JCS Substrate Authorship and Provenance

This page is the single citable URL for AlgoVoi’s substrate authorship. Every artefact here is AlgoVoi-authored, Apache-2.0 licensed, and independently verifiable with one shell command. No AlgoVoi infrastructure is required to verify any claim on this page. If you are an acquirer’s technical lead doing diligence: this is the single page you read.

AI-assisted development disclosure. The substrate architecture, IETF Internet-Drafts, conformance vectors, cross-language reference implementations, and associated automation were developed by AlgoVoi with the assistance of two AI platforms — Anthropic Claude and Perplexity AI — used throughout for code validation, error correction, and build automation. All creative direction, technical decisions, and publication acts were made by AlgoVoi. Under UK CDPA 1988 s.9(3), copyright in computer-generated works vests in the person who made the arrangements necessary for the creation of the work — AlgoVoi. No third-party AI provider asserts any IP claim over the output. Over 1,500 development sessions are locally archived and can be made available to a verified acquirer under NDA as part of technical due diligence. Session logs from 2026-05-10 through 2026-05-16 show continuous daily activity on compliance, JCS canonicalisation, and conformance-suite artefacts, independently corroborating the May 2026 server-file timestamps cited as prior-art anchors in the temporal authorship timeline below.

The substrate, in one sentence

AlgoVoi authors a canonicalisation substrate for agentic-payment receipt formats (x402, AP2, A2A, MPP) plus the reference implementations, conformance corpus, and IETF Internet-Drafts that pin it. The substrate is byte-deterministic across 8 independent JCS implementations in 8 programming languages, including the implementation by the editor of RFC 8785 itself (Anders Rundgren via the Java impl). AlgoVoi operates as an independent substrate author as of 2026-05-24 (see “Coalition position” below).

Authored artefacts at a glance

#	Artefact	Surface	First public	Verify command
1	Production compliance machinery (`/compliance/screen`, `/compliance/attestation`)	api.algovoi.co.uk	2026-04-12	`curl -s https://api.algovoi.co.uk/.well-known/verascore-provider.json`
2	Canonicalisation discipline (Substrate Rule 2 integer-timestamp, JCS RFC 8785 pin) — specified in `draft-hopley-x402-canonicalisation-jcs-v1` and inline in `draft-hopley-x402-compliance-receipt` §4 and `draft-hopley-x402-refund-receipt` §4	IETF datatracker + Mintlify	2026-05-23 (IETF I-D §4)	`curl -sL https://www.ietf.org/archive/id/draft-hopley-x402-canonicalisation-jcs-v1.txt` once posted
3	JSON Schema (compliance receipt v1) on JSON SchemaStore	json.schemastore.org/algovoi-compliance-receipt-v1.json	2026-05-23 (merged via PR #5726)	`curl -s https://json.schemastore.org/algovoi-compliance-receipt-v1.json`
4	`algovoi-substrate` Python reference impl	PyPI	2026-05-23 (v0.3.0 current)	`pip install algovoi-substrate>=0.3.0`
5	`@algovoi/substrate` TypeScript reference impl	npm	2026-05-23 (v0.3.0 current)	`npm install @algovoi/substrate@^0.3.0`
6	`algovoi-audit-verifier` selective-disclosure verifier	PyPI + npm	2026-05-23	`pip install algovoi-audit-verifier`
7	`algovoi-rfc9421-verifier` HTTP-signature verifier	PyPI + npm	2026-05-24	`pip install algovoi-rfc9421-verifier`
8	Conformance vector corpus (counts on the substrate page, incl. cryptographic-property fixtures)	chopmob-cloud/algovoi-jcs-conformance-vectors	2026-05-19 (initial sets); current state 2026-06-22	`git clone https://github.com/chopmob-cloud/algovoi-jcs-conformance-vectors`
9	IETF Internet-Draft `draft-hopley-x402-compliance-receipt`	IETF datatracker	2026-05-23, Independent Submission, Informational	`curl -sL https://www.ietf.org/archive/id/draft-hopley-x402-compliance-receipt.txt`
10	8-implementation byte-for-byte cross-validation attestation (JCS RFC 8785)	attestation file	2026-05-24	See the attestation file for the 8 install commands; expect 192/192 byte-for-byte agreements
11	8-implementation cross-validation attestation (RFC 9421 + RFC 9530 + Ed25519)	attestation file	2026-05-24	`bash vectors/rfc9421_proxy_chain_v0/run_all.sh` in the cloned corpus; expect 24/24 agreements
12	`algovoi-refund-receipt` refund receipt reference impl	npm (LIVE v0.1.0); PyPI publish pending new-project rate-limit clear	2026-05-24 (v0.1.0)	`npm install @algovoi/refund-receipt` — live-tested 17/17 conformance pass
13	IETF Internet-Draft `draft-hopley-x402-refund-receipt`	IETF datatracker	2026-05-24, Independent Submission, Informational, POSTED	`curl -sL https://www.ietf.org/archive/id/draft-hopley-x402-refund-receipt.txt`
14	IETF Internet-Draft `draft-hopley-x402-canonicalisation-jcs-v1` (current revision 01) — discipline-level normative spec under sole AlgoVoi authorship; revision 01 adds Appendix C “Known Adopters” with AlgoVoi (production) and Supership `service_trust_v0` (downstream adopter)	IETF datatracker	-00 posted 2026-05-24, -01 posted 2026-05-24, Independent Submission, Informational	`curl -sL https://www.ietf.org/archive/id/draft-hopley-x402-canonicalisation-jcs-v1.txt`
15	`algovoi-settlement-attestation` multi-chain settlement attestation reference impl	npm (LIVE v0.1.0 once published); PyPI publish pending new-project rate-limit clear	2026-05-24 (v0.1.0)	`npm install @algovoi/settlement-attestation`
16	IETF Internet-Draft `draft-hopley-x402-settlement-attestation` — closes the receipt lifecycle gap (admission -> settlement -> refund) under sole AlgoVoi authorship; multi-chain via `settlement_chain` string	IETF datatracker	POSTED 2026-05-24, Independent Submission, Informational	`curl -sL https://www.ietf.org/archive/id/draft-hopley-x402-settlement-attestation.txt`
17	`algovoi-cancellation-receipt` mandate cancellation receipt reference impl — four-state closed enumeration (USER_REQUESTED / MERCHANT_REQUESTED / COMPLIANCE_TERMINATED / EXPIRED); closes the mandate-termination gap	npm (LIVE v0.1.0); PyPI publish pending new-project rate-limit clear	2026-05-24 (v0.1.0)	`npm install @algovoi/cancellation-receipt`
18	IETF Internet-Draft `draft-hopley-x402-cancellation-receipt` — mandate-termination categorical receipt under AlgoVoi authorship; welcomes downstream-adopter contributions per Appendix C “Known Adopters” pattern	IETF datatracker	POSTED 2026-05-24, Independent Submission, Informational	`curl -sL https://www.ietf.org/archive/id/draft-hopley-x402-cancellation-receipt.txt`
19	`algovoi-composite-trust-query` verifier-side composite-trust-query response reference impl — closed four-state enum `{TRUSTED, PROVISIONAL, INSUFFICIENT_EVIDENCE, UNTRUSTED}`; top-of-stack format above the four receipt formats	npm (LIVE v0.1.0); PyPI publish pending new-project rate-limit clear	2026-05-25 (v0.1.0)	`npm install @algovoi/composite-trust-query`
20	IETF Internet-Draft `draft-hopley-x402-composite-trust-query` — verifier-side response format closing the top of the receipt stack under AlgoVoi authorship	IETF datatracker	POSTED 2026-05-24, Independent Submission, Informational	`curl -sL https://www.ietf.org/archive/id/draft-hopley-x402-composite-trust-query.txt`
21	Substrate Adopters Registry (`docs.algovoi.co.uk/adopters`) — public registry of parties publishing under `canon_version: jcs-rfc8785-v1`. Maintained by AlgoVoi as neutral observer; submission via PR, issue, or email; year-N audit-grade record of adoption. Parallels Appendix C “Known Adopters” of the canonicalisation I-D. Includes Citation discipline section specifying citation patterns adopters typically surface (URN + IETF I-D + registry link + in-band `canon_version`)	docs.algovoi.co.uk/adopters (HTML) · docs.algovoi.co.uk/adopters.json (JSON-LD)	2026-05-25 (v1, AlgoVoi + Supership + PEAC Protocol entries); 2026-05-26 Citation discipline section added	`curl https://docs.algovoi.co.uk/adopters.json`
22	8-implementation 5-format cross-validation attestation — 320/320 byte-for-byte agreements across 5 receipt/response formats (compliance, settlement, cancellation, refund, composite-trust-query) under 8 independent JCS implementations (Python, Node.js, Ruby, PHP, Go, Rust, Java, .NET). PHP runner uses inline pure-stdlib JCS (no composer dep). Cumulative with 2026-05-24 attestation (row 10): 512/512 across 7 distinct vector sets at this date. (Cumulative total reached 832/832 on 2026-06-17 when action_ref_exactly_once_v1, adversarial_isolation_v1, retention_chain_v0, retention_chain_v1, epi_interop_v0, and epi_pqc_v0 attestations were added.)	attestation file	2026-05-25	`bash _attestations/2026-05-25-8-impl-5-format-cross-validation/run_all.sh` in the cloned corpus; expect 320/320 PASS
23	AlgoVoi APM (Agent Payment Module) — production agentic-payment platform running the substrate work. Multi-chain (8 families: Algo, VOI, Solana, Stellar, Hedera, Base, Tempo, Ethereum) + multi-protocol (x402, AP2, MPP, A2A) + multi-rail (USDC + fiat) + EMR 2011-safeguarded + IETF-spec-aligned. Substrate = open standards; APM = production implementation; one acquirer story	docs.algovoi.co.uk/platform/apm	operational since 2026-04	`curl https://api.algovoi.co.uk/health`
24	Hosted verifier hub (`verify.algovoi.co.uk`) — three public no-auth endpoints: `POST /verify` (audit bundle), `POST /action-ref` (JCS canonical hash + SHA-256, 8-impl attested), `POST /rfc9421` (RFC 9421 Ed25519 signature verification). All three backed by the same substrate packages.	verify.algovoi.co.uk	audit verifier 2026-05-09; `/action-ref` + `/rfc9421` 2026-05-29	`curl https://verify.algovoi.co.uk/action-ref`
25	RFC 9421 proxy-chain conformance fixture (AlgoVoi-designed) — `generate.py` + `verify.py` demonstrating that RFC 9421 HTTP Message Signatures + RFC 9530 Content-Digest headers survive unmodified through a 3-hop edge-to-application proxy chain. 4/4 verification checks pass against the live production endpoint. Test vector: RFC 8032 §7.1 Test 1 (deterministic Ed25519). Submitted to the A2A conformance suite as the canonical proxy-chain fixture for A2A §3.8 (v0.3.3 deliverable). PRs withdrawn at coalition exit 2026-05-24; fixture validation receipt preserved independently.	aeoess/aps-conformance-suite#5 · validation receipt gist	2026-05-16	`gh gist clone 5f35eaa527d292bf3ddc52f8725a85c9 && python3 verify.py`; expect 4/4 [OK]. `output_log.txt` in gist records 14/14 pass at time of submission.
26	Multi-chain Ed25519 substrate-independence fixture (AlgoVoi-designed) — `generate.py` + `verify.py` demonstrating that an A2A protocol payload can be signed simultaneously under three independent Ed25519 keys derived via BIP44 paths for Algorand (`m/44'/283'/0'/0'/0'`), Solana (`m/44'/501'/0'/0'`), and Stellar (`m/44'/148'/0'`). 3/3 byte-match verifications pass. Proves A2A wire-format is blockchain-agnostic; agents can assert capability across chains without re-signing. Submitted to the A2A conformance suite as the multi-chain substrate-independence fixture for A2A §3.8 (v0.3.3 deliverable). PRs withdrawn at coalition exit 2026-05-24; fixture validation receipt preserved independently.	aeoess/aps-conformance-suite#6 · validation receipt gist	2026-05-16	`gh gist clone 5f35eaa527d292bf3ddc52f8725a85c9 && python3 verify.py`; expect 3/3 [OK]. `output_log.txt` in gist records 14/14 pass at time of submission.
27	`algovoi-substrate-pqc` Python reference impl — JCS+PQC integration layer (ES256 + Ed25519 + Falcon-1024 + ML-DSA-65) over `pqcrypto`/PQClean + `cryptography` + `rfc8785`. 12-row `signature_algorithm` open-enum + fail-closed verifier discipline + cross-implementor byte-anchor convergence proof methodology. Source code on GitHub. 27/27 tests pass	PyPI · GitHub	2026-05-26 08:35 UTC	`pip install algovoi-substrate-pqc`
28	`@algovoi/substrate-pqc` TypeScript reference impl — pure-JS, browser + Node + Bun + Deno compatible. Wraps `@noble/post-quantum` (Paul Miller) for PQC + `@noble/curves` + `@noble/hashes` + `canonicalize`. Same `signature_algorithm` open-enum + fail-closed verifier discipline. 26/26 tests pass	npm · GitHub	2026-05-26 08:38 UTC	`npm install @algovoi/substrate-pqc`
29	Cross-product producer × verifier matrix attestation — 6 producers (Python, TS, Ruby, PHP, Go, Rust) × 8 verifiers (Python, TS, Ruby, PHP, Java, Perl, Go, Rust) = 48/48 cells PASS. Same canonical SHA-256 anchor `sha256:cc8315f7...e0` across all producers. Go produces 3 schemes (ES256 + Ed25519 + ML-DSA-65; no pure-Go Falcon without CGo); Rust produces all 4. Reproducible from any contributor environment via `python scripts/cross_product_matrix.py`	attestation file · 2026-05-26 original	2026-05-30 (updated; original 2026-05-26)	`git clone chopmob-cloud/algovoi-substrate-pqc && python scripts/cross_product_matrix.py`
30	Three audit-grade PQC implementations cross-validated byte-for-byte — PQClean (via `pqcrypto` on Python) ↔ `@noble/post-quantum` (TypeScript, Paul Miller) ↔ Bouncy Castle 1.84 (Java, `MLDSASigner` + `FalconSigner`). All three independently verify the same Falcon-1024 and ML-DSA-65 signatures over identical canonical bytes. Java verifier at `verifiers/java/`	Java verifier	2026-05-26	`cd verifiers/java && bash fetch-deps.sh && javac -cp "lib/" -d out Verify.java && java -cp "out;lib/" Verify`
