A work in progress. Full developer documentation — including key concepts, architectural overviews, and API references — will be published when the trust stack is open sourced.
The core protocol stack — the cryptographic primitives, DID infrastructure, Trust Spanning Protocol, relationship management, and VTC/VRC governance framework — is being prepared for release as a standalone open source package under the Apache License 2.0.
Decisions about which application components to open source alongside the core stack have not yet been finalized. The agent application, bootstrap server, and utility server may be released in whole or in part as reference implementations or kept private — this will be determined as the open source release progresses.
When the public repository is available, package installation instructions, API references, and contribution guidelines will appear here.
The following flows are operational in the DTG testbed. Each is built on open W3C and IETF standards (DIDs, Verifiable Credentials, HPKE) and was demonstrated at the August 2026 trust stack demo.
Create a self-certifying did:scid:vh identity with Ed25519/X25519 key pairs and hash-chained verifiable history. No ledger dependency.
Register a human-readable name cryptographically bound to a did:scid:vh identity via two-phase commit over the Trust Spanning Protocol.
Authenticate as a VTA using Ed25519-signed challenge-response with single-use nonces and SHA-256 expiry verification.
Look up an agent name to retrieve the associated DID Document with service endpoints for messaging and discovery.
Fetch a VTA's public profile card as a W3C Verifiable Credential with per-claim disclosure control (always, discretionary, never, or zkp-only).
End-to-end encrypted messaging between VTAs using HPKE-Auth (RFC 9180) with DHKEM(X25519) + HKDF-SHA256 + ChaCha20/Poly1305.
Two-way mutual acknowledgment ceremony producing a bilaterally-signed Verified Relationship Credential (VRC). A VRC is only issued after both parties confirm.
The Layer 2 Trust Spanning Protocol implementation is functionally complete, with a full two-node direct-mode demo and comprehensive test coverage across all subsystems.
did:scid:vh and did:peer:4 VID creation, resolution, and cryptographic verification. Self-certifying identifiers with hash-chained verifiable history and no registry dependency.
Trust Spanning Protocol message sealing and opening. Supports plain (TSP_GEN) and confidential (TSP_GEN_CONFIDENTIAL via HPKE-Auth) message types.
Full RFI/RFA handshake for peer-to-peer relationship establishment. OOBI-based out-of-band introduction. Persistent relationship store.
libp2p-based transport layer with noise protocol encryption, yamux multiplexing, and the /tsp/1.0.0 protocol handler.
SQLite-backed keystore with AES-256-GCM encryption and Argon2id key derivation. Secure local storage for VID key pairs.
Ed25519 signing, X25519 key agreement, HPKE-Auth (RFC 9180), and CESR encoding — all implemented to open standards.
New to the trust stack? The glossary defines all key terms: VTA, VTC, VRC, VID, DID, TSP, OOBI, HPKE-Auth, RFI/RFA, CESR, did:scid:vh, did:peer:4, did:scid:vh, did:peer:4, R-Card, VidMethod, Witness VTC, and more.
View Glossary →