Skip to content

Knowledge base

Vouch in Ghostty: trust-gating open-source contributions

Ghostty merged the Vouch model in February 2026: only contributors a maintainer has explicitly vouched for may open pull requests, and denounced users are blocked. It answers floods of AI-generated contributions with explicit social trust rather than an accumulated reputation score.

Written by

Updated:

Evidence 7

Our position. We take the Vouch logic from contributors to harnesses: review cannot scale, so a named, versioned, scoped harness with a track record becomes the unit of trust. A new model version does not inherit the trust of the old harness; it earns its own (vouch the harness (opens in a new tab)).

Ghostty’s change supports that position from the open-source side. The pull request that introduced the model was opened on 3 February 2026 and merged on 15 February 2026 (ghostty-org - Introduce the Vouch/Denouncement Contribution Model, ghostty PR #10559 (opens in a new tab)). Its argument is that AI removed the natural barrier to entry that let open-source projects trust a contributor by default (Vouch announcement (opens in a new tab)).

How does Vouch gate contributions?

Vouch is a forge-agnostic, POSIX-friendly trust-gating system for OSS contributions:

  • Only vouched users may open PRs or participate in contributions
  • Maintainers vouch a user by commenting lgtm on an issue that user opened
  • Bad actors are denounced (denounce [user] [reason]) by any maintainer and blocked
  • Storage is a single flat VOUCHED file (purposely POSIX-manipulable)
  • Enforcement: Nushell CLI (vouch.nu) + GitHub Actions workflows
  • Web-of-trust vision: projects share and ingest each other’s VOUCH files

Repos:

  • github.com/mitchellh/vouch — the system itself
  • github.com/ghostty-org/ghostty/pull/10559 — first production integration
  • github.com/badlogic/pi-mono — stated inspiration

Why do maintainers need a trust gate?

The Ghostty pull request frames the problem in these words, quoted verbatim:

“the landscape has changed particularly with the advent of AI tools that allow people to trivially create plausible-looking but extremely low-quality contributions with little to no true understanding. Contributors can no longer be trusted based on the minimal barrier to entry to simply submit a change.”

“I hope that eventually projects can form a web of trust and share and ingest VOUCH files from other projects they trust in order to get a better default trust model across projects in the age of relentless AI attack.”

Is Vouch a reputation system?

No. Vouch rests on explicit social trust: someone already trusted vouches for you. It does not accumulate a score from prior activity. Trust-based contribution gating describes it accurately, and it sits closer to a web of trust or an allowlist than to Stack Overflow–style reputation points.

The distinction decides the security posture. Reputation systems are gameable, lagging, and quantitative. Trust-gating is adversarial, proactive, and qualitative — a very different security posture.

Do agents as users make pull requests obsolete?

The “Building for trillions of agents” thesis (“Make something agents want”) frames agents as future primary users of software. It supports the broader argument that human-first workflows must adapt, but it is a thesis about software design pressure, not a concrete replacement for Git, PRs, or code review. It does not argue that Git and pull requests disappear.

Is there a comparable system at Amp Code? Not on the public record. Public commentary has linked Vouch to an alleged Amp Code “reputation-based system for handling untrusted outside code contributions.” Amp Code’s own published material covers shared threads, leaderboards and secure-coding concerns, not a contribution-gating framework, and no primary source for the claim has surfaced.

Does trust-gating work inside a company?

The constraint has moved. The question is no longer whether AI can write code, it is whether an organization can absorb AI-generated code safely. Vouch answers that on the intake side: it gates who may contribute rather than reviewing what they contributed. The same logic transfers to inner-source and enterprise contribution models, where a large internal engineering org faces the same flooding problem behind the firewall.

It also pairs with the Stanford “rich get richer” finding from the AI productivity studies: weak engineering hygiene no longer only slows an AI-assisted team down, it now exposes the project to contribution flooding.

What is still open?

  • Will other high-profile maintainers adopt Vouch, turning the web-of-trust vision into reality?
  • Does this pattern migrate into inner-source and enterprise contribution models?
  • How does Vouch interact with GitHub’s own contribution-review tooling — complement or conflict?

Resources

Posts

Tools and repositories