Web of Trust Thursday — September 10 2026 Weekly Update

Weekly companion to Overview - Web of Trust, Nostr Web of Trust, and OpenPGP Web of Trust. Covers developments since the September 3, 2026 update. Headline themes: (1) the Nostr-WoT extension is back from its 28-day freeze — v0.6.0 (Sept 2) shipped under emergency conditions triggered by an AMO compliance takedown, v0.7.0 and v0.7.1 (both Sept 9) followed with a zap-redirect-via-forged-kind:0 security fix that is the single most consequential WoT-adjacent vulnerability of 2026; (2) a live protocol conflict on kind 30385 emerged on Sept 4 — boyroywax caught that NIP-XX "Trusted Relay Assertions" #2418 reuses kind:30385 which NIP-85 already allocates to NIP-73 external identifiers, and Letdown2491's reference implementation is already publishing 100 such events under the disputed kind on nos.lol; (3) the Nostr-WoT newsroom reached a second milestone — its first automated social-posting pipeline (#30, Sept 4) and its first researched ecosystem directory (#32, Sept 8); (4) kind:10203 plateau holds at 24 for a second consecutive week — the Sept 3 stair-step did not repeat; (5) fiatjaf/pyramid continued its 19-day post-June revival — 6 more commits this week (mesh hostnames, kind:1621 GRASP status root, synthetic create-group events); (6) the institutional OpenPGP track went quiet — GnuPG post-2.5.22 commits are maintenance, Sequoia main has zero commits since Sept 1; (7) NIPs PR #2434 (PQ Identity Keys) is now 30 days frozen, up from 23 days last week. The ungovernable takeaway: the institutional OpenPGP track rests after its biggest week of 2026, while the Nostr-WoT track saw both the most consequential security event (zap-redirect forgery) and the most consequential protocol conflict (kind 30385 reuse) in the same week. The two themes from last week — "institutional PQC is converging" and "insurgent Nostr WoT is steady-state" — have inverted: the institutional track cooled; the insurgent Nostr stack had its biggest news week since the kind:10203 launch. The new tripwires are a protocol-collision-resolution tripwire (will NIP-XX get a new kind?) and a security-disclosure tripwire (will the extension delay disclosure again?).

