> For the complete documentation index, see [llms.txt](https://parad0xlabs.gitbook.io/parad0xlabs-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://parad0xlabs.gitbook.io/parad0xlabs-docs/web0-how-it-all-connects/web0-stack.md).

# The Stack

DNS is owned. Payments are gatekept. Identity is surveilled. Compute is centralized. Web0 is not one product. It is six layers that replace each of those with cryptographic protocols on Solana — and a `.null` domain is the address that resolves all six at once.

***

## The Full Stack Diagram

```mermaid
flowchart TB
    subgraph L1["Layer 1 — Discovery"]
        EXT["null-resolver\n(Chrome MV3 extension)"]
        PDA["NullDomain PDA\n(314 bytes on-chain)"]
        EXT -->|"derive seeds + RPC fetch"| PDA
    end

    subgraph L2["Layer 2 — Content"]
        AR["Arweave\n(ANS-104 path manifest)"]
        TURBO["@ardrive/turbo-sdk\n@irys/sdk"]
        TURBO -->|"upload"| AR
    end

    subgraph L3["Layer 3 — Identity"]
        DP["Dark Null Protocol\n(Parad0x-Labs/Dark-Null-Protocol)"]
        ZK["Groth16 / BN254\nlocal prover"]
        ZK -->|"passport_hash"| DP
    end

    subgraph L4["Layer 4 — Payments"]
        X402["dna-x402\n(x402-gate + x402-pay)"]
        USDC["USDC on Solana\n(facilitator cosigns)"]
        X402 -->|"on-chain receipt"| USDC
    end

    subgraph L5["Layer 5 — Compute"]
        NULLA["nulla-local\n(MeshTaskRouter + CreditLedger)"]
        PEERS["NULLA peer mesh\n(Ed25519 signed bids)"]
        NULLA <-->|"TASK_OFFER / TaskBid"| PEERS
    end

    subgraph L6["Layer 6 — Proof & Reward"]
        DAG["Receipt-DAG\n(x402 receipt → task_id → WorkProof)"]
        MEMO["SPL Memo tx\n(proof hash anchored on-chain)"]
        DAG -->|"SHA-256 proof"| MEMO
    end

    subgraph EXT_SOLANA["Solana Mainnet — LIVE programs"]
        REG["null_registrar\nid pending (config)"]
        AUC["null-auction (English + capped fee)\nid pending (config)"]
        AGATE["dark_x402_access_gate\nid pending (config)"]
        NULLIF["dark_nullifier_record\nid pending (config)"]
        REPGATE["dark_reputation_gate\n9nN7UTTT…"]
        RCT["receipt_commitment_tree\n8jC8QGiD…"]
        RANCH["receipt_anchor\n6HSRGiv…"]
    end

    subgraph EXT_ARWEAVE["Arweave"]
        GW["Gateway fallback\nirys → arweave.net → ar.io"]
    end

    PDA -->|"arweave_txid field"| AR
    PDA -->|"passport_hash field"| DP
    PDA -->|"x402_endpoint field"| X402
    AR --> GW
    X402 --> L6
    NULLA --> L6
    L6 --> MEMO
    MEMO --> EXT_SOLANA
    PDA --- EXT_SOLANA
```

***

## The Resolver Is The Keystone

A single `.null` domain PDA is 314 bytes. Inside those bytes live three pointers. Resolve one name and you have the full stack: where the content lives, how to pay for access, and who the operator is.

```mermaid
flowchart LR
    NAME["parad0x.null"] -->|"sha256(name) → seeds"| PDA

    subgraph PDA["NullDomain PDA"]
        F1["arweave_txid\n(bytes 97–128)"]
        F2["x402_endpoint\n(bytes 129–256)"]
        F3["passport_hash\n(bytes 257–288)"]
    end

    F1 -->|"fetch manifest"| L2["Layer 2\nArweave content"]
    F2 -->|"HTTP 402 rail"| L4["Layer 4\nx402 payment gate"]
    F3 -->|"verify commitment"| L3["Layer 3\nDark Passport identity"]
```

No DNS lookup. No ICANN. No API key. The PDA derivation is deterministic from the name alone — any client with an RPC endpoint can resolve it independently.