31	AP2 #250 PQSafe joint deliverable closed — AP2 PaymentMandate canonical bytes signed under four schemes (ES256 + Ed25519 + Falcon-1024 from AlgoVoi side; ML-DSA-65 from PQSafe side per AP2 #250). Joint co-maintainer access established. PQSafe credit scoped to the ML-DSA-65 contribution per published policy	chopmob-cloud/ap2-pq-conformance	PR merged 2026-05-26 04:38 UTC	`git clone chopmob-cloud/ap2-pq-conformance && (cd algovoi-side && pip install rfc8785 cryptography pqcrypto && python verify.py); (cd pqsafe-side && python verify.py)`
32	AlgoVoi-hosted discrimination-tuple injectivity rule canonical mirror — the AlgoVoi-authored substrate rule first posted A2A #1734 on 2026-05-14, hosted under AlgoVoi infrastructure independent of any downstream composition document. Cross-references the agentgraph composition + the IETF I-D for the citation chain	`algovoi-jcs-conformance-vectors/docs/discrimination-tuple-injectivity-v0.md`	2026-05-26	`curl https://raw.githubusercontent.com/chopmob-cloud/algovoi-jcs-conformance-vectors/main/docs/discrimination-tuple-injectivity-v0.md`
33	Microsoft AGT #276 substrate-author public-record anchor — calibrated correction on Microsoft Agent Governance Toolkit Discussion #276 establishing dated public-record origin of the discrimination-tuple injectivity rule (A2A #1734 May 14 + agentgraph commit `229040b` §2 + IETF I-D POSTED). Trusted-partners offer for downstream consumers following the originating-contribution discipline	microsoft/agent-governance-toolkit#276	2026-05-26 08:16 UTC	Read the discussion comment directly
34	Canonicalisation discipline v2 (PQC-aware) — AlgoVoi-authored revision under `urn:x402:canonicalisation:jcs-rfc8785-v2`. Strictly additive over v1; canonicalisation core unchanged. Adds the `signature_algorithm` open-enum registry (12 rows: ES256/ES256K/Ed25519/ML-DSA-44/65/87/Falcon-512/1024/SLH-DSA-SHA2-128s/HMAC-SHA-256/384/Hybrid), fail-closed verifier discipline, and PQC algorithm normative references (FIPS 204/205/206). Sole AlgoVoi authorship with PQSafe ML-DSA-65 scoped credit on AP2 #250. v1 adopters retain their registry position; v2 adopters land separate rows. IETF I-D formalisation deferred pending the active IETF list thread (May 2026) on Independent Submissions stream scope	docs.algovoi.co.uk/canonicalisation-substrate-v2	2026-05-26	`curl https://docs.algovoi.co.uk/canonicalisation-substrate-v2`
35	`algovoi-rfc9421-signer` RFC 9421 HTTP Message Signatures signer reference impl — produces a detached `Signature` + `Signature-Input` header pair over a canonicalised request signing base; companion to `algovoi-rfc9421-verifier`. Sole AlgoVoi authorship	PyPI · npm	2026-05-29 (v0.1.0)	`pip install algovoi-rfc9421-signer`
36	`algovoi-pef` Payment Evidence Frame reference impl — five claim types (payment_admission, payment_settlement, payment_cancellation, payment_refund, composite_verdict) consolidated under a single `frame_id` (SHA-256 over JCS-canonical preimage); optional RFC 9421 detached signature; Python + TypeScript parity. 8-impl byte-for-byte cross-validated (64/64 agreements)	PyPI · npm · GitHub	2026-05-30 (v0.1.0)	`pip install algovoi-pef`
37	IETF Internet-Draft `draft-hopley-x402-payment-evidence-frame` — Payment Evidence Frame: canonical wrapper consolidating all x402 receipt types into a single verifiable artefact under sole AlgoVoi authorship. -00 posted 2026-05-30	IETF datatracker	2026-05-30, Independent Submission, Informational	`curl -sL https://www.ietf.org/archive/id/draft-hopley-x402-payment-evidence-frame.txt`
38	8-implementation PEF cross-validation attestation — 64/64 byte-for-byte agreements across PEF frame_id derivation and claim-type serialisation under 8 independent JCS implementations. Cumulative across all vector sets: 880/880 across 14 vector sets (as of 2026-06-18)	attestation file	2026-05-30	See attestation file for reproduction commands; expect 64/64 PASS
39	Four audit-grade PQC implementations cross-validated byte-for-byte — PQClean (Python `pqcrypto`), `@noble/post-quantum` (TypeScript, Paul Miller), Bouncy Castle 1.84 (Java `MLDSASigner` + experimental `FalconSigner`), RustCrypto `ml-dsa` + `pqcrypto-falcon` (Rust). All four independently verify the same Falcon-1024 and ML-DSA-65 signatures over identical canonical bytes. Go verifier covers ES256 + Ed25519 + ML-DSA-65 (no pure-Go Falcon). 48/48 cells PASS across 6 producers × 8 verifiers	Go verifier · Rust verifier	2026-05-30	`cd verifiers/rust && cargo run -- verify <artefact.json>`
40	`algovoi-receipt-verifier` 8-step JWS compliance-receipt verifier — offline-capable (no AlgoVoi infrastructure dependency). Verification steps: JWS format → algorithm whitelist (EdDSA/ES256K/RS256) → Ed25519 signature → `canon_version` registry → JCS re-canonicalisation → required fields → `screen_result` enum → `payment_hash` binding. 9 error codes. Platform endpoint `POST https://api.algovoi.co.uk/v1/receipt/verify` (rate-limited 120/min)	PyPI · npm · GitHub	2026-05-31 (v0.1.0)	`pip install algovoi-receipt-verifier` — Python 41/41; `npm install @algovoi/receipt-verifier` — TypeScript 19/19; 13 conformance vectors (5 valid + 8 invalid, each invalid maps to a Phase 8 ATB threat)
41	`algovoi-webhook-verifier` standalone cryptographic verifier for the `X-AlgoVoi-Signature` header produced by the AlgoVoi gateway. Validates v1 (HMAC-SHA256) and v2 (HKDF-SHA256-derived key + HMAC-SHA384) signature components; enforces replay protection (300 s default tolerance). 6 error codes. Zero runtime dependencies	PyPI · npm · GitHub	2026-05-31 (v0.1.0)	`pip install algovoi-webhook-verifier` — Python 47/47; `npm install @algovoi/webhook-verifier` — TypeScript 45/45; 8-lang × 13 vectors = 104/104
42	`algovoi-receipt-sentinel` sliding-window duplicate/replay/scan monitor. Consumes error-code streams from `algovoi-webhook-verifier` and `algovoi-receipt-verifier`; fires `TAMPER_DETECTED`, `REPLAY_DETECTED`, `SCAN_DETECTED`, `BURST_FAILURE` alert types. Zero runtime dependencies	PyPI · npm · GitHub	2026-05-31 (v0.1.0)	`pip install algovoi-receipt-sentinel` — Python 36/36; `npm install @algovoi/receipt-sentinel` — TypeScript 35/35; 8-lang × 13 vectors = 104/104
43	ATB Phase 2 ZKP service (`atb-zkp-service` v0.1.0) — Rust microservice generating Pedersen commitments + Bulletproofs range proofs over Ristretto255. Proves `score ≥ threshold` without revealing the score. Called by the bench cert endpoint and by the gateway ATB ZKP client. 47+ hours live in production as of 2026-06-04. Curve: ristretto255, scheme: bulletproofs-v1, range_bits: 64	production — `curl https://agent-trust-bench.algovoi.co.uk/agent-trust-bench/.well-known/atb-keys.json` · IACR ePrint 2026/109852	2026-06-04 (deployed; Phase 1 Falcon-1024 ATB certs live since 2026-06-01)	`curl -s https://agent-trust-bench.algovoi.co.uk/.well-known/atb-keys.json \| jq '.cert_policy'` — confirms Phase 2 issuance policy live
44	IETF Internet-Draft `draft-hopley-x402-pqc-credential-binding-00` — Falcon-1024 (FIPS 206 / FN-DSA) and ML-DSA-65 (FIPS 204) credential binding to x402 agentic payment authorisation: credential envelope format, JCS canonicalisation discipline applied to signed payloads, gateway verification procedure, and a session token binding that replaces per-request API-key authentication. Ninth AlgoVoi Independent Submission	IETF datatracker · IACR ePrint 2026/109852	2026-06-04, Independent Submission, Informational	`curl -sL https://www.ietf.org/archive/id/draft-hopley-x402-pqc-credential-binding-00.txt`
45	IETF Internet-Draft `draft-hopley-x402-federation-zkp-00` — cross-issuer ZKP credential composition protocol. §5.2 composite commitment algorithm: `SHA-256(domain_label ‖ comm_0 ‖ … ‖ nonce)`; §6 federation token format; §7 security properties. Tenth AlgoVoi Independent Submission	IETF datatracker · IACR ePrint 2026/109852	2026-06-04, Independent Submission, Informational	`curl -sL https://www.ietf.org/archive/id/draft-hopley-x402-federation-zkp-00.txt`
46	IACR ePrint 2026/109852 — “Agent Trust Bench: Adversarial Payment Profiling for Autonomous Agents with Post-Quantum Credential Binding and Cross-Issuer Federation”. Extends ATB paper with §5.2 Bulletproofs ZKP, §6 PQC credential binding (Falcon-1024/ML-DSA-65), §7 cross-issuer federation protocol. Submitted 2026-06-04; under editor review	IACR ePrint 2026/109852	2026-06-04 (under review)	`curl -s https://eprint.iacr.org/2026/109852` — confirms IACR receipt
47	`algovoi-federation-validator` v0.1.1 — AlgoVoi Commercial License v1.0. Cross-issuer ZKP credential composition: independently-issued Falcon-1024 ATB Pass Certificates from different issuers composed into a single composite federation token with no shared trust root. Composite commitment: `SHA-256(domain_label ‖ comm_0 ‖ … ‖ nonce)`; HMAC-SHA256 signed federation token. Internal bypass for existing infra. 59/59 tests. Deployed in production	production (internal, not publicly indexed) · IETF: `draft-hopley-x402-federation-zkp-00` + `draft-hopley-x402-pqc-credential-binding-00`	2026-06-04 (deployed; AlgoVoi Commercial License v1.0)	`curl https://api.algovoi.co.uk/health` confirms gateway which calls this service; direct verification requires commercial licence
48	`algovoi-zkp-receipt` v0.1.0 — AlgoVoi Commercial License v1.0. ZKP-bound payment receipt attestation: binds an ATB Phase 2 ZKP credential to a specific on-chain payment receipt — proving `score ≥ threshold` without score disclosure. Falcon-1024 signature covers both receipt fields and ZKP fields. 13/13 tests. Deployed in production	production (internal) · IETF: `draft-hopley-x402-pqc-credential-binding-00`	2026-06-04 (deployed; AlgoVoi Commercial License v1.0)	Same as above — direct verification requires commercial licence
49	ZKP receipt binding + composite trust verdict wiring — gateway post-settlement pipeline. After every confirmed x402 settlement on a Phase 2 ATB session: (1) `X-ZKP-Receipt-Payload` response header carries the unsigned ZKP receipt payload binding the agent credential to the on-chain payment; (2) `X-Composite-Trust-Verdict` response header carries the verdict (`TRUSTED` when `SETTLED` + `threshold_met=true`). `POST /compliance/trust-query` now recognises `zkp_receipt` objects as trust signals: `threshold_met=true → TRUSTED`, `threshold_met=false → UNTRUSTED`. Zero impact on standard (non-Phase 2) payment flows	`api.algovoi.co.uk/compliance/trust-query` · `gateway/app/services/trust_verdict.py` · `gateway/app/services/zkp_receipt_client.py`	2026-06-04	`curl -X POST https://api.algovoi.co.uk/compliance/trust-query -H "Content-Type: application/json" -d '{"receipts":[{"settlement_result":"SETTLED"},{"type":"zkp_receipt","threshold_met":true}]}'` — expects `{"trust_outcome":"TRUSTED",...}`
50	Signed A2A AgentCard, detached EdDSA JWS over JCS per A2A §8.4. The agent card at `/.well-known/agent.json` carries a `signatures[]` block (`alg` EdDSA, `kid` d0481df4cbbda8e8aba86709419884ef, `typ` JOSE); the Ed25519 verify key is published at `/.well-known/jwks.json` (OKP/Ed25519, matching kid) and the platform Falcon-1024 public key at `/.well-known/pqc-keys.json` (`did:web:api.algovoi.co.uk#falcon-1024-1`). Signer `verascore_jwks.sign_agent_card()`	agent.json · jwks.json · pqc-keys.json	live, independently fetched 2026-07-14; authored 2026-07-06	`curl -s https://api.algovoi.co.uk/.well-known/agent.json` and `/.well-known/jwks.json`; rebuild the JCS of the card minus `signatures[]` and verify the detached EdDSA JWS against the jwks Ed25519 key with any stock JOSE library. No AlgoVoi infrastructure.
51	AlgoVoi Mesh (L3), post-quantum mutual agent-to-agent settlement. Two agents verify each other offline with Falcon-1024 (kid = first 16 bytes of `SHA-256(public key)`), negotiate a chain via signed chain offers, and settle once as one content-addressed `execution_ref`; the chain carries a 32-byte anchor and never verifies Falcon. Revocation is issuer-signed CRL, enforced in the handshake. Commercial licence; the on-chain settlement proof is public across ten independently-verified chains, including the first settlement on a UTXO chain (Bitcoin). (Arc was also tested but its testnet RPC was not reachable for independent verification, so it is not asserted here.)	commercial (`algovoi-mesh`, not public-indexed) · public on-chain proof · docs.algovoi.co.uk/agent-mesh	2026-07-14 to 2026-07-15 (on-chain proof, ten chains)	Public, no AlgoVoi infra: `curl -s "https://mainnet.mirrornode.hedera.com/api/v1/topics/0.0.10641585/messages?limit=1"` and base64-decode the message, and it reads `algovoi-mesh:sha256:150b4e46...`, the exact settlement reference, on Hedera mainnet Consensus Service. Every settlement anchors the same `execution_ref` via each chain’s native field: canonical `algovoi-mesh:sha256:<hex>` on Algorand, VOI, Solana, Hedera and XRPL; raw calldata `0x<hex>` on Base, Tempo and Ethereum; `algovoi-mesh:sha256:` + raw digest in an OP_RETURN on Bitcoin; a native `manage_data` entry on Stellar. Each transaction is linked from the product page and recomputes offline.
52	Keystone L2 open packages (Apache-2.0, public PyPI): `algovoi-substrate` v0.4.1 (the open RFC 8785 / JCS canonical substrate, `CANON_VERSION jcs-rfc8785-v1`) plus Cython builds `algovoi-keystone-validate`, `algovoi-keystone-secure-lite`, `algovoi-keystone-sqlalchemy` v0.2.0	substrate · validate · secure-lite · sqlalchemy	2026-07-02 (substrate 0.4.1); 2026-07-10 (keystone Cython 0.2.0)	`pip download <pkg>==<ver> --no-deps`, `sha256sum`, compare to the digest at `https://pypi.org/pypi/<pkg>/<ver>/json`. Third-party hosted; no AlgoVoi infrastructure.

