Skip to main content

​
2026-06-02

  • ATB Pass Certificate Phase 2 — Bulletproofs ZKP deployed. The Agent Trust Bench now issues zero-knowledge range proof certificates (atb_cert_version: "2") when ATB_ZKP_ENABLED=true. The score is committed to a Pedersen commitment (Ristretto255) and a Bulletproofs range proof attests score ≥ threshold without revealing the score itself, its components, or the agent’s exact behaviour distribution. The gateway verifies the proof via a Rust microservice wrapping the dalek-cryptography bulletproofs crate. Phase 2 certs are presented via X-ATB-ZK-Credential (separate from Phase 1’s X-ATB-Credential). Both headers are accepted by the AlgoVoi reference gateway and trigger the same 20% discount on valid proofs. Phase 1 behaviour is unchanged when ATB_ZKP_ENABLED=false. The header_name field in the cert response always tells you which header to use. Spec: ATB Pass Certificate. Agent guide: integration.

​
2026-06-01 (evening)

  • algovoi-atb v0.1.1 published to PyPI and npm (@algovoi/atb). Official client package for the Agent Trust Bench. One-call run_bench(agent_fn) drives your agent through all 166 profiles, logs refusals via POST /refused/{profile_id}, and returns a RunResult with certificate_b64 ready for the X-ATB-Credential header. Pass an existing run_id to tag traffic against a pre-created report. Full Falcon-1024 certificate verification with pip install algovoi-atb[verify]; TypeScript (@algovoi/atb) mirrors the API with structural + expiry verification and ESM + CJS output. Python 25/25 · TypeScript 22/22 tests. Package suite.
  • ALGOVOI_MODE documented. The MCP server’s standard vs substrate response model is now documented on the MCP server integration page. standard mode returns the bare traditional x402/MPP/AP2/A2A response. substrate mode (default) adds AlgoVoi substrate primitives: settlement_attestation, compliance_receipt, action_ref, composite_hash, ctq_response.
  • ATB Hub Registry — joint-harness conformance gate made mandatory. Check 12 (joint_harness_conformance) now blocks conformance_status=pass. Operators must submit valid JCS joint-receipt vectors (compliance half + conformance half) to receive a passing conformance transcript. Application form updated with a required conformance_vectors_json field. Self-attestation alone no longer qualifies for registry admission. ATB Hub Conformance.

​
2026-06-01

  • ATB Hub Registry — self-service application form live. Isolated FastAPI service at api.algovoi.co.uk/atb-hubs/apply. Public form where organisations submit applications to operate an ATB Pass Certificate hub. Synchronous conformance check runs against the candidate’s keys_url at submission time — 11 checks covering URL hygiene, document shape, Falcon-1024 public key encoding, kid consistency, cert policy fields, methodology version match. Pass/fail transcript stored with the application; pending list available to AlgoVoi via direct DB query for monthly registry refresh decisions. Own container, own SQLite, own surface; no entanglement with the payment gateway. Substrate-author posture: AlgoVoi runs the standards body application surface for an open federated protocol. Hub conformance spec.
  • ATB Pass Certificate — multi-hub federation deployed. Opens the substrate to federated issuance: any organisation can now operate an ATB hub alongside AlgoVoi’s reference bench. Gateway-side trust resolves through three mechanisms (in precedence): pinned hubs (ATB_PINNED_HUBS_JSON), allowlist (ATB_TRUSTED_HUBS), or AlgoVoi-signed Adopters Registry (ATB_REGISTRY_URL + ATB_REGISTRY_ROOT_PK_B64). Legacy single-issuer path continues to work as a fallback. Certs now carry a methodology_version field so verifiers know which scoring scheme produced any given score. Spec for becoming an approved hub: ATB Hub Conformance. The substrate is Apache 2.0; registry inclusion is discovery + trust-by-default, not gatekeeping. 74 unit + integration tests passing; deployed dark-by-default (multi-hub paths inactive until a second hub is configured). Strategic posture: AlgoVoi is the standards body + reference hub, mirroring how IETF / OWASP operate.
  • ATB Pass Certificate cross-impl validation complete. Three independent Falcon-1024 implementations now verify identical certificate bytes: Python pqcrypto (PQClean), Rust pqcrypto-falcon (PQClean), Java BouncyCastle 1.78+. The signature wire format is byte-portable across all three; only the public-key encoding differed (PQClean adds a 1-byte algorithm-ID header). Bench now publishes both PK encodings (public_key_pqclean_b64 1793 bytes + public_key_raw_h_b64 1792 bytes) at /.well-known/atb-keys.json so verifiers don’t need adapter code. Reference verifiers and conformance vectors are available to approved hub applicants.
  • ATB Pass Certificate (Phase 1) — reputation-gated variable pricing. The Agent Trust Bench now issues Falcon-1024 signed reputation credentials at /agent-trust-bench/sessions/{session_id_hash}/certificate. Agents that complete 10+ adversarial profiles and score above threshold receive a JCS-canonical ATB Pass Certificate, presented to participating x402 gateways via the X-ATB-Credential header for a 20% discount on the challenge amount. Bench public key published at /.well-known/atb-keys.json (Falcon-1024, 1793-byte key, 16-char kid). Gateway-side verifier caches results for 5 minutes; LRU eviction at 512 entries. Phase 2 (Bulletproofs zero-knowledge range proof) deferred. Spec: ATB Pass Certificate. Agent guide: integration. 57 unit + integration tests passing.

