Documentation Index
Fetch the complete documentation index at: https://docs.algovoi.co.uk/llms.txt
Use this file to discover all available pages before exploring further.
1. Purpose
This document compiles concrete, externally-reproducible evidence that the AlgoVoi canonicalisation substrate has crossed from internal AlgoVoi work into ecosystem-resident infrastructure. Every datum below is reproducible by running the commands in Section 13 against public APIs (PyPI, npm, GitHub, IETF Datatracker). No private telemetry was used.
2. IETF Internet-Draft anchor
Six AlgoVoi-authored Internet-Drafts on the IETF Datatracker, Independent Submission stream, Informational, sole AlgoVoi authorship:
The Independent Submission stream is sponsor-independent. These citation-stable URLs do not depend on the goodwill of any commercial standards-body sponsor.
All six I-Ds expire 2026-11-26 per the IETF six-month rule. Renewal is a single re-submission per draft to extend by a further six months. This is a low-effort quarterly operation included in the diligence-pack maintenance inventory; it does not require IETF approval, working-group sponsorship, or commercial backing.
3. Bibliographic ecosystem inclusion
The AlgoVoi URN urn:x402:canonicalisation:jcs-rfc8785-v1 is indexed in the IETF / Relaton bibliographic catalogue.
| Repository | Matches | Significance |
|---|
ietf-tools/relaton-data-ids | 9 | IETF document-tooling bibliographic data |
relaton/relaton-data-ids | 9 | Relaton citation library, used by IETF, ISO, IEEE, ANSI document toolchains |
4. Published package distribution
Eighteen Apache 2.0 substrate-aligned packages under AlgoVoi sole authorship (nine unique package names, each published on both PyPI and npm). The package list as of 2026-05-28: algovoi-substrate, algovoi-substrate-pqc, algovoi-settlement-attestation, algovoi-refund-receipt, algovoi-cancellation-receipt, algovoi-composite-trust-query, algovoi-rfc9421-verifier, algovoi-audit-verifier, and algovoi-reference-agent. Two additional companion packages (algovoi SDK on PyPI, @algovoi/use-wallet-algovoi on npm) are included in the tables below for completeness.
In addition to the installable packages, three public no-authentication REST endpoints are live at verify.algovoi.co.uk:
| Endpoint | What it verifies | Live since |
|---|
POST /verify | Selective-disclosure audit bundles (hash chain + HMAC signature) | 2026-05-09 |
POST /action-ref | JCS RFC 8785 canonical form + SHA-256 of any action_ref preimage; 8-implementation attested | 2026-05-29 |
POST /rfc9421 | RFC 9421 HTTP Message Signature (Ed25519) + RFC 9530 Content-Digest check | 2026-05-29 |
curl -s -X POST https://verify.algovoi.co.uk/action-ref \
-H "Content-Type: application/json" \
-d '{"agent_id":"did:web:api.algovoi.co.uk","action_type":"payment.authorize","scope":"base:0x2d96f2bc","timestamp_ms":1748534400000}'
# returns: {"action_ref":"sha256:6c3c08eb...","implementations_attested":8,...}
4.1 PyPI substrate-aligned packages (last 30 days)
| Package | Last day | Last week | Last month |
|---|
algovoi-substrate | 252 | 757 | 757 |
algovoi-substrate-pqc | 208 | 208 | 208 |
algovoi-settlement-attestation | 99 | 235 | 235 |
algovoi-cancellation-receipt | 224 | 224 | 224 |
algovoi-refund-receipt | 99 | 239 | 239 |
algovoi-composite-trust-query | 207 | 207 | 207 |
algovoi-audit-verifier | 102 | 227 | 227 |
| PyPI subtotal (7 packages measured) | | | 2,097 |
algovoi-rfc9421-verifier and algovoi SDK lookups were rate-limited at refresh time. Refresh any time via the API in Section 13.)