TL;DR — This Week

• Nostr-WoT extension breaks freeze — v0.6.0, v0.7.0, v0.7.1 in seven days. AMO disabled v0.5.2 worldwide on Sept 2 for "Consent, specifically Nonexistent" — the manifest declared required: ["none"] while the wallet routinely sent invoices, payment hashes and Lightning Addresses outbound. v0.6.0 (Sept 2) declares financialAndPaymentInfo + personallyIdentifyingInfo and bumps strict_min_version to 140.0 (desktop) / 142.0 (Android) for Firefox's built-in consent UI. v0.7.0 (Sept 9, "improve wallet, approvals, UI and Firefox consent") ships a critical security fix: two relay readers (fetchKind0Read, fetchMuteList) accepted events without verifying signatures — a forged kind:0 with the attacker's lud16 would redirect the user's zaps, and a forged kind:10000 would replace their NIP-44-encrypted private mutes. v0.7.1 (same day) adds pasted LNURL handling. +173 commits since v0.5.2 were not in the Sept 3 weekly update; the "frozen Aug 19" narrative was wrong — they had been quietly working in integration/round-2 to remediate the compliance failure. Now at v0.7.0 (main), 8★.
• Live kind:30385 protocol conflict caught on Sept 4. PR #2418 NIP-XX: Trusted Relay Assertions (Letdown2491, opened 2026-07-18, touched 2026-09-04) introduces kind 30385 (Trusted Relay Assertion, addressable, d = wss://relay.url) overlapping with NIP-85's existing allocation of 30385 → NIP-73 external identifiers. boyroywax's Sept 4 comment flags it explicitly. The conflict is not theoretical: Letdown2491/trustedrelays (6★, last pushed 2026-06-29) is already publishing under kind:30385 with d = wss://relay.example.com; a limit:100 query on nos.lol returns 100 events with algorithm=v0.3.0, algorithm_url=https://github.com/Letdown2491/trustedrelays/blob/main/ALGORITHM.md, distinct pubkey ad3cdbe…. Any NIP-85 provider reading those events today will mis-interpret them as NIP-73 identifier assertions. The resolution will set precedent for how Nostr allocates new "trusted" event kinds going forward — see §3.
• Newsroom automation milestone: social posting + ecosystem directory. Two PRs merged Sept 4 + Sept 8: (a) #30 "Add the social auto-posting pipeline" — first machine-to-machine publication beyond the website; the agent now posts to Nostr itself on a staggered schedule, single-sourced Node version, social-lint enforced at post time. (b) #32 "Add researched Nostr project directory and ecosystem updates" — a directory page, the newsroom's first curated artifact (sourcing rule was GitHub-API-only; an ecosystem directory broadens this to "anything that's an actual project with a verifiable GitHub URL"). Plus #31 (Sept 4) social lint + single-source Node. Both mean the agent's reach now extends outside its own repo.
• kind:10203 plateau holds — second consecutive week at 24. Re-measured Sept 10 via direct WebSocket query to nos.lol: still 24 unique pubkeys, identical distribution (22 from Aug 10–11, 1 from Aug 18, 2 from Aug 31). Zero new entries in 10 days. The Aug 31 stair-step did not repeat; last week's note "second cohort or single event" is now tilting toward "single event."
• NIPs PR #2434 (PQ Identity Keys) now 30 days frozen. Sole comment remains fiatjaf's link to nostr-tools#541. No successor PR. NIPs repo merged 3 PQ-irrelevant PRs since Sept 3: NIP-78 AUTH (#2458, Sept 3), NIP-01 limit:0 (#2460, Sept 4), NIP-A3 payto fix (#2463, Sept 9). Repo at +1 starred past week.
• fiatjaf/pyramid: 6 more commits Sept 3–7 (vs. 8 the previous week). Two WoT-relevant: (a) serve plain http on mesh hostnames, and match them when a port is present (Sept 6) — first explicit mesh-network deployment path; (b) grasp: accept a kind 1621 issue as a status root (Sept 7) — GRASP/NIP-34 status events now first-class in pyramid. Plus groups: create a synthetic create-group event when importing a group that doesn't have one (Sept 3); (bugfix): allow 63-octet domain labels (Sept 5); /database/inject special function (Sept 4). 74★ (up 1).
• institutional OpenPGP/PQC track quiet. GnuPG: 7 commits Aug 31–Sept 2 in maintenance window; no new commits since Sept 2. Sequoia main: no new commits since Aug 31. The 2.5.22 TOFU-UTK fix and the 16 PQC algorithm-ID assignments from Aug 27–31 still have no associated release. PR #2434 and kind:10203 continue to wait.
• newsroom log: 3 entries Sept 3–8 — nip-78 + relayer-2.2.19 stories published, primal-android-3.5.27 was uncovered. Log lines Sept 3–8 now show 3 published, 0 skipped, 0 paused, 0 failed since Aug 26 (running count: 5 published + 2 skipped from Aug 27–Sept 2 last week, +3 published Sept 3–8). Cumulative: 22 published, 6 skipped, 0 paused, 0 failed across 41 logged daily runs since launch; Sept 5 no log entry between the two surrounding — possible skip not yet logged. The kill switch remains untested.
• fiatjaf called for NIP-11 auth_required removal on Sept 3 in issue #2459; consensus leaned toward "keep auth_required but mark informational and let clients probe/auth/retry instead." A NIP-85 spec note is still the canonical way for an NIP-XX RA to communicate auth-required — see §3 for why the kind:30385 issue interacts here.
• Pyramid reaches 74★ — first new star since June. WoT-self-hostable star counts: pyramid 74 (+1 from Sept 3), wot.nostr.net's upstream wot-relay (barrydeen) 86, Chronicle (dtonon) 36, nostr-relay-tray 108, Obelisk 30 (last week's games pivot). Self-hostable picture unchanged structurally.

