Build Report · A Week in Digital Trust

7 Days of Trust

In one week, the team moved a whole digital-identity ecosystem forward — from the cryptographic engine room to the apps in your pocket. Here's the plain-English tour of what got built, what's new, and why it matters.

📅 May 31 → June 7, 2026 · 11 projects
233
commits shipped
11
active projects
7
days
2 new
services born this week
Start Here · The Big Idea

What is all of this, really?

Imagine an internet where you own your ID — not a username a company hands you, but a tamper-proof digital credential you carry in your own wallet. You prove who you are, share only the details you choose, and join trusted communities where membership is cryptographically provable instead of being a name on someone's server list. That's what these projects build, layer by layer.

Core engine & infrastructure Communities & trust Apps & plugins you use Toolkits & specs for builders
★ Featured this week

The VTC invite process — now a complete loop

A Verifiable Trust Community (VTC) is a members-only group where everyone carries a tamper-proof digital membership card they fully own. The big milestone this week: the team closed the join loop end-to-end — a community can invite a complete stranger, that person holds the invite privately, presents it to apply, and the community automatically issues a membership credential on approval.

✉️
Invite
Community invites a prospective member — even someone it's never met.
🔒
Hold
The invite sits privately in the person's own wallet. No central list.
🙋
Present
They present it to apply — proving eligibility without over-sharing.
🎟️
Join
On approval, a membership credential is auto-delivered. You're in.
🛡️ Invites can't be replayed — single-use challenge ✅ Issuer signature + revocation checked at join time 🕵️ Privacy-preserving proof (BBS selective disclosure) ⚙️ Runs on a configurable, point-and-click rules pipeline 📩 Clear, human-readable reason when an application is denied
★ Featured this week

OpenVTC — one identity, many communities

OpenVTC is the free, open front door to this world: a "Know Your Developer" tool that lets people prove they're real and join trusted communities without any central authority vouching for them. The headline change this week makes one account able to belong to many communities at once — each with its own identity, so your activity isn't silently linked across them.

🧩 Multi-community membership

A single rework (~6,100 lines across 51 files) lets you belong to many VTCs simultaneously. Per community, you choose to mint a fresh identity or reuse one — and you're warned when reuse links you.

🗂️ A friendly Communities dashboard

Every community in one place: status, "member since" date, an "action needed" badge, star-to-favourite, and a quick switcher. Join requests stay live in a Pending state and auto-expire after 7 days.

🤝 Trust without gatekeepers

Membership rests on real people vouching for real people — a "personhood" badge plus peer-to-peer "I vouch for this person" credentials — not a company's permission.

🌳 Built to scale into structure

A full design spec settled 17 decisions, including nested "sub-communities" up to 8 levels deep, enforced by the trust authority.

124
commits on the core (VTI) alone — busiest day: 39 on June 3
63/63
a perfect score on the W3C credential-standards conformance suite
~41k
lines added in the core infrastructure this week
0
known security vulnerabilities left in the JS Relying-Party SDK (down from 4)
The Reading Guide · 11 Projects

Every project, in plain English

From the deepest cryptography to the app on your phone. Each card: what it is, what shipped this week, and the fun stat.

Verifiable Trust Infrastructure

CORE
The backbone. Lets organisations hold their own identity keys and run self-governing communities where roles and permissions are proven by credentials, not server lists.
  • Built a complete digital wallet — receive, store, search, present & issue credentials.
  • Closed the invite-to-join loop end-to-end (see featured callout).
  • Added selective disclosure — prove a fact without revealing anything else.
  • Launched multi-device + mobile support and stronger "step-up" approval for risky actions.
WalletCommunitiesStep-up 124 commits

Trust Development Kit (TDK)

CORE
The cryptography toolkit builders use to create privacy-first identity apps — no central authority holding your data.
  • Standards-grade selective-disclosure signatures (BBS) — reveal just "over 18", hide the rest.
  • Added unlinkable pseudonyms — appear as a different identity to each service so you can't be tracked.
  • Hit a perfect 63/63 on the W3C canonicalization test suite.
  • Wider crypto (P-384/P-521) and blind signatures — sign a credential without seeing it.
PrivacyStandards 37 commits

OpenVTC ★

COMMUNITIES
The open, "Know Your Developer" front door for proving you're real and joining trusted communities — no central gatekeeper.
  • Multi-community membership — one account, many communities, each with its own identity.
  • New Communities dashboard with status, favourites & a quick switcher.
  • Lazy identity creation — connect first, choose fresh-or-reuse per community.
  • Full design spec: 17 decisions, nested communities up to 8 levels deep.
MembershipPrivacy 5 commits · 6.1k lines

