How do two Fediverse instances establish bilateral trust and authority without building bespoke integrations for every connection or extending ActivityPub itself to carry it? And how do we keep a verifiable paper-trail of moderation and governance decisions for when disputes arise?

NOMOI answers both with signed, scoped mandates. Organizations anchor their institutional presence so anyone, anywhere can discover and audit it. Authority is issued as signed mandates that recipients can re-delegate, but only ever a strict subset of what they received, and so on down the chain.

The unit of identity is the key-pair, kept algorithm-agnostic through COSE identifiers. NOMOI rests on a deliberately narrow set of normative commitments: deterministic CBOR, a declared content-identifier profile, COSE algorithm identifiers, and a six-operation abstract Transport Layer. It introduces no new cryptographic assumptions and commits to no single storage or discovery network. The reference implementation runs over IPFS/IPNS, so it works out of the box on existing, battle-tested P2P infrastructure.

This talk is aimed at developers looking for application-independent solutions to governance problems in the Fediverse.