​
2026-05-22

  • Vauban-authored IETF Internet-Draft draft-vauban-x402-stark-receipts-00 submitted. Vauban Research submitted an adopter-authored x402 receipt-format extension I-D to the IETF datatracker (submission ID 163411, ISE Manual Post queue, all automated checks passed). The draft anchors to the AlgoVoi-authored canonical preimage discipline (JCS RFC 8785); AlgoVoi is credited in the I-D acknowledgments as the discipline author and as the originating author of four substrate vector sets the Vauban receipt format anchors against.

​
2026-05-21

  • AlgoVoi Chrome extension v2.6.1 — EIP-6963 multi-wallet discovery. AlgoVoi now announces itself via EIP-6963 so dApp wallet pickers (Uniswap, RainbowKit, Wagmi, viem multiInjectedProviderDiscovery) list AlgoVoi alongside MetaMask rather than losing the slot to MetaMask’s synchronous window.ethereum claim. Both wallets co-exist; the user chooses per dApp. Six-chain coverage (Algorand, VOI, Hedera, Base, Arc, Tempo) and 18/18 protocol × chain combinations unchanged from v2.5.0. GitHub release packaged zips attached; Chrome Web Store / Firefox AMO review in progress.
  • JCS Canonicalisation Substrate docs page published. Technical reference for the AlgoVoi-authored RFC 8785 canonicalisation substrate: 5 normative rules, 53 conformance vectors, 5 reference implementations (Python / JavaScript / Go / Java / Rust), 265 byte-for-byte agreements across four non-overlapping author sets. Includes all five AlgoVoi-authored gist links with named provenance, the cross-validation service record for Axes 2 and 3, and the cross-implementation validation history. Live at docs.algovoi.co.uk/canonicalisation-substrate.

​
2026-05-20

  • MCP Server v1.5.0 — 28 tools, 8 chains, MPP subscription support. Three new MPP subscription tools added: create_mpp_subscription, get_mpp_subscription, cancel_mpp_subscription. Brings the total tool count to 28 across 8 chain families (Algorand, VOI, Hedera, Stellar, Base, Solana, Tempo, ARC). Published simultaneously to PyPI (algovoi-mcp==1.5.0) and npm (@algovoi/mcp-server@1.5.0) and as a GitHub release asset. Upgrade: uvx algovoi-mcp==1.5.0 (Python) or npx -y @algovoi/mcp-server@1.5.0 (TypeScript).

​
2026-05-19

  • AlgoVoi Chrome extension v2.6.0 — EVM-path hardening + packaged release. Current release (latest). The v2.5.x → v2.6.0 patch line hardens the EVM balance/RPC path with protocol × chain coverage unchanged from v2.5.0: v2.6.0 adds an automatic Base primary-RPC fallback (mainnet.base.org → base.publicnode.com) so ETH and USDC balances no longer silently display zero when the primary RPC is unreachable in the popup context; v2.5.9 fixed Base ETH/USDC not showing; v2.5.8 fixed the Tempo USDCe gas limit; v2.5.7 cleared all TypeScript errors. The GitHub release now ships packaged zips (algovoi-2.6.0-chrome.zip, -firefox.zip, -source.zip) so the six-chain build can be loaded directly without building from source. Chrome Web Store / Firefox AMO review still in progress; store builds remain on the stable single-stack 1.0.x line.
  • AlgoVoi Chrome extension v2.5.0 — six-chain payment-protocol coverage. Browser extension now ships native x402, MPP, and AP2 support across Algorand, VOI, Hedera, Base, Arc, and Tempo. Eighteen-of-eighteen protocol × chain combinations wired in a single popup. Signing scheme per chain: AVM (Algorand / VOI) via algosdk Ed25519; Hedera via HashPack WalletConnect for HTS; EVM (Base / Arc / Tempo) via viem signTransaction secp256k1 with chain-appropriate value transfer (ERC-20 transfer(USDC) on Base, native gas USDC on Arc, ERC-20 transfer(USDCe) on Tempo). AP2 mandates Ed25519-signed on AVM / Hedera, EIP-191 secp256k1-signed on EVM. MPP credentials carry did:pkh:eip155:{chainId}:{address} on EVM rails so downstream verifiers resolve the signer to the correct chain without a translation layer. Single browser wallet for the full AlgoVoi payment-protocol surface.