DID Hosting Service

COMMUNITIES
"Web hosting, but for self-owned identities." Publishes and safeguards portable did:webvh IDs so they stay reliably look-up-able and honest.
  • Adopted the next-gen Trust Tasks v0.2 permissions framework — without breaking older clients.
  • Smoother "check-name" — probe, reserve & auto-assign identity names, no collisions.
  • Added a guided "discover-first" setup wizard for operators.
HostingReliability 11 commits

Trust Tasks Framework

SPEC
The shared rulebook that lets different companies' systems agree on the exact shape of a trusted action — so it can travel safely between them.
  • Released Framework 0.2 — standardised naming + security hardening, 0.1 still works alongside.
  • Published a new passkey spec family (enroll / list / revoke passwordless logins).
  • Added step-up policy and a push-notification control family.
  • Public registry now shows visual, side-by-side version diffs.
InteropPasskeys 17 commits

Push Gateway

NEW
The "doorbell" that wakes up a mobile authenticator — a silent, content-free nudge so your phone connects and picks up its secure messages. Built from scratch this week.
  • Empty → working service in one week, with a full command dispatcher.
  • Self-hostable Web Push sender — no Apple/Google account required.
  • Privacy by design: the wake-up never sees message content; sender-authenticated via DIDComm.
  • Shipped with a vulnerable crypto dependency removed from day one.
Mobile wake-upPrivacy 18 commits

Browser Plugin

APP
A browser extension to log into websites with your fingerprint/face passkey — while your real identity keys stay safely on a remote server, never in the browser.
  • Added Web Push wake-up so logins can be approved even behind a private network.
  • Upgraded secure messaging to close an encryption flaw; patched a flagged advisory.
  • Fixed a bug so saved credentials survive browser restarts.
PasswordlessPhishing-resistant 9 commits

iOS Mobile Agent

APP
An iPhone app that acts as your personal login approver — biometrics step you up from basic to strong authentication when a sensitive action needs extra proof it's really you.
  • Built the core tap-to-approve biometric confirmation for high-security actions.
  • Connected to its identity server over both direct and encrypted-messaging channels.
  • Live receive-loop so the phone is reachable even behind a private network.
BiometricStep-up 6 commits

Relying-Party SDK (JS)

TOOLKIT
A toolkit for website operators to safely verify the login tokens this system produces — closing a gap where logins could be trusted without checking.
  • Cleared all 4 security advisories (1 critical, 3 moderate) → zero vulnerabilities.
  • Moved verification onto a vetted, audited code path with less hand-rolled crypto.
  • Added first tests for session-cookie security settings.
Security 2 commits · −1,477 lines

DIDComm Messaging (JS)

TOOLKIT
A lightweight JavaScript library for secure, sender-verified encrypted messaging between identity apps in the browser.
  • Fixed an encryption flaw so messages are now standards-correct & interoperable.
  • Smart dual-key fallback so upgraded & not-yet-upgraded apps still talk during rollout.
  • Released as v0.5.0 with a clear migration path.
InteropMessaging 2 commits

Trust-Graph Credentials

TOOLKIT
A Rust library for creating & verifying tamper-proof credentials — memberships, endorsements, relationship cards — for proving who-trusts-whom.
  • Upgraded to the latest (v0.7) data-integrity signing engine; released v0.1.3.
  • Enabled public publishing so others can build on it.
Credentials 2 commits

The through-line

RECAP
Eleven projects, one mission.
  • Engine room: VTI + TDK make the cryptography real and standards-compliant.
  • Communities: OpenVTC + DID Hosting let real groups form and grow.
  • In your hands: the iOS app + browser plugin put it on your devices.
  • For builders: the specs & SDKs let everyone else plug in safely.
233 commits7 days 🚀
The Big Themes

Four threads ran through the whole week

🪪

Your own wallet

Holding, presenting & issuing credentials you control — the personal data wallet came to life.

🤝

Communities that govern themselves

Invite → hold → present → join, with rules you author visually instead of in code.

📱

Devices & step-up

Multi-device control plus phone-based biometric approval for the riskiest actions.

🛡️

Privacy & hardening

Selective disclosure, unlinkable pseudonyms, removed vulnerable dependencies, audit prep.

Why It Matters

The payoff, in human terms

🙋

For individuals

You own your credentials and reveal only what's necessary — stronger privacy, far less data exposure.

🏢

For communities & business

Onboarding becomes a trustworthy, automated flow; access is cryptographically provable, with no stale lists.

🔐

For security teams

The most dangerous actions now demand strong, phone-based approval — shrinking the blast radius of a stolen password.