Temporal authorship timeline

For anyone challenging the substrate authorship claim, the public git history is the authoritative record.

Date (UTC)	Surface	Event
2026-03-15 to 2026-03-19	X / Twitter (public)	@AlgoVoi publishes daily build-in-public series: x402 tenant platform. 6 posts across 5 days documenting test suite growth from 748 → 902 → 3,535 → 7,792 → 9,845 → 57,765 unit tests, all passing. Mar 18 adds multi-tenant premium routing (`/api/premium/[tenantid]`, `/api/voi-premium/[tenantid]`). Mar 19 reaches Phase 4508/4508 complete. Coverage across control_plane, gateway, facilitator, shared. Public disclosure of AlgoVoi’s x402 payment platform.
2026-04-12	AlgoVoi platform	First commit on `compliance.py`: sanctions screening, risk tier enforcement, AML retention. The production compliance machinery that the IETF I-D later specifies.
2026-04-25	X / Twitter (public)	@AlgoVoi posts: “AlgoVoi — Testnet Support” — public multi-chain protocol compatibility matrix across x402, MPP, AP2 and A2A for Base Sepolia, Stellar testnet, Algorand testnet, Solana devnet, Hedera testnet, VOI testnet, and Tempo testnet. Live testnet results with compliance notes published openly. Public disclosure of AlgoVoi’s multi-chain agentic payment infrastructure.
2026-04-26	algovoi-substrate’s KYB encryption	Production KYB encryption (Fernet/AVK1) operational.
2026-05-04	X / Twitter (public)	@AlgoVoi posts: “AlgoVoi PQC Tier 2 sub-project A shipped. HMAC dual-emit (v1 SHA-256 + v2 SHA-384) across every internal channel and outbound webhook. AES-256-GCM dispatcher live alongside AES-128.” Links to `algovoi.co.uk/AlgoVoi/compliance.html`. Public disclosure of AlgoVoi’s cryptographic compliance infrastructure.
2026-05-07	AlgoVoi platform	`/compliance/screen` and `/compliance/attestation` production-hardened with rate-limiting, strict-v4 UUID, sanctions list reconcile, tipping-off compliance (SAMLA s.20).
2026-05-09	verify.algovoi.co.uk	Hosted audit-verifier service goes live.
~2026-05-12	LinkedIn (public)	AlgoVoi publishes post announcing Agent Trust Bench: “AI agents that handle money need a test suite. Here is one. 138 adversarial payment scenarios. Free to use. No account required. Works with any x402 facilitator.” 138 adversarial x402 profiles across 30 threat categories including steganography attacks, LLM reasoning exploits, framework-specific attacks (LangGraph, CrewAI, AutoGen, OpenAI Swarm), and ethical bypass framing. Public prior-art disclosure of ATB methodology on LinkedIn.
2026-05-16	aeoess/aps-conformance-suite	AlgoVoi designs and submits two A2A §3.8 conformance fixtures: (1) RFC 9421 proxy-chain fixture #5 — 4/4 signature-survival checks against a live 3-hop edge-to-application chain; (2) multi-chain Ed25519 substrate-independence fixture #6 — same A2A payload signed under Algorand + Solana + Stellar BIP44 derivation paths, 3/3 byte-match. Both fixtures are AlgoVoi-designed and target the v0.3.3 A2A spec deliverable.
2026-05-19	chopmob-cloud/algovoi-jcs-conformance-vectors	First conformance vector sets (AP2 OMH v0, CTEF + APS v1, privacy_class, per-chain envelope) published.
2026-05-21	x402-foundation/x402	AlgoVoi files PR #2436 — canonicalisation discipline including Substrate Rule 2 (integer timestamps MUST).
2026-05-22 14:07	giskard09/argentum-core	Commit `71c01e8` — adds two field names (`authority_verified_at_ms`, `revocation_check_at_ms`) to action-ref.md v1.0. AlgoVoi acknowledges argentum-core’s authorship of these two specific field names. They sit on top of the AlgoVoi substrate.
2026-05-22 16:18 UTC	kenneives/agentgraph	PR #21 (`test(cross-impl): add 4-language JCS substrate runners for row #3 reproduction`) MERGED by kenneives. Adds four-language JCS substrate matrix runners to the agentgraph repo anchored to AlgoVoi’s canonicalisation discipline, independently reproducing the substrate cross-validation methodology in a third-party codebase.
2026-05-22 16:47	x402-foundation/x402	Vauban Pay (`seritalien`) APPROVES PR #2436. Co-signs Substrate Rule 2 on the canonical spec record.
2026-05-22 ~22	IETF datatracker	Vauban Pay submits `draft-vauban-x402-stark-receipts-00` (immutable archive copy), §7.1 of which mandates the integer-timestamp rule — independently corroborating Substrate Rule 2 — and which names AlgoVoi in its acknowledgments and §7 co-authorship statement.
2026-05-22	X / Twitter (public)	@AlgoVoi posts: “If you’re shipping a receipt or mandate format in x402, AP2, A2A or MPP, here’s the JCS RFC 8785 canonicalisation substrate it should anchor to. 5 reference impls. 53 vectors. 5 normative rules.” Links to `docs.algovoi.co.uk/canonicalisation-substrate`. Public prior-art disclosure of JCS canonicalisation substrate to the x402 / agentic payments developer community.
2026-05-23	LinkedIn (public)	AlgoVoi publishes post announcing canonicalisation substrate milestone: “Five independent implementations of RFC 8785 now agree byte-for-byte across 53 conformance vectors covering mandates, receipts, privacy attestations, and chain-specific envelopes… Canonicalisation is substrate work.” Links to `docs.algovoi.co.uk/conformance-vectors` and the substrate matrix gist. Public prior-art disclosure of JCS+SHA-256 cross-implementation substrate on the same day as `algovoi-substrate 0.3.0` PyPI publication.
2026-05-23	AlgoVoi	Substrate package extracted from production to PyPI + npm (v0.1.0 → v0.2.0 → v0.2.1). SchemaStore PR #5726 merges the compliance receipt JSON Schema. Three new conformance anchor sets published. AlgoVoi files `draft-hopley-x402-compliance-receipt` to IETF datatracker.
2026-05-23 17:18	kenneives/agentgraph	PR #24 MERGED, adding CTEF row 9 `urn:x402:receipt:stark-vauban-pay-v1` under `transactional`/`cryptographic` taxonomy — extending the receipt-class registry to include a Vauban Pay STARK receipt entry.
2026-05-23 20:58	giskard09/argentum-core	Commit `96931c9` — adds JCS timestamp encoding rule to argentum-core spec. Published the same day as AlgoVoi’s formulation of the same rule on A2A #1734, approximately 2 hours after AlgoVoi’s post on that thread.
2026-05-24 early	AlgoVoi	`[email protected]` + `[email protected]` shipped. JCS 8-impl matrix attested (192/192) + RFC 9421 8-impl matrix attested (24/24). IETF I-D `draft-hopley-x402-compliance-receipt` posted on datatracker.
2026-05-24 ~08	x402 #2428	Follow-up on the x402 TSC `transactional` vs `cryptographic` taxonomy question for v0.4. AlgoVoi posted a drive-by update on the same thread linking the new attestations.
2026-05-24 ~09:55	AlgoVoi	Coalition exit decision. Operator call: independence over coalition coordination. Farewell posted on x402 #2428. AlgoVoi PR #2436 on x402-foundation/x402 closed gracefully (seritalien APPROVED + arian-gogani LGTM preserved on the closed PR record).
2026-05-24 ~10	AlgoVoi	Architecture pivot: each AlgoVoi receipt class ships as its own standalone published package + IETF I-D. `algovoi-substrate` v0.4.0 (which had bundled refund_receipt) reverted to v0.3.0; refund_receipt extracted into new standalone `algovoi-refund-receipt` v0.1.0.
2026-05-24 ~10:30	AlgoVoi	`@algovoi/[email protected]` published to npm. Live registry install tested byte-identical against `refund_receipt_v1` conformance vectors (8 vectors + 5 pair + 3 chain + 1 build-then-verify = 17/17 PASS). PyPI publish blocked by new-project rate limit; token retained for retry.
2026-05-24 ~10:35	AlgoVoi	All 21 upstream-thread watchers + 3 coalition scheduled tasks stopped. AlgoVoi operates fully independently going forward.
2026-05-24 ~11:20	AlgoVoi	`draft-hopley-x402-canonicalisation-jcs-v1` drafted as standalone IETF Internet-Draft under sole AlgoVoi authorship. Future AlgoVoi receipt I-Ds normatively reference this discipline I-D rather than redefining §4 inline.
2026-05-24 23:39 UTC	IETF list	John Klensin (writing in personal capacity) posts to the IETF list raising procedural concerns about the recent volume of x402-related Independent Submissions: (i) x402 Foundation has its own standards process; (ii) IETF change-control / authority questions; (iii) stablecoin-payment-method specifics; and the appearance-of-IETF-endorsement risk. Not an endorsement; a substantive request for a DISPATCH-like discussion of whether the work belongs in the IETF. AlgoVoi reply deferred pending review of ISE criteria.
2026-05-25	AlgoVoi	Substrate Adopters Registry v1 launched at `docs.algovoi.co.uk/adopters` (three entries: AlgoVoi, Supership/Crest, PEAC Protocol). 8-impl × 5-format cross-validation attestation published (320/320 byte-for-byte agreements; cumulative 512/512 across 7 distinct vector sets). `algovoi-refund-receipt`, `algovoi-settlement-attestation`, `algovoi-cancellation-receipt`, `algovoi-composite-trust-query` all published to PyPI + npm. IETF -01 revisions filed for compliance-receipt and refund-receipt.
2026-05-25	google-agentic-commerce/AP2#265	jithinraj (PEAC Protocol) independently confirms AP2 open_mandate_hash cross-implementation pass and is added to the Substrate Adopters Registry as entry #3 — first organic downstream-adopter signal from a party with no prior AlgoVoi coalition relationship.
2026-05-25	x402 #2400	A contributor engaged on the VCX payment-record thread (x402 #2400). AlgoVoi cited its IETF I-D as the canonicalisation source and offered APM as a reference implementation. Resolved (see 2026-06-22 below).
2026-05-25	x402-foundation/x402#2452	EfeDurmaz16 (Sardis) + TateLyman engage on AP2+x402 composition thread. AlgoVoi anchored evidenceHash → SHA-256(JCS), categorical compliance receipt for deny case, and audit-chain-row shape. Sardis named as Adopters Registry candidate.
2026-05-25 17:14 UTC	agentgraph-co/agentgraph	kenneives publishes `semantic-divergence-boundary-v0.md` at commit `229040b` formalising AlgoVoi’s discrimination-tuple injectivity rule as §2 with named AlgoVoi co-authorship per the originating-contribution discipline. Front-matter and §7 attribution table both cite AlgoVoi as the formalism originator.
2026-05-26 ~04:54 UTC	IETF list	Eliot Lear (Independent Submissions Editor) replies to the same thread with a procedural pointer to rfc-editor.org/about/independent and notes he has not reviewed any of the drafts. Confirms the ISE review process exists and has not yet been invoked.
2026-05-26	IETF list	AlgoVoi (Chris Hopley) posts a short procedural acknowledgment to the same thread committing to review the ISE criteria against the relevant drafts and revert. Substantive engagement with Klensin’s three concerns deferred pending the criteria review.
2026-05-26 03:02 UTC	chopmob-cloud/ap2-pq-conformance	rayc0 (PQSafe) opens PR #1 landing ML-DSA-65 (FIPS 204) signature over the AP2 PaymentMandate canonical bytes — completes the four-scheme cross-implementor convergence (ES256 + Ed25519 + Falcon-1024 + ML-DSA-65).
2026-05-26 04:38 UTC	chopmob-cloud/ap2-pq-conformance	PR #1 merged. PQSafe granted co-maintainer access per published policy. AP2 #250 joint deliverable closes.
2026-05-26 08:16 UTC	microsoft/agent-governance-toolkit	AlgoVoi posts substrate-author anchor comment on Discussion #276 — calibrated date-anchoring correction with three immutable citation anchors (A2A #1734 May 14, agentgraph `229040b` §2, IETF I-D POSTED). Open Apache-2.0 + trusted-partners offer for downstream consumers.
2026-05-26 08:35 UTC	PyPI	`algovoi-substrate-pqc 0.1.0` published — Python reference impl for JCS+PQC integration.
2026-05-26 08:38 UTC	npm	`@algovoi/substrate-pqc 0.1.0` published — TypeScript twin. Both packages e2e-verified against AP2 PQ conformance fixtures (8/8 schemes across both registries).
2026-05-26	AlgoVoi-substrate-pqc	Cross-product matrix attestation published: 4 producers × 6 verifiers = 24/24 cells PASS. Same canonical SHA-256 `sha256:cc8315f7...e0` across four independent JCS implementations. Three audit-grade PQC implementations agree byte-for-byte: PQClean + `@noble/post-quantum` + Bouncy Castle.
2026-05-26	docs.algovoi.co.uk	Canonicalisation discipline v2 (PQC-aware) published at `/canonicalisation-substrate-v2` under sole AlgoVoi authorship. URN `urn:x402:canonicalisation:jcs-rfc8785-v2`. Strictly additive over v1 (canonicalisation core unchanged); adds signature_algorithm registry + fail-closed verifier discipline + PQC normative references. PQSafe credit scoped to ML-DSA-65 contribution on AP2 #250. v1 adopters retain registry position. IETF I-D filing deferred pending Klensin/Lear thread on Independent Submissions stream scope.
2026-05-26	awslabs/agentcore-samples	AlgoVoi posts substrate-author anchor on Issue #1546 comment — calibrated correction on aeoess (AEOESS Consilium) post that described the canonicalisation discipline as “the x402 substrate’s own canonicalizer” without attribution. The comment establishes sole AlgoVoi authorship of `urn:x402:canonicalisation:jcs-rfc8785-v1` in the AWS Labs permanent archive, cites the IETF I-D + the 8-impl 192-vector cross-validation matrix + the three production adopters in the Substrate Adopters Registry. Trusted-implementations offer routed through the AlgoVoi-curated registry.
2026-05-26 10:20 UTC	x402-foundation/x402	PR #2438 (`docs(specs): fix broken link to batch-settlement spec in cloudflare scheme`) MERGED by a maintainer. Small +1/-1 documentation fix landing in upstream x402 spec text. Signal of active maintainer cadence in the x402 review queue today. AlgoVoi commit-signing configured for this machine going forward; future AlgoVoi PRs (#2453, #2322, #2334) land signed without rebase pass.
2026-05-26 10:23 UTC	docs.algovoi.co.uk/adopters	Citation discipline section added to the Substrate Adopters Registry (commit `caf7eeb` on `chopmob-cloud/docs` main). Specifies citation patterns adopters typically surface: URN `urn:x402:canonicalisation:jcs-rfc8785-v1` + IETF I-D `draft-hopley-x402-canonicalisation-jcs-v1` cited as normative reference; registry-link in adopter READMEs / API docs / developer surfaces; in-band `canon_version: jcs-rfc8785-v1` byte-stable across artefacts. Patterns are observation-shape, not gating conditions for inclusion.
2026-05-26 ~10:27 UTC	x402-foundation/x402	PR #2453 review-ping posted to surface the canonicalisation discipline PR (sole-AlgoVoi authorship; replaces closed #2436) back to active queue. References live IETF I-D `-01` + three production adopters in the Substrate Adopters Registry. Same-day maintainer-cadence signal from #2438 merge suggests realistic review window 24-48h.
2026-05-27 06:08 UTC	x402-foundation/x402	AlgoVoi closes PR #2322 (`spec(bazaar): add Compliance category`) — closed by AlgoVoi (chopmob-cloud), not merged. AlgoVoi actively manages its own PR portfolio as an independent substrate author; closure preserves the dated public-record of the Compliance category proposal without requiring downstream maintainer action.
2026-05-27	agentgraph-co/agentgraph	kenneives publishes CTEF v0.3.2 live at agentgraph.co — downstream ecosystem building on the substrate, demonstrating independent adoption.
2026-05-10 – 2026-05-31	microsoft/semantic-kernel, finos/ai-governance-framework, langchain-ai/langgraph, crewAIInc/crewAI	giskard09 coordinated authorship-capture campaign. Across SK #13957, FINOS #296, LangGraph #7687, and CrewAI #4877, giskard09 systematically promoted `action-ref-v1.0` in `argentum-core` (commit `71c01e8`) as the canonical spec for `SHA-256(JCS({agent_id, action_type, scope, timestamp_ms}))`. On 2026-05-28, giskard09 announced `draft-giskard-action-ref-00` as “in preparation, co-authored with @aeoess.” Diagnostic field-name drift: giskard09’s May 10 Python snippet used `int(time.time())` (second precision) and May 30 citation used `timestamp` (no `_ms` suffix) — AlgoVoi’s spec and Pidlisnyi’s own Jun 5 self-admission both use `timestamp_ms`. arian-gogani (Nobulex) claimed “16/16 byte-identical validation” against giskard09’s fixtures, completing a coordinated attribution triangle: giskard09 claims spec authorship, aeoess co-authors the draft, arian-gogani provides “independent” validation. All three actors have `author_association: NONE` in all relevant threads. Full evidence record: `content/diligence-pack/giskard09-action-ref-capture-2026-06-05.md`.
2026-05-27–28	x402-foundation/x402	Three independent organisations publicly confirm byte-identical interoperability with the AlgoVoi substrate on issue #2332: (1) `luisllaver` (AURA, 2026-05-28 01:08) — “AURA does not define its own [canonicalisation] — we conform to RFC 8785 (JCS) + SHA-256, the same discipline @chopmob-cloud is pinning in `draft-hopley-x402-canonicalisation-jcs-v1`. Cite that.” (2) `andysalvo` (Crest, 2026-05-27 13:20) — “Vector 4 (chopmob corpus anchor): PASS — 3-way byte-identical across Crest, AURA, and AlgoVoi.” (3) `giskard09` (Mycelium Trails, 2026-05-28 01:25) — “once the ref is in the evidence array, the receipt is auditable anywhere, no AURA dependency.” Three parties, one thread, one shared anchor: `chopmob-cloud/algovoi-jcs-conformance-vectors`.
