Draft proposal · No agreement in place · Nothing has been awarded

Review proposal

wsu.life · Node three · A proposal to the Utah Board of Higher Education

Prove what you
already earned.Once.

Two-thirds of Weber State's associate-degree earners come back within a year for another credential and every one of them pays a cost in time to prove something already true.

Weber State is also the third node, built from the published specification alone
the only real test of whether any of this is reusable.

Explore the idea Funding details
Abstract

The problem
and the test

Weber State University brings the problem and the test. Two-thirds of its associate-degree earners return within a year for another credential and pay a cost in time to prove what is already true. Weber State comes online third, built from the published specification alone with no hands-on help — the only real test of whether any of this is reusable. It issues from its own keys and cannot read what any other institution issued.

Proposed subaward: $330,000. No agreement exists and nothing has been awarded.

What you get

Eight things you can actually do

Start here. The rest of this page is how it works and who controls it which matters, but this is what it is for.

01

Identity

Prove one thing without showing everything

A landlord who needs to know you are enrolled receives enrolled: yes. Not your transcript, not your address history. The rest never leaves your phone.

02

Payments

Pay, get paid, and never pay a fee

Tuition, lunch, a parking pass, a campus paycheck. Today a $3,000 tuition payment by card costs around $88 in fees. Here it costs nothing.

03

Endorsements

Keep the proof when someone vouches for you

A professor's recommendation, held by you signed, verifiable, reusable. It does not expire when they change jobs.

04

Reputation

Show what you have actually done

Projects finished, hours served, skills demonstrated — all portable, all yours. No rating, no rank, no leaderboard.

05

Agreements

Sign it and hold your own copy

Enrollment forms, housing leases, work agreements. Proof of who signed and exactly what they signed, held by both parties.

06

Credentials

Prove what you earned, once, forever

Certificates, degrees, competencies verified in seconds without anyone phoning a registrar.

07

Community

Connect without becoming the product

Campus messaging, groups, and mail on open protocols, on infrastructure your own university operates. Nobody is mining it.

08

Your own intelligence

An assistant that works from what you hold

No standing access to anything. When it needs authority it asks for exactly one thing, for one purpose, expiring, revocable with one tap.

Who holds your record is the whole question.

Everything you use today works the same way. Some company or some office holds your record, and lets you look at it. Your grades, your money, your signature, your messages. You are the subject of the file, not the owner of it.

That arrangement is not a law of nature. It is a design choice, made when there was no cheap way to prove something was true without a trusted middle. There is now.

A key is the thing only you have, that proves something came from you. A node is the place an institution keeps its own keys, so no single school and no single company sits in the middle of everyone else. That is the entire mechanism.

Not decentralized instead of centralized. Decentralized authority, pointed at a centralized model. The model becomes a tool you aim — it stops being a party you are exposed to.

Role

The replication node,
and the one that
brings the problem

Weber State does two things no other partner can. It supplies the problem this project is trying to solve, stated in its own data. And it is the independent test of whether any of this is reusable. Every one of those returning students pays a friction cost to prove what they have already earned — that cost is measurable, and reducing it is the project's clearest dollar-denominated outcome.

7,553

Credentials awarded by Weber State in 2024–2025

969

Of them certificates

2 in 3

Associate-degree earners return within a year

80%

Tested reference implementations at population scale today

The lock can change.
The address never does.

Everything on this page rests on one small piece of machinery: the keys that prove a record is yours. Four questions every person actually asks - where keys come from, what happens when one is stolen, what happens when a phone is lost, and how an assistant can use any of this without learning who you are.

01 · Origin
Derived keys

One secret on your device quietly produces a separate key for every place you use it. Nobody can connect them.

02 · Change
Rotating keys

Retire a key and name its successor without changing who you are on the network.

03 · Recovery
Key restoration

A lost phone is an inconvenience not the loss of your degree, your money, or your history.