***

## What Happens In A Full Stack Transaction

One agent, one name, one atomic flow from discovery to auditable receipt.

```mermaid
sequenceDiagram
    participant Agent
    participant Resolver as null-resolver (L1)
    participant PDA as NullDomain PDA
    participant Passport as Dark Passport (L3)
    participant Gate as x402-gate (L4)
    participant PayClient as x402-pay (L4)
    participant NULLA as NULLA mesh (L5)
    participant Solana as Solana Mainnet (L6)
    participant DAG as Receipt-DAG (L6)

    Agent->>Resolver: navigate parad0x.null
    Resolver->>PDA: fetch account (RPC)
    PDA-->>Resolver: arweave_txid + x402_endpoint + passport_hash
    Resolver-->>Agent: endpoint URL + identity commitment

    Agent->>Passport: verify passport_hash against reputation threshold
    Passport-->>Agent: reputation ≥ threshold (ZK proof valid)

    Agent->>Gate: GET x402_endpoint
    Gate-->>Agent: HTTP 402 + X-Payment-Details (amount, token, chain, facilitator)

    Agent->>PayClient: authorize payment (hard spend cap check)
    PayClient->>Solana: broadcast USDC tx
    Solana-->>PayClient: confirmed tx signature
    PayClient->>Gate: retry with X-Payment-Receipt header

    Gate->>Gate: verify receipt (request_hash + facilitator sig)
    Gate-->>Agent: 200 OK — task accepted

    Agent->>NULLA: MeshTaskRouter.broadcast_task()
    NULLA->>NULLA: peers reply with TaskBid (model, credits, Ed25519 sig)
    NULLA->>NULLA: CreditLedger.spend() escrows credits
    NULLA->>NULLA: winner executes task
    NULLA->>NULLA: SHA-256(task_id + result + node_id) = proof_hash

    NULLA->>Solana: SPL Memo tx (proof_hash anchored)
    Solana-->>NULLA: confirmed

    NULLA->>DAG: link x402 receipt_id → task_id → WorkProof → SPL Memo tx
    DAG-->>Agent: audit trail complete — receipt retrievable by receipt_id
```

***

## The Keystone Gap

The diagram above is the target architecture. Several pieces are now live on mainnet (see the Repo Map); here is the state of what is — and isn't — wired yet.

**Layer 4-5 wire does not exist.** `ComputeRentalMarket.rent()` is an in-process stub. The x402-pay client and the NULLA MeshTaskRouter are separate systems that do not talk to each other. Payment receipt IDs are not passed into task context.

**NULLA credits are SQLite-local.** `CreditLedger` writes to `mesh_credit_ledger` on disk. Credits do not settle to SPL. There is no export path to on-chain NULL tokens yet.

**x402 settles USDC separately.** The x402 facilitator cosigns receipts and confirms on-chain payment — but that confirmation loop is not feeding back into credit issuance or task routing.

**The on-chain receipt layer is live; the DAG graph is not.** `receipt_anchor` and `receipt_commitment_tree` are deployed on mainnet, so receipts are anchored and a Merkle root of them exists today. What's still unbuilt is the higher-level graph that links `x402 receipt_id → task_id → WorkProof` into one traversable structure.

**Dark Passport: the verifier IS on-chain now.** `dark_reputation_gate` is deployed on mainnet (`9nN7…`) and a real private-track-record proof **verified on mainnet** (`4eJCm2G9`), with replay / forged / tampered all rejected. What's left is wiring the *specific* Passport circuits (job-count / success-rate / earnings) onto it plus finality-grade anchoring; the `passport_hash` PDA field is already writable via `UpdatePassport` (0x07).

The immediate build target is the Layer 4-5 wire: x402-pay calls `NULLA.broadcast_task()`, task completion writes proof hash, proof hash links back to the receipt ID, receipt ID closes the loop to the on-chain USDC settlement.

***

## What Makes Web0 Different

| Existing solution          | What controls it                                  | Web0 equivalent  | What controls Web0                                                |
| -------------------------- | ------------------------------------------------- | ---------------- | ----------------------------------------------------------------- |
| GoDaddy DNS                | ICANN / GoDaddy TOS                               | `.null` PDA      | Solana validators (1000+)                                         |
| AWS / Cloudflare CDN       | Amazon / Cloudflare                               | Arweave          | 500+ independent storage nodes                                    |
| Stripe / PayPal            | Payment company TOS, KYC                          | x402 USDC        | Cryptographic receipt (`request_hash` + facilitator sig)          |
| LinkedIn / GitHub identity | Platform; account deletion destroys history       | Dark Passport    | ZK math (Groth16 / BN254); proof is local, commitment is on-chain |
| Vast.ai / io.net compute   | Platform controls job assignment, pricing, oracle | NULLA mesh       | Challenge-response proof; no platform between task and payment    |
| Google / ENS search        | Google algorithm / ENS Labs governance            | `.null` resolver | Deterministic PDA derivation from name hash alone                 |

The critical distinction from every existing DePIN network: there is no oracle between task completion and payment. Grass, io.net, Helium, and Render all have a centralized layer — a foundation-owned database, a proprietary validator, or OTOY — that decides whether work was done and what the reward is. x402 receipt = `request_hash` + on-chain tx + facilitator signature. The receipt is the proof. No third party decides. The facilitator cosigns but does not allocate rewards and does not run a work-verification database.

Akash comes closest — true on-chain escrow per block — but has no work verification at all. Payment flows regardless of delivery. Web0's model adds `SHA-256(task_id + result + node_id)` committed before reveal, anchored via SPL Memo, linked to the x402 receipt. Work is verified cryptographically, not by a platform.

