auto-trust web of trust chat requests behind a setting

docs/web-of-trust.md

@@ -156,26 +156,23 @@ Where request rooms are rendered, show the mutual count for the sender:
 
 ### Phase 3 — opt-in auto-trust (behind a setting)
 
+Status: **implemented** (Phase 2 skipped for now; it will follow a different
+flow).
+
 The payoff: strangers vouched for by the user's contacts can skip screening.
 
-- Add `pub wot_auto_trust: bool` to `setting_accessors!` in
-  `crates/settings/src/lib.rs` (default `false`) and a toggle in the existing
-  preferences screen (`crates/workspace/src/dialogs/settings.rs`).
-- When enabled, apply it in one place — `ChatRegistry::new_message` in
-  `crates/chat/src/lib.rs`, next to the existing promotion rule — so in-app and
-  any future consumer can't drift (Amethyst's lesson from `TrustVerdicts`):
-
-  ```rust
-  if this.kind == RoomKind::Request
-      && (message.rumor.pubkey == public_key
-          || (AppSettings::get_wot_auto_trust(cx) && wot.is_in_network(&message.rumor.pubkey)))
-  {
-      this.set_ongoing(cx);
-  }
-  ```
-
-  Group requests stay conservative: every member must be in the network (or
-  already a contact) to promote, mirroring how `is_contact` works today.
+- `pub wot_auto_trust: bool` in `setting_accessors!` in
+  `crates/settings/src/lib.rs` (default `false`) and a "Web of trust" toggle in
+  the preferences screen (`crates/workspace/src/dialogs/settings.rs`).
+- The rule lives in one predicate — `Room::auto_trusted(me, cx)` in
+  `crates/chat/src/room.rs`: the setting is on and every member other than the
+  current user is inside the web of trust (`is_in_network`, so followed
+  senders always pass and strangers need at least one mutual contact).
+  It's applied at every point a room's kind is decided so the states can't
+  drift: `ChatRegistry::add_room` (incoming first message),
+  `ChatRegistry::new_message` (live promotion next to the existing
+  I-sent-it rule), and `ChatRegistry::extend_rooms` (rooms loaded from the
+  database, so the split survives a restart).
 
 Deliberately not planned: sorting contacts (the new-chat dialog lists only
 follows already), notification feeds (coop has none), muting/spam scoring.