> ## Documentation Index
> Fetch the complete documentation index at: https://docs.algovoi.co.uk/llms.txt
> Use this file to discover all available pages before exploring further.

# AlgoVoi Evidence Auditor: prove your signed documents are valid, at scale

> Batch-verify a whole archive of signed documents (classical RSA/ECDSA and post-quantum), flag the weak, expired and quantum-exposed ones, and produce a signed, tamper-evident audit report your auditor checks with the free verifier.

AlgoVoi Evidence Auditor verifies **every** signature across an archive of
documents and produces a **signed, tamper-evident audit report** you can hand to
an auditor, then re-run each cycle to prove nothing changed. It is the middle
rung between the free verifier (check one document) and the Compliance Suite
(manage the whole records lifecycle).

## The ladder

* **Free** — [`algovoi-reseal-verify`](/reseal): inspect and verify a single document.
* **Evidence Auditor** (this): batch-verify a whole archive + the signed report.
* **[Compliance Suite](/verifiable-compliance-suite)**: store write-once, retain,
  place legal holds, run a console, forward to SIEM, custody keys, seal at scale.

## Use

After purchase on the [Suite Store](https://api.algovoi.co.uk/suite-store) you
receive an index token and a licence key. Install the auditor from the token-gated
AlgoVoi index (its public dependencies come from PyPI):

```bash theme={null}
pip install --index-url https://<your-index-token>@api.algovoi.co.uk/pkgs/simple/ \
            --extra-index-url https://pypi.org/simple/ algovoi-evidence-audit
export ALGOVOI_LICENSE_KEY="<your-licence-key>"

av-audit keygen                                  # your auditor identity
av-audit run ./signed-records --out ./audit      # verify the archive -> report
av-audit run ./signed-records --baseline ./audit/audit-report.json   # diff a re-run
```

`run` produces `audit-report.json` (findings), `audit-report.json.reseal.json`
(the signed attestation), `audit-report.html`, and `audit-report.csv`.

## The report verifies itself, with the free tool

The report is signed with a post-quantum reseal envelope, so anyone can confirm
it is authentic and unaltered using the free verifier, no licence needed:

```bash theme={null}
pip install algovoi-reseal-verify
av-reseal-verify verify audit-report.json.reseal.json --file audit-report.json --expect-kid sha256:...
```

## What it flags per document

verified / invalid, unsigned, weak digest (SHA-1), expired certificate, broken
trust chain, partial-coverage (shadow) PDF, and post-quantum exposure — with
optional offline trust-path (`--trust-roots`) and CRL (`--crl`) checks. Every
report that flags quantum-exposed documents is your cue to [re-anchor them](/reseal).

## Scope

Read-only: it verifies and reports; it never stores, mutates, or governs your
documents. **Auditing an archive is the licensed action** (gated at the engine,
fail-closed); *verifying* an existing report is free with `av-reseal-verify`, as
is single-document verification. Air-gap capable, no upload.