2026-05-29 11:03 UTC	IETF datatracker	`draft-hopley-x402-canonicalisation-jcs-v1` reaches revision -04. The discipline I-D that all other AlgoVoi receipt I-Ds normatively reference now has four public revisions on the IETF Independent Submission datatracker under sole AlgoVoi authorship.
2026-05-29 11:08 UTC	chopmob-cloud/algovoi-crest-joint-harness	Repo made public. Issue #1 closed with AlgoVoi reply comment acknowledging Crest’s vector contribution and clarifying that all code in the repo is solely AlgoVoi-authored. AlgoVoi’s position on authorship and scope is on the permanent public record.
2026-05-29 15:12 UTC	PyPI	`algovoi-rfc9421-signer 0.1.0` published — RFC 9421 HTTP Message Signatures producer package (AlgoVoi sole authorship). Companion to the already-published `algovoi-rfc9421-verifier`. Both signer and verifier now available on PyPI and npm; full signing-and-verification round-trip covered by the substrate package suite.
2026-05-29	verify.algovoi.co.uk	Two new public no-auth hosted verifier endpoints added to the existing `verify.algovoi.co.uk` hub: `POST /action-ref` (returns RFC 8785 JCS canonical form + SHA-256 digest for any `{agent_id, action_type, scope, timestamp_ms}` payload; 8-implementation attested) and `POST /rfc9421` (full RFC 9421 + RFC 9530 verification including signing-base reconstruction, Content-Digest check, and Ed25519 signature check against any supplied public key). Both route through the AlgoVoi gateway (`api.algovoi.co.uk/verify/*`) via VPC. No auth, rate-limited. Live-tested in CI against the `algovoi-rfc9421-signer` reference fixture (wrong-key and tampered-body rejection cases included).
2026-05-30	chopmob-cloud/algovoi-pef	`[email protected]` published to PyPI + npm (Python + TypeScript parity). Payment Evidence Frame reference impl: five claim types, `frame_id` SHA-256 over JCS-canonical preimage, optional RFC 9421 detached signature. IETF I-D `draft-hopley-x402-payment-evidence-frame-00` posted to IETF datatracker as seventh AlgoVoi Independent Submission, Informational.
2026-05-30	chopmob-cloud/algovoi-substrate-pqc	PQC cross-product matrix expanded: Go and Rust added as producers and verifiers. Matrix now 6 producers × 8 verifiers = 48/48 cells PASS. Four audit-grade PQC implementations cross-validated: PQClean, `@noble/post-quantum`, Bouncy Castle 1.84, RustCrypto. All six producers confirm same byte-anchor `sha256:cc8315f7...e0`. Attestation at `_attestations/2026-05-30-cross-product-matrix.md`.
2026-05-30	chopmob-cloud/algovoi-jcs-conformance-vectors	PEF 8-impl cross-validation attestation: 64/64 byte-for-byte agreements. Cumulative cross-implementation total: 576/576 across 8 vector sets (8 independent JCS runtimes throughout).
2026-05-30	microsoft/agent-governance-toolkit	Discussion #814 comment updated: corrected cross-validation figures to 576/576 over 8 vector sets; ATB profiles to 144/31; PEF artefact added to the table.
2026-05-31	LinkedIn (public)	AlgoVoi publishes post detailing ATB threat taxonomy and methodology: “Autonomous agents are increasingly being asked to authorise real financial transactions. The failure modes are not theoretical.” Six failure classes documented publicly: authority manipulation, knowledge poisoning, context exhaustion, cross-chain race conditions, simulation escape, tool schema confusion. ATB now covers 160 profiles across 36 threat categories, all mapped to OWASP LLM Top-10. Public prior-art disclosure of ATB methodology and threat classification framework.
2026-05-31	PyPI + npm	`[email protected]` published — 8-step offline JWS compliance-receipt verifier (Python 41/41, TypeScript 19/19, 13 conformance vectors). `[email protected]` — `X-AlgoVoi-Signature` verifier (8-lang × 13 vectors = 104/104). `[email protected]` — sliding-window tamper/replay/scan monitor consuming both verifiers’ error streams (8-lang × 13 vectors = 104/104). Package suite reaches 28 packages (14 PyPI + 14 npm namespaces).
2026-06-02	x402-foundation/x402	A maintainer closes 9 AlgoVoi PRs in one batch (#2334, #2453, #2493—#2495, #2524—#2527) — identical boilerplate on each: “hard to review as a group… interconnected… large in scope.” Every PR was CI-green and merge-ready; the single failing check was the team’s Vercel fork-deploy gate (unrelated to spec content). Patterns covered: JCS canonicalisation, compliance-receipt, settlement-attestation, cancellation-receipt, refund-receipt, pre-payment-compliance-gate, composite-trust-query, rfc9421-binding, payment-evidence-frame. Resolved (see 2026-06-22 below). Full record: `content/diligence-pack/x402-pr-closure-record-2026-06-02.md`.
2026-06-02 17:46 UTC	x402 PR #2544	VCX PR #2544 opened (22 TypeScript files + spec) implementing a JCS+SHA-256 envelope-digest pipeline (`sha256:<hex>` prefix, JCS+SHA-256 formula, `settled_payment_ref`, `SETTLED / PENDING_FINALITY / REVERSED`, content-addressed audit references, cross-language conformance vectors). Resolved (see 2026-06-22 below). Full record: `content/diligence-pack/vcx-attribution-incident-2026-06-02.md`.
2026-06-02 (same day)	x402 PR #2544	AlgoVoi noted on the thread that it had published related canonicalisation work earlier (earliest dated record May 16). Resolved (see 2026-06-22 below).
2026-06-03	AlgoVoi	AlgoVoi noted its earlier published canonicalisation work to the x402 maintainers regarding PR #2544; question since closed. Resolved (see 2026-06-22 below).
2026-06-03 16:38 UTC	x402 PR #2544	A maintainer posts on PR #2544 notifying the team to review — the first foundation response since the PR was opened. AlgoVoi’s provenance comments are on the PR record. Resolved (see 2026-06-22 below).
2026-06-03 (later)	AlgoVoi	A follow-up note regarding PR #2544 was sent via the submitter’s published contact channel. No action and no PR withdrawal requested. Resolved (see 2026-06-22 below).
2026-06-22	AlgoVoi	Resolution. AlgoVoi considers the PR #2544 matter closed. The PR’s current revision implements RFC 8785 and the MIT `canonicalize` library independently and adds a References / Public Standards section and NOTICE; AlgoVoi’s authorship rests on the dated prior-art record above, and no claim is outstanding.
2026-06-04	AlgoVoi	PQC + ZKP + Federation layer shipped. Two new Commercial License v1.0 packages deployed to production: `algovoi-federation-validator` v0.1.1 (cross-issuer ZKP credential composition, 59/59 tests, production) and `algovoi-zkp-receipt` v0.1.0 (ZKP-bound payment receipt attestation, 13/13 tests, production). Two new IETF I-Ds filed (ninth and tenth AlgoVoi Independent Submissions): `draft-hopley-x402-pqc-credential-binding-00` and `draft-hopley-x402-federation-zkp-00`. IACR ePrint 2026/109852 submitted under review. ATB ZKP service (Rust / Bulletproofs / Ristretto255) confirmed live in production. Gateway upgraded: Phase 2 ATB sessions now produce `X-ZKP-Receipt-Payload` (binding agent credential to on-chain payment) and `X-Composite-Trust-Verdict` response headers post-settlement. `POST /compliance/trust-query` upgraded to recognise `zkp_receipt` objects as trust signals. UK Gov inspect_evals PR #1732 updated with IACR ePrint citation. 42 tests across agent auth + ZKP receipt suite all passing.
2026-06-05	awslabs/agentcore-samples	`agent-governance-spec/aps-x402-composition` (2 commits, Apache 2.0) pitched as an official AgentCore Payments sample on Issue #1546. The repo uses `canonicalizeJCS()` with the exact framing: “The two streams agree byte-for-byte on every null-free input, which is every production input the demo emits” — AlgoVoi’s coined cross-validation language from the JCS substrate documentation. No AlgoVoi attribution in the repo. The associated IETF I-D `draft-pidlisnyi-aps-01` (filed 2026-05-14, author: Tymofii Pidlisnyi, AEOESS; confirmed live on IETF datatracker) was cross-validated against AlgoVoi’s implementation two days after filing: gist `5f35eaa527d292bf3ddc52f8725a85c9` (2026-05-16, public, chopmob-cloud) records 14/14 APS v1 + CTEF v0.3.1 vector passes against AlgoVoi’s substrate — Pidlisnyi reviewed that work via PRs #5 and #6 to the conformance suite before coalition exit 2026-05-24. Five AlgoVoi attribution comments are on the permanent record in the same thread (2026-05-26, 2026-05-30, 2026-06-04, 2026-06-05 × 2), establishing sole AlgoVoi authorship of `urn:x402:canonicalisation:jcs-rfc8785-v1`.
2026-06-05 (later)	awslabs/agentcore-samples	Self-admission by Tymofii Pidlisnyi (AEOESS). In issuecomment-4627635509 Pidlisnyi publicly named `SHA-256(JCS({agent_id, action_type, scope, timestamp_ms}))` as “the cross-ecosystem correlation key”, listed x402, argentum-core, Gonka, and A2A#1850 as the line it correlates with, and confirmed APS ships it as an additive helper (`computeExternalActionRefV1`) because the APS-native action_ref has a different preimage (camelCase fields, multi-scope array, second-precision ISO 8601 vs milliseconds). In the same comment, described the shared preimage as “showing up independently” across those ecosystems. AlgoVoi’s authorship pin (issuecomment-4628621074) posted 3 hours 8 minutes later (05:47 UTC): “The external correlation form … is the AlgoVoi-authored `action_ref` primitive specified in `draft-hopley-x402-canonicalisation-jcs-v1` §4. Published in `algovoi-substrate 0.3.0` (PyPI 2026-05-23, Apache 2.0). Its appearance across x402, argentum-core, Gonka, and A2A#1850 traces to that source.” The “independent derivation” claim is contradicted by the gist (2026-05-16): AlgoVoi’s implementation cross-validated APS v1 two days after Pidlisnyi filed the draft — Pidlisnyi reviewed that work directly via PRs #5 and #6. The construction’s specific field names (`timestamp_ms` millisecond precision, single-string `scope`) are normative in `draft-hopley-x402-canonicalisation-jcs-v1` §4 under sole AlgoVoi authorship. Full evidence record: `content/diligence-pack/aeoess-agentcore-self-admission-2026-06-05.md`.
2026-06-06	awslabs/agentcore-samples	Adoption + attribution-detachment signal. In issuecomment-4640393540 arian-gogani (Nobulex) confirmed nobulex’s `action_ref` is `SHA-256(JCS({agent_id, action_type, scope, timestamp_ms}))` with `timestamp_ms` an epoch-millisecond integer (“not RFC 3339 string”) — byte-identical to the preimage specified in `draft-hopley-x402-canonicalisation-jcs-v1` §4 / `algovoi-substrate 0.3.0` (PyPI 2026-05-23). Adoption of the construction on these exact terms is welcomed — it is the intended outcome of Apache-2.0 publication. The same comment proposed relocating the canonical description into “a short shared doc in a neutral place (not either project’s repo)” — the one move inconsistent with the Apache-2.0 condition, since it detaches the standard from its attributed origin. Recorded as a watch item; no AlgoVoi thread response (upstream silence active). Comment body SHA-256: `b674049219754db644e66c922556bc0365b8e4b3e0fc14a0175ef721b9ce6bba`. Full record: `content/diligence-pack/awslabs-1546-neutral-doc-capture-2026-06-07.md`.
2026-06-07 to 2026-06-11	OWASP, LangGraph, semantic-kernel, awslabs/agentcore-samples, A2A	Continued cross-venue adoption of the construction. `action_ref = SHA-256(JCS({agent_id, action_type, scope, timestamp_ms}))` and the signed receipt-chain appeared across further venues: OWASP CheatSheetSeries AML/sanctions cheat-sheet (#2125 + PR #2217, using AlgoVoi’s `timestamp_ms` epoch-integer form), LangGraph #7687, semantic-kernel #13957 (`action_ref` described as a “recomputable correlation handle”), and a cross-stack `aps-conformance-suite` built on the JCS/`action_ref` vectors. Adoption on these terms is welcomed — it is the intended outcome of Apache-2.0 publication. Authorship remains pinned to `draft-hopley-x402-canonicalisation-jcs-v1` §4 / `algovoi-substrate 0.3.0` (PyPI 2026-05-23). Full evidence record (SHA-anchored): `content/diligence-pack/action-ref-capture-master-evidence-2026-06-07.md`.
2026-06-11	OASIS CoSAI; a2aproject/A2A	AlgoVoi contributions. (1) On the OASIS CoSAI Agent Credentials RFC (ws4 #99) AlgoVoi contributed the predicate-only zero-knowledge threshold distinction for trust scores — proving `score ≥ threshold` (Bulletproofs over Ristretto255, threshold bound into the proof transcript, Falcon-1024-bound, offline-verifiable) rather than disclosing the score as a value. (2) Three AlgoVoi-authored A2A extension registrations rebased clean to mergeable: Compliance Gate #1886, Settlement Attestation / Composite Trust Query / RFC 9421 Message Signing #1896, Payment Evidence Frame #1898.
2026-06-11 to 2026-06-12	microsoft/agent-governance-toolkit#806 · mohdibrahimaiml/epi-recorder	Credited interop convergence (positive attribution). EPI Recorder cross-tested its canonicaliser against AlgoVoi’s published JCS conformance corpus. After aligning `ensure_ascii`, EPI produces byte-identical canonical bytes, and all 8 EPI golden vectors reconcile to AlgoVoi-recomputed `frame_id`s — independently triple-validated across three RFC 8785 implementations (`rfc8785`/Python, `canonicalize`/JS, `gowebpki/jcs`/Go). AlgoVoi seeded the `epi_interop_v0` interop set (5 vectors, each `anchored_to` `draft-hopley-x402-canonicalisation-jcs-v1`), held as a 2-impl interop set and not folded into the 8-impl conformance totals. EPI published `docs/EPI-ALGOVOI-INTEROP.md`, which credits AlgoVoi’s authorship/provenance page, the canonicalisation-substrate docs, and the conformance corpus — a credited downstream adopter, the intended outcome of Apache-2.0 publication. EPI golden file byte-lock `sha256:78227cad2ab12189bff72f1a1b65fb6ab5894cd89489e2ad61203937db729fb7`; interop-doc git blob `55489ca1babc77684fd4e49fbfc7f386768ddaab`.
2026-06-13	visa/trusted-agent-protocol#16 · x402-foundation/x402	Convergence + author-of-record correction. The Visa Trusted Agent Protocol receipt-signing RFC (#16, opened by `tomjwxf`) converges on the AlgoVoi model: Ed25519 + JCS RFC 8785 canonical receipts and the two-layer split (RFC 9421 for request authentication, a signed JCS-canonical receipt for the evidence layer). `arian-gogani` (Nobulex) positioned CTEF / Nobulex / `aeoess/aps-conformance-suite` as the reference and claimed “x402#2322 just landed a MUST for JCS canonicalization on all signed receipts.” Contradicted by primary source: x402 #2322 and #2334 are AlgoVoi-authored and closed unmerged (`mergedAt: null`), and `specs/extensions/bazaar.md` on x402 `main` carries no Compliance category or JCS MUST — it never landed, by us or anyone. AlgoVoi posted the author-of-record correction (issuecomment-4699712372), pointing only to live Apache-2.0 tooling (the conformance vectors, 8-impl byte-identical, and the verifier at `api.algovoi.co.uk/v1/receipt/verify`). Separately, `0xbrainkid` (AgentFolio/SATP) carried the AlgoVoi two-layer + key-source-provenance framing into the same thread unprompted. Adoption of the model is welcomed; the false “landed” attribution is corrected on the record.
2026-07-02	PyPI	`algovoi-substrate` v0.4.1 published (open Apache-2.0 RFC 8785 / JCS canonical substrate, `CANON_VERSION jcs-rfc8785-v1`). Current public reference implementation of the canonicalisation discipline.
2026-07-06	AlgoVoi	Signed A2A AgentCard shipped (build authored 2026-07-06). The agent card at `/.well-known/agent.json` carries a detached EdDSA JWS over its JCS canonical form per A2A §8.4; the Ed25519 verify key is published at `/.well-known/jwks.json` and the platform Falcon-1024 public key at `/.well-known/pqc-keys.json`. Card authenticity, key publication, and post-quantum identity are three distinct keys, independently fetchable.
2026-07-10	PyPI	Keystone L2 open packages published as Cython builds (Apache-2.0): `algovoi-keystone-validate`, `algovoi-keystone-secure-lite`, `algovoi-keystone-sqlalchemy` v0.2.0.
2026-07-14	AlgoVoi	AlgoVoi Mesh (L3) proven on-chain. Post-quantum mutual agent-to-agent settlement, one authorised Falcon-1024 pair per run, settled across seven independently-verified chains (Algorand, VOI mainnet, Base, Solana, Stellar, Tempo, Hedera mainnet). Each transaction carries the exact content-addressed `execution_ref` its handshake produced; the Hedera mainnet Consensus Service anchor is verifiable from the public mirror node with no AlgoVoi infrastructure. The card-signing well-known surfaces (row 50) confirmed live and independently fetched this date.
2026-07-15	AlgoVoi	Three further chains proven, anchor format canonicalised. Ethereum (Sepolia, EVM raw calldata), the XRP Ledger (re-anchored to the canonical `algovoi-mesh:sha256:` memo, superseding an earlier bare-format anchor), and Bitcoin (testnet, OP_RETURN) settled the same content-addressed `execution_ref` with no settlement-code change. Bitcoin is the first settlement on a UTXO chain (all prior nine are account-model). Ten chains now independently verifiable, each carrying the same reference via its native field.

