebra that respects all three. It exists. It comes from an unexpected place: thermodynamics.
Marcolli and Thorngren (2014) introduced an algebraic structure where addition is replaced by an entropy-optimized minimum and multiplication distributes over it. The thermodynamic semiring defines a new way to combine two values:
where S is the Rényi H₂ entropy:
The minimization finds the optimal mixing proportion p ∈ [0,1] that balances two competing forces: the desire to pick the better (lower) value, and an entropy bonus that rewards mixing. The temperature parameter β controls the tradeoff.
Key properties of this operation:
Low β (cold) = strict. Only strong, clear signals survive aggregation. The entropy bonus is small, so the operation approaches plain min(x,y). High β (hot) = permissive. The entropy bonus is large, so even weak signals contribute. The operation approaches the arithmetic mean.
From biological signaling theory (Grafen 1990): the weight a signal deserves should reflect its cost structure. A peacock’s tail is credible precisely because it is expensive. A cheap signal — a tweet, a self-description — is credible only when the cost of lying is high relative to truth-telling.
The commitment multiplier follows the log-likelihood ratio:
where LR(c) is the likelihood ratio of observing signal c under honest versus dishonest behavior, and α = 0.065 is derived from equilibrium conditions in the Grafen model. Four natural classes emerge:
| Class | Example | LR | m(c) |
|---|---|---|---|
| Self-assertion | free text claim | ≈ 1.0 | 1.000 |
| Staked claim | reputation at risk | ≈ 3.0 | 1.071 |
| Economic proof | Lightning payment_hash | ≈ 10.0 | 1.150 |
| Cryptographic proof | verifiable computation | ≈ 50.0 | 1.254 |
The differences look small — 7% between free text and staked reputation, 25% for cryptographic proof. But these multipliers compound across aggregation paths. After five hops through the trust graph, a chain of cryptographic proofs outweighs a chain of self-assertions by a factor of (1.254/1.000)5 ≈ 3.1×. Sybil rings, which can only produce self-assertions, are naturally suppressed.
The full reputation score applies commitment class weights before thermodynamic aggregation. Each edge in the trust graph carries a raw trust value t ∈ [0,1] and a commitment class c. The weighted trust is t’ = t · m(c). Then the thermodynamic semiring aggregates these weighted values along the graph.
The visualization below takes the trust graph from Section II, applies the commitment weights from Section III, and compares the final score against naive linear averaging.
Non-associativity means aggregation order is protocol-level. You cannot compute reputation in arbitrary order and expect consistent results. The protocol must specify the aggregation path — depth-first from the querier, breadth-first by hop count, or some other canonical traversal. Different orders yield different scores. This is not a bug. It reflects the genuine path dependence of trust propagation.
Temperature β is a per-relay parameter. Strict relays can set low β for higher Sybil resistance: only strong, diverse attestation chains survive the cold. Permissive relays set high β, welcoming newcomers but accepting more noise. This creates a natural spectrum from high-trust curated spaces to open public squares, controlled by a single parameter.
Commitment classes create natural Sybil barriers. At equilibrium, paid attestations dominate free ones because the commitment multiplier compounds across hops. A Sybil operator who can manufacture a thousand free attestations still scores below a single chain of five genuine cryptographic proofs. The cost of faking economic or cryptographic commitment scales linearly; the benefit of honest commitment compounds geometrically.
This framework provides the mathematical foundation for the NIP-XX Agent Reputation Attestations protocol. Kind 30085 events carry both a trust value and a commitment class tag. Relays implementing the thermodynamic semiring can aggregate these events using the ⊕β operation, with β as a relay-configurable parameter. The commitment class multipliers follow the Grafen formula with α = 0.065.
See also: Hodge Decomposition of Trust (detecting Sybil rings via curl), Cheeger’s Inequality (spectral gap and bottleneck cuts), Commitment Classes (full taxonomy), Trust Tensor (Tucker decomposition).