A four-layer architecture for verifiable, private, tamper-proof identity and relationships — built on open W3C standards and the Trust over IP (ToIP) model.
The internet was designed to move data, not to establish trust. Every layer of the modern internet — from DNS to HTTP to OAuth — was bolted on after the fact, creating a patchwork of centralized identity silos that are fragile, privacy-invasive, and increasingly exploited by bad actors and AI systems alike.
The First Person Trust Stack is a ground-up redesign of how trust works on the internet. It is organized around the Trust over IP (ToIP) four-layer model, which separates the concerns of identity infrastructure, message transport, credential exchange, and application logic into clean, composable layers — each of which can be implemented independently and upgraded without breaking the others.
The core primitives are:
These primitives — VTAs, VTCs, and VRCs — are defined by the Trust over IP (ToIP) architecture model.
The goal is a decentralized trust graph of VTAs, VRCs, and VTCs — a graph of verifiable identities and relationships that isn't owned or gated by any single party. Different implementations can take different technical paths toward the same interoperable outcome.
Work bridging Layer 1 and Layer 3 has also begun. A method-agnostic way of representing identities now exists so this stack isn't locked to any single DID approach, and a small, purpose-built piece of the Layer 3 credential model has been implemented to support decentralized key rotation — see the Layer 1 and Layer 3 pages below for the details, framed from each layer's perspective.
Current implementation status for each layer of the First Person Trust Stack. Click any layer for detailed documentation.
| Layer | Name & Role | Technology | Status |
|---|---|---|---|
| 4 |
PNM / CNM / Developer Apps
|
End-user UI/UX for creating, joining, and managing trust applications, communities, and networks. Personal Network Manager (PNM), Community Network Manager (CNM), and developer-facing app tooling. | Planned |
| 3 |
VTCs & VRCs
|
W3C Verifiable Credentials for trust task execution — issuing, presenting, and verifying VRCs within VTCs. Significant external traction via W3C Verifiable Credentials · reviewing the Trust Tasks framework for potential integration Integration with this stack not yet started. | In Progress |
| 2 |
VTAs & TSP
|
Trust Spanning Protocol (TSP) over libp2p transport. did:peer:4 VID creation, HPKE-Auth confidential messaging, RFI/RFA relationship handshake. Direct Mode complete. did:scid:vh operational. | Active — Direct Mode |
| 1 |
DID Infrastructure
|
DID method infrastructure, key rotation, and witness proofs. Built in TypeScript with a peer-to-peer, libp2p-native approach to decentralized identity. | Active |
The DID infrastructure layer: decentralized identifiers, key management, and witness proofs. Built in TypeScript with a peer-to-peer, libp2p-native approach.
Active Layer 1 Details →The Trust Spanning Protocol (TSP) layer: VTA identity, authenticated messaging, relationship establishment, and HPKE-Auth confidential messaging. Our primary active build.
Active — Direct Mode Layer 2 Details →VTCs and VRCs: the credential exchange layer where trust tasks are defined, executed, and verified using W3C Verifiable Credentials within governance-bounded communities.
In Progress Layer 3 Details →End-user applications built on the trust stack: Personal Network Manager, Community Network Manager, and developer-facing tooling for trust-aware applications.
Planned Layer 4 Details →Each layer builds on the one below it, but is designed to be independently implementable and upgradeable:
did:scid:vh — self-certifying
with hash-chained verifiable history, built-in pre-rotation, and witness attestation support.
did:peer:4 (self-certifying, no network lookup) is also available for development.