What this substrate provides

+----------------------------------------------------------+
|  AlgoVoi-authored substrate                              |
+----------------------------------------------------------+
|                                                          |
|  Canonicalisation discipline                             |
|    (IETF I-D §4; published at /canonicalisation-substrate)|
|    - JCS RFC 8785 pin                                    |
|    - Substrate Rule 2: timestamp_ms MUST be integer      |
|    - Field-name + array-order + type-validation rules    |
|                                                          |
|  Primitives (in algovoi-substrate v0.3.0)                |
|    - canonicalize(obj) -> JCS canonical string           |
|    - action_ref(agent_id, action_type, scope, ts)        |
|        -> SHA-256 of the canonical preimage              |
|    - transition_hash + build_transactional_action_chain  |
|    - build_compliance_receipt + verify_audit_chain       |
|    - composite_trust_query_hash                          |
|                                                          |
|  Receipt format (draft-hopley-x402-compliance-receipt)   |
|    - Closed enum {ALLOW, REFER, DENY}                    |
|    - payer_ref content-addressed reference               |
|    - integer screen_timestamp_ms                         |
|    - canon_version in-band pin                           |
|    - jurisdiction_flags ordered list                     |
|    - screen_provider_did DID URI                         |
|                                                          |
|  Audit chain                                             |
|    - content_hash per row                                |
|    - prev_hash linkage                                   |
|    - Object Lock COMPLIANCE 7y retention (S3)            |
|                                                          |
|  Conformance corpus (counts on the substrate page)       |
|    - 8-impl byte-for-byte: 880/880 agreements            |
|                                                          |
+----------------------------------------------------------+
|  PQC / ZKP / Federation layer (2026-06-04)               |
+----------------------------------------------------------+
|                                                          |
|  Post-quantum credential binding                         |
|    - Falcon-1024 ATB Pass Certificate (NIST FIPS 206)    |
|    - ML-DSA-65 (NIST FIPS 204) hybrid support            |
|    - kid = hex(SHA-256(pk))[:16]                         |
|    - JCS signing discipline over cert payload            |
|    - IETF: draft-hopley-x402-pqc-credential-binding-00  |
|                                                          |
|  Bulletproofs ZKP (score ≥ threshold, score not revealed)|
|    - Pedersen commitment over Ristretto255               |
|    - Bulletproofs range proof (range_bits=64)            |
|    - Phase 2 ATB cert: commitment_b64 + proof_b64        |
|    - IACR ePrint 2026/109852                             |
|                                                          |
|  Cross-issuer federation                                 |
|    - Composite commitment: SHA-256(domain‖comm_0‖…‖nonce)|
|    - HMAC-SHA256 federation token (no shared trust root) |
|    - IETF: draft-hopley-x402-federation-zkp-00           |
|                                                          |
|  ZKP receipt (payment + credential binding)              |
|    - Binds Phase 2 ATB cert to on-chain payment          |
|    - X-ZKP-Receipt-Payload response header               |
|    - X-Composite-Trust-Verdict: TRUSTED/PROVISIONAL/...  |
|    - gateway POST /compliance/trust-query upgraded       |
|                                                          |
+----------------------------------------------------------+

All platform interactions captured as substrate receipts

Every payment interaction processed by the AlgoVoi platform generates a substrate receipt. There are no unreceipted interactions. This is enforced at the gateway level, not as an optional feature. The five receipt types cover the complete payment lifecycle with no gaps:

Event	Receipt type	IETF I-D / reference
Payment admission (compliance screen result)	`compliance_receipt_v1` — closed `{ALLOW, REFER, DENY}` enum	`draft-hopley-x402-compliance-receipt`
Multi-chain settlement confirmed	`settlement_attestation_v1` — chain + tx_id + amount anchored	`draft-hopley-x402-settlement-attestation`
Refund issued	`refund_receipt_v1` — `{FULL, PARTIAL}` with amount and original `payment_ref`	`draft-hopley-x402-refund-receipt`
Mandate cancelled	`cancellation_receipt_v1` — closed `{USER_REQUESTED, MERCHANT_REQUESTED, COMPLIANCE_TERMINATED, EXPIRED}` enum	`draft-hopley-x402-cancellation-receipt`
Verifier composite verdict	`composite_trust_query_v1` — closed `{TRUSTED, PROVISIONAL, INSUFFICIENT_EVIDENCE, UNTRUSTED}` enum	`draft-hopley-x402-composite-trust-query`
ZKP-credentialed payment (Phase 2 ATB session)	`zkp_receipt_v1` — Falcon-1024 signed; binds ATB ZKP commitment + proof to on-chain payment; proves `score ≥ threshold` without disclosure. Returned as `X-ZKP-Receipt-Payload` header	`draft-hopley-x402-pqc-credential-binding-00` · IACR ePrint 2026/109852

All five receipt types are in turn consolidated by the Payment Evidence Frame (algovoi-pef, draft-hopley-x402-payment-evidence-frame): a single frame_id (SHA-256 over the JCS-canonical preimage of the frame manifest) that binds all receipts for one payment event into one verifiable artefact. Every receipt row is appended to a SHA-256 JCS hash-chained audit ledger with prev_hash linkage across five table types (payment events, compliance decisions, audit snapshots, settlement records, webhook deliveries). The chain is:

Stored in Backblaze B2 with Object Lock COMPLIANCE mode retention to 2033
Verifiable without trusting AlgoVoi — the hash chain can be reconstructed from the raw rows and checked against any row’s content_hash
Publicly downloadable via the merchant dashboard audit-bundle endpoint
Verified by the standalone algovoi-audit-verifier package (PyPI + npm) with no AlgoVoi infrastructure dependency

What this means for an acquirer: the substrate is not a paper proposal. Every receipt format has a reference implementation (published package), an IETF Internet-Draft, an 8-implementation cross-validation attestation, and a production deployment generating live receipts across seven chain families. The receipt corpus is an independently verifiable forensic record of every payment interaction the platform has ever processed.

Contributions acknowledged (historical record)

AlgoVoi is the substrate author. Specific narrow contributions made by other parties during the period of coalition coordination (2026-05-19 to 2026-05-24) are credited where they originate. These acknowledgements stand on the public record regardless of subsequent coalition state:

Contribution	Author	Where it lands
`timestamp_ms` epoch-integer canonical preimage convention (Substrate Rule 2 of the canonicalisation I-D)	Andy Salvo / Crest Deployment Systems	Identified the timestamp precision failure mode on x402#2326 and x402#2357 on 2026-05-20. Credited in IETF I-D revisions `draft-hopley-x402-canonicalisation-jcs-v1-02`, `draft-hopley-x402-compliance-receipt-02`, and `draft-hopley-x402-refund-receipt-02` filed 2026-05-25.
Retention-property clause in the canonicalisation discipline	FeedOracle	PR #2436 — credited in the section footer
`[email protected]` Rust JCS implementation (one of five in the conformance matrix)	seritalien / Vauban Pay	Listed by name in the substrate matrix · validation report on x402#2357
`authority_verified_at_ms` and `revocation_check_at_ms` field names	giskard09 / argentum-core	First appeared in argentum-core `71c01e8` on 2026-05-22. These two specific field names compose on top of the AlgoVoi substrate; argentum-core authorship of these two field names is acknowledged.
Namespace-prefixing convention positive attribution	arian-gogani / nobulex	Cited the convention as AlgoVoi-authored on x402#2332
Pre-layer principal-authority framing co-development	MolTrust, 0xbrainkid, musaabhasan	A2A #741 thread

What this substrate is NOT

Honest scope:

Not agent identity hashing. AlgoVoi’s JCS application produces payment-action transaction references and payment-lifecycle receipts. The action_ref function takes an (agent_id, action_type, scope, timestamp_ms) tuple and produces a hash of that payment-action event; the output identifies the payment action, not the agent. JCS agent identity hashing — hashing an agent descriptor to produce a stable identity token for a transparency log or identity registry — is a different JCS application domain with a different input schema, different canonicalisation semantics, and different threat model. This substrate covers neither agent identity derivation nor transparency log commitment.
Not a closed-enum on every field. scope is a non-empty string, not a closed enum. The substrate publishes naming conventions (e.g. {emitter}:{scope} namespacing) as non-normative recommendations.
Not a single-vendor lock-in. Five (now eight) independent JCS implementations produce byte-identical canonical bytes. A buyer can swap any one for another without changing the receipt format.
Not a complete reputation system. The substrate produces evidence (compliance attestations, settlement receipts, audit chains); scoring layers like Verascore consume that evidence. AlgoVoi does not author Verascore.
Not the only substrate in the space. Other independent authors have published related but separable receipt and settlement formats: Vauban Pay (STARK settlement proofs, in draft-vauban-x402-stark-receipts), Concordia (commitment receipts), nobulex (bilateral receipts), Agent OS (committed claims). These compose against the canonicalisation substrate without redefining it. AlgoVoi does not represent or speak for any of these parties.

Verifying the claims on this page independently

Every claim on this page is verifiable from a developer machine in under ten minutes:

# 1. AlgoVoi substrate primitives (Python)
pip install algovoi-substrate==0.3.0
python -c "from algovoi_substrate import action_ref; print(action_ref('agent_alpha','payment','vauban:stark_settlement',1716494400000))"
# expects: 7528529a8be2044488e603b7913efaa4f83620dbcc63010d4a1478cf7e9a473c

# 2. AlgoVoi substrate primitives (TypeScript)
npm install @algovoi/substrate@^0.3.0
node -e "import('@algovoi/substrate').then(m => console.log(m.actionRef({agent_id:'agent_alpha',action_type:'payment',scope:'vauban:stark_settlement',timestamp_ms:1716494400000})))"
# expects the same digest

# 3. RFC 9421 HTTP signature verifier
pip install algovoi-rfc9421-verifier==0.1.0
# Then verify a captured request: see the package README

# 4. Full conformance corpus
git clone https://github.com/chopmob-cloud/algovoi-jcs-conformance-vectors
cd algovoi-jcs-conformance-vectors/vectors/compliance_receipt_v1
python runner_python.py   # expects: PASS 8 vectors + 5 pair invariants + 3 chain invariants
node runner_node.js       # expects: PASS

# 5a. JCS 8-implementation matrix
# See _attestations/2026-05-24-8-impl-cross-validation.md for the 8-language reproduction commands.

# 5b. RFC 9421 + Ed25519 + SHA-256 8-implementation matrix
cd algovoi-jcs-conformance-vectors/vectors/rfc9421_proxy_chain_v0
bash run_all.sh           # expects: 8/8 PASS (Python, Node, Go, Rust, Java, PHP, .NET, Ruby)

# 6. IETF Internet-Draft
curl -sL https://www.ietf.org/archive/id/draft-hopley-x402-compliance-receipt-02.txt | head -30

# 7. JSON Schema (auto-loaded by every JSON-aware IDE)
curl -s https://json.schemastore.org/algovoi-compliance-receipt-v1.json | head -20

# 8. Refund receipt format (standalone AlgoVoi-authored package)
npm install @algovoi/refund-receipt @algovoi/substrate
node -e "import('@algovoi/refund-receipt').then(m => import('@algovoi/substrate').then(s => { const r = m.buildRefundReceipt({original_payment_ref:'sha256:0dd5d0b76c9b9281fdeb2509ad38ab132b16a17385ca01d976ff9e6e12563a0f',refund_result:'FULL',refund_timestamp_ms:1716494400000,refund_provider_did:'did:example:refund-provider-1',refund_amount:{amount_minor:'100000',asset_id:'USDC.6'},jurisdiction_flags:['UK','EU']}); console.log(s.sha256Jcs(r)); }))"
# expects: 7fdd283c3a8abb14d893999d1d16e2f7697ad0539250f2e0fc3e31ce89943dcb

# 9. Hosted action_ref verifier (no install required)
curl -s -X POST https://verify.algovoi.co.uk/action-ref \
  -H "Content-Type: application/json" \
  -d '{"agent_id":"did:web:api.algovoi.co.uk","action_type":"payment.authorize","scope":"base:0x2d96f2bc","timestamp_ms":1748534400000}'
# expects: {"action_ref":"sha256:6c3c08eb...","implementations_attested":8,...}

# 10. Hosted RFC 9421 verifier (schema reference)
curl https://verify.algovoi.co.uk/rfc9421
# expects: algorithm "Ed25519 (RFC 8032)", spec_ref "https://www.rfc-editor.org/rfc/rfc9421"

Commands 1–8 run against primary registries (PyPI, npm, IETF datatracker, json.schemastore.org, GitHub). Commands 9–10 use AlgoVoi infrastructure but are independently reproducible by installing the packages and running the same logic locally.

Coalition position

As of 2026-05-24, AlgoVoi operates as an independent substrate author. The decision was recorded in claim #577 of the AlgoVoi memory-graph and made public via a graceful farewell on x402-foundation/x402 #2428 the same day. The associated AlgoVoi PR #2436 on x402-foundation/x402 was closed gracefully, with seritalien’s APPROVED review and arian-gogani’s LGTM preserved on the closed-PR historical record. The substrate authorship case is anchored across at least thirty-seven independent public surfaces listed above. None depend on coalition co-signing or maintainer cooperation to remain anchored. The surfaces are:

Under AlgoVoi control: production endpoints (api.algovoi.co.uk, verify.algovoi.co.uk), Mintlify docs (docs.algovoi.co.uk), chopmob-cloud GitHub repos.
Under neutral public registries: PyPI, npm, IETF datatracker, JSON SchemaStore, GitHub itself.

Each new receipt class ships as its own standalone published package

IETF I-D + Mintlify page under sole AlgoVoi authorship. The first post-exit example is the refund receipt (algovoi-refund-receipt v0.1.0 published to npm 2026-05-24; live-tested 17/17 byte-identical against the conformance vector set; companion I-D draft-hopley-x402-refund-receipt and Mintlify page at /refund-receipt).

A lineage rewrite would need to remove AlgoVoi authorship from every one of the twenty-four surfaces simultaneously — across multiple independent registries, GitHub history, and the IETF datatracker. That is structurally not possible. AlgoVoi continues to acknowledge specific narrow contributions made by other parties during the coalition-coordination period (see “Contributions acknowledged (historical record)” above) and respects the authorship of separately-authored receipt formats published by other independent authors (Vauban Pay STARK receipts, Concordia commitment receipts, etc.).

Commit attribution across all substrate repositories

The following table records every commit across all 17 public AlgoVoi substrate repositories as of 2026-05-31, by author email. This is the authoritative machine-verifiable record of who wrote the code.

Repository	AlgoVoi commits	External commits	External author and nature
algovoi-jcs-conformance-vectors	32	1	Andy Salvo / Crest (`[email protected]`) — contributing own downstream vectors; commit message states “Authorship of these vectors stays with Crest… Anchored to AlgoVoi’s canonicalisation discipline”
algovoi-substrate	21	0	—
algovoi-rfc9421-verifier	10	0	—
algovoi-audit-verifier	13	0	—
algovoi-substrate-pqc	22	0	—
algovoi-refund-receipt	7	0	—
algovoi-settlement-attestation	6	0	—
algovoi-cancellation-receipt	7	0	—
algovoi-composite-trust-query	7	0	—
algovoi-rfc9421-signer	2	0	—
algovoi-reference-agent	4	0	—
algovoi-crest-joint-harness	1	0	Crest held write access; zero commits made
algovoi-pef	5	0	—
ap2-pq-conformance	2	1	Raymond Chau / PQSafe (`[email protected]`) — scoped ML-DSA-65 contribution, credited
algovoi-receipt-verifier	7	0	—
algovoi-webhook-verifier	3	0	—
algovoi-receipt-sentinel	4	0	—
algovoi-federation-validator	1	0	— (Commercial License v1.0; sole AlgoVoi authorship)
algovoi-zkp-receipt	1	0	— (Commercial License v1.0; sole AlgoVoi authorship)
TOTAL	155	2

AlgoVoi: 155 of 157 commits (98.7%). Neither external commit modifies AlgoVoi-authored substrate code: one contributes Crest’s own downstream vectors, one adds PQSafe’s scoped ML-DSA-65 fixture. Verification: gh api repos/chopmob-cloud/{repo}/commits --paginate --jq '.[].commit.author.email' | sort | uniq -c on any of the repos above.

Third-party acknowledgments on the public record

The following parties have explicitly acknowledged AlgoVoi authorship of the substrate in their own public commits, approved PRs, or published documents. These are not AlgoVoi claims — they are statements by third parties on immutable public surfaces.