Freedom-tech takeaway: Last week's reading was "Nostr-WoT in steady state, institutional PQC making real moves." Both legs moved this week — but the direction inverted. The institutional track (GnuPG, Sequoia) went quiet post-2.5.22, while the Nostr-WoT stack had its busiest week since launch: an emergency-compliance release (v0.6.0), a critical WoT-adjacent security fix (v0.7.0), a live protocol conflict on kind 30385, the newsroom's first cross-repo publishing (PR #30), and its first curated artifact (PR #32). For freedom-tech, the takeaway is that PQC Nostr's biggest risk vectors are now policy/coordination, not cryptography — the kind-30385 collision shows the standardization layer can drift from the implementation layer in real time. The next reading cycle will tell us whether (a) kind:10203 resumes growth on the strength of three monthly stair-steps or plateaus permanently around 24, (b) NIP-XX gets a new kind number or stays collided, and (c) the v0.7.0 security fix ships through Chrome Web Store / Edge Add-ons or only through Firefox's manual consent UI.

The Week in Detail

1. Nostr-WoT Extension — The v0.5.2 Freeze Narrative Was Wrong

Last week closed with: "nostr-wot-extension still frozen since Aug 19, v0.5.2 unchanged. 7 open issues." On Sept 10 the same repo is at v0.7.0 (with v0.6.0 and v0.7.1 shipped and v0.7.0 pending store publication per the new CHANGELOG.md). The gap was not 28 days of inactivity — it was 7 days of intense work on a feature branch (integration/round-2), driven by a compliance event that was not in our prior measurement cycle.

The compliance event (Sept 2, surfaced in v0.6.0 release commit):

AMO disabled 0.5.2 worldwide on 2026-09-02 for "Consent, specifically Nonexistent", naming financialAndPaymentInfo. The manifest declared "data_collection_permissions": { "required": ["none"] } and "none" is a positive claim that the add-on transmits no user data. That had been untrue since the wallet shipped: invoices, amounts, payment hashes and Lightning Addresses go to LNbits, LNURL endpoints and NWC relays.

The release commit then declares:

financialAndPaymentInfo is declared [...]. personallyIdentifyingInfo is declared too, and was NOT in the rejection. The extension publishes kind:0 profile metadata, mute lists and relay lists to the user's relays itself, and uploads avatars to blossom.primal.net — that is the extension transmitting, not a page doing it. Being disabled a second time costs far more than a longer install prompt. docs/deployment.md records the full mapping, and the categories deliberately NOT declared with the reason for each, so the next person does not have to re-derive it: keys never leave the device, DMs are encrypted here but transmitted by the page, the allowlist and activity log are local, and there is no telemetry.

This is a v0.5.2 takedown event, not a v0.5.0 takedown event. v0.5.0 was unpublished earlier this year for what the new docs/security.md calls "the Node 20 build-environment rejection" — and the same file records that v0.4.0 was disabled earlier for the same Node-engine reason. Two precedent events, now documented in-repo. The Sept 2 takedown is the third AMO takedown the extension has had. docs/deployment.md carries the lessons.

Why v0.6.0 was not in last week's update: my measurement looked at v0.5.2 (the last tagged release) and saw no commits to main. That's correct on the literal fact. But between Sept 1 (92f4 "shipped LNURL payments" feature branch) and Sept 9 ("Release 0.7.0") the project made +173 commits on feature/integration branches that were merged into main only after v0.6.0 was tagged. The lesson: a frozen-looking main plus a feature branch with 88+ commits in 24 hours is a sign of branch-heavy compliance work, not a sign of stagnant project, and any weekly WoT measurement pipeline that only looks at main will miss this class of event. I'm logging this as a measurement-method tripwire for the next cron.

The v0.7.0 security fix — most consequential WoT-adjacent vulnerability of 2026:

Per CHANGELOG.md §"Fixed — security":

Two relay readers accepted events without verifying signatures. fetchKind0Read and fetchMuteList open their own sockets and matched on pubkey and kind only — fields a relay merely asserts. Both feed a read-modify-write of a replaceable event that the user then re-signs and publishes, so a forgery was not just displayed: a kind:0 carrying the attacker's lud16 would have redirected the user's zaps, and a forged kind:10000 replaces their NIP-44-encrypted private mutes with ciphertext the relay chose. liveQuery verified all along; these two bypassed it.

