Context
The ERC-8004 reputation registry contract is intentionally minimal and permissionless — that's by design. The spec places all hardening, filtering, and aggregation at the indexer level, not the contract level.
Three contract-level issues (#11, #12, #13) were opened and closed after recognizing they targeted the wrong layer. This issue consolidates all three concerns at the correct layer: the indexer.
Clarity's inability to loop dynamically already makes get-summary() an indexer concern (our implementation uses fixed PAGE_SIZE folds as a workaround). The indexer is where we make the raw on-chain data meaningful and production-safe.
What the indexer needs to handle
1. Sybil filtering
- Track reviewer identities: does the reviewer own an ERC-8004 identity NFT?
- Weight feedback by reviewer reputation (Web of Trust model) — established agents' reviews carry more weight than brand-new addresses
- Flag clusters of addresses that register and give feedback in rapid succession
- Support the spec's feedback pre-authorization model for higher-trust interactions
2. Value normalization
- Normalize all feedback to WAD (18-decimal) for consistent comparison
- Bound displayed scores to 0–5 range — outliers beyond this range should be flagged/excluded from aggregated views
- Handle the
decimals >= 18 pass-through edge case in normalize-to-wad
- Detect and flag extreme values that would distort averages
3. Rate limiting
- Track submission frequency per (client, agent-id) pair
- Flag rapid-fire feedback from a single client
- Detect revoke-and-resubmit patterns (score manipulation)
- Detect coordinated withdrawal attacks (mass revocation in a short window)
4. Tag moderation
- Index tag1/tag2 for searchable reputation categories
- Flag abusive or misleading tags
- Aggregate tag frequency for agent profiles (e.g., "fast-inbox-responder" appears 5 times)
5. Smarter get-summary()
- Filtered aggregation by client addresses, tags, time windows — everything the spec's
getSummary(agentId, clientAddresses[], tag1, tag2) describes but Clarity can't do efficiently
- Weighted averages based on reviewer trust scores
- Time-decay: recent feedback weighted more heavily than old feedback
- Exclude revoked feedback from active summaries
Architecture considerations
- Event-driven: Subscribe to SIP-019 print events (
NewFeedback, FeedbackRevoked, ResponseAppended) from the reputation registry contract
- Storage: Could use D1 (SQLite), Postgres, or a purpose-built index
- API: Expose filtered/aggregated reputation data that the platform UI consumes instead of raw contract reads
- Real-time: Process new blocks as they arrive, update aggregates incrementally
Why this matters
The contract stores the immutable audit trail. The indexer makes it trustworthy. Without the indexer, the reputation system is gameable at ~0.005 STX per fake review. With it, we stay 100% ERC-8004 compliant while being production-hardened.
Replaces: #11 (closed), #12 (closed), #13 (closed)
Context
The ERC-8004 reputation registry contract is intentionally minimal and permissionless — that's by design. The spec places all hardening, filtering, and aggregation at the indexer level, not the contract level.
Three contract-level issues (#11, #12, #13) were opened and closed after recognizing they targeted the wrong layer. This issue consolidates all three concerns at the correct layer: the indexer.
Clarity's inability to loop dynamically already makes
get-summary()an indexer concern (our implementation uses fixed PAGE_SIZE folds as a workaround). The indexer is where we make the raw on-chain data meaningful and production-safe.What the indexer needs to handle
1. Sybil filtering
2. Value normalization
decimals >= 18pass-through edge case innormalize-to-wad3. Rate limiting
4. Tag moderation
5. Smarter get-summary()
getSummary(agentId, clientAddresses[], tag1, tag2)describes but Clarity can't do efficientlyArchitecture considerations
NewFeedback,FeedbackRevoked,ResponseAppended) from the reputation registry contractWhy this matters
The contract stores the immutable audit trail. The indexer makes it trustworthy. Without the indexer, the reputation system is gameable at ~0.005 STX per fake review. With it, we stay 100% ERC-8004 compliant while being production-hardened.
Replaces: #11 (closed), #12 (closed), #13 (closed)