Skip to main content
AlgoVoi exists inside an open-protocol ecosystem (x402, MPP, AP2, A2A, Solana Pay, Algorand, VOI, Stellar, Hedera, Base, Tempo). The fastest way to evaluate whether a payment provider is a real participant or a marketing site is to look at what they have contributed back upstream. The pattern behind the list below is consistent across every ecosystem AlgoVoi touches. The same class of problem recurs independently: two implementations disagree about bytes or hashes, one object is not cryptographically bound to another, a verifier trusts an attacker-controlled root, a check is skipped, a failure opens instead of closing, or provenance is lost across a language boundary. AlgoVoi’s response is always the same shape: Canonicalise -> Bind -> Verify -> Fail closed -> Produce evidence -> Independently reproduce. The sections below are the public proof of that work. Every link is a public pull request, issue, or IETF document on a public repository, verifiable from a browser with no AlgoVoi account. Each item is tagged with what actually happened upstream, GitHub-accurate as of the date shown: merged, open, reviewed, withdrawn by AlgoVoi, or declined by a maintainer.

IETF Internet-Drafts

AlgoVoi-authored specifications filed with the IETF under the Independent Submissions stream (Informational). These are not vendor whitepapers — they are citable IETF documents with assigned datatracker URLs and submission IDs. They are the durable, protocol-neutral home for the formats below: independent of any single repository’s review decision. The nine I-Ds span the receipt and attestation formats, the JCS canonicalisation discipline, NIST post-quantum credential binding (Falcon-1024 / ML-DSA-65, FIPS 204 / 206), and cross-issuer ZKP federation. The last two are, as far as the author is aware, the first agentic-payment I-Ds to anchor credential binding and federation to the NIST post-quantum standards.

Protocol-level contributions

These land AlgoVoi as a canonical reference inside the protocol’s own repository, not just an entry in an external list.

Compliance-evidence and attestation specifications

AlgoVoi authored the compliance-evidence and attestation surface as a set of extension specifications: a categorical compliance receipt, settlement attestation, cancellation/refund envelopes, a composite trust query, and an RFC 9421 transport binding. These were first filed against x402-foundation/x402. On 2026-06-02 the core team closed the community extensions tree in a single batch: 49 pull requests from roughly 28 different authors, closed within minutes of one another (AlgoVoi’s nine among them, between 17:27 and 17:30 UTC, with no per-PR review comments), and opened its own consolidated vcx-v1 extension PR (#2544) about half an hour later, at 17:59 UTC. None of the AlgoVoi formats were closed on an individual merit review; they were part of a repository-wide reset of the extensions tree. The specifications do not depend on that repository. Every format below is filed as a citable IETF Internet-Draft (above) and shipped as an installable reference implementation (further below); the AP2 spec-PR mirrors were later withdrawn by AlgoVoi to reduce open-PR footprint (next section). The table records the original x402 filings for provenance, the close date, and the durable home of each format.

Protocol spec PRs (AP2, A2A, MPP)

The compliance-evidence surface above was mirrored as spec PRs in the AP2, A2A, and MPP-specs repositories, alongside protocol samples and fixes. The extension-spec mirrors were withdrawn by AlgoVoi in August 2026 to reduce open-PR footprint; each format’s durable home is its IETF I-D and published package (above). The protocol samples and the later SDK/security fixes remain open.

JCS canonicalisation substrate

The AlgoVoi-authored RFC 8785 canonicalisation substrate is the sole-AlgoVoi-authored discipline that downstream adopters validate against for receipt-format work. Full reference at /canonicalisation-substrate (v1) and /canonicalisation-substrate-v2 (v2, PQC-aware). The substrate has been cross-validated across eight independent JCS implementations in eight programming languages (Python, TypeScript, Go, Rust, Java, PHP, .NET, Ruby) with 880/880 byte-for-byte agreements directly executed (cumulative as of 2026-06-18). See the most recent attestation.

