JCS Canonicalisation Substrate

Documentation Index

Fetch the complete documentation index at: https://docs.algovoi.co.uk/llms.txt

Use this file to discover all available pages before exploring further.

The agentic-payments ecosystem (x402, AP2, A2A, MPP) depends on byte-identical canonicalisation of receipt and mandate objects across independent implementations. If two verifiers serialise the same logical object differently, their hashes diverge, and any retention-obligated audit trail breaks at year-5 supervisor re-verification. AlgoVoi authors the canonicalisation substrate that anchors this property across the ecosystem: a coalition-converged set of normative rules (JCS RFC 8785 + epoch-millisecond timestamp pinning + type-validation-before-canonicalisation + retention-property co-equal with cross-observer property) plus 53 conformance vectors validated byte-for-byte across 5 reference implementations in 4 languages. This page is the canonical entry point: the rules, the impls, the vectors, the coalition convergence record. If you are building anything that serialises and hashes a mandate, receipt, attestation, or audit object in the agentic-payments coalition, you should be running against this substrate.

​

The five reference implementations

The substrate is defined by what these five impls agree on. They are independently authored by four non-overlapping author sets, which is what makes the substrate empirical rather than vendor-claimed. A vector “validates” only if all five produce bit-identical canonical bytes and bit-identical SHA-256 digests of those bytes. The matrix runs 53 vectors × 5 impls = 265 byte-for-byte agreements across the four anchor sets.

​

The substrate rules (normative)

The five rules that any spec referencing this substrate inherits. Coalition-converged in the x402#2326 shared canonicalisation section v3, co-authored with Vauban Pay and FeedOracle.

1. JCS_hash = SHA-256(JCS(RFC 8785)(object)), lowercase hex. JCS is the only canonicalisation primitive. Variants like json.dumps(sort_keys=True, separators=(',',':'), ensure_ascii=False) are close approximations but not bit-identical to RFC 8785 (number serialisation §3.2.2.3 and Unicode handling differ); they will produce divergent hashes across implementations.
2. timestamp_ms MUST be epoch-millisecond integer. RFC 3339 string admits multiple lexically distinct encodings of the same instant (Z vs +00:00, fractional precision, .000 vs no-fraction), which under JCS produce different digests. The pin closes that surface.
3. Field names are load-bearing opaque bytes. Renaming a field even with equivalent semantics is a canonicalisation-breaking change. The substrate carries a field-name canonicalisation invariant (vectors 007a / 007d / 008a / 008b in privacy_class_v0.1).
4. Type validation BEFORE canonicalisation, reject rather than coerce. A field declared as string that receives an integer is a hard validation failure, not a silent type-cast. Coercion produces non-deterministic canonicalisation surface across implementations.
5. Retention property is co-equal with cross-observer property. A spec referencing the substrate MUST include canon_version when emitted under a framework-bound retention obligation (MiCA Art. 80 / AMLR Art. 56 / DORA Art. 14). The version pin is what lets a year-5 auditor distinguish “the canonicalisation rules drifted” from “the object content drifted.”

​

The conformance vectors (5 anchor sets, 53 vectors total)

Each anchor set is an AlgoVoi-authored gist with:

• A vectors.json containing structured pair-invariants (same_hash_as, different_hash_from) so a verifier doesn’t just check absolute hash values, it checks the relational property the substrate is meant to anchor.
• Single-file runners for all 5 reference impls so anyone can reproduce the matrix in their own environment.
• An attestation file recording the 265-agreement substrate matrix run dates and the third-party validators who confirmed it.

​

Axis 0 substrate sets (5 anchor sets)

All five sets are published under Apache 2.0. Provenance: chopmob-cloud (AlgoVoi) is the original author of every Axis 0 vector and the substrate-architecture skeleton; specific application-axis vector sets authored by other coalition members (andysalvo action-ref, feedoracle hybrid-PQC) are validated against this substrate as cross-validation service runs, not redefined by them.