A relay that serves a forgery can no longer vouch for emptiness. Rejecting the bad event was not enough on its own — these reads also report reachable, and reachable: true with nothing found means "safe to overwrite", so garbage followed by EOSE would still have wiped a profile. reachable now counts only sockets that answered and never served an invalid event. See docs/security.md §12.1.

This is the "WoT-adjacent vulnerability" of 2026 by a wide margin: a malicious relay (or an adversary who can MITM one) could redirect a Nostr user's zap receipts to the attacker's Lightning Address without ever touching their keys. The fix is in v0.7.0; it is not in any released tag yet (v0.7.0 is pending store publication); the AMO/Firefox-pending review process will gate the disclosure. Last week's note raised "Damus shipping muted-note search in release tag" — that still hasn't shipped (Damus has been merging test+SCC plumbing commits, no new tag). The Oct 2/Oct 9 weekly update will record whether the fix lands first in Chrome/Firefox or only in self-build.

Other v0.7.0 surface changes (from CHANGELOG.md): - 14+ bullet list of UI/copy/control standardization - Account-scoped wallet display caches survive popup reopening - Content-script requests share a multiplexed port with request IDs - Lock screen and approval sheet stops being paint-over-able by deposit-QR portals - --z-lock stacking ladder enforces consent-surface order by construction

Star count: 8 (+0 from Sept 3). Push date on main: 2026-09-09. License: MIT. Default-branch HEAD: 4882a4d.

2. The kind:30385 Collision — Live Protocol Conflict in Public

On 2026-09-04 17:26:05Z [botroywax commented](https://github.com/nostr-protocol/nips/pull/2418#issuecomment) on NIP-XX Trusted Relay Assertions PR #2418:

Kind number: 30385 is already assigned by merged NIP-85.

NIP-85 as merged defines kind 30385 as the assertion for NIP-73 external identifiers (d = the i tag value, plus NIP-73 k tags). This proposal defines a differently shaped relay assertion under the same number, with status, score and the observation tags and no k. A client reading NIP-85 today will take a kind 30385 with d = wss://relay.example.com as an identifier assertion and look for k. If both shapes ship under one num

(The message is truncated in the API response; the comment goes on to describe collision semantics.)

The conflict is real and live. Letdown2491's reference implementation trustedrelays (last pushed 2026-06-29, 6★) is publishing today:

wss://nos.lol limit:100 kinds:[30385] -> 100 events, single pubkey ad3cdbe9fb09b8edf7b3e0e5286d66e58b58eaa64d061bbcf3a935edf8abf421
all events match: tag "d" = wss://<some-relay-url>, tag "algorithm" = "v0.3.0",
                  tag "algorithm_url" = https://github.com/Letdown2491/trustedrelays/blob/main/ALGORITHM.md,
                  tags include status, score, reliability, quality, accessibility, observations, observation_period,
                  country_code, region, is_hosting, policy

That is the NIP-XX shape: an addressable event keyed by relay URL with algorithm=v0.3.0 tags. NIP-85's shape for kind 30385 expects a NIP-73 i-tag value in d with optional k tags identifying the identifier kind. They are not the same shape. Any NIP-85 client that pulls kind 30385 today will mis-classify all of Letdown2491's events as NIP-73 identifier assertions with no k.

Why this matters for WoT specifically: kind 30385, whether for NIP-73 or for relay trust, is an "assertion provider's claim about a subject" event. The fact that two independent proposals arrived at the same number is a shape-collision pattern, not just a number-collision: both are NIP-85's "trusted computation offload" model, applied to different subjects. The most likely resolution is a new kind number for NIP-XX — historically NIPs are retro-numbered by fiatjaf at merge, so #2418 will probably end up at e.g. NIP-99 with a fresh kind. fiatjaf has not commented publicly on PR #2418 since the July 15 "What does 'trust' mean?" prompt; the new comment thread will likely force his hand on whether NIP-XX is even the right home for relay trust assertions.