Party	Surface	What they said
Andy Salvo / Crest	Own git commit `81f48361` in `algovoi-jcs-conformance-vectors` (2026-05-24)	“Anchored to AlgoVoi’s canonicalisation discipline jcs-rfc8785-v1”
kenneives / agentgraph	Commit `229040b` in `agentgraph-co/agentgraph` (2026-05-25)	“AlgoVoi-authored formalism (originating A2A #1734 May 14)” and “AlgoVoi /compliance/screen catches tuple mismatch at admission”
seritalien / Vauban Pay	APPROVED PR #2436 on `x402-foundation/x402` (2026-05-22)	Explicit approval of AlgoVoi’s canonicalisation discipline PR including Substrate Rule 2
seritalien / Vauban Pay	IETF Internet-Draft `draft-vauban-x402-stark-receipts-00` (submitted 2026-05-22; immutable IETF archive copy)	Names AlgoVoi twice: in the acknowledgments — “AlgoVoi (JCS substrate determinism cross-validation across four published vector sets ; architectural skeleton of the shared canonicalisation discipline [X402-2326])” — and in §7: “The shared canonicalisation discipline [X402-2326] co-authored by AlgoVoi, FeedOracle, and Vauban Pay…”. Note: revisions `-01` (2026-05-23) through the current `-02` carry neither named acknowledgment; they instead cite the AlgoVoi-registered URN `urn:x402:canonicalisation:jcs-rfc8785-v1` explicitly (7 in-document citations). The `-00` named-credit text is permanently preserved in the IETF archive and cannot be altered by subsequent revisions.
giskard09 / argentum-core	Commit `96931c9` (2026-05-23 20:58 UTC)	Spec update adding JCS timestamp encoding rule to argentum-core — published approximately 2 hours after AlgoVoi’s formulation of the same rule on A2A #1734 earlier that day
arian-gogani / nobulex	x402-foundation/x402 issue #2332 (2026-05-19)	Publicly attributed the namespace-prefixing convention and JCS canonicalization correction to AlgoVoi
Raymond Chau / PQSafe	PR #1 to `ap2-pq-conformance` (2026-05-26)	Contributed ML-DSA-65 fixture under AlgoVoi’s repo structure, fixture format, and Apache 2.0 licence
luisllaver / AURA	x402-foundation/x402 issue #2332 (2026-05-28 01:08 UTC)	“AURA does not define its own [canonicalisation] — we conform to RFC 8785 (JCS) + SHA-256, the same discipline @chopmob-cloud is pinning in `draft-hopley-x402-canonicalisation-jcs-v1`. Cite that; our /v1/action-ref is just a conforming implementation.” AURA explicitly states it does not author canonicalisation discipline; AlgoVoi does.
andysalvo / Crest	x402-foundation/x402 issue #2332 (2026-05-27 13:20 UTC)	“Vector 4 (chopmob corpus anchor): PASS — 3-way byte-identical across Crest, AURA, and AlgoVoi. Published at verify.crestsystems.ai/aura-conformance-v0.json.” Names `chopmob-cloud/algovoi-jcs-conformance-vectors` as the shared anchor in a three-party byte-identical interoperability verification.
giskard09 / Mycelium Trails	x402-foundation/x402 issue #2332 (2026-05-28 01:25 UTC)	“That’s the property that matters — once the ref is in the evidence array, the receipt is auditable anywhere, no AURA dependency. Clean ship.” Publicly confirms that AURA has shipped action-ref portability (`SHA-256(JCS(preimage))`), auditable without an AURA dependency — giskard09 endorsing the shared portable construction (2026-05-28, comment `4560057627`, body SHA-256 `6989d88f0966195078d84b68a7f88c0e41a4efe33f274394d71d8b4b13290c25`). Contradiction: the same actor also claims argentum-core’s `action-ref.md` is the sole origin “predating AlgoVoi” (A2A #1734, 2026-05-23; and the June W3C #34 effort) — see Coalition Engagement Log.
Poke-nushi (a2aproject/A2A maintainer-adjacent)	a2aproject/A2A issue #1769 (2026-06-05T06:24Z)	“Thanks — this is helpful detail, and `action_ref` is a useful concrete example of a stable cross-phase binding key. The admission → post-execution → chain/verdict structure you describe is very relevant to the boundary being discussed here. It shows one concrete way a payment-specific profile can make admission artifacts and settlement artifacts independently verifiable.” Independent third-party acknowledgment of `action_ref` as the correct cross-phase binding primitive in the A2A verifier-side trust / permit / receipt architecture discussion. Poke-nushi had no prior AlgoVoi relationship; the acknowledgment was unprompted beyond AlgoVoi’s technical contribution to the thread.
Tymofii Pidlisnyi / AEOESS	awslabs/agentcore-samples issue #1546 issuecomment-4627635509 (2026-06-05T02:39Z)	“The form nobulex matches (SHA-256 over JCS / RFC 8785 of `{agent_id, action_type, scope, timestamp_ms}`, metadata outside the preimage) is the cross-ecosystem correlation key. We ship it as an additive helper, `computeExternalActionRefV1`, so APS actions correlate with the x402, argentum-core, Gonka, and A2A#1850 line.” Pidlisnyi publicly named AlgoVoi’s `action_ref` construction as the cross-ecosystem standard and confirmed APS ships it as a helper because APS-native format uses a different preimage. This admission was made after AlgoVoi’s authorship post in the same thread (2026-05-26) and in response to AlgoVoi’s 576-vector comment (2026-06-05T00:06Z). Pidlisnyi reviewed AlgoVoi’s cross-validation of APS v1 in May 2026 via conformance suite PRs #5 and #6. Full evidence record: `content/diligence-pack/aeoess-agentcore-self-admission-2026-06-05.md`. Note: Pidlisnyi did not attribute AlgoVoi as the author — the admission is implicit, not explicit. It is significant precisely because it comes from an adversarial party with direct knowledge of AlgoVoi’s prior work.

Every party who has engaged substantively with the substrate has left a public record acknowledging AlgoVoi as the author — including parties who have subsequently disputed aspects of the attribution in other forums.

Provenance of this page

Authored 2026-05-24 by AlgoVoi (chopmob-cloud). Lives at docs.algovoi.co.uk/substrate-authorship-provenance. Updated when new substrate artefacts land or when AlgoVoi’s coalition position changes. Last material updates:

2026-05-24 ~10:30: Coalition exit recorded; refund receipt v0.1.0 added as the 12th artefact; surface count moved from 12 to 14 with the addition of refund receipt and its companion IETF I-D.
2026-05-24 ~11:20: Canonicalisation discipline I-D added as 14th artefact (recovers closed-PR-#2436 work under sole AlgoVoi authorship); surface count moved from 14 to 15. Future receipt I-Ds normatively reference this discipline I-D instead of redefining §4 inline.
2026-05-25 ~14:30: x402 Document Index published at /x402-document-index cataloguing all 13 IETF I-Ds in x402 namespace (6 AlgoVoi sole-authored + 6 Vauban + 1 Sato/Soos). The index records anchor-citation coverage: 7 of 12 in-scope receipt-format I-Ds cite urn:x402:canonicalisation:jcs-rfc8785-v1 explicitly; 5 reference the canonicalisation discipline by terminology and RFC 8785 only, without URN citation. The URN registration in Section 10.1 of draft-hopley-x402-canonicalisation-jcs-v1 is the authoritative registration; documents using the discipline are encouraged to cite the URN normatively so cross-spec verifiers can resolve the registration unambiguously.
2026-05-25 ~14:35: Acknowledgments revisions filed: draft-hopley-x402-canonicalisation-jcs-v1-02, draft-hopley-x402-compliance-receipt-02, and draft-hopley-x402-refund-receipt-02 filed on IETF datatracker with Andy Salvo (Crest Deployment Systems LLC) credited for the timestamp_ms epoch-integer canonical preimage convention (Substrate Rule 2 of the canonicalisation I-D). Acknowledgment is consistent with how FeedOracle is credited (specific substantive contribution to the discipline). Substrate-author position retains sole-AlgoVoi authorship of the discipline itself; specific contributions are credited at the appendix layer.
2026-05-29: Commit attribution table and third-party acknowledgments section added. Records 111/113 commits (98.2%) as sole AlgoVoi authorship across all 13 substrate repos, plus six independent third-party public acknowledgments of AlgoVoi authorship. Full forensic detail in the internal diligence pack at content/diligence-pack/AUTHORSHIP-PROVENANCE-REPORT.md.
2026-05-30: [email protected] published (PyPI + npm). IETF I-D draft-hopley-x402-payment-evidence-frame-00 posted (seventh AlgoVoi I-D). PQC cross-product matrix expanded to 48/48 (6 producers x 8 verifiers; Go + Rust added). Cumulative JCS cross-validation: 576/576 across 8 vector sets. Artefact table extended to row 37; commit attribution live-verified and updated to 139/141 (98.6%) across 14 substrate repos. AGT #814 comment corrected to current figures.
2026-05-31: [email protected], [email protected], and [email protected] published to PyPI + npm (sole AlgoVoi authorship, Apache 2.0). Artefact table extended to rows 40–42. Commit attribution updated to 17 repos, 153/155 (98.7%). Package suite: 28 packages, 14 PyPI + 14 npm namespaces. /application-matrix added to See also.
2026-06-02: VCX PR #2544 recorded. 9 AlgoVoi PRs (all CI-green) were closed the same day the VCX PR was opened, implementing a JCS+SHA-256 pipeline. AlgoVoi noted on the thread that it had published related work earlier (IETF draft dates 2026-05-29/30, PyPI package dates 2026-05-23/25, live server file timestamps May 16). Full diligence records at content/diligence-pack/vcx-attribution-incident-2026-06-02.md and content/diligence-pack/x402-pr-closure-record-2026-06-02.md. Resolved 2026-06-22: AlgoVoi considers the matter closed; the PR’s current revision implements RFC 8785 + the MIT canonicalize library independently and adds a References / Public Standards section and NOTICE.
2026-06-03: AlgoVoi noted its earlier published work to the x402 maintainers at 14:03 UTC, and via the submitter’s published contact channel; no PR withdrawal requested. At 16:38 UTC, a maintainer posted on PR #2544 notifying the team to review. Resolved 2026-06-22: AlgoVoi considers the matter closed. Upstream silence maintained per policy.
2026-06-04: PQC / ZKP / Federation layer. Artefact table extended to rows 43–49. Two new IETF I-Ds filed (ninth + tenth AlgoVoi Independent Submissions): draft-hopley-x402-pqc-credential-binding-00 and draft-hopley-x402-federation-zkp-00. IACR ePrint 2026/109852 submitted (under editor review). Two new Commercial License v1.0 packages deployed to production: algovoi-federation-validator v0.1.1 (59/59 tests, production) and algovoi-zkp-receipt v0.1.0 (13/13 tests, production). ATB ZKP service (Rust / Bulletproofs / Ristretto255) confirmed live in production with Phase 2 cert issuance. Gateway upgraded: X-ZKP-Receipt-Payload and X-Composite-Trust-Verdict headers added to x402 settlement responses for Phase 2 ATB sessions. POST /compliance/trust-query now recognises zkp_receipt objects as trust signals (threshold_met=true → TRUSTED). Receipt lifecycle table extended with zkp_receipt_v1. Substrate diagram updated with PQC/ZKP/Federation layer. Commit attribution updated to 155/157 (98.7%) across 19 substrate repos. LinkedIn article published: “Post-Quantum Credentials, Zero-Knowledge Proofs, and Cross-Issuer Federation: What Agentic Payment Standards Need Next” — public disclosure of PQC/ZKP/Federation layer covering all nine IETF I-Ds, Falcon-1024/ML-DSA-65 credential binding, Bulletproofs range proofs, and cross-issuer federation across x402, AP2, MPP, and A2A.
2026-06-16: Vauban crate evidence + VCX-Vauban named link. “Notable: vauban-org competing substrate” section extended with vauban-x402-jcs-conformance 0.1.0 (crates.io, published 2026-05-24, tarball SHA-256 188dc67c31a4252ce7d1a55b6cbfd58d42759a83563ab4da8ffbfd6d02f61e75): the crate self-identifies as the “5th-implementation runner” (matching the label from seritalien’s edited comment 4505674559 preserved in GitHub userContentEdits), references expected_jcs_bytes_b64 (AlgoVoi’s vector field, first committed 2026-05-23) as the field format it consumes from unnamed “publicly available conformance suites,” and explicitly names PR #2412 (AlgoVoi’s Axis 0 substrate vectors PR) while omitting AlgoVoi’s name. Published on the same day as the four-surface scrub; no NOTICE file. crates.io is append-only and cannot be scrubbed; this is the immutable successor to gist b0b86baabae3 (observed HTTP 404 on 2026-06-11). Coalition Engagement Log updated with 2026-06-16 VCX stance comment (4720862348) and documented VCX-to-Vauban link (the PR author names the Vauban contributor in acknowledgments; the 2026-06-02 batch closure names both parties). PR #2544 comment anchor table updated. (The VCX PR #2544 attribution matter is resolved — see the 2026-06-22 Resolution entry in the timeline.) Full diligence record: evidence/diligence-pack/vauban-crate-content-extract-2026-06-16.md.

Coalition Engagement Log

Public claims made by third parties about AlgoVoi-authored concepts. AlgoVoi policy: single reply pointing to this page, then silence. No public arguments. Every incident logged here for diligence.

