The foundation of the trust stack: decentralized identifiers (DIDs), key management, verifiable data registries (VDRs), and the infrastructure that makes self-sovereign identity possible.
Layer 1 is the DID infrastructure layer — the bedrock on which all higher layers of the trust stack depend. It answers the question: how does a participant in the trust graph prove who they are, and how does anyone else verify that proof without relying on a central authority?
The answer is Decentralized Identifiers (DIDs) — a W3C standard for self-sovereign identity. A DID is a globally unique identifier that is controlled by its owner (not by a registrar or platform), backed by cryptographic key material, and resolvable to a DID Document that describes the identity's public keys, service endpoints, and capabilities.
Layer 1 infrastructure includes:
The FPTS has its own native path to Layer 1 functionality — no DNS, no external registry,
no ledger dependency. A DID-method-agnostic VidMethod interface decouples
identity from any one DID method, a minimal VTC/VRC primitive provides just enough
governance machinery to support a witness pool, and a hash-chained, pre-rotation key
rotation mechanism backed by a decentralized Witness VTC provides verifiable identity
rotation without relying on external infrastructure.
This is implemented and tested today — see Native Identity & Rotation below for details.
✅ Complete
The FPTS solves DID rotation with the same decentralized building blocks the rest of the
stack already uses: a method-agnostic
identity interface, a minimal governance primitive, and libp2p-native peer relationships. Multiple
completed implementations carry this from a fixed did:peer:4 identity all the way to a
rotating, witness-attested did:scid:vh identity.
VidMethod Abstraction ✅ Complete
A DID-method-agnostic interface (create(), resolve(), verify())
that Agent and RelationshipManager depend on instead of calling
method-specific functions directly. did:scid:vh is wrapped as ScidVhMethod,
did:peer:4 as DidPeer4Method — interchangeable identity backends.
Just enough of Layer 3 to unblock Layer 1: a VTC identity with an admin list, a
Vrc (Verified Relationship Credential) type with an M-of-N co-signed signature
bundle, and createVtc() / issueVrc() / verifyVrc() —
governance logic lives in a policy document, not in new cryptographic primitives.
RotatingVidMethod — a second VidMethod implementation with real key
rotation. Each rotation pre-commits to the next key (pre-rotation) and is attested by M-of-N
members of a decentralized Witness VTC (the same minimal VTC/VRC primitive above), replacing
DNS watchers with a libp2p-native, opt-in community of witnesses.
Different DID methods make different tradeoffs between decentralization, offline capability,
and infrastructure requirements. The FPTS uses did:scid:vh as its primary long-lived
identity method, with did:peer:4 available for quick development scenarios.
A self-certifying DID method that carries its own cryptographic proof of provenance via a hash-chained verifiable history. No external ledger or VDR dependency — the DID itself is the root of trust. Supports built-in key pre-rotation and witness attestation via a decentralized Witness VTC. Used as the primary long-lived identity method in the FPTS.
Tradeoff: Long identifiers; requires at least one Witness VTC to exist
(a documented "genesis" Witness VTC is shipped for development). Rotation-aware code depends
on the VidMethod interface for interchangeability.
A self-certifying DID method where the DID document is embedded in the identifier itself. No network lookup required — resolution and verification are fully offline. Available for quick development and testing scenarios where key rotation is not needed.
Tradeoff: Long identifiers; no key rotation (a new DID must be created for each identity). Ideal for ephemeral identities and peer-to-peer development.
Traditional identity systems require a central authority — a government, a platform, a corporation — to issue and vouch for your identity. Self-sovereign identity (SSI) flips this: you generate your own cryptographic key pair, derive your DID from it, and control your identity document directly. No one can revoke your identity without your consent, and no one can impersonate you without your private key.
A DID resolves to a DID Document — a JSON-LD document that describes the identity's public keys (for signing and encryption), service endpoints (for messaging and discovery), and verification methods. The DID Document is the public face of a VTA.
Key rotation is the process of replacing an old cryptographic key with a new one. Pre-rotation means committing to the hash of the next key before rotating — so that even if an attacker compromises your current key, they cannot rotate to a key they control, because the next key's hash is already published and locked in.
A witness is a third party that observes and attests to DID Document updates. Witness proofs provide
a tamper-evident audit trail and prevent unilateral key rotation attacks. The did:scid:vh method
supports configurable witness thresholds; the FPTS's native did:scid:vh achieves
the same guarantee via M-of-N attestations from a decentralized Witness VTC rather than a hosted
watcher network.