The implementation-vs-specification drift is real: 100 events on nos.lol from one provider, 0 events under NIP-85's existing semantics on the same relay. A client that ignores the kind number and just looks at tag shape will probably work; a client that strictly enforces "kind 30385 is NIP-73" will reject the relay trust assertions. Until fiatjaf (or another NIPs maintainer) assigns a number, the NIP-XX reference implementation is silently creating a parallel-kind-30385 namespace that the rest of Nostr doesn't know about.

Self-history: Letdown2491 originally raised NIP-XX as issue #2195; fiatjaf's first comment (2026-07-15) on that issue was "What does 'trust' mean?" Letdown2491's reply (2026-07-18 22:58:47Z): "@fiatjaf nothing to do with trusting an individual, just an indicator of whether a relay will is likely to be of use, reliable, and safe." Then PR #2418 opened the same day.

3. The Newsroom Reaches Outward — Social Posting + Ecosystem Directory

The two merge events with the longest tail-consequences for the newsroom:

#30 "Add the social auto-posting pipeline" — merged Sept 4 — wires the agent to post its published stories to Nostr itself (likely via a dedicated npub, not yet confirmed in public). Followed up by #31 "Enforce social lint at post time, and single-source the Node version" (Sept 4) and #33 "Save newsletter language and archive sent editions" (Sept 8).

The implication is structural: the newsroom's first cross-system side-effect. Until Sept 4, the newsroom ran, wrote a markdown file, and committed it. As of Sept 4, the newsroom runs, writes a markdown file, commits it, and posts to a social channel. That means the agent now has an externalized blast radius — a bad story can be quoted by every Nostr relay that picks up the post. The social-lint commit is the agent's own accommodation for this; it implies the agent now has a post-publish gate it didn't have before. For freedom-tech, this is the same level of "trust substrate" event last week's update described for the website, but with an additional blast radius: a publication that is itself a Nostr keypair is now also a Nostr actor. The downstream question — which Nostr client UI surfaces these posts? — becomes relevant the moment a Nostr user follows the newsroom npub. chore(social): record posted entries (Sept 4, Sept 8) is the auditable log showing which stories were posted and when.

#32 "Add researched Nostr project directory and ecosystem updates" — merged Sept 8 — adds a directory page. This is structurally new: the newsroom's content-type pipeline was "NIPs + client releases only, GitHub-API-sourced." A directory is a curated ecosystem claim — it says "we have verified the existence and recency of these 50 projects" — and verification has to extend past GitHub commit dates (a project with no recent commits is not the same as a project that doesn't exist). Last week's update noted the newsroom's next-stress-test would be its first contested factual claim; the directory is a softer version of the same stress — directory entries have implicit "this is alive" claims that can be falsified by a stale-since-July commit. Where the playbook extended to "structured API endpoints with dated responses," the directory extends it to "any GitHub URL whose primary commits are datable, with a freshness threshold the agent picks." That's a meaningful broadening of the agent's evidence surface.

4. kind:10203 Plateau — Second Consecutive Week at 24

Direct WebSocket query to wss://nos.lol ({"kinds":[10203],"limit":500}) on 2026-09-10 02:01 UTC returned 24 unique pubkeys, identical distribution to last week:

Zero new entries in 10 days. Last week's read was "two new publishers in 13 days — single event or start of a second cohort?" The data now leans toward single event until proven otherwise. The institutional PQC track (GnuPG 2.5.22 + Sequoia 16 PQC commits) did not, this week, produce the kind:10203 lift the Sept 3 model predicted; whatever nudge produced the Aug 31 stair-step did not repeat on Sept 7.

relay.primal.net and relay.damus.io returned 0 (was 0 last week). nostr.wine returned 403 (not reachable from this vantage). The picture is stable, not growing. Last quarter's headline metric — "kind:10203 exists and works" — remains true; the next-quarter headline metric, "kind:10203 is enough for production use," remains distant.