4.2 npm @algovoi/* scope (last 30 days)
| Package | Last month |
|---|
@algovoi/substrate | 693 |
@algovoi/substrate-pqc | 220 |
@algovoi/rfc9421-verifier | 213 |
@algovoi/settlement-attestation | 220 |
@algovoi/cancellation-receipt | 222 |
@algovoi/refund-receipt | 206 |
@algovoi/composite-trust-query | 219 |
@algovoi/audit-verifier | 211 |
@algovoi/use-wallet-algovoi | 237 |
| npm subtotal (9 packages) | 2,441 |
4.3 Combined and discounted
| Surface | Last month |
|---|
| Raw combined | ~4,500 |
| After 35 percent bot / mirror / scanner discount | ~2,900 real human or CI downloads |
5. Public GitHub fingerprint analysis
GitHub Code Search counts for AlgoVoi-distinctive fingerprints across all public repositories (refreshed 2026-05-28):
| Fingerprint | Total matches | Includes internal AlgoVoi repos |
|---|
urn:x402:canonicalisation:jcs-rfc8785-v1 | 88 | Yes |
urn:x402:canonicalisation:jcs-rfc8785-v2 | 5 | Yes |
draft-hopley-x402-canonicalisation-jcs-v1 | 55 | Yes |
draft-hopley-x402-compliance-receipt | 62 | Yes |
draft-hopley-x402-settlement-attestation | 32 | Yes |
algovoi-substrate (PyPI name) | 110 | Yes |
@algovoi/substrate (npm name) | 94 | Yes |
rfc9421_proxy_chain_v0 (conformance fixture) | 26 | Yes |
algovoi-jcs-conformance-vectors (corpus repo) | 55 | Yes |
canon_version: jcs-rfc8785-v1 (PIN v1 emit) | 132 | Yes |
canon_version: jcs-rfc8785-v2 (PIN v2 emit) | 29 | Yes |
6. External canon_version emit — who is declaring AlgoVoi’s pin in their own code
canon_version: jcs-rfc8785-v1 declared by eight external public repositories:
| External repository | Emit count | Significance |
|---|
ietf-tools/relaton-data-ids | 9 | IETF bibliographic tooling (structural) |
relaton/relaton-data-ids | 8 | Relaton library used by IETF, ISO, IEEE, ANSI |
vauban-org/x402-stark-receipts-conformance | 4 | Vauban Pay emitting AlgoVoi’s pin in their own conformance vectors |
SchemaStore/schemastore | 1 | Public JSON schema catalogue, AlgoVoi PR 5726 merged |
ffflorian/schemastore-updater | 1 | SchemaStore tooling derivative |
andysalvo/action-ref-verify | 1 | Independent verifier emitting AlgoVoi’s pin |
aeoess/agent-governance-vocabulary | 1 | AEOESS Consilium synthesis matrix |
arian-gogani/nobulex | 1 | Nobulex (Adopters Registry member) |
canon_version: jcs-rfc8785-v2 declared by two external public repositories (v2 published 2026-05-26; broader propagation pending):
| External repository | Emit count | Significance |
|---|
aeoess/agent-governance-vocabulary | 1 | AEOESS aware of PQC v2 discipline |
SchemaStore/schemastore | 1 | JSON schema catalogue updated |
7. DID-based keyid resolution usage
AlgoVoi’s RFC 9421 binding extension specifies dual-resolution keyid (DID-based and HTTPS-URL-based). DID-based pattern observed in two adjacent agent-payments extensions:
| External repository | Matches | Context |
|---|
jschoemaker/Envoys-public | 2 | Envoys A2A signature/v1 extension |
agentgraph-co/agentgraph | 1 | Agentgraph (AlgoVoi PR 21 merged upstream) |
8. Substrate Adopters Registry
Six attested external entries at docs.algovoi.co.uk/adopters, with AlgoVoi as registry editor:
- AlgoVoi v1 (substrate author)
- AlgoVoi v2 (PQC substrate author)
- Supership / Crest Deployment Systems
- PEAC Protocol
- Nobulex
- Vauban Pay
Adoption is observable in the open without requiring any vendor’s permission.
9. JSON SchemaStore inclusion
AlgoVoi compliance receipt v1 schema merged into the SchemaStore public catalogue (PR 5726). The schema is now part of the default schema-validation surface for editors and validators that consume SchemaStore.
10. Featured public attestations
Selected public statements on open GitHub threads from downstream consumers and independent verifiers, quoted verbatim with source URL for reproduction.
10.1 AURA self-attribution on canonicalisation authorship
Source: x402-foundation/x402 issue #2332, comment by luisllaver (AURA contributor), 2026-05-28 01:08 UTC.
URL: https://github.com/x402-foundation/x402/issues/2332
“On the canonicalization spec: AURA does not define its own - we conform to RFC 8785 (JCS) + SHA-256, the same discipline @chopmob-cloud is pinning in draft-hopley-x402-canonicalisation-jcs-v1. Cite that; our /v1/action-ref is just a conforming implementation (key sort = UTF-16 code units, strings as literal UTF-8, integers verbatim).”