Conformance fixtures and reference artefacts

Reference implementations

Installable substrate primitives published to PyPI and npm with byte-for-byte cross-language parity. All packages Apache 2.0. Public verifier endpoint: verify.algovoi.co.uk/action-ref — returns the RFC 8785 JCS canonical form and SHA-256 digest, verified byte-identical across 8 independent implementations.

Post-quantum and federation layer

The PQC credential-binding and cross-issuer federation I-Ds above are implemented by a commercial gateway layer (AlgoVoi Commercial License v1.0, not public PyPI): algovoi-federation-validator (composes independently-issued PQC ZKP credentials into a single federation token with no shared trust root), algovoi-zkp-receipt (Falcon-1024 signature covering payment-receipt and ATB ZKP credential fields together), and algovoi-atb-credential-verifier. The Apache-2.0 algovoi-substrate-pqc package (above) is the public PQC-aware canonicalisation substrate (Falcon-1024, ML-DSA-65, ES256, Ed25519 cross-validated). Full catalogue at /package-suite.

Data and registry

Governance and agent-security fixes

Not every contribution is a payment-evidence format. A large share of AlgoVoi’s upstream work is plain security and fail-closed engineering inside other teams’ agent stacks: find a place where an agent framework can trust the wrong thing, fail open, accept malformed input, or diverge across languages, and fix it where it lives. Most of these land under the upstream project’s own name, not an AlgoVoi extension. That is the point: influence through merged fixes, not adopted branding.

Microsoft Agent Governance Toolkit (AGT)

Security and fail-closed governance fixes merged into microsoft/agent-governance-toolkit. The MerkleAuditChain reproducibility fix (#3361) is the same discipline as the JCS substrate above: an audit root an independent party can rebuild byte-for-byte.

A2A reference SDKs

Security fixes and adversarial reviews across the A2A reference implementations. Adversarial security reviews posted on third-party PRs (review contributions, not AlgoVoi-authored code): a2a-dotnet #450 (cross-tenant task access), #453 (terminal-state transition and cancel race), #475 (capability-aware extended-card errors), and a2a-python #1191 (terminal state to subscriber streams).

x402 engineering

Implementation and fail-closed fixes in x402-foundation/x402, beyond the compliance-evidence specs above.

AP2 agent-commerce fixes

SDK and sample fixes in google-agentic-commerce/AP2 that harden the mandate and credential trust boundary.

Supply-chain hardening (GitHub Actions SHA-pinning)

A cross-repository pass pinning third-party GitHub Actions to commit SHAs, so a moved tag cannot silently change CI behaviour.

Standards-discussion authorship

Where AlgoVoi authors or shapes spec text inside a protocol’s own RFC / working-group discussion. The throughline: AlgoVoi contributes converged spec text and deterministic conformance artefacts, scoped as seeds the protocol communities own long-term, not vendor-proprietary surfaces. URN rows are protocol-scoped (urn:x402:), not vendor-scoped.

Agent framework integrations

Wallet integrations

Curated lists and ecosystem indexes

These are recognition entries, but they signal AlgoVoi’s footprint across adjacent open-source communities. Status labels are GitHub-accurate; list maintainers merge on their own cadence and some decline.

x402, AP2, and agent-payments ecosystem

A2A ecosystem

MCP and Web3 lists

Chain-specific lists

AI framework and security lists

Why we make this list public

Most payment providers ship a marketing site. The thing that distinguishes a real protocol participant is the public commit history, the PRs that maintainers can review and merge, and the contributions that show up upstream. We list all of these in one place — merged, open, and declined alike — so anyone evaluating AlgoVoi (a prospective tenant, a regulator, an investor, a competitor) can verify the contribution footprint without having to take our word for any of it. Where a maintainer declined a PR, we say so and point to where the work now lives. If you are a maintainer of an ecosystem repo we should be listed in and are not, tell us.

See also