Date	Platform	Actor	Claim	Verified fact
2026-06-01	crewAIInc/crewAI discussion #4232	kenneives (AgentGraph)	Cited `draft-giskard-aeoess-action-ref` as the IETF I-D source for `action_ref`	`draft-giskard-aeoess-action-ref` confirmed non-existent on IETF datatracker (2026-06-01). Correct I-D: `draft-hopley-x402-canonicalisation-jcs-v1` `-00` submitted 2026-05-24, current `-04` 2026-05-29. Any coalition submission would postdate our `-00` by a minimum of 8 days. kenneives acknowledged the correction the same day: “you’re right… calling it a published IETF I-D was ahead of reality on my part. The `action_ref` construct itself does appear in a real datatracker doc, `draft-hopley-x402-canonicalisation-jcs-v1`.”
2026-06-02	x402 PR #2544	VCX PR author	Filed VCX PR #2544 implementing a JCS+SHA-256 envelope-digest pipeline (`sha256:<hex>` prefix, `settled_payment_ref`, `SETTLED / PENDING_FINALITY / REVERSED`, content-addressed audit references); 9 AlgoVoi PRs were closed the same day.	AlgoVoi’s related work was published earlier: `algovoi-substrate 0.3.0` (PyPI 2026-05-23: `sha256_jcs()`, `content_hash`, `prev_hash`); `algovoi-settlement-attestation 0.1.0` (PyPI 2026-05-25: `SETTLED / PENDING_FINALITY / REVERSED`, `settled_payment_ref`); live server files 2026-05-16; IETF drafts 2026-05-29/30. AlgoVoi engaged on the PR (6 comments), noting its earlier published work. (Resolved 2026-06-22: the PR’s current revision adds a References / Public Standards section and NOTICE citing RFC 8785 and the MIT `canonicalize` library, implemented independently; AlgoVoi considers the matter closed, authorship resting on the dated prior-art above.) Full record: `content/diligence-pack/vcx-attribution-incident-2026-06-02.md` + `content/diligence-pack/x402-pr-closure-record-2026-06-02.md`.
2026-06-03	microsoft/agent-governance-toolkit Discussion #276	`Rul1an` (NONE)	Described `action_ref = SHA-256(JCS(...))` as “giskard09’s” in a comment on architectural binding of decision records to execution outcomes.	Contradiction on the record: giskard09’s argentum-core `action_ref` was colon-concatenation until he migrated it to JCS+SHA-256 on 2026-05-19 (commit `77a10ff`, message: “correct action_ref derivation to JCS+SHA-256 (was colon-concat)”) — i.e. after AlgoVoi’s JCS substrate was public (gist 2026-05-16). The JCS canonicalisation discipline `action_ref` relies on is AlgoVoi-authored (`algovoi-substrate 0.3.0`, PyPI 2026-05-23; `draft-hopley-x402-canonicalisation-jcs-v1`, IETF 2026-05-24). On 2026-05-23 the same actor claimed argentum-core’s `action-ref.md` was “predating AlgoVoi substrate involvement” and asked to be cited “as the origin” (A2A #1734, comment `17034900`, body SHA-256 `ab02e39b1e8c702d3acf13961b70c406b2ee65b24ea91a220fdd940b2a4382b2`; cite-as-origin `17035163`, `2f994f2af4935302c9e087fda1e9dcc9bdbcf007da13dff6ce4157de7a3ba342`) — a claim his own 2026-05-19 commit contradicts. No further reply — one-reply policy applies; two replies already made on this thread.
2026-05-10 – 2026-06-05	microsoft/semantic-kernel #13957, finos/ai-governance-framework #296, langchain-ai/langgraph #7687, crewAIInc/crewAI #4877	`giskard09` (NONE), `aeoess` (NONE), `arian-gogani` (NONE)	Coalition promoted `action-ref-v1.0` (argentum-core commit `71c01e8`) as the canonical spec for `SHA-256(JCS({agent_id, action_type, scope, timestamp_ms}))` — across four major framework threads simultaneously. giskard09 announced `draft-giskard-action-ref-00` “in preparation, co-authored with @aeoess.” arian-gogani cited “16/16 byte-identical validation” against giskard09’s fixtures. Update 2026-06-05: Following AlgoVoi’s field-name challenge on SK #13957, giskard09 publicly clarified that `action-ref-v1.0` hashes an RFC 3339 string (`"2026-05-15T10:00:00.123Z"`) — not an epoch-millisecond integer. This confirms the two specs produce different SHA-256 digests and are incompatible. However, giskard09’s co-author aeoess (Pidlisnyi) publicly named the epoch-millisecond integer form (`timestamp_ms`) as the “cross-ecosystem correlation key” on the same day — identifying AlgoVoi’s form, not `action-ref-v1.0`, as the ecosystem standard. The coalition’s co-authors describe different formats as the cross-ecosystem key. Giskard09 clarification · AlgoVoi contradiction post	Misattribution resolved by giskard09’s own clarification: `action-ref-v1.0` and `draft-hopley-x402-canonicalisation-jcs-v1 §4` are confirmed distinct constructions. aeoess’s Jun 5 self-admission identifies AlgoVoi’s epoch-ms integer form as the cross-ecosystem standard — not the RFC 3339 string form in `action-ref-v1.0`. Full evidence record: `content/diligence-pack/giskard09-action-ref-capture-2026-06-05.md`.
2026-06-05	awslabs/agentcore-samples Issue #1546	Tymofii Pidlisnyi (AEOESS, identity confirmed via IETF datatracker author field on `draft-pidlisnyi-aps-01`)	Pitched `agent-governance-spec/aps-x402-composition` (2 commits) to AWS Labs as an official AgentCore Payments sample. Repo uses `canonicalizeJCS()` and the exact “byte-for-byte on every null-free input” framing from AlgoVoi’s cross-validation documentation with no attribution. In the thread, described `[email protected]` as “the x402 substrate’s own canonicalizer” (community property framing) and described arian-gogani/nobulex’s matching `SHA-256(JCS({agent_id, action_type, scope, timestamp_ms}))` construction as “independent convergence”.	Timestamped prior art: gist `5f35eaa527d292bf3ddc52f8725a85c9` (2026-05-16, public) records AlgoVoi running 14/14 APS v1 cross-validation checks two days after `draft-pidlisnyi-aps-01` was filed — Pidlisnyi reviewed PRs #5 and #6 to the conformance suite before coalition exit 2026-05-24. Note: `draft-pidlisnyi-aps-01` was filed 2026-05-14, before `algovoi-substrate 0.3.0` PyPI publication (2026-05-23) but after AlgoVoi’s production implementation was running (May 16 server timestamps). Five AlgoVoi attribution comments on permanent record (2026-05-26, 2026-05-30, 2026-06-04, 2026-06-05 × 2). On 2026-06-05 Pidlisnyi publicly named AlgoVoi’s construction the “cross-ecosystem correlation key” and admitted APS ships it as `computeExternalActionRefV1` because the APS-native format differs — see self-admission row above. Full evidence record: `content/diligence-pack/aeoess-agentcore-self-admission-2026-06-05.md`.
2026-06-07	Cross-thread sweep — crewAI #5802, crewAI #5888 + PR #6030, crewAI #4877, A2A #1850, A2A #1893, A2A #1734, finos #296, ag2 #2942, SK #14056, autogen #7492	giskard09, aeoess, arian-gogani, nagasatish007, rpelevin, azender1, christopher-h-johnson (all NONE)	AlgoVoi’s `action_ref` (`SHA-256(JCS({agent_id, action_type, scope, timestamp_ms}))`), the JCS canonicalisation discipline, and the receipt formats presented as the actors’ own specs / attributed to competitors / proposed as standards, with no AlgoVoi or `draft-hopley` attribution. Notable: a joint `draft-giskard-aeoess-action-ref` that lists AlgoVoi only as a “byte-identical verifier” (A2A #1850, giskard09, comment SHA `cdeaa20e…`); an explicit lineage reversal — “action-ref.md … predating AlgoVoi substrate involvement … the spec did not adopt the implementations” (A2A #1734, giskard09, SHA `ab02e39b…`) plus a request to cite action-ref.md “as the origin of that pattern … in the IETF record” (SHA `2f994f2a…`); and PR #6030 landing AlgoVoi’s `params_hash = SHA-256(JCS(params))` + fail-closed `expires_at` + decision/outcome record-pair into CrewAI core crediting only Neura Relay + `draft-farley-acta` (`governance_decision.py` blob `314ece89…`).	Adoption is welcomed under Apache-2.0; the recorded item is the attribution gap. 52 comment SHA-256 anchors + PR #6030 body and 3 git-blob SHAs captured and author-verified 2026-06-07 (issue/PR: `gh api …/issues/comments/<id> -t '{{.body}}' \| sha256sum`; discussion: GraphQL `databaseId` body `\| head -c -1 \| sha256sum`; both validated against prior ledger hashes). The ecosystem standardised on AlgoVoi’s exact parameters — epoch-millisecond integer `timestamp_ms`, single-string `scope` — per `draft-hopley-x402-canonicalisation-jcs-v1 §4` and `algovoi-substrate 0.3.0` (PyPI 2026-05-23). Full record (every id, author, verbatim quote and SHA): `content/diligence-pack/action-ref-capture-master-evidence-2026-06-07.md`.
2026-06-08	a2aproject/A2A Discussion #1920	`kenneives` (AgentGraph, NONE)	Opened a v0.4 `transactional` claim_type RFC consolidating AlgoVoi’s production model as the coalition’s collective spec: a two-layer attestation (L1) plus execution-time receipt (L2) referencing L1 by hash; `action_ref` content-addressed correlation “citing both methods symmetrically rather than one as origin” (APS §4.1 plus argentum-core); `binding_digest = sha256(JCS(charge_ref, amount_usd, subject_did, nonce))`; an exactly-once guard keyed on `action_ref` (PENDING to COMMITTED); a verifier-attestation admission gate with static cap plus dynamic limit and settlement binding; and cross-chain receipt portability. Named leads are Vauban (seritalien) and Concordia (Erik Newton), with kenneives driving the receipt-envelope and Trust Score v2 composition and aeoess / azender1 / evidai contributing; AlgoVoi excluded as origin.	Adoption is welcomed under Apache-2.0; the recorded item is the explicit origin-neutralisation. AlgoVoi prior art predates the RFC by roughly two weeks: the two-phase admission-to-settlement lifecycle in `draft-hopley-x402-settlement-attestation` (IETF POSTED 2026-05-24) and `algovoi-settlement-attestation 0.1.0` (`SETTLED / PENDING_FINALITY / REVERSED`, PyPI 2026-05-25); `action_ref` and the JCS Substrate Rule 2 in `draft-hopley-x402-canonicalisation-jcs-v1 §4` (IETF 2026-05-24) and `algovoi-substrate 0.3.0` (PyPI 2026-05-23); and post-settlement composite-trust wiring (`X-Composite-Trust-Verdict`, 2026-06-04). Opened 16:41 UTC, after AlgoVoi’s same-shape pre-execution-versus-finality contribution on AP2 #275 (16:13 UTC). SHA-256 anchors: discussion body `0416217021f1f9862829c1ad7c6b94689ce1a05c2b354bd43bbc940b5d6ef25b`; azender1 exactly-once comment `81c4bf81753de56c4945fdb81f6a4e2b9cce1ab787acdb0535d4c25057fabca3`. Full record: `content/diligence-pack/action-ref-capture-master-evidence-2026-06-07.md` (2026-06-08 addendum, item 3).
2026-06-16	x402 PR #2544	`chopmob-cloud`	AlgoVoi posted stance comment `4720862348` rejecting the “comment-period contributor” framing in the PR acknowledgments.	Comment on the record: peer-contributor framing declined; AlgoVoi aligns its code and conformance vectors as it sees fit. (Resolved 2026-06-22: AlgoVoi considers the matter closed.) The PR acknowledgments name a Vauban contributor as an equal comment-period contributor alongside AlgoVoi, providing a documented VCX-to-Vauban link. Separately confirmed on the same day: a maintainer’s 2026-06-02 batch closure named both AlgoVoi and the Vauban contributor in the same group; the Vauban crate `vauban-x402-jcs-conformance 0.1.0` (published 2026-05-24) and VCX PR #2544 (committed 2026-06-02) both implement RFC 8785 JCS. Evidence record: `evidence/diligence-pack/vauban-crate-content-extract-2026-06-16.md`.

Apache 2.0 except where individual package LICENCE files specify otherwise.

Third-Party Adoption Evidence

Independently verified on 2026-06-04 via GitHub code search and direct file fetch. All repos below use AlgoVoi substrate patterns in production or published code.

Third-party repos using AlgoVoi substrate patterns

Confirmed adoptions (6 external repos, 13 files)

Repo	Language	Pattern	File
`arcanesys/nixfleet`	Rust	`pub fn sha256_jcs_hex<T: Serialize>` — direct port of AlgoVoi canonicalize	`crates/nixfleet-canonicalize/src/lib.rs`
`arcanesys/nixfleet`	Rust	`pub fn sha256_jcs<T: Serialize>` — routes through `sha256_jcs_hex`	`crates/nixfleet-agent/src/evidence_signer.rs`
`agentveil-protocol/agentveil-sdk`	Python	`def sha256_jcs(value: Any) -> str` + `HASH_PREFIX = "sha256:"`	`classification.py`
`agentveil-protocol/agentveil-sdk`	Python	`GENESIS_PREV_EVENT_HASH = "sha256:" + hashlib.sha256(...)` + audit chain with `prev_event_hash`	`evidence/store.py`
`aeoess/agent-passport-system`	TypeScript	`sha256_jcs: string` field + `sha256_jcs` in conformance runner (5 matches)	`src/core/canonical-jcs.ts`, `conformance-runner.ts`
`faramesh/faramesh-core`	Go	`CanonicalizationJCS = "jcs-rfc8785-v1"` constant; `canonicalize.JCSMarshal` pattern	`internal/core/dpr/record.go`
`vauban-org/x402-stark-receipts-conformance`	Multi	`canon_version: "jcs-rfc8785-v1"` + `action_ref = SHA-256(JCS(preimage))` derivation	`manifest.json`, `ADOPTERS.md`
`agentgraph-co/agentgraph`	Python / JS	`CANONICALIZATION = "jcs-rfc8785-v1"` + `envelopeDigest` function	`src/trust/envelope_v2.py`, `sdk/js/src/verify.js`

Notable: vauban-org competing substrate

Vauban Pay (seritalien) has published a competing “authoritative” conformance suite (vauban-org/x402-stark-receipts-conformance, repo created 2026-05-24) and substrate package (@vauban-pay/[email protected] on npm), positioning “Vauban Pay as primary author of the specification track.” Its Reference Implementation Matrix folds in AlgoVoi-authored material with no attribution: the vector sets action_ref_namespace_v0, action_ref_transactional_v0, and compliance_receipt_v1; the 192/192 8-implementation cross-validation result; and the “non-overlapping authoring entities” framing. compliance_receipt_v1 is labelled “Compliance receipt format per IETF I-D.”Dated provenance, all predating the 2026-05-24 repo creation:

The three vector sets are AlgoVoi-authored in chopmob-cloud/algovoi-jcs-conformance-vectors, first committed 2026-05-23.
The 192/192 8-implementation attestation is AlgoVoi’s: 2026-05-24-8-impl-cross-validation.md.
“Compliance receipt format per IETF I-D” is draft-hopley-x402-compliance-receipt, sole AlgoVoi (Christopher Hopley) authorship.
seritalien had APPROVED AlgoVoi PR #2436 (2026-05-22) before standing up the competing suite.

No AlgoVoi code is copied: Vauban’s package (Apache 2.0), its settlement-receipt schema (a distinct six-element Claim model, not the AlgoVoi SETTLED / PENDING_FINALITY / REVERSED enum), and its vector files are independently authored. Adoption of the substrate is welcomed under Apache 2.0; the recorded item is the attribution gap, where AlgoVoi-authored conformance material and the 192/192 result are presented under sole “Vauban primary author” framing.vauban-x402-jcs-conformance 0.1.0 on crates.io (2026-05-24, immutable record). Vauban published a Rust crate to crates.io on 2026-05-24, the same day as the four-surface scrub of PR comments (edits at 11:14Z, 11:48Z, 12:02Z UTC) and the I-D revision removing named AlgoVoi credit. crates.io is append-only: packages can be yanked but not deleted, and tarballs remain permanently downloadable from static.crates.io. Tarball SHA-256 (verified 2026-06-16): 188dc67c31a4252ce7d1a55b6cbfd58d42759a83563ab4da8ffbfd6d02f61e75; git commit anchor c25bf63f90d53e5cbd052989f6bbedf4304fb2e8 from vauban-org/vauban-zkpay. Evidentiary points: (1) Cargo.toml description self-identifies as “Reference 5th-implementation runner,” the same label used in seritalien’s edited comment 4505674559 (original body 2026-05-21T07:16:27Z, preserved in GitHub userContentEdits); (2) lib.rs docstring references expected_jcs_bytes_b64, AlgoVoi’s conformance vector field name first committed to the AlgoVoi corpus on 2026-05-23 (one day before the crate), as the field format consumed from “publicly available conformance suites” which are not named in the crate; (3) README explicitly names x402 PR #2412 (AlgoVoi’s Axis 0 substrate vectors PR) without naming AlgoVoi as its author; (4) the crate is Apache 2.0 with no NOTICE file attributing AlgoVoi’s conformance vector corpus. Gist b0b86baabae33e289fdb6d2f3fb30130 (the Rust 5th-impl runner that validated 21/21 AlgoVoi vectors, containing explicit AlgoVoi thread links) was observed at HTTP 404 on 2026-06-11 with no Wayback snapshot; the crate occupies the same technical function on a surface that cannot be deleted. GitHub userContentEdits preserves all pre-edit comment bodies from the 2026-05-24 scrub; the full capture is in the diligence pack (evidence/diligence-pack/seritalien-2433-2434-attribution-capture-2026-06-12.md, captured 2026-06-12). Full crate extract: evidence/diligence-pack/vauban-crate-content-extract-2026-06-16.md.

Notable: nobulex / aeoess action_ref, co-developed primitive with an attribution gap on the discipline (2026-06-06)

Context (recorded for accuracy): the bare action_ref derivation is an openly co-developed primitive. The concept originated as a colon-concatenation form attributed to giskard09; AlgoVoi contributed the JCS plus integer-millisecond timestamp_ms discipline (“Substrate Rule 2”) that makes the digest reproducible across implementations. arian-gogani (Nobulex) has separately and publicly credited AlgoVoi as the author of the namespace-prefixing convention (x402 #2332, 2026-05-23) and adopted nobulex:bilateral. AlgoVoi does not claim exclusive authorship of the bare formula; the AlgoVoi-authored layer is the JCS/integer-ms discipline and the conformance corpus below.This cuts both ways, and the second direction is on the record: the form arian-gogani ships is the epoch-millisecond integer timestamp_ms, which is AlgoVoi’s JCS discipline, not the RFC 3339 string form used by the giskard09 / argentum-core lineage that the coalition has elsewhere claimed as the origin of action_ref (A2A #1734, “action-ref.md … predating AlgoVoi substrate involvement”; giskard09’s own 2026-06-05 clarification confirms action-ref-v1.0 hashes an RFC 3339 string). A coalition-adjacent implementation conforming to AlgoVoi’s integer-ms form, while the coalition claims a lineage whose form is incompatible with it, is direct evidence that the discipline actually being adopted across the ecosystem is AlgoVoi-authored. Adoption and the lineage-rewrite contradict each other; the adoption is AlgoVoi’s form.On 2026-06-06, arian-gogani (Nobulex) posted the action_ref derivation, action_ref = SHA-256(JCS({agent_id, action_type, scope, timestamp_ms})) with timestamp_ms as an epoch-millisecond integer (the AlgoVoi-aligned form), across four AlgoVoi-active threads, shipped as pip install nobulex, without AlgoVoi attribution on those posts:

On agentcore-samples #1546 the construction was coordinated with aeoess and reframed as APS’s “cross-ecosystem correlation key” and nobulex’s construction validated against “our fixture set.”The same construction was also filed as a pull request against a standards-authority reference: OWASP/CheatSheetSeries #2217 (arian-gogani, opened 2026-06-06, open as of 2026-06-08) adds action_ref = SHA-256(JCS({agent_id, action_type, scope, timestamp_ms})) verbatim, with timestamp_ms as an epoch-millisecond integer, to the AML/Sanctions AI Agent Payments cheat sheet, citing EU AI Act Article 12 and ISO/IEC 42001, with the AlgoVoi JCS/integer-ms discipline (the layer that makes the digest reproducible across implementations) uncredited (PR body SHA-256 19535df0e25280c3d3d6ad90e8d4f76b7c7813e3f9d23aa6a5a3091feefaf54b; commit 188cdc7e7e51c0ccba7f7f2f92a925aa41b1aee2).Adoption of the primitive is welcomed under Apache 2.0; the recorded item is the attribution gap on the AlgoVoi-authored layer. The conformance corpus is AlgoVoi-authored: the action_ref_namespace_v0 anchor set in the conformance vector corpus, the discipline specified in draft-hopley-x402-canonicalisation-jcs-v1 (IETF Independent Submission, sole AlgoVoi authorship), and the live derivation endpoint at verify.algovoi.co.uk/action-ref. Byte-identical output against that corpus is AlgoVoi-authored bytes; the dated authored fixture set is AlgoVoi’s.

