nip85-trusted-assertions

Use ContactCardEvent.create with the target user pubkey, a provider signer, and a publicInitializer setting tags like rank, followers, and hops. The event is addressable at 30382:<provider>:<target>, and the d-tag holds the subject's pubkey.

Kind 10040 is a replaceable event where an observer declares which providers they trust for which metrics. Each entry is a ServiceProviderTag like ["30382:rank", provider pubkey, relay URL], and entries may be public tags or NIP-44 encrypted private content.

A 30382 or other assertion is meaningful only if its author is listed in the observer's 10040 for a matching service type such as 30382:rank. Quartz does not enforce this cryptographically; the consuming code checks author equality and ignores assertions from unlisted signers.

No. A missing tag means unknown and the typed accessors return null, never zero. There is also no range validation on values, so consumers must defend against out-of-range or negative numbers themselves.

For an account's own contact cards, petname, summary, and their NIP-30 emoji mappings always live in the NIP-44 encrypted content, never in public tags. ContactCardEvent.build strips stray public copies, and provider-signed WoT cards use public metric tags instead.

All assertion kinds are addressable, so the latest event per (kind, author, d-tag) coordinate wins under standard NIP-01 rules. There is no expiry tag or prescribed refresh cadence; staleness policy is left to the consumer.