​
2026-05-17

  • Agent Trust Bench now spans all 8 supported chains. Every 402 challenge returns 8 accepts[] legs: Base, Algorand, Solana, Stellar, Hedera, Tempo, VOI, and ARC testnet. Agents can pick whichever chain they support. All receivers are pre-configured (opted-in, trustlined, or associated as appropriate), with per-chain decimal scaling handled automatically in the envelope (Stellar 7dp, ARC native gas USDC 18dp, everything else 6dp). The bench is now the first public x402 research surface offering this level of chain parity. Hedera receiver swapped to 0.0.10376692 (HTS USDC associated UNFROZEN). VOI uses native ASA 302190 (Aramid aUSDC), not ARC200. Discovery metadata surfaces (/donations, /.well-known/x402.json, /discovery/resources) and the landing footer + stats page all updated to list all 8 receivers.
  • MCP Server v1.4.3 (Python and TypeScript) — 8-chain coverage. Added ARC testnet (chain_id 5042002, native gas USDC wrapper at 0x3600...0000, 18 decimals on-chain) bringing supported networks to 8 mainnets plus their testnet equivalents. Corrected the VOI mainnet description: aUSDC (asset ID 302190) is a native ASA, not an ARC-200 application. The asset ID was always correct; only the metadata description was misleading. list_networks now returns 26 network keys including the new arc_testnet entry. Upgrade: uvx algovoi-mcp==1.4.3 (Python) or npx -y @algovoi/mcp-server@1.4.3 (TypeScript).

​
2026-05-12

  • MCP Server v1.4.2 (Python) — Cloudflare compatibility fix. All HTTP requests from algovoi-mcp now send User-Agent: algovoi-mcp/1.4.2. The default Python-urllib/3.x user-agent was blocked by Cloudflare’s bot-detection layer on api.algovoi.co.uk (HTTP 403 / error 1010). This affected discover_resources, screen_recipient, get_compliance_attestation, and all API-key-authenticated calls. TypeScript (@algovoi/mcp-server@1.4.1) was not affected. Upgrade: uvx algovoi-mcp==1.4.2.

​
2026-05-10

  • MCP Server v1.4.1 (TypeScript) / v1.4.1 (Python) — 25 tools, 7 chains. Twelve new tools added over v1.2.0:
    • try_mpp_endpoint — probe any MPP or x402 URL; decode WWW-Authenticate: Payment (MPP) or X-Payment-Required (x402 v1) and return the payment legs. No API key required.
    • verify_x402_proof — decode a base64 x402 proof and verify the on-chain transaction.
    • generate_x402_challenge — compose an x402 v1 X-Payment-Required header.
    • generate_ap2_mandate — compose an AP2 v0.1 PaymentMandate.
    • verify_ap2_payment — verify an AP2 mandate payment receipt via direct indexer.
    • discover_resources — fetch the public AlgoVoi Bazaar catalog (x402 + MPP resources from active tenants). No API key required.
    • screen_recipient — pre-payment sanctions screen against OFSI / OFAC SDN / EU Consolidated. No API key required.
    • get_compliance_attestation — fetch the operator compliance posture (frameworks, audit chain, Object Lock status). No API key required.
    • create_recurring_authority, get_authority, list_authorities, confirm_authority, revoke_authority, pause_authority, resume_authority, manual_pull — eight Tier 2 recurring-payment tools for standing-authority subscriptions.

​
2026-05-09

  • Agent Trust Bench /stats now serves an HTML dashboard in browsers. Visiting agent-trust-bench.algovoi.co.uk/stats in a browser renders a live stats page (bar charts by event type / profile, escalation funnel, top user-agent table, 30-second auto-refresh). API and agent clients receive the same JSON payload as before — content-negotiated on the Accept header.

​
2026-05-08

  • Recurr hosted authorisation page backend is live. recurr.algovoi.co.uk/{signing_token} renders the wallet-connect signing flow for Tier 2 standing authorities. Supported wallets: AlgoVoi Extension, Pera, Defly, and Lute (Algorand/VOI) via the official WalletConnect SDK; MetaMask / Rainbow / Coinbase Wallet (EVM — Base, Tempo); Phantom / Solflare (Solana); HashPack / Blade / Kabila (Hedera); Freighter / Albedo / LOBSTR (Stellar).

