A four-layer architecture for verifiable, private, tamper-proof identity and relationships —
built on open W3C standards and the Trust over IP (ToIP) model. v0.1.0 is released:
the protocol engine (@p2p-trust-stack/core) and the agent API
(@p2p-trust-stack/app-api) are open source and published to npm.
The internet was designed to move data, not to establish trust. Every layer of the modern internet — from DNS to HTTP to OAuth — was bolted on after the fact, creating a patchwork of centralized identity silos that are fragile, privacy-invasive, and increasingly exploited by bad actors and AI systems alike.
The P2P Trust Stack is a ground-up redesign of how trust works on the internet. It is organized around the Trust over IP (ToIP) four-layer model, which separates the concerns of identity infrastructure, message transport, credential exchange, and application logic into clean, composable layers — each of which can be implemented independently and upgraded without breaking the others. Version 0.1.0 is the first open source release of that design: a working, published implementation of Layers 1–4 rather than a specification.
The core primitives are:
These primitives — VTAs, VTCs, and VRCs — are defined by the Decentralized Trust Graph (DTG) working group.
Around those primitives sit the stack's engines: a Credential Factory that mints, verifies, and displays the full DTG credential family through a single interface; a Governance Guard that validates governance rules for ceremonies, memberships, and credential issuance; and a data-driven Policy Engine whose rules live in the database, not in code, so a community can change what it allows without a redeploy.
The goal is a decentralized trust graph of VTAs, VRCs, and VTCs — a graph of verifiable identities and relationships that isn't owned or gated by any single party. Different implementations can take different technical paths toward the same interoperable outcome.
Work bridging the layers is now well underway. A method-agnostic way of representing identities exists so the stack isn't locked to any single DID approach; heterogeneous multi-step trust operations (a community founding, a credential issuance, a peer relationship) run as trust-task ceremonies — ordered sequences of policy gates and effects catalogued in the database and driven by code; and the governance decisions those ceremonies enforce are policy documents evaluated by the Policy Engine. See the Layer 1–3 pages below for the details, framed from each layer's perspective.
Current implementation status for each layer of the P2P Trust Stack. Click any layer for detailed documentation.
Active implemented, exercised end-to-end, and released · Foundations Laid core mechanisms working today, being hardened and extended · In Progress under active implementation · Planned designed, not yet built
| Layer | Name & Role | Technology | Status |
|---|---|---|---|
| 4 |
PNM / CNM / Developer Apps
|
End-user UI/UX for creating, joining, and managing trust applications, communities, and networks. Personal Network Manager (PNM), Community Network Manager (CNM), and developer-facing app tooling. The Agent App reference applications (web + TUI) are built and operational: register VTAs, found and administer VTCs, issue VRCs, manage community rules, send invitations, and chat. The stack is already being embedded in other test applications. | Active — Reference Apps Built |
| 3 |
VTCs & VRCs
|
W3C Verifiable Credentials issued through the unified Credential Factory. The Governance Guard and data-driven Policy Engine enforce community rules at issuance and crystallization, and a database-backed trust-task ceremony model drives multi-step operations — VTC establishment, membership onboarding, VRC personhood, and policy evaluation all run today. Shipped in v0.1.0. The Trust Tasks framework's conventions — peer-scoped task type identifiers, a conformant JSON request/response envelope, and its document and decision vocabulary — have been incorporated in anticipation of supporting interoperability; that interop is not implemented yet (see the Roadmap). | Foundations Laid |
| 2 |
VTAs & TSP
|
Trust Spanning Protocol (TSP) Rev 3 over libp2p transport. did:scid:vh + did:peer:4 identity, HPKE-Base confidential messaging, XRFI/XRFA/XRFD relationship handshake, and post-quantum signatures and hybrid KEM. Direct Mode complete and released in v0.1.0. | Active — Released in v0.1.0 |
| 1 |
DID Infrastructure
|
DID method infrastructure, key rotation, and witness proofs. Built in TypeScript
with a peer-to-peer, libp2p-native approach to decentralized identity.
Released in v0.1.0 as @p2p-trust-stack/core.
|
Active — Released in v0.1.0 |
The DID infrastructure layer: decentralized identifiers, key management, and witness proofs. Built in TypeScript with a peer-to-peer, libp2p-native approach. Shipped in v0.1.0.
Layer 1 Details →The Trust Spanning Protocol (TSP) Rev 3 layer: VTA identity, authenticated and confidential messaging, relationship establishment, and post-quantum cryptography. Direct Mode complete and released in v0.1.0.
Layer 2 Details →VTCs and VRCs: the credential layer where trust tasks are defined, executed, and verified using W3C Verifiable Credentials, with the Credential Factory, Governance Guard, and Policy Engine enforcing community rules. Released in v0.1.0 and now exercising real community ceremonies.
Layer 3 Details →End-user applications built on the trust stack: Personal Network Manager, Community Network Manager, and developer-facing tooling. The Agent App reference build (web + TUI) now registers VTAs, founds and administers VTCs, issues VRCs, manages community rules, sends invitations, and chats — and is being integrated into other test applications.
Layer 4 Details →Each layer builds on the one below it, but is designed to be independently implementable and upgradeable:
did:scid:vh — self-certifying
with hash-chained verifiable history, built-in pre-rotation, and witness attestation support.
did:peer:4 (self-certifying, no network lookup) is also available for development.
Start building on v0.1.0. Install the agent API — core comes with it:
npm install @p2p-trust-stack/app-apiSee the API Reference for every method, and the GitHub repository for source, tests, and the changelog. Requires Node.js ≥ 22.5 (Node-only).