Application matrix

Payer initiates payment
        │
        ▼
AlgoVoi Gateway
  ├─► Compliance Engine — screens wallet + URL (OFSI, OFAC, 7 feeds)
  ├─► build_compliance_receipt() [substrate] → compact JWS → Payer
  ├─► Facilitator — on-chain verification (7 chain families)
  ├─► build_settlement_attestation() [substrate] → stored + returned
  ├─► Audit Chain — JCS hash-chained row appended (B2 WORM)
  └─► (on refund) build_refund_receipt() [substrate]
      (on cancellation) build_cancellation_receipt() [substrate]

Recipient verifies receipt
  └─► algovoi-receipt-verifier
        ├─ JWS decode + Ed25519 verify
        ├─ JCS re-canonicalisation check
        └─ Result → algovoi-composite-trust-query → TRUSTED / PROVISIONAL

Auditor verifies chain
  └─► algovoi-audit-verifier
        ├─ Per-row content_hash check
        ├─ hash-chain continuity
        └─ HMAC-SHA256 bundle signature

AI agent calls gateway
  └─► algovoi-mcp-server (29 tools)
        └─► gateway HTTP API
              └─► receipts / compliance / screening

Tenant receives webhook
  └─► algovoi-webhook-verifier
        ├─ Header parse + timestamp check
        ├─ HMAC-SHA256 v1 verify
        ├─ HKDF-SHA256 key derive + HMAC-SHA384 v2 verify
        └─ JSON parse + event-type check → event dict
              │ error_code (on failure)
              ▼
        algovoi-receipt-sentinel
              ├─ sliding window per source
              ├─ matches TAMPER / REPLAY / SCAN / BURST rules
              └─ SentinelAlert → notify security team (or null)