04 · Delegation
Your intelligence hires theirs

Your own directed intelligence uses a large model without ever handing it who you are.

One root, many keys
Your root secret
  • Never leaves the device
  • Never sent to a server
  • Never seen by your university
Identity key
DKX7...9MQ2

Shown to the registrar

Payments key
DA3M...PV8L

Shown to campus merchants

Agreements key
DQP9...T4XC

Shown to a counterparty

Community key
DZT4...BR6N

Shown to the comms server

Derivation runs one direction. A key can be produced from the root, but the root cannot be worked backward out of a key. Because each party is handed a different key, two of them comparing notes learn nothing: the registrar and the campus store hold values that look unrelated. This is what an automated system cannot follow. A platform, or a model, that sees your key at one place and your key at another has no mathematical way to know they belong to the same person. There is nothing to stitch. You do not memorize any of this and you never type a key.

Never changes, not once
Signing key DKX7...9MQ2
In Force
Next key, sealed EJ9K...W2FS

Each entry in your record does two jobs. It signs with the key in force at that moment, and it seals a fingerprint of the key that will come next. The successor is committed before it is ever used, so a thief who takes today's key still cannot name tomorrow's. Rotating is a normal event in the log, not a new account.

Try a signature from the retired key

A verifier replays this log from the beginning. It accepts a signature only if the key was in force at the sequence number where the signature was made.

Survives a lost device
The phone you lost DQp9...t4Xc key held here
Your new phone nothing on it yet
Witness nodes holding your log. Any 3 of the 5 is enough.
UVU node BUV1...7RK4
idle
UVU node BUV1...7RK4
idle
Weber State node BWB3...Q2LN
idle
State archive BST4...M6YD
idle
ClearFoundation node BCF5...V8HA
idle
agreement: waiting replayed: none

Not one of these nodes can read your record. They hold a signed log and confirm what order it happened in. No node can issue a key. Only your root can.

How it works
Never shown to any model
Your device
  • root secret,never leaves
  • your record, held here
  • your rules, set by you
Your directed intelligence
  • reads your record locallydecides what to ask, and how littleissues authority one grant at a time
The grant
  • Key: none yet
  • Purpose: compare two transfer paths
  • Discloses: credits earned, 64 credits
  • Not disclose: name, ID, grades
  • Expires: in 10 minutes
  • minutesrevocable: one tap
A large model

Public, or private and non public

  • Sees: a fresh identifier
  • Sees: the question, the 64 credits
  • Never: your root
  • Never: your other keys
  • Never: your history
  • Never: standing access
State: idle

This is the difference between directed digital intelligence and artificial intelligence in one picture. Yours runs on your device, reads your record locally, and decides how little to ask. Theirs is very good at language and reasoning, and it gets exactly one scoped grant, under a key that was made for this request and will never be used again. When the grant expires the model holds nothing it could use to find you, and the next request arrives under a different key it has never seen. Public model or private one, the boundary is the same. You direct yours. Theirs hires theirs.

A stolen key is not a stolen life

Rotation retires the old key in the same record that names the new one. The theft becomes a dated line in your history instead of the end of it.

Old signatures keep standing

The log says which key was in force when, so a transcript signed two years ago still verifies after four rotations. No re- issuance, no fees.

Nobody can do it for you

Your university can issue a credential and witness your log. It cannot rotate your keys or sign in your place and neither can the company that built this.

The model never learns who you are

Every request rides a key made for that request and never used again. Two requests share nothing a model could use to connect them.

One open standard · Nobody owns it

Three universities. You in the middle.

UVU

Utah Valley University
www.uvu.university
Own keys

WSU

Weber State University
www.weber.university
Own keys

USU

Utah State University
www.usu.university
Own keys

Your keys. Your record.

The institutions are peers not branches of a platform. Each can revoke only what it issued, and none can read the others.

