Vouch adds web-of-trust to fight AI spam

AI didn't just lower the bar for contributing — it nuked the foundational assumption that open source has always relied on: that effort implies intent. Vouch is the first serious engineering proposal to replace that implicit contract with an explicit one.

• –The cold-start problem is real: if you need a vouch to open a PR, how do you get vouched? Hashimoto's answer ("introduce yourself like a normal human") works at small scale but may not survive growth
• –The federated web-of-trust model is the most interesting part — if Vouch achieves critical mass, a newcomer vouched at one high-profile project gets a head start everywhere else
• –Already deployed in production at Ghostty (Hashimoto's own terminal emulator), which gives it credibility over vaporware proposals
• –The HN thread (1,077 points, 486 comments) shows strong consensus on the problem diagnosis even where debate exists on the solution — maintainer burnout from AI PR spam is a widely validated pain point
• –Forge-agnostic design and POSIX-parseable flat files signal this is meant to be infrastructure, not a GitHub-specific hack