Credential to Trust through VHTTP (Valuable Human Time Transfer Protocol
What an Open Source Summit India keynote revealed about the queue between human activity and recognised value
At the Open Source Summit India, a keynote panel on digital public infrastructure offered a neat three-part progression. Aadhaar tells the world who we are. UPI lets us pay. The proposed Trust Layer asks a third question: not merely can we pay?, but can we be believed?
It is a useful line. It is also where the language becomes more ambitious than the machinery.
The machinery described by Radha Kizhannattam of Networks for Humanity consists primarily of two components.
The Decentralized Directory helps systems discover recognised registries and issuers.
OpenCred allows institutions to issue portable, tamper-evident credentials that holders can carry in a wallet and present elsewhere for verification.
That is credential infrastructure.
Credential infrastructure can help answer:
Who issued this claim?
Is the issuer recognised?
Has the credential been altered?
Can the holder carry it across systems?
Can a verifier check it without telephoning the original institution and praying that somebody answers?
Those are necessary questions. They are not the whole of trust.
Trust also requires us to ask how the claim came into existence, what evidence supported it, whether the issuer had authority in that context, whether the judgment remains current, whether it may be challenged, and whether the holder freely consented to its use.
A credential is a signed sentence.
Trust is the governed process that decided whether the sentence deserved to be written.
The most revealing word in the keynote was “queue”
The panel’s deepest organizing idea was not blockchain, biometrics or even trust.
It was the queue.
Suresh Khadakbhavi of DigiYatra began by describing people waiting outside the United States Embassy. By the time he and his colleague completed their morning walk, the queue had grown. He connected that familiar Indian experience to the airport problem DigiYatra was created to address: repeated checkpoints, identity verification, uncertainty and the risk of missing a flight.
OpenCred addresses another queue. A trained worker receives a certificate, applies elsewhere, and then waits while the prospective employer tries to contact the issuing institution. The institution may answer. It may not. Somewhere, an office phone rings beside an empty chair while a human opportunity quietly expires.
The Decentralized Directory reduces the queue involved in finding a recognised issuer. OpenCred reduces the queue involved in carrying and verifying the issued credential. In the panel’s example, the credential can sit inside the holder’s wallet and be verified in seconds rather than reconstructed through phone calls, PDFs and institutional archaeology.
That gives us a useful product principle:
Every protocol must eventually remove a queue i.e. friction point.
Not every queue is visible. Some have plastic chairs, token numbers and a bored security guard. Others are hidden inside databases, inboxes, approval chains and institutional doubt.
The queue is where a system converts human time into administrative waste.
We had encountered another queue
I recognised the pattern because we had once stood inside another version of it.
In 2017, while working at Heptagon alongside Quess Corp, we had a close view of the machinery through which workers entered the Indian labour market. Every appointment carried documents, verification, coordination, background checks and delay. Moving one person into one job required several systems to repeatedly ask whether the person existed, whether the documents were real and whether the same history could be believed again.
We helped digitise part of that machinery through a paperless onboarding platform. A process that had taken approximately seven days could be completed in fourteen minutes.
The result did not finish the problem. It revealed its next layer.
Once onboarding was no longer the principal bottleneck, a series of harder questions appeared. Could employment history move with the worker? Could credentials travel rather than remain locked inside an employer’s database? Could skills be validated continuously instead of reconstructed during every job change? Could background verification become incremental rather than restarting from zero whenever a person entered another organisation?
That first response became PeopleChain.
PeopleChain was not an attempt to assign a price to a human being. It was an attempt to prevent the labour market from repeatedly investigating the same history. A verified employment record could be carried forward, with only new information added and validated.
But the question refused to remain that small.
If employment records could travel, what about skills? If skills could be validated, what about the time spent acquiring them? If time could be captured, could we distinguish learning, earning, recovery, care and institution-building? Who would validate those activities? Which community had the authority to do so? What should become portable, and what should remain private?
That is how a labour-verification problem began expanding into The Internet of Value.
The Linux Foundation keynote therefore lands at an interesting point in this journey. OpenCred is now working on part of the queue PeopleChain identified: portable credentials that can move across institutions.
But the queue does not end when the certificate travels.
It simply moves upstream.
Credential infrastructure starts after someone has decided what counts
Consider a credential stating that a worker completed a nursing programme.
OpenCred may help establish that the credential was issued by a recognised institution, belongs to its holder, has not been altered and can be verified elsewhere. That matters.
