Shelter Protocol

Integrated P2P Runtime

An open protocol for creating end-to-end encrypted, federated, user-friendly web applications. Defines a lightweight federated virtual machine based on signed, ordered "contract chains" (event logs) with E2E encryption primitives. The reference implementation is Chelonia (a JS framework). Group Income (voluntary basic income app) is the primary production use case. Governance: okTurtles Foundation (501(c)(3) non-profit).

Community
Links
Visit Community

Details

License AGPL-3.0 (Chelonia / chel CLI); protocol spec open (MIT)
Dev Status 🔬 Beta
Dev Status Detail Active — Chelonia CLI updated Feb 2026; Group Income beta testing ongoing
Owner okTurtles Foundation (501c3 non-profit)
Country USA (Washington D.C.)
Start Year 2019
Stack JavaScript / TypeScript (Chelonia); VueJS 2.x (Group Income UI); Hapi.js (server); WebSockets; SBP (Selector-based Programming, custom micro-framework); WebAssembly sandbox for smart contract execution
Funding Donations (BTC, XMR, ZEC, USD); GitHub Sponsors; grant requests from aligned orgs; DWeb event participation
Last Investigated Mar 9, 2026

Use Case Domains

Communication Platform Evolution & Sovereignty Group Formation & Governance

Affordances

End-to-end encrypted Composable groups Self-hostable Consent-based governance

Integrated P2P Runtime Attributes

Origins Evolved from Group Income's technical requirements — okTurtles Foundation needed an E2E encrypted, federated application layer to build voluntary basic income app without server-side data visibility. Published as standalone protocol spec ~2019-2022.
Database Custom append-only message log (contract chains) persisted server-side; each contract chain is a self-referencing CID-addressed event log stored in server key-value store; state reconstructed by replaying events
Query Language None (event-sourced state; no query language)
Data Formats JSON (SPMessage format); BLAKE2b-256 content IDs (CID, Base58 encoded); shelter: URI scheme for addressing resources; JWS-compatible signatures
Collaborative Live Editing No native CRDT collaborative editing; shared mutable state via contract chain event sourcing and reactive Vue state updates
Rich Text Editing No (text-based messaging; no rich text primitives in protocol)
Mobile Support No native mobile SDK; web app accessible via mobile browser; Tauri mentioned as recommended distribution approach for security
Web Support Yes — browser-native; primary deployment target is web application
Native Apps Tauri-based desktop packaging recommended in security docs; no official native mobile app
Terms okTurtles Foundation non-profit; no commercial terms; Group Income app open source
Funds FY2022: $11,122 + 4.49 BTC + 132.9 XMR received; $57,748 + 1.95 BTC + 440 XMR paid out
Based On ActivityPub (federation concepts); IPFS/CID (content addressing); event sourcing / CQRS patterns; zero-knowledge sub-protocols for password salt retrieval
P2P Architecture Federated server model (servers relay contract chain messages to subscribers); clients store/reconstruct local state; servers cannot read encrypted payloads
Overlay Network None — uses existing HTTP/HTTPS + WebSockets; server federation via standard web protocols
Content Addressing Yes — BLAKE2b-256 CIDs (Base58 encoded) address all resources; shelter: URI scheme; first SPMessage in chain is CID of the contract
Local-First Partial — state reconstructed locally from replayed events; offline: events queued but requires server sync for propagation; state snapshots reduce replay cost
E2EE Yes — OP_ACTION_ENCRYPTED for encrypted actions; OP_KEY_ADD/OP_KEY_SHARE for key management; ZK sub-protocol for password salt retrieval without revealing password to server; unique keys per device optional; EdDSA/ECC primitives; cipher-agnostic by design for post-quantum upgrade path
CRDTs Lib No — uses ordered event logs (deterministic replay); no CRDT library
Byzantine Fault Tolerance No formal BFT — federated trust model; server operators are trusted; contracts upgradeable by authorized keys
Signature JWS-compatible signing (JSON Web Signatures); OP_KEY_ADD / OP_KEY_SHARE primitives; signingKeyId referenced per message; ECC (cipher-agnostic design)
Permissions Capability-based key authorization: each SPMessage references a signingKeyId and encryptionKeyId defined at contract creation; OP_KEY_ADD grants new keys (multi-device); OP_KEY_SHARE shares secrets between keys; role/function authorization model customizable per contract; server cannot override client-side key permissions
Semantic Web Compatibility None — no RDF, JSON-LD, or linked data primitives
Smart Contract Yes — "contracts" are upgradeable programs (any language) that process OP_ACTION events against shared state; WebAssembly sandbox recommended; Contract Manifest defines versioned contract code; state transition defined per event type; analogous to OOP class/instance model
Protocol Stack Position Application layer — sits above TCP/IP and HTTP/WebSockets; provides encrypted federated application VM layer; comparable to ActivityPub at a higher abstraction level (application runtime vs. social protocol)
Asset / Value Embedding None — no native token or asset primitives in protocol
Development Tools Chelonia (JS/TS framework, AGPL-3.0) — reference implementation of Shelter Protocol for browser and Node.js; @chelonia/cli (chel) — CLI utility (TypeScript, AGPL-3.0); @chelonia/crypto, @chelonia/lib, @chelonia/serdes — npm packages; @sbp/sbp — Selector-based Programming micro-framework; Group Income codebase as reference application
Deployment Options Self-hosted server (Hapi.js); web app served separately from server (recommended for security — prevents malicious JS injection); Tauri for desktop app distribution; server stores encrypted contract chains; clients reconstruct state locally
Authentication & Identity Identity Contract (customizable per app): stores username, email, profile picture as E2E encrypted state; unique keypairs per device (EdDSA); ZK-based password/salt authentication without exposing password to server; OP_KEY_ADD for multi-device keyset management; no centralized identity registry
Storage Model Server-side append-only contract chain storage (encrypted blobs); client-side reconstructed application state; optional state snapshots every N messages for sync efficiency; CID-addressed immutable messages
Interoperability Low — Shelter Protocol is self-contained; no ActivityPub federation (despite conceptual borrowing); no DID/VC integration; shelter: URI scheme is custom; no standard identity or data portability interfaces
Social Graph Application-defined via contracts; no native social graph primitives; Group Income implements group membership via identity + group contracts
Protocol Maturity / Standardization Custom / Community spec — not submitted to any SDO; spec published at shelterprotocol.net; shelter: URI scheme documented informally; Chelonia is alpha/beta; Group Income in beta testing
Update Policy Contracts are explicitly upgradeable — each event references a specific contract version; new versions can be deployed; state replay uses version-tagged events; key rotation supported via OP_KEY_ADD/REVOKE