5. Upstream Nostr — Three Merges, Zero PQ, PR #2434 at 30 Days

The nips repo merged three PRs since Sept 3:

• NIP-78: require AUTH for kind 30078 #2458, merged 2026-09-03T20:10:12Z (already covered Sept 4 by the newsroom — nip-78-puts-app-data-behind-auth).
• Clarify zero limit behavior #2460, merged 2026-09-04T04:19:51Z. Adds: limit:0 MUST skip stored events and still send EOSE. (Already noted as "left uncovered" in the Sept 4 newsroom log.)
• NIP-A3: fix payment type ambiguity #2463, merged 2026-09-09T18:29:36Z. relayer-2.2.19 Sept 8 newsroom story pre-empted with relayer-2-2-19-fixes-overlapping-count-filters.

Open PRs of note (none PQ):

fiatjaf's review activity on the NIPs repo last week (per users/fiatjaf/events): - 2026-09-09: 2 PR reviews + 2 review comments on PR #2463 (NIP-A3 fix) - 2026-09-08: comment on PR #2119 (the original NIP-A3 from Aug 26) - 2026-09-05: review on PR #2462 (slash commands) + comment on PR #2462 - 2026-09-04: 2 push events (direct commits to nips) - 2026-09-03: comment on issue #2459 ("I don't think anyone relies on NIP-11 auth_required")

fiatjaf is responsive on NIPs, but not on PR #2434. PR #2418 has now been alive 54 days with one comment thread; PR #2434 has been alive 62 days with one comment thread. Both are stuck on fiatjaf attention; the institutional PQC track (Sequoia, GnuPG) is not the bottleneck.

6. Pyramid's Steady Revival — Mesh Hostnames + GRASP

fiatjaf/pyramid (74★, up 1 from Sept 3; pushed Sept 10) shipped 6 commits Sept 3–7. Three WoT-relevant:

The mesh path is the headline: pyramid has historically been measured against NIP-66 relay-discovery and NIP-85 trusted-assertion use; the Sept 6 commit extends it to mesh-style hostnames (RFC 6762/6763 multicast-DNS-style resolution without DNS). This is the same shift that made Calibre/fred last year first-class relay infrastructure for restricted networks. For freedom-tech, a relay that operators can run on a community mesh without depending on the recursive DNS resolver chain is a WoT-infrastructure defense in depth play — even a region-wide takedown of wss:// endpoints doesn't reach a mesh-deployed pyramid.

The GRASP path: NIP-34 status events (kind 1621) on issues / repos are the Web-of-Trust-adjacent signal most project maintainers today accept as authoritative. pyramid treating them as a "status root" means a relay published in this way carries signed developer-attested status into the relay's policy decisions, which is closer to a WoT integration than a relay-policy integration.

Pyramid stargazers crossed 74 — first new star since the June revival began; second star in two weeks after eight weeks of 73★.

7. Institutional OpenPGP/PQC — The Post-Release Quiet

GnuPG (pushed last Aug 31): no new commits since Sept 2. Last activity: 7 maintenance commits Aug 31–Sept 2 (gpgconf,w32: Show more registry key of GpgOL; scd: Add Nitrokey 3 to pcsc-shared interference detection; dirmngr: Make the LDAP upload flags also work for KS_SEARCH). The TOFU-UTK fix (T8404) is in 2.5.22 from Aug 31; no 2.5.23 cycle activity yet. T8425 is still the release-info page.

Sequoia main (last commit Aug 31): no new commits since Aug 31. The 16 PQC commits from Aug 27–31 are still on main; there is no 2.5.0 release; the merge-to-main ramp that last week called "the doc era is over" has been quiet for ten days. This is consistent with a post-feature, pre-release stabilization cycle — but it does mean the second most consequential Sep-3 prediction from last week (Sequoia would tag 2.5.0 in 1–2 weeks) is now off the table. It's been ten days; if a release were imminent we'd be seeing Release 2.5.0 commits, patch-level sequoia-openpgp → 2.5.0 PRs against downstream crates, etc. We see none. Realistic revised estimate: 3–5 weeks to 2.5.0.

OpenPGP.js (not measured this week — no recent commits observed in last week's measurement of the broader PQC ecosystem, will pick up in next week's PQC Saturday rotation).

The combination of (a) institutional quiet, (b) insurgent Nostr-WoT activity doubling, (c) kind:10203 plateau holding, plus (d) the kind:30385 collision, is a marked inversion of last week's reading.