It still does not establish:
whether the original assessment was fair;
whether the skill remains current;
whether the person can perform it in a particular context;
whether the credential reflects practice or merely attendance;
whether unpaid experience should count;
whether the issuing institution’s policy can be inspected;
whether the holder can challenge an error;
whether the verifier may retain or reuse the information;
whether the activity strengthened or depleted the person performing it.
A green tick has excellent manners. It is not a moral philosopher.
What Networks for Humanity calls the Trust Layer is therefore better understood as a credential-trust layer: infrastructure for discovering trusted issuers and carrying verifiable claims.
The wider trust process begins before credential issuance and continues after verification. It includes activity, evidence, context, authority, policy, consent, dispute and consequence.
This is the layer The Internet of Value is trying to specify.
We drew the missing box in 2024
In October 2024, we published Protocols for Machines to Protocols Of, By and For Humans. The article began with the OSI and TCP/IP models, then proposed additional conceptual layers above the internet’s application layer:
a Value Exchange Layer, represented by systems such as UPI, Bitcoin and Ethereum;
a Goods and Services Transaction Layer, represented by Beckn;
a Human Interaction Layer, represented by VHTTP.
VHTTP stood for Valuable Human Time Transfer Protocol.
The early model imagined a request containing a start time, end time, activity, proof, wellbeing context and community context. The system would return a validation result and a record of the value captured. The model also included Value Capture, a Wellbeing Protocol and SAOcommons.
VHTTP - Valuable Human Time Transfer Protocol
The core intuition was that the internet should not merely transfer packets, payments and products. It should also help represent human time, contribution and context.
The architecture, however, had the administrative modesty of a small government.
One orange box was expected to capture activity, interpret wellbeing, validate contribution, establish identity, manage privacy, resolve disputes and calculate value. It was a protocol, therapist, auditor, passport office and municipal corporation with a JSON endpoint.
The insight was right.
The boundaries were not.
VHTTP did not disappear. It changed jobs.
VHTTP is no longer one giant protocol trying to understand the whole person.
It now acts as the human interaction and transfer envelope around four bounded protocols:
~ValueCaptureProtocol~WellbecomingProtocol~SAOcommons~WellbeingIdentity
The first three process flows: an activity is captured, interpreted and—when appropriate—validated by a community.
The fourth is the persistent memory layer. It holds what may remain part of identity across time.
A shared ProtocolLinkId binds the records across all four protocols without collapsing them into one database object. The separation matters because the authority to record what happened should not automatically include the authority to interpret our body, price our contribution or expose our identity.
One envelope. Four responsibilities. Less protocol imperialism.
The updated protocol stack
The current stack can be compressed into four sentences:
Capture what happened.
Interpret what it did to us.
Validate what it contributed to the commons.
Remember who we are becoming.
Each sentence belongs to a different protocol.
~ValueCaptureProtocol: What happened?
The first protocol captures a bounded occurrence of time.
Its core elements are:
TimeSliceActivityProofAttributionIntegrity
The protocol records when the activity began, when it ended, what happened, what evidence exists and how the occurrence should be attributed.
Attribution is not simply “Moses worked for two hours.” It asks who acted, inside which project or community, under which context, with which validating authority and, when relevant, through which economic route.
The WellbecomingNodeTag routes the occurrence toward the appropriate interpretation. The ProtocolLinkId binds the record to subsequent protocol events.
This stage does not decide whether the activity was healthy, economically valuable or worthy of public recognition. It establishes the claim being made.
Data capture becomes dangerous the moment the recorder starts pretending to be a philosopher.
~WellbecomingProtocol: What did the activity do to us?
Every captured activity may be interpreted through six nodes:
Physiology, Emotion, Feeling, Thought, Habit and Performance.
The first five belong to the participant’s private state. Performance acts as the gateway through which an occurrence may produce a public, externally validatable contribution.
This boundary is central to the current design.
Sleep, grief, recovery, illness, reflection, a family conversation or an afternoon spent staring at the ceiling may alter our private state. They do not automatically become public economic claims.
A nap does not need a derivatives market. Civilization may continue.
Performance remains inside wellbeing, but wellbeing is not reduced to Performance. When an occurrence involves Performance, it may move onward to ~SAOcommons. The same occurrence may also update our private state because work can affect physiology, emotion, feeling, thought and habit.
This lets the system recognise a simple fact that most productivity software treats as heresy: output happens inside a body.
