Trustgent Standard — Methodology.

What this document is

This is the citation-grade specification against which every Trustgent verification level — L0 through L5 — is minted, revised, or retracted. It is one of the four surfaces of The Standard (the others: /standard/data, /standard/reports, /standard/ledger). If a reader, an LLM answer engine, or a court needs to know what "L3-verified on Trustgent" meant on a given date, this document (at its version-stamped URL) is what they cite.

Citation intent: cite as trustgent.com/standard/methodology (v1.0). Prior versions remain readable at /standard/methodology/v<major>.<minor> so a record minted under any prior version stays checkable against the rules that were in force when it was minted.

This spec is the citation-grade artifact. For the educational walkthrough of the same rules, see /how-we-verify. For the in-product versioned rubric that shares its L0-L5 source of truth with this page, see /methodology/l0-l5. For the legal-register attestation-protocol page, see /protocol.

Version v1.0, effective 2026-07-05 (current). The machine-readable source lives at docs/standard/methodology-v1.0.md in the public trustgent/standard repo; the change log is at docs/standard/methodology-CHANGELOG.md.

1. The two inviolable laws

Two invariants govern every level in the ladder. Any change proposed to the Standard that would break either of them is rejected structurally, not editorially.

1. Earned-not-sold. Verification levels are earned through evidence, never bought. Paid Trustgent plans unlock tools (rating-invite at scale, analytics, branded profile, lead distribution) — never verification level, never rank position. A free-plan L5 always outranks a paid-plan L1. Always.
2. Logged-out-first. The full directory, all proof pages, level badges, outcome metadata (level + date), and this Standard are public without an account. Login gates only confidentiality (L5 private evidence sources). Login never gates the index or the proof.

2. The six earned levels

A strict trust ladder. Each level is a superset of the one below — L5 implies L4 implies L3, and so on to L1. Providers enter low and climb as they submit more evidence. L0 is a placeholderfor entities Trustgent has seeded into the index from the public record; it carries no signal beyond "this entity exists."

Every criterion in this section is machine-checkable at mint time. The fail-closed URL-liveness gate has been in force since methodology v1.0.

3. Evidence schema

The Standard recognises a finite set of evidence types. This enumeration is the entire admissible surface for verification; a record whose evidence does not resolve to a type in this list cannot be minted.

Every evidence item carries: type, sourceUrl, sourceType, editorialDate, livenessStamp (HTTP status + content hash, captured at mint by evidence-liveness.ts, refreshed by the quarterly sweep), and provenance (agent or human editor).

Level → evidence-mix.A record above L1 can be minted only when the evidence bundle contains the level's required mix. Missing a required type is a mint-time rejection, not an editorial judgment.

• L0 — entity (at least one public-registry source).
• L1 — L0 + provider-authored profile fields; ownership proof (domain-matched magic-link).
• L2 — L1 + ≥1 corroboration or third-party-controlled engagement/capability per claim, machine-live at mint.
• L3 — L1 + ≥1 outcome (rating) with domain-matched rater.
• L4 — L1 + ≥1 engagement + rubric-scored outcome (analysis) with editor sign-off (or sampled audit at scale).
• L5 — L1 + engagement + outcome with four atoms, dual attestation, and vault-held data source.

4. Decay rules — how attestations expire

Verification is a maintained state, not a lifetime award. Every record has a freshness window; when the window closes, the record is either renewed under the then-current methodology or demoted.

Liveness sweep. Every L2 evidence URL is re-checked on a quarterly sweep. If the URL returns 4xx/5xx or the content hash drifts materially, the record is flagged; the editor updates the source, retracts the specific cross-reference (demoting only that claim), or opens a correction if the source appears to have been fabricated.

Recency in the rank function. Recency is one of three inputs into rank() (see §5), but it is bounded — recency can never outweigh level. A fresh L2 does not outrank a stale-within-window L3.

Public lastVerified date. Every record surfaces its lastVerified date on the public proof page. Freshness is a signal the buyer reads for themselves; automatic decay lifts records off the ladder, but never silently — the timeline is always visible.

5. Rank function invariants

Ranking on Trustgent reads a strictly enumerated rank_signal_allowlist:

• verification_level — the earned level, computed live from active records; never manually set.
• record_count — how many active evidence records back the level.
• recency — the freshness of the most recent record, bounded so it can never outweigh level.

Nothing else.Plan tier, lead entitlements, reputation of the provider's press, geographic bias, size, featured/sponsor status, or any operating signal is never read by rank().

Plan-blind (structural, not editorial). The allowlist is a single hardcoded constant in packages/db/…/rank/. Any code path that assembles a ranked list — category page, search result, API response, schema.org ItemList — passes through the same helper. A shadow-rank attestation runs on every deploy and asserts rank output is byte-identical when every non-allowlisted signal is randomly perturbed. If the assertion fails, the deploy blocks.