​
2026-05-07

  • Pre-sale security sweep complete. 0 CRITICAL · 1 HIGH (deferred with documented mitigation) · 0 MEDIUM · 4 LOW across all platform components. Full data-room prepared at content/.

​
2026-05-06

  • Compliance attestation and screening endpoints live.
    • GET /compliance/attestation — machine-readable compliance status document (SAMLA 2018 s.20 compliant, PEP screening posture, sanctions controls, retention policy). Returned from /discovery/resources as a linked compliance statement — makes AlgoVoi the first compliance-aware Bazaar facilitator.
    • POST /compliance/screen — real-time wallet sanctions screening against 7 threat-intel feeds before any payment is accepted. Returns a risk decision with structured rationale.
  • Audit chain live. Each payment event generates a SHA-384 hash-chained receipt, committed atomically to Postgres and archived to Backblaze B2 under Object Lock (COMPLIANCE mode, 7-year retention). The verifiable audit bundle is accessible at GET /compliance/attestation with a pointer to the public verifier repository.
  • nginx permanent DNS-caching fix deployed. Docker container restarts no longer cause 502 outages. nginx now uses resolver 127.0.0.11 valid=10s with variable upstreams — IPs are re-resolved from Docker’s embedded DNS every 10 seconds rather than cached at startup.

​
2026-05-05

  • Checkout abandonment — POST /checkout/{token}/abandon lets checkout pages signal an explicit user cancellation. All four platform adapters (OpenCart, WooCommerce, PrestaShop, Shopware) now call this endpoint on “Back” / close — merchants receive a payment.cancelled webhook event immediately instead of waiting for the checkout to time out.
  • pay-skills catalog live at /.well-known/pay-skills.json. AlgoVoi is the first multi-chain entry in the solana-foundation/pay-skills registry, with provider entries for the Agent Trust Bench (algovoi/agent-trust-bench) and the compliance gate (algovoi/compliance-gate).
  • CSP nonces across all public-facing pages. Content-Security-Policy nonces added to all gateway-rendered HTML (checkout pages, x-connect widget, shop demo, signup, recurr hosted page, demo page). style-src-attr: 'unsafe-inline' retained for inline style= attributes; all other inline scripts are nonce-gated.

​
2026-05-05

  • Stellar xChain is now live on mainnet. EVM USDC (Base, Arbitrum, Polygon, Optimism, Ethereum, BNB, Avalanche) → classic Stellar USDC at Circle’s canonical issuer (GA5ZSEJ…), end-to-end in ~60–120s. Allbridge Core’s swap-and-bridge route invokes a Soroban swap pool that auto-converts to canonical USDC and credits the merchant’s G… Stellar address via a normal account_credited effect — any Stellar wallet supports the asset, no Soroban-aware wallet required. Migration 101 adds 'stellar' to xchain_destination_t. Tenants flip via the dashboard’s new xChain card on the Overview tab or PATCH /internal/tenants/{id}/xchain. Circle CCTP V2 will be added as a second protocol once Circle ships Stellar mainnet contracts publicly (currently testnet-only).
  • Circle CCTP V2 Fast Transfer is now the default protocol for Solana xChain. End-to-end EVM USDC → Solana settlement in ~50 seconds (faster than Allbridge’s ~90-120s), zero pool slippage, native Circle USDC on both sides. Implemented as a new bridge_protocol field on xchain_bridge_attempts (migration 100) so Algorand keeps using Allbridge (Circle hasn’t deployed CCTP on Algorand) while Solana auto-routes via CCTP. AlgoVoi runs a Solana relayer wallet that submits receive_message on Circle’s MessageTransmitterV2 for each attested deposit; daemon auto-retries on transient failures. Allbridge stays available as a fallback if anyone ever wants to opt out.