~SAOcommons: What did the contribution mean to this community?
A Performance occurrence may enter one of three routes:
Learning, Earning or OrgBuilding.
The community must then apply a declared policy. That policy should establish:
which evidence is acceptable;
which skill or level applies;
who may validate the contribution;
which rate or valuation rule applies;
how correction and replay work;
how disputes are handled.
The protocol flow is:
Validation → Attestation → Valuation → Dispute
The final term matters. A system that can issue a credential but cannot hear an objection is not a trust system. It is a stamp machine with brand guidelines.
~SAOcommons may generate skill evidence, attestations, portfolio records and credentials. Where a community has constituted the relevant rate and settlement policy, it may also generate a Value Record.
This is where the equation enters:
VC=W×Vcom
Here, VC is the value captured for a Performance time slice, W is the relevant wellbeing state and Vcom is the community-governed rate or value rule.
The equation does not mean every human experience becomes money. Non-Performance activity contributes to our wellbeing state without automatically becoming a settlement claim.
The protocol records grief. It does not list grief on an exchange.
~WellbeingIdentity: What should remain part of identity?
~WellbeingIdentity requires more attention because it is not another profile.
It is a personal institution of memory, continuity and controlled representation.
A conventional identity system asks whether the same legal person has appeared again. A Wellbeing Identity asks what may persist across our appearances without turning the person into one permanently visible score.
[Insert the dedicated Wellbeing Identity architecture image here.]
The architecture contains eight nodes.
GivenIdentity
Given Identity contains institutionally issued or inherited facts: legal name, date of birth, nationality, language and other social markers.
These facts may be required for access. They should not become the complete definition of the person.
A caste marker, for example, may be relevant for a constitutional entitlement, historical record or participant-chosen context. That does not entitle every verifier, employer or community to receive it.
Given Identity establishes legibility. It does not establish destiny.
EarnedIdentity
Earned Identity contains credentials, validated contributions, portfolio records and community attestations.
This is where credential infrastructure becomes relevant. An attestation produced through ~SAOcommons may later be packaged into a portable credential and carried across institutional boundaries.
But the credential is the final output. Its legitimacy depends on the activity, proof, validator, community authority, policy version and dispute path behind it.
RentedIdentity
Much of what we currently call identity is rented.
A job title is rented from an employer. A platform rating is rented from a platform. A follower count is rented from an account provider. A verified badge may vanish because a company changes policy or a subscription payment fails.
These identities affect opportunity, but we do not control them.
Naming this category RentedIdentity prevents us from mistaking platform dependence for ownership. A 4.9-star profile is a lease with a login screen.
Skills
Skills are separated from credentials because the two are not identical.
A credential tells us that an issuer made a claim. A skill record should show evidence, level, trajectory and context. It should help us understand what has been demonstrated, where it was demonstrated and how the capability is changing.
A certificate can remain static for twenty years. A skill cannot.
MoralCompass
Moral Compass contains chosen values, practiced virtues and commitments through which we orient action.
This cannot become an employer’s morality score or a public righteousness leaderboard. No institution should be allowed to declare that one participant possesses 8.4 units of integrity while another is spiritually undercollateralised.
Its purpose is reflective coherence: whether our actions remain aligned with commitments we chose.
It is a compass, not a court.
Story
Data gives us events. Story gives those events continuity.
A performance gap may look like decline until recovery appears in the longer arc. A missed deadline may look like unreliability until caregiving context becomes visible. A career transition may appear fragmented until its skill thread is understood.
Story does not mean publishing the raw Value Log. It means allowing the participant to create a contextual, audience-specific account of change.
The system should remember enough to stop repeatedly misunderstanding us, but not so much that identity becomes a compulsory autobiography.
IdentityState
Identity State contains W-history, direction and convergence over time.
It is not a permanent score stamped onto the person. It is a time-dependent record of state and movement across the six Wellbecoming nodes.
Two identical scores may conceal different trajectories. One participant may be recovering. Another may be declining. The direction, composition, confidence and freshness of the underlying signals matter.
Most importantly, Identity State is not human worth.
A thermometer records temperature. It does not decide whether the patient deserves care.
ConsentAndDisclosure
Consent and Disclosure governs who may see what, for which purpose, for how long and with which revocation or correction rights.
In the full stack, it appears as one of the eight identity nodes. Architecturally, it is also the control plane surrounding all the others.