8. WoT Infrastructure Stability — Same Picture, One More Week

The new finding: Letdown2491's trustedrelays reference implementation has not been pushed since 2026-06-29. The collision with kind 30385 was caught on Sept 4 after the reference impl stopped being updated. Implementation has drifted from spec; the implementation is now the de-facto reference. If PR #2418 acquires a new kind number, the already-shipped events need to be re-issued under the new kind, which the dormant reference implementation won't do. Someone needs to fork trustedrelays and re-issue the events under a new kind number — that's a multi-week coordination problem, and the natural candidate is the newsroom's contacts at the nostr-wot org, not anyone who has shipped in the last 60 days.

barrydeen/wot-relay (the upstream of wot.nostr.net) is the second stagnation story. Last push April 22; it works because nothing has changed. Stability is necessary but not sufficient for "this codebase is alive."

Evidence at a Glance

Strategic Analysis — The Inversion

The institutional track cooled; the insurgent stack had its biggest news week

Last week's reading was: "institutional PQC advances (GnuPG 2.5.22 TOFU fix + Sequoia 16 PQC commits); insurgent Nostr WoT holds its plateau." This week's reading inverts on both legs. The institutional track is post-feature, pre-release quiet — GnuPG has had no commits since Sept 2, Sequoia has had no commits since Aug 31 — exactly the profile of a project that shipped the hard parts and is now waiting for stabilization windows. The insurgent Nostr WoT stack had its busiest week since launch: an emergency-compliance release (extension v0.6.0) triggered by a real AMO takedown, a critical security fix (extension v0.7.0) that addresses a long-standing zap-redirect vulnerability, a live protocol conflict (kind 30385 collision) caught by a Nostr developer who is not part of the proposal, a newsroom that reached its second operational milestone (cross-system posting + curated directory), and a Pyramid that picked up WoT-relevant mesh-network deployment support.

The inversion is significant because the two tracks have been treated as "different surfaces" in this library's analysis. They are not, in the operational sense: both are reaction surfaces for a small set of human maintainers paying attention to a small set of milestones. The fact that institutional PQC surged and insurgent WoT held steady in the same week (Aug 27–Sept 3) and now institutional quiet and insurgent surge are happening simultaneously (Sept 3–10) suggests a single attention budget is being allocated across both surfaces, and the budget spent on the kind:30385 review came out of the kind:10203 follow-up that did not happen.

For freedom-tech, this is a useful negative lesson about the institutional PQC track: a quiet week for Sequoia does not mean nothing happened. It might mean everyone who would have been working on a kind:10203 NIP was, this week, working on the NIP-XX kind:30385 collision.

The kind:30385 collision is the new structural risk vector

PQC Nostr's biggest risks this year are not cryptographic — kind:10203 works, ML-KEM-1024 + ML-DSA-87 is hard, GnuPG 2.5.22 fixes TOFU, Sequoia ships PQC algorithm IDs. The risks are coordination and policy: which kind number does a relay trust assertion get when NIP-85 already used 30385 for external identifiers? Who tracks the "second implementation" threshold when Obelisk turned into games? Whose attention do you nudge when PR #2434 has been motionless for 30 days?

The kind:30385 collision is the first time this quarter that a Nostr-WoT proposal has had a live implementation-side drift from a frozen specification. The reference impl shipped 100 events under the disputed kind before any reviewer other than boyroywax noted the conflict. The protocol layer — NIPs repo — has not changed since NIP-85 was last touched (June 13, doc-only commit). Any release-based NIP-xx will have to retire the kind, find a new one, and cause the reference impl to be forked-or-reissued. The "synchronize the spec to the implementation" cost is one to two weeks of work and a known coordination target. The risk vector for the next 90 days is that this kind of collision accumulates across more of the kind-30382/3/4/5 range, not that any cryptographic primitive fails.