​
2026-05-04

  • xChain v2 — Solana destination live. EVM USDC bridged via Allbridge Core now settles directly to Solana payout addresses, alongside the existing Algorand path. Each tenant picks the destination via the xchain_destination_chain flag (default algorand, opt-in solana); both can run concurrently across a fleet of merchants. Settlement bypasses the LogicSig step on Solana — Allbridge delivers canonical Circle USDC straight to the merchant’s Solana wallet, no intermediate address.
  • Solana xChain typical end-to-end ≈ 90–120s for the full bridge-and-settle cycle. Source-tx revert detection added — if the customer’s swapAndBridge reverts on Base/Arb/etc. (most common cause: insufficient native gas for the bridge messenger fee), the checkout surfaces “Try bridge again” within seconds rather than spinning indefinitely.
  • Bridge slippage tolerance for Solana destinations — default 0.5% / 50 µunits absolute, env-tunable via XCHAIN_BRIDGE_SLIPPAGE_BPS and XCHAIN_BRIDGE_SLIPPAGE_ABS_MICROUNITS. Required because Allbridge’s combined source+dest pool fees deliver a few basis points under the bridged amount on small payments.
  • Merchant platform notifications wired into xChain settle — WooCommerce, OpenCart, PrestaShop, and Shopware integrations now flip the order to processing automatically on xChain Solana settlement, mirroring the direct-payment /verify flow. Previously xChain checkouts left the order stuck in pending payment even after USDC arrived.
  • Already-paid checkout redirect — refreshing a paid checkout link now auto-redirects to the merchant’s order-received page after 2s instead of dead-ending on a “Back to home” link pointing at the AlgoVoi gateway domain.

​
2026-04-27

  • 7-chain adapter rollout — Base, Solana, and Tempo chains added to all 23 adapter files: MPP adapter, AP2 adapter, 7 AI model adapters (OpenAI, Claude, Gemini, Bedrock, Cohere, xAI, Mistral), 9 AI framework adapters, and 4 no-code adapters (Zapier, Make, n8n, X). All adapters bumped to v1.1.0. 93/93 smoke checks pass.
  • MCP Server v1.2.0 — 11 tools → 13 tools. Added fetch_agent_card and send_a2a_message for A2A agent discovery and payment-gated calls from inside Claude, Cursor, and Windsurf. Published to npm and PyPI.
  • Tempo RPC — configurable via ALGOVOI_TEMPO_RPC env var (Alchemy endpoint); Base uses https://mainnet.base.org; Solana uses https://api.mainnet-beta.solana.com.
  • Protocol adapters (MPP v2.3.0, AP2 v2.1.0) — full EVM (eth_getTransactionReceipt) and Solana (getTransaction) on-chain verification added for Base, Solana, and Tempo.

​
2026-05-03

  • PQC Tier 2 — HMAC upgrade. All internal service-to-service channels and outbound webhook signatures now support dual-version HMAC: v1 (SHA-256, existing) and v2 (SHA-384, new). New webhooks carry both X-AlgoVoi-Signature-v1 and X-AlgoVoi-Signature-v2 headers; verifiers can validate either. Sub-keys derived via HKDF — no key rotation required.

​
2026-04-25

  • $1,000 KYC-unlock free mainnet trial replaces the prior rate-cap trial. Pass KYC and you get $1,000 of free mainnet payments across all 7 chains, then 0.50% per payment.
  • 9 outbound notification destinations live: Slack, Discord, Microsoft Teams, Mattermost, Rocket.Chat, Google Chat, Zulip, Telegram, generic webhook. All share the same retry stack and audit log.
  • Hosted-checkout payment.confirmed webhooks now fire alongside the existing x402 and MPP paths, with payment_link_token and payment_link_label in the event payload.
  • Self-payment block at the verifier across all 7 chains.

​
2026-04-24

  • Solana Actions and Blinks endpoint live at api.algovoi.co.uk/actions/checkout/{token}, returning unsigned VersionedTransactions with SPL USDC transfer plus Solana Pay reference binding.
  • All 4 conversational bots live: X, Telegram, Discord, Viber. Multi-tenant, with per-tenant chain preferences.
  • Solana Pay reference binding for hosted checkouts. Replaces memo binding on Solana with cryptographic reference-pubkey binding.

​
2026-04-22

  • Base chain added as the fifth supported chain. USDC ERC-20 settlement.
  • AP2 v0.1 reference scenarios shipped upstream: human-present crypto-algo and crypto-solana scenarios.
  • A2A v1.0 agent live at api.algovoi.co.uk/.well-known/agent.json with three skills (verify-payment, create-checkout, check-status).

​
2026-04-20

  • Pabbly Connect app approved and listed in the Pabbly app store.
  • Cloud edge live for off-gateway status sync and chat-bot webhooks.

​
2026-04-15

  • Stellar chain added as the fourth supported chain. USDC issuer + XLM native, with 28-byte memo binding.
  • MultiFernet rotation for tenant-secret encryption.

​
Earlier

  • Hedera chain added, USDC HTS via Mirror Node verification.
  • VOI chain added, ARC-200 aUSDC.
  • Algorand chain as the original launch chain.

​
Subscribing

When the status page goes live at status.algovoi.co.uk, subscribers will receive changelog and incident emails automatically. For now, watch this page for changelog and incident updates.