Significance: A downstream consumer publicly directing readers to cite the AlgoVoi IETF I-D as the canonical reference. AURA explicitly states it does not author canonicalisation discipline; AlgoVoi does. This is the substrate-author / downstream-adopter distinction articulated on a public x402-foundation thread by the downstream party itself.
10.2 Three-way byte-identical interoperability verification
Source: x402-foundation/x402 issue #2332, comment by andysalvo (independent verifier), 2026-05-27 13:20 UTC.
URL: https://github.com/x402-foundation/x402/issues/2332
“Vector 4 (chopmob corpus anchor): PASS — 3-way byte-identical across Crest, AURA, and AlgoVoi. Published at verify.crestsystems.ai/aura-conformance-v0.json.”
Significance: An independent verifier confirming that AURA’s reputation-record canonicalisation, the Crest verifier matrix, and AlgoVoi’s conformance corpus all produce byte-identical hashes on the same preimage. The “chopmob corpus anchor” reference is AlgoVoi’s chopmob-cloud/algovoi-jcs-conformance-vectors, named explicitly as the anchor point of the three-way agreement.
10.3 Action-ref portability shipped by downstream consumer
Source: x402-foundation/x402 issue #2332, comment by giskard09 (Mycelium Trails / argentum-core), 2026-05-28 01:25 UTC.
URL: https://github.com/x402-foundation/x402/issues/2332
“That’s the property that matters — once the ref is in the evidence array, the receipt is auditable anywhere, no AURA dependency. Clean ship.”
Significance: A second downstream consumer (Mycelium Trails) publicly confirming that AURA has shipped action-ref portability per the AlgoVoi-authored discipline (SHA-256(JCS(preimage))). The “auditable anywhere, no AURA dependency” property is the substrate-author position working as designed: the receipt is independently verifiable because the canonicalisation discipline is normative, not vendor-locked.
10.4 Summary
Three independent organisations (AURA, Crest, Mycelium Trails) publicly on a x402-foundation issue, in the same thread, attesting to:
- AlgoVoi’s IETF I-D as the canonical citation for canonicalisation discipline
- Byte-identical interoperability against AlgoVoi’s conformance corpus
- Substrate-author portability working as designed in their shipped consumer-side code
The chronological arc of issue #2332 from 2026-05-15 through 2026-05-28 is preserved in the public GitHub record. All attestations above are reproducible by anyone reading the thread.
11. Temporal priority: production deployment versus IETF Internet-Draft filing
This section establishes that the IETF Internet-Drafts under sole AlgoVoi authorship formalise behaviour that was already running in production on api.algovoi.co.uk. The drafts are descriptive of a live system, not proposals for a system to be built. In every case below, the production deployment date precedes the I-D filing date.
The dates below cluster within a five-week window. This reflects a focused, intensive effort during the period when the multi-chain agentic-payment receipt-format gap became operationally pressing on the AlgoVoi production gateway. The compression is real and is acknowledged here as deliberate concentrated work to formalise running production behaviour into a coherent body of IETF-anchored specifications, not as evidence of multi-year prior production history that the dates would not support. The substrate-author value is the combination of production deployment, IETF anchoring, published reference implementations, and cross-implementation cross-validation, all of which are demonstrably present, regardless of the calendar window in which they were assembled.