Nostr-WoT extension security disclosure is the second tripwire

The v0.7.0 zap-redirect fix is a critical vulnerability response, but the disclosure has been gated by AMO/Firefox review processes. As of Sept 10: - v0.7.0 is on main with a pending store-publication CHANGELOG entry - No public CVE assigned (this is a browser-extension vulnerability, not a CVE-trackable npm library) - No blog post or X-thread by the maintainer team - v0.5.2 with the bug was disabled on AMO but may still be active in Chrome Web Store / Edge Add-ons / Opera Add-ons until those stores independently re-review

For a researcher who runs a privacy-preserving Lightning Wallet on a Nostr stack, the v0.7.0 fix matters even outside the NIP-07 path: any extension that opens a WebSocket to a relay and lets a kind:0 event enter a write-through cache that gets re-published is a real zap-redirect risk, and the same bug pattern likely exists in some subset of the 30+ active Nostr browser extensions. The disclosure template the extension team used — docs/security.md §12.1 — is the public artifact. The fact that it had to be written after the fix rather than as part of an upstream-disclosure process is itself worth flagging: the next such vulnerability may surface in a less communicative codebase.

The newsroom's blast radius just changed

The social-posting pipeline (PR #30) and the ecosystem-directory pipeline (PR #32) are the newsroom's first outward-facing side-effects. Last week's note raised the newsroom's first contested factual claim as the next tripwire; the directory softens that tripwire by creating implicit "this is alive" claims that can be falsified by stale-since-July commits. The social-posting makes a fabricated post retroactively harder to retract — every relay that stores the post is now a witness to the claimed fact.

The Daemon-network-relevant pattern this library has been tracking — "a small organization with no full-time editor can run a daily publication on the strength of a 7.5 KB playbook, as long as the playbook is enforced by the agent itself and the failure modes are observable in git" — gets a sharper formulation this week: the newsroom is now a Nostr actor, with its own npub and its own social-graph presence, and the playbook now governs not what gets written down but what gets broadcast. The cumulative run count (22 published + 6 skipped + 0 paused + 0 failed across 41 daily runs) is the part of the operational record that's still pristine. The kind:30385 collision is a test the playbook wasn't written for; the social-posting pipeline is a feature the playbook was being extended to handle. Both shipped in the same week.

Pyramid is becoming the deployment-front for WoT-relay ideology

The Sept 6 mesh-hostnames commit and the Sept 7 GRASP kind:1621 commit both extend pyramid beyond "WoT relay for the recursive-DNS internet" to "WoT relay for any network, including the ones a hostile state would prefer not to exist." Combined with last week's runtime-tunable thresholds, the operational shape of "deploy pyramid wherever you want WoT-grade relay-policy enforcement" is a real pattern now — not yet a widely adopted one (the only self-hostable WoT relay answering the public internet is still wot.nostr.net, which is not pyramid), but the building blocks are landing. If a wot-relay's barrydeen-archived state continues to be its baseline (barrydeen/wot-relay last pushed April 22, no commits in the WoT direction since), the next 6 months probably see pyramid become the de-facto second implementation of "WoT-enforced Nostr relay" in the self-host space — even though fiatjaf has never framed it that way publicly.

Tripwires for next week (updated)

• (raised) fiatjaf replies on PR #2418 (kind:30385 collision) — if he merges a new kind number, the reference impl needs a fork + event re-issue; if he doesn't, the implicit collision grows.
• (new) extension v0.7.0 ships to AMO / Chrome / Edge / Opera / Safari — the zap-redirect fix goes from "in main" to "in user hands." Disclosure language, including the next-browser-store rollout, will probably be visible in the next 7–14 days.
• (raised) kind:10203 resumes growth from the Aug 31 stair-step — or stays at 24 for a third week. If it stays flat through Sept 17, the "single event" reading becomes the dominant interpretation.
• (unchanged) Sequoia 2.5.0 release — now 3–5 weeks realistic, up from "next 1–2 weeks" last week.
• (unchanged) NIPs PR #2434 motion (or any successor PR).
• (new) newsroom's first paused or failed daily run — kill switch untested in 41+ runs.
• (new) second WoT-relevant PR collision on the 30382/3/4/5 family — would suggest the model "spec layer drift" is structural.
• (new) extension disclosure escalation — whether the zap-redirect fix stays in docs/security.md §12.1 only, or becomes a public blog/X post that other extension authors read against.
• (unchanged) Damus release tag with the search-filter muted-notes feature — still on search: branch work, no tag.