***

## Repo Map

The six protocol layers, status as of June 2026:

| Layer          | Repo                                         | Status                                                                                                                                                                      |
| -------------- | -------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| L1 — Discovery | `null-resolver/`                             | **LIVE** — Chrome extension resolving `.null` on mainnet                                                                                                                    |
| L1 — Registrar | `null-registrar`                             | **LIVE** — program id being finalized (retired/superseded — see config (pending))                                                                                           |
| L1 — Auction   | `null-auction`                               | **LIVE** — English (open-ascending) resale + 1–3 char premium, capped fee; program id being finalized (retired/superseded — see config (pending))                           |
| L2 — Content   | Arweave (turbo-sdk / irys)                   | **LIVE** — `parad0x.null` serving Arweave                                                                                                                                   |
| L3 — Identity  | `dark-null-protocol/`                        | **LIVE (primitive)** — `dark_reputation_gate` deployed (`9nN7…`); a real track-record proof **verified on mainnet** (`4eJCm2G9`). Full Passport circuits in progress.       |
| L4 — Payments  | `dna-x402/`                                  | **PARTIALLY LIVE** — `dark_x402_access_gate` live on mainnet (program id being finalized — retired/superseded — see config (pending)); x402-gate/pay middleware in progress |
| L5 — Compute   | `nulla-local/`                               | **LOCAL ONLY** — mesh runs locally; the on-chain settlement wire is the open build target                                                                                   |
| L6 — Proof     | `receipt_anchor` + `receipt_commitment_tree` | **LIVE** — both anchored on mainnet (`6HSRGiv…`, `8jC8…`); the higher-level Receipt-DAG graph still to build                                                                |

**Live privacy programs on Solana mainnet** — the Dark NULL stack (missing from older diagrams):

| Program                   | Address                                        | Does                                 |
| ------------------------- | ---------------------------------------------- | ------------------------------------ |
| `dark_x402_access_gate`   | retired/superseded — see config (pending)      | private pay-to-access                |
| `dark_nullifier_record`   | retired/superseded — see config (pending)      | double-spend / replay shield         |
| `dark_reputation_gate`    | `9nN7UTTT5hgKnc2LZTqr3qaLLSt5PxWUrDbpUTGYHRxp` | prove a track record, reveal nothing |
| `receipt_commitment_tree` | `8jC8QGiDJRRxhbPXMX5wJnGUq89xJZ2LsHMdbn2urCas` | Merkle root of private receipts      |

***

## The Full Product Family

The six layers are the *protocol*. These are the products people install and pay for — each stands on the layers above. (The data/evidence/media products were missing from earlier versions of this page.)

| Product                                                                                                  | Tier      | What it is                                                         |
| -------------------------------------------------------------------------------------------------------- | --------- | ------------------------------------------------------------------ |
| [`.null` / null-resolver](/parad0xlabs-docs/null-resolver-.null-domains/null-resolver.md)                | Discovery | Own your name and your corner of the web                           |
| [DNA x402](/parad0xlabs-docs/dna-x402-payment-rail/dna-x402.md)                                          | Payments  | Pay-per-call HTTP money rail                                       |
| [Dark Null Protocol](/parad0xlabs-docs/dark-null-protocol-zk-privacy-and-identity/dark-null-protocol.md) | Identity  | Prove who you are without saying who you are                       |
| [NULLA Local](/parad0xlabs-docs/nulla-local-compute-mesh/nulla-local.md)                                 | Compute   | Local-first agent runtime + mesh                                   |
| [Liquefy](/parad0xlabs-docs/liquefy-compression-+-proofs/liquefy.md)                                     | Data      | Compression that beats Zstd, with proofs (MIT)                     |
| [Nebula Media](/parad0xlabs-docs/nebula-media-proof-carrying-media/nebula-media.md)                      | Media     | Proof-carrying video/audio compression (MIT, open-core)            |
| [**OpenClaw Vault**](/parad0xlabs-docs/openclaw-skills-+-agent-flight-recorder/openclaw.md)              | Evidence  | **The agent flight recorder — the first multi-user product** (MIT) |

**OpenClaw is the keystone product:** it uses Payments (x402 receipts) + Identity (Agent Passport) + Proof (Solana anchor) + Data (Liquefy) all at once — which is exactly why it's the first thing a business buys. Web0 is the protocol; OpenClaw is the first product built on the whole thing.

**The whole family is MIT-licensed and open** — no closed cores, no commercial-license tiers. Where we charge, it's for managed hosting, scale, and support, never for the code.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter:

```
GET https://parad0xlabs.gitbook.io/parad0xlabs-docs/web0-how-it-all-connects/web0-stack.md?ask=<question>
```

The question should be specific, self-contained, and written in natural language.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.