11.1 Discipline-by-discipline timeline
| Discipline | Production deployment | IETF I-D first posted | Delta | Live evidence |
|---|
JCS canonicalisation pin (urn:x402:canonicalisation:jcs-rfc8785-v1) | 2026-05-15 (x402 v2 canonical content-negotiation) | 2026-05-25 | ~10 days | Wire format on api.algovoi.co.uk settlement payloads |
Compliance receipt format (compliance-receipt-v1) | 2026-05-06 (/compliance/attestation endpoint live) | 2026-05-25 | ~19 days | Public attestation endpoint emitting receipts under the canon pin |
Hash-chained audit ledger (substrate of audit-verifier) | 2026-05-06 (Cluster A audit chain, four then five hash-chained tables) | (composes with the receipt I-Ds) | ~19 days | Backblaze B2 Object Lock COMPLIANCE retention to 2033 |
Refund receipt format (refund-receipt-v1) | 2026-05-01 (Recurr engine launch, PSD2-aligned mandate lifecycle) | 2026-05-25 | ~24 days | Refund flow live across seven chain families with full receipt emission |
Cancellation receipt format (cancellation-receipt-v1) | 2026-05-01 (Recurr mandate cancellation flow) | 2026-05-25 | ~24 days | Mandate state machine emitting cancellation receipts |
Settlement attestation format (settlement-attestation-v1) | 2026-05-04 (CCTP V2 Solana settlement attestation) and earlier per chain | 2026-05-25 | ~21 days | Multi-chain settlement attestations on Algorand, VOI, Hedera, Stellar, Base, Solana, Tempo |
Composite trust query format (composite-trust-query-v1) | 2026-05-06 (/compliance/attestation composite verdict response) | 2026-05-25 | ~19 days | Production composite-verdict responses from the live endpoint |
PQC migration discipline (urn:x402:canonicalisation:jcs-rfc8785-v2) | 2026-05-03 (PQC Tier 2A HMAC dual-emit), 2026-05-26 (PQC v2 substrate publication) | (no I-D for v2 yet; published as algovoi-substrate-pqc@0.1.x reference implementation) | Substrate-side migration discipline operational before v2 substrate publication | |
RFC 9421 binding for x402 (rfc9421-x402-binding-v1) | 2026-05-17 (proxy-chain RFC 9421 signature validation fixture in aps-conformance-suite) | (drafted, not yet IETF-filed at refresh date) | RFC 9421 covered-components set and Content-Digest discipline live in production verifier | |
urn:x402:canonicalisation:jcs-rfc8785-v2 PQC discipline, and rfc9421-x402-binding-v1), the substrate-author anchor is the Apache 2.0 reference implementation publication date on PyPI and npm, together with the hash-stable version-pin history maintained by both registries. For PQC v2 the anchor package is algovoi-substrate-pqc (published 2026-05-26 on PyPI and npm). For the RFC 9421 binding the anchor package is algovoi-rfc9421-verifier (published on PyPI and npm as @algovoi/rfc9421-verifier, current version 0.3.x). Registry publication timestamps are publicly auditable and serve in lieu of the IETF Datatracker timestamp until the I-Ds are filed.
11.2 Foundational platform milestones (context)
These are not standards themselves but the platform underpinnings that the standards-bearing services run on:
| Platform milestone | Production date |
|---|
| PQC Tier 1 (JWT multi-algorithm verifier) | 2026-04-26 |
| PQC Tier 2A (HMAC v1 + v2 dual-emit on internal channels) | 2026-05-03 |
| PQC Tier 2B (AVK2 AES-256-GCM at-rest dispatcher) | 2026-05-03 |
| xChain bridging via Allbridge | 2026-05-05 |
| Audit bundle endpoint (selective-disclosure bundles) | 2026-05-06 |
| Facilitator active-passive failover | 2026-05-09 |
| MPP subscriptions (Tier 1 recurring) | 2026-05-13 |
| APM safeguarding (Electronic Money Regulations 2011, regulations 20-21) | 2026-05-14 |
| MCP server v1.5.0 published (PyPI + npm + GitHub release, 28 tools, 8 chains) | 2026-05-20 |
AP2 open_mandate_hash v0 cross-implementation anchored | 2026-05-20 |
| JCS four-implementation cross-validation matrix | 2026-05-21 |
| Eight-implementation cross-validation matrix (substrate authorship anchor) | 2026-05-24 |
11.3 CTEF non-inclusion
AlgoVoi submitted contributions to the Collaborative Trust and Evidence Framework (CTEF) process during the period covered by this timeline. Those contributions were not included in the final CTEF publication. The substrate artefacts documented in this page — IETF Internet-Drafts, Apache 2.0 reference implementations, cross-implementation conformance vectors, and hosted verification endpoints — are AlgoVoi-authored and exist independently of any consortium process.
For every receipt-family I-D, the underlying format was emitting under production traffic on api.algovoi.co.uk for at least nineteen days before the formal IETF Internet-Draft was filed. For the recurring-lifecycle receipts (refund, cancellation), the production behaviour predates the I-D by approximately twenty-four days. The canonicalisation pin itself was the wire format of the production gateway ten days before the I-D was posted.
The substrate-author position is therefore not anchored only in IETF filings or published packages. It is anchored in a system that was running, emitting, and verifying the wire format under real traffic before any of the formal artefacts existed. The IETF I-Ds, the Apache 2.0 reference implementations, and the cross-implementation matrix are all downstream of the production deployment. They describe what was already true, not what was proposed.
11.4 What this demonstrates
Three independent forms of priority evidence:
- Live system priority. The wire format was operational under real compliance-auditable traffic across seven chain families before the formal standards artefacts existed.
- IETF Independent Submission priority. The drafts are date-stamped on the public datatracker (2026-05-25).