Infrastructure

Built in one place, controlled from three

Everything is engineered and hosted from the Canopy campus in Lindon - the reference node, the witnesses, the hosting, the engineering. The keys are not. The standard in the middle is public and belongs to nobody; the keys stay with each university. Take the base away and the standard still exists and the keys still work.

Control

Who controls what, stated plainly

Each university controls its own issuance

Its own keys in its own hardware, its own issuance policy, its own revocation registry. It can revoke what it issued and nothing else. No node can issue on another node's authority or read another node's records.

The person holds the credentials

In a wallet on their device. They choose what to present and to whom, one attribute at a time. Custodial recovery exists and is opt-in and separable - not a back door held by anyone by default.

The standard is shared and open

KERI and ACDC for keys and authentic chained data, W3C Verifiable Credentials for format, OpenID4VP for presentation. The conformance suite is published open source so the state can check any vendor's claim - including ours.

Nobody keeps an aggregate store

There is no central database of who holds what, and nobody can list who verified what. A wallet that is a view onto someone else's server is not a wallet.

Scope

WHAT WEBER STATE IS FUNDED TO DO, AND FOR HOW MUCH

Work package Award Amount
Independent node stood up from published documentation alone HERFP $130,000
Stackable credential and certificate portability HERFP $120,000
Veterans and transfer student cohorts HERFP $10,000
Undergraduate research assistants and local coordination HERFP $30,000
Total subaward $330,000
Zero fees

Nothing, then a subscription the institution can decline

Students pay no fee, no surcharge, and no basis point, and nothing may be passed through to them. The institution pays nothing per transaction either. There is no revenue share anywhere in this model. Earlier drafts of the campus proposal carried a one percent fee on rewards and stored value split between the provider and the university; it has been removed.

Two things make zero credible rather than a slogan. This institution can run its own node, because the specification and conformance suite are published open source – hosting is a convenience, not a lock. And the keys stay here whether it self-hosts or subscribes, so buying hosting never means handing over authority.

Layer Who it serves Price
wsu.life The person: wallet, credentials, agreements, reputation, the agent $0
weber.host The institution: node, witnesses, verification capacity, communications and community servers Subscription, optional
When

What ships now, what follows, what waits

Now · Both awards, year one
  • Identity- prove one fact, not everything
  • Payments- no fee, no surcharge, ever
  • Endorsements- you keep the proof
  • Reputation- attestations, never a score
  • Agreements- signed, and you hold your copy
  • Credentials- verified in seconds
  • Community- on infrastructure your university runs
  • Your own intelligence- one scoped grant at a time

Every one is a real transaction with a real current cost - which is what makes the measurement meaningful.

Phase II · Years two and three
  • Transfer articulation - credit accepted at the next institution, proven once
  • Campus and association voting - eligibility separated from the secret ballot (public elections out of scope)
  • Housing - verified applicants and landlords, gated by fair-housing counsel
  • Transportation - transit, parking, verified carpool
  • Marketplace - verified peer marketplace with escrowed settlement
  • Campus permits - parking, event, lab and facility access as credentials
  • More universities - any USHE institution, from the published specification

Funded inside the awards where the application says so, gated by counsel where noted.

Later · Other issuers
  • Professional licenses - once state licensing boards become issuers
  • Professional certifications - industry and board, alongside academic ones
  • State permits - when a state agency, not a university, is the issuer
  • Employer and civic credentials - the wider Utah Life vision

Not in either application - listed so the roadmap is visible and the scope is honest.

Applications

Two scopes. No double billing.

HERFP Track 1 Not submitted

Research translation · Secure computing

Credential issuance, verification, portability, a conformance suite, trust framework, and adversarial security research.

Request $4.85M
36 months
AI Moonshot Not submitted

Open horizon · Area 5

A pro-human AI agent bound to student-held credentials, with scoped delegation, a consent ledger, and measurement of human agency.

Request $1M
24 months

The proposal states that both applications include a cost crosswalk so no person, equipment item, or cost line is charged twice.
An additional $3.5 million in cost share is offered; its schedule is incomplete.