Research Roadmap

_Questions to answer before we can publish with authority. Updated 2026-07-24._

---

Active Research Topics

1. EV Codesign Pricing & Flow (2026)

Why: The Codesign for Windows guide needs current, accurate information. The existing content has "..." as the last step.

Questions to answer:

What are current DigiCert EV codesign certificate prices (2026)?

What is the exact HSM key generation flow? The original author wrote "HSM (remember what it was)" — this needs to be documented precisely.

Has SmartScreen changed its reputation mechanics recently?

What is the current best practice for CI pipeline integration (GitHub Actions, Azure Pipelines)?

Are there cheaper/better alternatives to DigiCert now?

Sources to check:

DigiCert pricing page

Azure Key Vault / AWS KMS for EV codesign

GitHub Actions marketplace for codesign actions

Community experiences (HN, Reddit, dev.to)

Depends on: Public web research, possibly a conversation with someone who has done it recently.

---

2. State Machine Tooling Landscape (2026)

Why: The State Machines cluster needs a definitive guide. Need to understand what competitors/alternatives exist.

Questions to answer:

What is the current state of XState v5?

Are there new state machine libraries since XState?

How do people actually use state machines for agent/AI workflows in production?

What's the relationship between state machines and LLM agent frameworks (LangGraph, etc.)?

Sources to check:

XState docs, changelog

LangGraph, Vercel AI SDK

State charts vs. finite state machines vs. statecharts — what's the practical difference?

---

3. Desktop App Update Pipeline Landscape

Why: To build the Fullstack Electron series with authority.

Questions to answer:

What are the current options for Electron auto-update (electron-updater, Velopack, Sparkle, custom)?

What changed in Electron 30+ regarding updates?

What is the state of Linux packaging for Electron in 2026?

Are there new distribution channels (Microsoft Store improvements, etc.)?

---

4. Graduated Trust: Open Questions (New — 2026-07-24)

Why: The Graduated Trust essay now includes 5 explicit open questions. These must be researched before the Seed Protocol RFC can be written with authority.

Questions to answer:

Reputation calibration: How severe should the cost be for vouching for someone malicious? What's the decay function? Proportional to the damage, or capped? Need to survey existing reputation systems (EigenTrust, Advogato, Google PageRank) for calibration guidance.

Sybil resistance at the edges: What prevents a cluster of mutually-vouching fake accounts? Can we adapt the Advogato "seed" concept? What graph-theoretic properties resist Sybil attacks (e.g., max-flow/min-cut approaches)?

Privacy: A fully public graph reveals a lot about contributor relationships. What privacy properties are required for different domains (OSS contributions vs. journalism vs. peer review)? Can we use zero-knowledge proofs or selective disclosure for certain graph paths?

Governance of scopes: Who decides what "cryptography scope" means? Is scope governance itself a trust-graph property? What's the relationship between scopes and Seed's capability system?

Recovery from compromise: When a high-reputation account is compromised, how does the graph recover? Can we revoke vouches retroactively? Does the graph support fork/reorg semantics like Git?

Sources to check:

EigenTrust paper (Kamvar, Schlosser, Garcia-Molina)

Advogato trust metric (Raph Levien)

OpenPGP Web of Trust literature

Keybase team architecture (now defunct, but lessons learned)

SourceCred algorithm

Seed's existing capability revocation semantics

Depends on: Reading the relevant academic papers. Mapping each proposal to Seed's existing primitives.

Priority: High — These questions directly block the Seed Protocol RFC, which is the highest-leverage output available.

---

5. Graduated Trust vs. Existing Trust Systems: Comparison (New — 2026-07-24)

Why: The Graduated Trust essay claims novelty but does not compare itself to existing systems. Before positioning it as a signature idea, we need to understand what's truly original vs. what's a recombination.

Questions to answer:

How does Graduated Trust differ from EigenTrust? EigenTrust also computes trust via transitive paths with weights. Is the novelty in the application domain (OSS contribution) rather than the algorithm?

How does Graduated Trust's hop-based friction model differ from OpenPGP's trust signatures (marginal/complete/ultimate)?

How does the vouching mechanism compare to Keybase's team/channel architecture?

What does SourceCred do that Graduated Trust doesn't (and vice versa)?

Are there existing OSS projects implementing something similar (e.g., SourceCred, Trustlines, BrightID)?

Sources to check:

EigenTrust paper

OpenPGP RFC 4880 trust model

Keybase documentation (archived)

SourceCred algorithm docs

BrightID whitepaper

Trustlines Network

Depends on: Reading and comparing 4-5 trust system specifications. This is medium effort but high value for positioning.

---

Completed Research

_None yet — this document is new._

---

Research Principles

Publish as you learn — Research notes can become short posts or footnotes. Don't wait until you have all answers.

Cite sources with hm:// links — Every factual claim should link to its source.

Revisit quarterly — Pricing, tools, and best practices change annually in the desktop/Electron ecosystem.

Tag research as "🔍 Active" or "✅ Complete" — Status clarity prevents redundant work.

---

Recent Additions

2026-07-24 — Added two new research topics triggered by the Graduated Trust essay revision:

Topic 4: Graduated Trust Open Questions — 5 questions (reputation calibration, Sybil resistance, privacy, scope governance, compromise recovery) that must be answered before the Seed Protocol RFC can be written.

Topic 5: Graduated Trust vs. Existing Trust Systems — Comparison needed to establish originality and academic grounding for the signature idea.

Both are high-priority because they directly support the P0 Seed Protocol RFC now on the content roadmap.