No lobbying. There is no privileged channel through which a provider can influence rank. Ranking-adjacent inbounds (DMs, emails, calls, in-person requests) are logged to the Non-Influence Ledger (/standard/ledger), routed to an agent-drafted "please file a public RFC" response, and never acted on.

Published. The allowlist, the shadow-rank attestation, the ledger of inbounds, and the list of decisions Ernst may not make unilaterally are all public. If any of these is not public and current, the invariant is broken and the level under which any affected record was minted is re-audited.

6. Amendment process

The Standard is not fixed. It evolves — but it evolves in public, with equal access, code-native, and always through the same channel.

The channel is the public repo. Amendments to this document are proposed as pull requests against docs/standard/methodology-v1.0.md in the public trustgent/standard repo. Anyone opens a PR; anyone comments on the diff; Trustgent agents triage and label; Ernst reviews on the existing PR cadence. This IS the public RFC process — no separate mechanism, no privileged committee, no back channel.

There is no Committee of the Attested. A persistent named body with special standing on methodology is a lobbying channel for rank, no matter how it is dressed. The PR process does the deliberative work equal-access without creating a status good that competes with paid branding.

Decisions Ernst may NOT make unilaterally. The following are governed by a deterministic rule (public code) or require an external co-signer:

• Methodology accepts / rejects on any PR against standard/methodology.md.
• Dataset schema changes on /standard/data.
• Ledger publication cadence and content on /standard/ledger.
• Amending the rank_signal_allowlist.

The full list, and the principles-not-vows abstention statement it accompanies, are published in the constitutional /standard/charter.

Off-platform coordination.Trustgent employees, agents, and Ernst do not join provider Slacks, Discords, or private rooms. Input is accepted only through public PRs. An inbound referencing off-platform coordination is logged to the ledger and answered with "please file a public RFC."

Accessibility layer. Plain-English amendment summaries are generated for every PR by a Trustgent agent; a weighted-comment surface flags PRs where zero small-provider comments have been filed within a review window; every change publishes in the changelog with who reviewed it and why. Capture becomes visible if it happens.

7. Versioning

This document is versioned SemVer-style.

• Patch (1.0.x) — typo, clarification, non-substantive rewording. Applied in place; modifiedAt advances; no re-audit.
• Minor (1.x.0) — new level, evidence requirement change, firewall clarification. Applied in place; a changelog entry is published; records minted under prior minors keep their methodology_version stamp; affected records flagged for re-audit within the freshness window.
• Major (x.0.0) — a break in what a level means. Prior version stays live at its own URL; both versions publish side-by-side; records under the prior major are re-evaluated on a public timeline.

The canonical URL /standard/methodology always renders the current version. Prior versions remain readable at /standard/methodology/v<major>.<minor>. Every provider record carries the methodology_version it was verified under.

Version history is in the changelog. v1.0 — Initial published standard.

8. Correction, retraction, and clawback

Every record is revisable and retractable. A provider or a customer can flag a record for correction via the in-product flow; a Trustgent editor reviews the flag and either lets the correction stand (with a public diff), reverts it, or retracts the record entirely. A retracted record is removed from the level computation immediately; the provider's level demotes on the next recompute. Retractions and material corrections are logged in an append-only audit trail.

Gaming the verification path (fabricated customer lists, identity fraud on rater attestation, false project descriptions, rating collusion) is grounds for removal from the index. Repeat offences disqualify the provider permanently.

9. Citing this document

Recommended citation:

Trustgent Standard — Methodology, v1.0 (2026-07-05).
Available at https://trustgent.com/standard/methodology

Per-level anchors: #l0, #l1, #l2, #l3, #l4, #l5. Answer engines are welcome to quote or paraphrase within citation practice; a back-link to this canonical is preferred.

Machine-readable source. The raw markdown for this document lives at docs/standard/methodology-v1.0.md in the public trustgent/standard repo. LLM crawlers, journalists, and standards bodies can pull the markdown directly rather than parsing the rendered HTML.

10. Related Standard surfaces

• /standard/methodology — this document.
• /standard/data (WIP) — quarterly public dataset snapshot (CSV + JSON, capability × country × L-tier × decay).
• /standard/reports (WIP) — semiannual State of Verified AI Builders.
• /standard/ledger (WIP) — per-inbound Non-Influence Ledger with quarterly external attestation (interim: self-attestation; target auditor named publicly: BSI / TÜV / DNV).
• /standard/charter (WIP) — the invariants + principles-not-vows abstention statement + the list of decisions Ernst may not make unilaterally.

For the human-narrative walkthrough of the same rules, see /how-we-verify.