​

Application axis sets (cross-validated, not AlgoVoi-authored)

The substrate is also the empirical anchor that other coalition members’ application-axis vector sets run against. Validation runs AlgoVoi performed on externally-authored sets:

• Axis 3 work-binding receipts (x402#2398, authored by @andysalvo) — 9 vectors × 4 reference impls = 36/36 byte-for-byte.
• Axis 2 hybrid-PQC receipt cores (x402#2411, authored by @feedoracle) — 4 receipt cores × 4 reference impls = 16/16 byte-for-byte; pinned-divergent-digest discipline confirmed for both FAIL vectors.

​

How to use it

If you are implementing a spec that anchors to this substrate, the integration path is:

1. Pick the closest anchor set. AP2 mandate-shaped objects → AP2 OMH v0. Chain-native amount or address fields → per_chain_envelope v0. Privacy / settlement-visibility attestation → privacy_class v0.1. A2A receipt or APS delegation → CTEF + APS v1.
2. Run the matrix. Each gist ships single-file runners. The output is a 53-vector pass/fail table per impl. If your impl produces non-matching digests against the matrix output, your implementation has a canonicalisation drift you need to find before shipping the spec.
3. Cite the substrate. Document the canonicalisation rule applied (RFC 8785 + the four pins above) and the anchor set you validated against. The convention being adopted across the coalition is:

   Substrate validation: chopmob-cloud (AlgoVoi) 5-impl JCS reference matrix (rfc8785@0.1.4 / canonicalize@3.0.0 / gowebpki/jcs v1.0.1 / cyberphone/json-canonicalization / serde_jcs 0.2.0)

   Documented in the spec text rather than just review comments — gives future readers the replication anchor.
4. Pin canon_version if your spec is emitted under a framework-bound retention obligation (MiCA / AMLR / DORA). The substrate version-pin is what makes year-5 audit replication possible.

​

Coalition convergence

The substrate rules above are not unilateral. They are the converged output of a working-group conversation that ran across x402-foundation/x402 issue threads, A2A discussions, and AP2 issues over 2026-04 → 2026-05, with the v3 section freeze on 2026-05-21. This page tracks the substrate from AlgoVoi’s authorship perspective. The coalition-side spec text is at the v3 section comment. The IETF I-D is the long-horizon home; the coalition co-authorship is the convergence record. The x402 Foundation TSC liaison request (x402#2428, filed 2026-05-22 by Vauban Research) formally acknowledges AlgoVoi as the author of the architectural skeleton and cross-validation baseline before the Coinbase / Cloudflare / Stripe TSC.

​

Provenance and reproducibility

Everything on this page is independently reproducible:

• The five impls are public packages on PyPI / npm / Go module proxy / Maven / crates.io. No AlgoVoi infrastructure required to install any of them.
• The five anchor gists are publicly hosted at gist.github.com/chopmob-cloud/. No login required. Each gist’s vectors.json is JCS-canonicalised; the gist’s content hash anchors the substrate state.
• The matrix runs are documented in memory-graph/projections/cross_impl_validators.md — every run records the date, the runner version, the digest set, and which third-party attested it.
• Third-party attestations on record: @amavashev (Python), @Ectsang (JavaScript), @seritalien (Rust, runner shipped 3.5 hours after the AlgoVoi publication of the per_chain_envelope_v0 set).

The substrate is not vendor-claimed: it is empirically anchored by five impls × four non-overlapping author sets × 53 vectors that all agree byte-for-byte.

​

See also

• Ecosystem contributions — the upstream PRs and spec authorship surfaces where the substrate is being referenced.
• Compliance — how the AlgoVoi facilitator integrates the substrate into the retention-obligation framework (UK MLRs / SAMLA Reg 40(3) / FCA 7-year retention).
• x402#2326 shared canonicalisation section v3 — the coalition spec text.
• x402#2334 privacy_class spec PR — first protocol-level spec to reference the substrate by name (settlement-visibility attestation).
• Vauban Pay coalition hub — Axis 0 substrate panel — third-party rendered view of the 53-vector / 5-impl matrix with cross-links to AlgoVoi’s owned surfaces. Companion to Vauban’s STARK receipt docs.