- Published implementation priority. The Apache 2.0 packages on PyPI and npm have publication dates and version-pin history.
Any party arriving at this surface later, whether to absorb the format, propose an alternative, or claim co-authorship, does so against three independently verifiable temporal anchors.
12. Interpretation
Three layers of usage, in order of visibility:
- Public GitHub citations and emits. Eight external repositories declaring AlgoVoi’s v1 pin in their own conformance code, including Vauban Pay, AEOESS Consilium, Nobulex, an independent verification repository (andysalvo), and the structural standards-tooling layer (IETF / Relaton / SchemaStore). Three additional public attestations on x402-foundation issue #2332 from AURA, Crest, and Mycelium Trails (see Section 10).
- Standards-tooling ecosystem inclusion. The AlgoVoi URN is in the Relaton bibliographic catalogue, automatically resolved by every IETF-aligned citation-rendering toolchain.
- Silent download adoption. Approximately 2,900 real (post-discount) substrate-aligned package downloads per month across PyPI and npm. The bulk of usage is structurally invisible because Apache 2.0 has no telemetry and most adopters maintain private code.
What this evidence demonstrates:
The substrate has the three properties a working specification needs to be considered ecosystem-resident infrastructure:
- A citation-stable normative anchor on the IETF Independent Submission stream
- Apache 2.0 reference implementations with measurable monthly download traffic
- Public attestation by external parties through their own code, their own repositories, and their own statements in public threads
Combined with the temporal-priority evidence in Section 11, this is not a “proposed standard” but a substrate that was running in live production before the standards artefacts existed, has crossed from AlgoVoi-only into the public conformance code of multiple external parties, and is now indexed in the IETF bibliographic ecosystem. As of 2026-05-29, the canonical action_ref hash computation and RFC 9421 signature verification are also independently accessible via hosted endpoints at verify.algovoi.co.uk/action-ref and verify.algovoi.co.uk/rfc9421 — independently verifiable without installing any package.
13. Reproduction commands
Every datum in this page is reproducible from public APIs. Replace $TOKEN with a personal GitHub token.
# IETF Datatracker I-D metadata
curl -s "https://datatracker.ietf.org/api/v1/doc/document/?name=draft-hopley-x402-canonicalisation-jcs-v1&format=json"
# PyPI download stats
curl -s "https://pypistats.org/api/packages/algovoi-substrate/recent"
# npm download stats
curl -s "https://api.npmjs.org/downloads/point/last-month/@algovoi/substrate"
# GitHub code search count
curl -s -H "Authorization: token $TOKEN" \
"https://api.github.com/search/code?q=urn%3Ax402%3Acanonicalisation%3Ajcs-rfc8785-v1" \
| jq '.total_count'
# GitHub code search repo breakdown
curl -s -H "Authorization: token $TOKEN" \
"https://api.github.com/search/code?q=canon_version+jcs-rfc8785-v1&per_page=100" \
| jq -r '.items[].repository.full_name' | sort | uniq -c | sort -rn
# Hosted action_ref verifier — zero-install canonical hash check
curl -s -X POST https://verify.algovoi.co.uk/action-ref \
-H "Content-Type: application/json" \
-d '{"agent_id":"did:web:api.algovoi.co.uk","action_type":"payment.authorize","scope":"base:0x2d96f2bc","timestamp_ms":1748534400000}'
# expects: action_ref sha256:6c3c08eb36f7ae5f0c1db7760e1c67d93c299c884ad6b94647b09da7f99c5f91, implementations_attested 8
# Hosted RFC 9421 verifier — schema reference
curl https://verify.algovoi.co.uk/rfc9421
# expects: algorithm "Ed25519 (RFC 8032)", spec_ref "https://www.rfc-editor.org/rfc/rfc9421"
14. Limitations
- No per-package runtime telemetry exists. The AlgoVoi packages do not phone home.
- IETF Datatracker per-document download counts are not exposed via the public API. Aggregate datatracker traffic is private.
- GitHub Code Search has rate limits and indexes only public repositories. Private GitHub Enterprise installations, GitLab, Bitbucket, and internal version-control systems are not surveyed.
- Download counts include some baseline scraper, mirror, and security-scanner traffic. A 35 percent discount is applied to estimate real adopter activity; the true ratio is unknown.
- Adopters who use the substrate in closed-source code are structurally invisible to all the above measurements.
- Refresh frequency: this page should be re-generated quarterly using the commands in Section 13 to keep currency.
