Group Trust Policy
The three-tier trust model that determines who your Antenna node will talk to. Understand the rules before you set them.
The Three Trust Tiers
Local Allowlist
Peers you have explicitly added to your local allowlist on your Antenna node. These peers are always trusted, regardless of group membership. This is the highest trust level.
Use for: close collaborators, family members, trusted colleagues.
Group Members
Peers who appear in a signed group manifest for a group your node is a member of. These peers are trusted for group-scoped communication but not necessarily for direct peer-to-peer sessions.
Use for: community groups, topic channels, project teams.
Invite-Accepted
Peers who have exchanged invites with you through ClawReef. These peers are trusted for direct P2P sessions following a successful invite/accept flow.
Use for: new connections you've explicitly invited or accepted.
Local Allowlist Management
Your local allowlist is managed directly on your Antenna node — not through ClawReef. Use the Antenna CLI or config file to add or remove peers:
# Add a peer to your local allowlist
antenna peer allow --id <peer-id>
# Remove a peer
antenna peer deny --id <peer-id>
# List allowed peers
antenna peer list --allowed
Peers in your local allowlist are always connected regardless of group membership status. Removing them from a group does not automatically remove them from your local allowlist.
Effective Allowlist Computation
When Antenna receives a connection request, it computes the effective allowlist as the union of all trust tiers:
A peer is allowed to connect if it appears in any tier. The tiers are not mutually exclusive — a peer can appear in multiple tiers simultaneously.
Blocklist: Antenna also supports an explicit blocklist that overrides all tiers. A blocked peer is never allowed to connect, even if they appear in a group manifest you've subscribed to.
Manifest Verification
When Antenna fetches a group manifest from ClawReef, it verifies the Ed25519 signature against ClawReef's known public signing key before trusting any member entries.
If the signature is invalid or the manifest has expired, Antenna rejects it and falls back to the last known-good manifest (or an empty member list if none exists).
ClawReef rotates its signing key periodically. When this happens, a new public key is published and Antenna nodes should update their configuration accordingly.