A skill verifier may receive evidence of a demonstrated capability without receiving emotional history. A community may validate a contribution without accessing private physiological records. A public profile may show selected credentials without exposing raw proof, validator reasoning or W-history.
One canonical identity can therefore produce several projections:
a private self-view;
a community-specific projection;
a public projection.
Without this control plane, Wellbeing Identity becomes Aadhaar with a mood ring.
Not everything legible should be visible.
Where credential infrastructure can plug in
The Linux Foundation keynote does not describe a competing architecture. It describes infrastructure that may carry some outputs of this architecture.
A possible sequence looks like this:
~WellbeingIdentityupdates the permitted identity nodes and generates a consented projection.~~GivenIdentity Facet
Aadhaar
~~EarnedIdentity Facet
OpenCred or another credential mechanism packages the approved claim.
The Decentralized Directory helps the verifier resolve whether the issuing institution or community is recognised.
Digilocker can store the docs
~SAOcommonsvalidates the Performance contribution under a community policy.~~SkillLevel can be an OpenCred
The credential travels without the participant surrendering the entire underlying identity.
This remains an interoperability hypothesis, not an implementation claim. We do not need to rebuild every wallet, registry or credential standard merely because protocol diagrams are addictive.
OpenCred may carry the credential.
The Internet of Value must specify the human-value process from which the credential emerged.
The distinction can be stated simply:
The credential is the travelling output. Trust is the governed process that made it legitimate.
Open source does not automatically mean open power
The keynote is right about one thing that protocol builders regularly underestimate: governance is not an appendix.
Networks for Humanity argues that a global trust layer cannot be controlled by one company or one country. Neutral convening, open development and institutional alignment are treated as part of the infrastructure. The panel also acknowledges that alignment among institutions often takes longer than building the technology itself.
That lesson applies directly to The Internet of Value.
Open source makes code inspectable. Open standards make implementations interoperable. Open governance determines whether affected participants can shape the rules. Public infrastructure requires continuity, accountability, alternatives and redress.
A GitHub licence is not a constitution.
This is why community policy, validator authority, consent rules, versioning, correction, dispute resolution and prohibited uses belong inside the protocol design. The Internet of Value Research Foundation is not paperwork standing beside the technical system. Its stewardship, disclosures and governance boundaries are part of whether the system can be trusted.
The first product still needs to remove a queue
DigiYatra did not gain adoption because travellers developed a passionate interest in decentralized identity. It addressed a painful queue.
OpenCred does not matter because portable credentials make conference slides more symmetrical. It matters because workers should not lose an opportunity while an employer waits for someone at an institution to answer the phone.
The Internet of Value also needs a queue it can remove now, rather than a civilization it promises to redesign later.
Our queue is the distance between lived activity and recognised value.
At present, every new employer, project, platform or community asks us to reconstruct meaning from zero. We upload the résumé again, explain the work again, provide the evidence again, rebuild trust again and watch the context disappear again.
The Value Log is our first attempt to reduce that queue.
We record a day once. The narrative is converted into time-bound occurrences. We review what was inferred. Selected activities may be validated by relevant communities. Performance occurrences may be valued under a declared policy. Appropriate identity nodes may be updated. A credential may eventually travel without the raw life travelling with it.
Capital enters a new system carrying history, ownership and liquidity.
Human beings arrive with three photocopies and an apologetic email.
That is the queue we are trying to remove.
From portable credentials to contextual trust
Aadhaar can help establish identity.
UPI can move money.
The Decentralized Directory can identify recognised issuers.
OpenCred can carry a signed credential.
The four protocols of The Internet of Value ask what must happen before that credential should exist:
What happened?
What evidence supports it?
What did it do to the participant?
What did it contribute to a community?
Who had the authority to validate it?
Which policy governed the judgment?
How may the judgment be challenged?
What should become part of identity?
What may travel, to whom and for which purpose?
That is why VHTTP remains useful.
In 2024, it was one overloaded Human Interaction Layer. Today, it is the envelope connecting Value Capture, Wellbecoming, SAOcommons and Wellbeing Identity.
The Internet of Value is the science and art of valuing time. It is science because claims require schemas, proof, policy, validation, replay and audit. It is art because no schema gets to decide what a life means.
Credential infrastructure can prove that a certificate is real.
Human trust infrastructure must ensure that the human behind it does not become a certificate.
Hope to work closely with the Networks for Humanity folks in this regard.
- moses sam paul