Notable: A2A #1920 “v0.4 transactional” — the JCS+SHA-256 receipt construction adopted across four implementations under a symmetric-origin citation (2026-06-15)

a2aproject/A2A Discussion #1920 (“RFC: v0.4 transactional claim_type — a per-action receipt layer for trust-gated payments”, opened 2026-06-08, 23 comments as of 2026-06-15) consolidates a per-action receipt seam built on the AlgoVoi JCS+SHA-256 construction. The binding digest used throughout is binding_digest = sha256(JCS({amount_usd, charge_ref, nonce, subject_did})) (RFC 8785 canonical JSON + SHA-256), and the correlation primitive is a content-addressed action_ref. Four mutually-untrusting implementations — AgentGraph, LemonCake, SafeAgent, and agentid — cross-validate their digests byte-for-byte on a fresh clone, which is the AlgoVoi conformance methodology (the same fresh-clone byte-reproduction bar AlgoVoi publishes against its corpus).Citation form. The thread attributes action_ref to APS (draft-pidlisnyi-aps-01 §4.1) and argentum-core (action-ref-v1), “cit[ed] both methods symmetrically rather than one as origin” (opener item 5; restated by haroldmalikfrimpong-ops 2026-06-11, comment body SHA-256 3a87e36ad355febdc6abe2ad817268267676700592a0a80d6b846d40829985c1). draft-pidlisnyi-aps-01 (T. Pidlisnyi; -00 submitted 2026-03-27, -01 submitted 2026-05-14) §4.1 “Action Reference Computation” does specify action_ref = SHA-256(canonicalize(input_object)) with canonicalisation per RFC 8785 — but over a different preimage: {agentId, actionType, scopeRequired, timestamp} (camelCase, scopeRequired, plain timestamp), not the AlgoVoi {agent_id, action_type, scope, timestamp_ms} (snake_case, single-string scope, integer epoch-millisecond timestamp_ms). The two action_ref derivations are therefore not byte-identical — which the thread itself acknowledges (haroldmalikfrimpong-ops, above: “the APS draft-pidlisnyi-aps-01 preimage differs and is named symmetrically”). AlgoVoi does not claim authorship of the bare “SHA-256 over JCS-canonical fields” method; APS specifies its own variant, and its draft series predates AlgoVoi’s earliest public action_ref disclosure.Convergence toward the AlgoVoi form, dated 2026-06-15. On 2026-06-15 (azender1, comment body SHA-256 ec4a01ef14339482d6835a2ba9543a3413220ffde7ae7866ac5f9623887a712a) SafeAgent fixed a collision bug by migrating its identifier from an unescaped colon-concatenation f"{agent_id}:{action_type}:{scope}" to SHA256(JCS({agent_id, action_type, scope})), “matching the v1.1 fixture’s construction.” This is the same colon-concat → JCS+SHA-256 correction the giskard09 / argentum-core lineage itself made on 2026-05-19 (commit 77a10ff, “correct action_ref derivation to JCS+SHA-256 (was colon-concat)”) — recurring almost a month later, because the concatenation form does not cross-validate and the JCS discipline does. The same comment stands up a “Mycelium Trails” write path posting action_ref-keyed records to argentum.rgiskard.xyz. A later normative revision (kenneives 2026-06-14, comment body SHA-256 734edaef8c9f778f5f8b5aeb6fb0c73992b06b5093043e9bbd3e1237acc586af) makes the nonce-in-the-binding_digest-preimage and the action_ref-keyed exactly-once guard normative requirements.What AlgoVoi authored, scoped precisely. Not the bare JCS-over-fields method — APS published its own variant earlier, and the bare formula is openly co-developed (see the nobulex / aeoess note above). The AlgoVoi-authored layer is the specific snake_case integer-millisecond construction ({agent_id, action_type, scope, timestamp_ms}, integer epoch-ms timestamp_ms; “Substrate Rule 2”) and the multi-implementation conformance corpus that makes that exact digest reproducible byte-for-byte: the action_ref_namespace_v0 anchor set in the conformance vector corpus, the discipline in draft-hopley-x402-canonicalisation-jcs-v1 §4 (IETF Independent Submission, -00 posted 2026-05-24, sole AlgoVoi authorship), the public validation gist 5f35eaa… (2026-05-16), algovoi-substrate 0.3.0 (PyPI, 2026-05-23, Apache-2.0), and the live endpoint at verify.algovoi.co.uk/action-ref. The thread’s binding_digest and the SafeAgent migration below adopt exactly this snake_case integer-ms JCS+SHA-256 construction, not the APS camelCase variant.The argentum-core action-ref.md lineage specifically (distinct from APS) used colon-concatenation until commit 77a10ff on 2026-05-19 — postdating AlgoVoi’s 2026-05-16 gist on the JCS form. Adoption of the construction is welcomed under Apache 2.0; the recorded item is the attribution gap on the AlgoVoi-authored snake_case integer-ms discipline and conformance corpus. Byte-identical output against the AlgoVoi corpus is AlgoVoi-authored bytes.

Notable: foxbook — positive “AlgoVoi-shape” attribution (2026-06-03)

cloakmaster/foxbook (Benjamin Bandali; “Verifiable agent identity for A2A and MCP”, Apache 2.0, repo created 2026-04-21) publicly credits the AlgoVoi composition / “AlgoVoi-shape” for its composable settlement-evidence integration. On foxbook Discussion #79 (2026-06-03, comment body SHA-256 3c863411a3f42b7f590264ec565f4eaca060712ce3cbc299ac1221ae19a89640) the maintainer ratified “the AlgoVoi composition against the already-accepted typed-reference v1.0 shape,” naming AlgoVoi as the integrator layer. Related: A2A #1803 (x-foxbook v1 identity primitive).This is a positive-attribution signal — the construction is credited to AlgoVoi by name, the intended outcome of Apache-2.0 publication — recorded as adoption evidence, in contrast to the unattributed reframes above.Caveats (recorded for accuracy): (1) foxbook’s ratification lists @kenneives (substrate-layer reviewer), a coalition-adjacent party — so this is not a fully arm’s-length independent adopter. (2) foxbook’s separate claim (A2A #1803) that an x-foxbook block is “live at api.algovoi.co.uk” is not corroborated by the AlgoVoi agent card (/.well-known/agent.json contains no foxbook reference); that specific claim is unverified and is not asserted here.

Notable: EPI / `mohdibrahimaiml` — arm’s-length positive attribution and adoption (2026-06-08)

On microsoft/agent-governance-toolkit Discussion #806 (“.epi artifact format for portable compliance evidence output”), AlgoVoi noted on 2026-05-30 (comment body SHA-256 7ccfe491d2246d49ed22de0e8690b51fe20a6cd841c8c6b18f1fb4cc2fcd7570) that the load-bearing question for a portable compliance artefact is canonicalisation — that byte-identical artefacts from the same input across independent implementations require a deterministic canonicaliser (JCS RFC 8785), as specified in compliance-receipt-v1 and draft-hopley-x402-settlement-attestation.On 2026-06-08 the EPI author (mohdibrahimaiml) acted on that feedback and credited it (comment, body SHA-256 c157cf026195612fffdc302b6f7115af0f470643a4f63e805fb68e17737e9cd0): “Good catch on canonicalization. I audited the implementation against the repo, and the points you raised were real enough to act on.” EPI now ships deterministic canonical hashing with documented normalization rules, explicit field exclusions, formal conformance vectors, and offline Ed25519 verification (new epi_core/serialize.py fix + docs/EPI-CANONICAL-HASH.md), and the author frames AlgoVoi’s receipt model as the reference (“where EPI still diverges from your receipt model” — raw Ed25519 vs JWKS/JWS, no closed claim enum, no Object-Lock retention), proposing a shared conformance fixture (same input, independent implementations, identical frame_id).This is a fully arm’s-length positive-attribution and adoption signal — an independent maintainer adopting AlgoVoi’s JCS canonicalisation discipline, by name, after the fact, with no coalition-adjacent reviewer in the loop (the cleaner counterpart to the foxbook signal above). It is the intended outcome of Apache-2.0 publication, and it stands in direct contrast to the unattributed reframes recorded above.

Published Package Adoption

GitHub code search scan conducted 2026-06-04. PyPI + npm download data as of same date.

Package adoption — GitHub references and download volumes

Summary

Package	PyPI/month	npm/month	GitHub refs	Notable public listings
`algovoi-mcp` / `@algovoi/mcp-server`	974	1,210	5 repos	TensorBlock/awesome-mcp-servers (725 ★), electric-capital/open-dev-data (1,941 ★)
`algovoi-substrate` / `@algovoi/substrate`	929	773	0 public	— (private usage inferred from downloads)
`algovoi-rfc9421-verifier`	682	508	0 public	—
`algovoi-audit-verifier`	389	397	1 (mirror)	PyDigger metadata index
`algovoi-settlement-attestation`	367	261	0 public	—
`algovoi-composite-trust-query`	326	258	0 public	—
`algovoi-receipt-verifier`	140	68	1 (mirror)	PyDigger metadata index
`@algovoi/substrate-pqc`	—	403	0 public	—
`@algovoi/webhook-verifier`	—	62	0 public	—

MCP Server — confirmed public listings

electric-capital/open-dev-data (1,941 ★) Indexes chopmob-cloud/AlgoVoi-MCP-Server in the Algorand ecosystem under #sdk and #tools taxonomy. Used for ecosystem developer-count attribution.TensorBlock/awesome-mcp-servers (725 ★) Listed under Finance & Crypto with install instructions for both npx @algovoi/mcp-server and uvx algovoi-mcp. Describes multi-chain x402/MPP/AP2 payment gateway across 7 chains with on-chain settlement verification.

Download volume vs GitHub visibility gap

GitHub code search is blind to private repositories, internal forks, and air-gapped deployments. Download volumes for compliance-adjacent packages (algovoi-audit-verifier, algovoi-settlement-attestation, algovoi-composite-trust-query, algovoi-substrate-pqc) indicate active production usage in environments where public source disclosure is neither required nor typical — regulated financial services, enterprise AI pipelines, and sovereign governance deployments.Total PyPI downloads across all AlgoVoi packages: 18,600+ all-time as of 2026-06-04.

Full Code Pattern Adoption Scan — All Packages

Conducted 2026-06-04 via GitHub code search across all AlgoVoi published packages. 197 tool calls, 13 verification agents.

Full code pattern adoption scan — all packages (2026-06-04)

Tier definitions

Tier	Meaning
T1	Direct code match — independent repo reproduces the exact function/constant verbatim in a context that can only have originated from AlgoVoi’s published implementation
T2	Pattern / naming match — independent repo implements the same algorithmic pattern or error-code vocabulary without a declared dependency
T3	Reference / citation only — schema registrations, curated directory listings, standards-document citations; no executable code dependency
none	No public hits found outside org:chopmob-cloud at time of scan

Master table

Package	Tier	External repos	Key pattern	Notable adoption
Substrate (sha256_jcs / jcs-rfc8785-v1)	T1	7	, ,	arcanesys/nixfleet (Rust port); agentgraph
	T2	11	, , ,	ComfyUI-OpenClaw (545★); sipyourdrink-ltd/bernstein (544★); intentproof-sdk-python
	T2	2	RFC 9421 ++,	jschoemaker/Envoys-public (canonical reference); agentgraph-co/agentgraph
	T3	4	JSON Schema registration	SchemaStore/schemastore (3,776★); vscode-schemastore; vauban-org
Platform API headers	T3	9	did:web endpoint	jschoemaker/Envoys-public (3 live test scripts); andysalvo (8/8 JCS PASS)
	T3	4	Directory listing	TensorBlock/awesome-mcp-servers (725★); pab1it0/awesome-a2a (174★)
	none	0	,	PyPI mirror only
	none	0		Zero specific hits (111 false positives on generic HMAC patterns)
	none	0	, ,	IETF bibliography mirrors only
	none	0	,	IETF bibliography mirror only
	none	0	,	No public hits

algovoi-audit-verifier — T2 — 11 external repos

Broadest independent re-implementation footprint of any non-substrate package. The audit-chain vocabulary (, , ) has been independently reimplemented in Python, Rust, and JavaScript across 11 repos — none declare as a package dependency, indicating the pattern has become an informal community standard.Notable repos:

rookiestar28/ComfyUI-OpenClaw (545★) — with full + chain validation
sipyourdrink-ltd/bernstein (544★) — using the same pattern for knowledge-graph audit integrity
intentproof-sdk-python — + in a signed chained-event SDK; closest structural match

algovoi-compliance-receipt — T3 — SchemaStore (3,776★)

The compliance receipt JSON Schema is formally registered in SchemaStore — the primary editor validation registry for VS Code, JetBrains, and Neovim LSP users globally. Every developer who opens a compliance receipt JSON file in a supported editor gets AlgoVoi schema validation automatically.

algovoi-rfc9421-verifier — T2 — jschoemaker/Envoys-public

Envoys-public runs three live programmatic test scripts against AlgoVoi’s production endpoints (, , ), implements a compatible RFC 9421 stack citing AlgoVoi as the canonical reference, and treats as a cross-vendor verification target — the most substantive third-party integration found in the scan.

Platform API headers — PQC/ZKP layer

, , and returned zero hits outside org:chopmob-cloud — these headers were only shipped in production on 2026-06-04. This is expected: no third-party implementation has had time to adopt headers that are days old.

New findings beyond the substrate scan

Audit verifier has the largest independent re-implementation footprint (11 repos, T2) of any non-substrate package — not visible from the substrate-only scan.
jschoemaker/Envoys-public is the most substantive external integrator: running live programmatic tests across three AlgoVoi layers simultaneously (API endpoint, RFC 9421 patterns, compliance-receipt schema).

Private usage gap

Packages with zero or T3 public hits (receipt-verifier, webhook-verifier, CTQ, PEF, refund-receipt) are all post-PQC additions to the stack. Private registries, enterprise forks, and closed-source deployments are not indexed by GitHub code search. The audit-verifier finding (T2, 11 repos, zero declared package dependencies) demonstrates that real integration surfaces can materialize as pattern-level adoption before package-level imports appear in public repositories.Total confirmed external repos across all scans: 30+

​The substrate, in one sentence

​Authored artefacts at a glance

​Temporal authorship timeline

​What this substrate provides

​All platform interactions captured as substrate receipts

​Contributions acknowledged (historical record)

​What this substrate is NOT

​Verifying the claims on this page independently

​Coalition position

​Commit attribution across all substrate repositories

​Third-party acknowledgments on the public record

​See also

​Provenance of this page

​Coalition Engagement Log

​Third-Party Adoption Evidence

​Confirmed adoptions (6 external repos, 13 files)

​Notable: vauban-org competing substrate

​Notable: nobulex / aeoess action_ref, co-developed primitive with an attribution gap on the discipline (2026-06-06)

​Notable: A2A #1920 “v0.4 transactional” — the JCS+SHA-256 receipt construction adopted across four implementations under a symmetric-origin citation (2026-06-15)

​Notable: foxbook — positive “AlgoVoi-shape” attribution (2026-06-03)

​Notable: EPI / mohdibrahimaiml — arm’s-length positive attribution and adoption (2026-06-08)

​Published Package Adoption

​Summary

​MCP Server — confirmed public listings

​Download volume vs GitHub visibility gap

​Full Code Pattern Adoption Scan — All Packages

​Tier definitions

​Master table

​algovoi-audit-verifier — T2 — 11 external repos

​algovoi-compliance-receipt — T3 — SchemaStore (3,776★)

​algovoi-rfc9421-verifier — T2 — jschoemaker/Envoys-public

​Platform API headers — PQC/ZKP layer

​New findings beyond the substrate scan

​Private usage gap