Architecture

A capability mesh in layers. The generic, mandatory primitives — Identity (L0), Transport (L1), Content (L3) and Naming (L4) — have frozen semantics. Money (L2) is pluggable (an ecash / settlement adapter per community); Compute (L5), Coordination (L6) and Trust (L7) are swappable capabilities on top.

Layer	Responsibility	Implementation
L0 Identity	keys, sign/verify (self-certifying NodeId)	ed25519 + DAG-CBOR (`src/identity.rs`)
L1 Transport	dial-by-key, QUIC	`iroh` 1.0 (`src/net.rs`)
L2 Money	hold/transfer/redeem bearer ecash	ecash + payments (`src/ecash.rs`, `src/payment.rs`)
L3 Content	content-addressed blobs (put/get)	BLAKE3 store (`src/blob.rs`)
L4 Naming	signed records, mutable pointers (publish/resolve)	signed Spaces (`src/space.rs`)
L5 Compute	sandboxed, fuel-metered code (run)	Wasmtime 45 (`src/capsule.rs`)
L6 Coordination	scoped agreements binding capsule + payment (agree)	Pacts (`src/pact.rs`)
L7 Trust	replay a receipt -> same fuel/output (verify)	verifier role (`src/node.rs`)

The spine

The core crate is small and flat — one error type, no hidden state.

src/identity.rs   ed25519 keys; canonical-payload sign/verify (verify_strict)
src/blob.rs       BLAKE3 content store; verify-on-read
src/capsule.rs    deterministic, fuel-metered, deny-by-default Wasmtime
src/space.rs      signed records: per-author seq + TTL prune
src/pact.rs       ServiceCard / Quote / Receipt + the JobPact transition engine
src/payment.rs    PaymentAdapter trait + LocalCredit
src/ecash.rs      real Chaumian ecash (BDHKE on Ristretto255)
src/wallet.rs     Ed25519-signed-transfer ledger (alt payment adapter)
src/node.rs       a node: requester / provider / verifier roles
src/net.rs        iroh QUIC transport: pool, rpc, fetch_blob, serve
src/proto.rs      wire protocol: Request / Response (canonical DAG-CBOR)
src/llm.rs        Llama-2 inference, run as a WASM capsule (weights via env.blob_read)
src/bin/verse.rs  the CLI

Not layers

Two things people expect to find in the stack are deliberately not numbered layers:

Discovery / routing is not a layer. It is a soft-state index (which keys hold which hash) plus gossip that rebuilds itself — a catalog Space and registry living over Naming, never a foundation anyone must run.
Apps are not a layer. Agents, models, and grants (the CLI and src/llm.rs, e.g. Llama-2 inference run as a capsule) are built on the eight ideas, above and outside the stack.

Money (L2) is the one durable island, but only the mint’s clearing/reserve is a small optional trusted island that enforces scarcity. The bearer coin itself is the L2 foundation: possession of the bytes is the balance, so a node that cannot run Compute can still hold Money.

One binary, many roles

The same binary acts as mint, provider, verifier, registry, store, stage, bridge, guardian, or client. (There is no model role — inference runs as an ordinary capsule, so its receipt is replay-verifiable like any other.) Roles are capabilities, not separate protocols. A node reaches others only through the signed protocol — capsules run deny-by-default (no ambient network, wallet, or clock).

Continue to The protocol.