python:3.12-slim container.
Full source and one-command reproduction:
chopmob-cloud/substrate-comparisons.
The comparison runs up the stack. Layer 1, the canonicalisation substrate, is
settled by reproducible bytes: hash a record and read the result. That is everything
from the at-a-glance figures through measured throughput below. Layer 2, the trust
chain, and Layer 3, settlement, are settled by capability rather than a byte race:
every alternative works, so the question is which properties it keeps, offline-verifiable,
fail-closed, non-custodial, and bound to the transacting parties.
At a glance
1,000,000
action references, zero collisions
1226 / 1226
byte-for-byte across ten implementations
96 / 96
independent implementations fail closed
~118k / s
action references, single core
The number that decides it: payments kept at scale
A payment identity built on a coarse timestamp collapses distinct payments into one, so the second payment looks like a retry and is silently dropped. An integer millisecond identity keeps them apart. These are counted from real hashes, not modelled. AlgoVoi integer-millisecond: 100% of payments kept. All 1,000 unique, zero collisions. Second-precision timestamp: 0.2% kept. 99.8% lost as silent collisions. At 100,000 payments over 100 seconds the gap widens to 99.9% lost versus 0.0%. Counted from real hashes, not modelled.Cross-validation: the property a single implementation cannot show
A vector set is only trustworthy if independent implementations agree on it byte for byte. A single-implementation conformance set cannot demonstrate that, and it cannot show that independent implementations reject the same attack the same way. AlgoVoi substrate: ten independent implementations agree, 1226 of 1226 byte for byte. Single-implementation vector set: 1 implementation, no independent agreement. Ten independent JCS implementations in ten languages, including the RFC 8785 author’s Java. See the canonicalisation substrate page for the corpus. And on the adversarial path, eight independent implementations all accept the valid control and reject each of the eleven isolated attacks identically: 96 of 96 fail-closed verdicts. A single implementation cannot reproduce that.Where each method differs (by technique)
Every cell is decided by hashing a real record and reading the result. The reference holds every property; each alternative technique fails at least one.
Two bindings sit on a separate axis: whether a later tamper or a silent policy
change is detectable from the record alone. A content-addressed binding catches it; an
operator-assigned id or a version label does not.
What the field is built on
A survey of the independent agentic-payment canonicalization implementations in this space, each read from its own primary source and recorded in the public substrate adopters registry, finds the field still converging on one canonicalization identifier. As of 2026-07-15 the registry records thirteen independent parties anchoring thejcs-rfc8785-v1 canonicalization identifier in their own specs or code
(as preimage_format, canon_version, or a canonicalization constant), up from six at
the first survey on 2026-06-21. A further seven convergent implementations
independently use the RFC 8785 JCS plus SHA-256 content-address technique under their own
label, and two more cite the identifier at the model level. The implementations that adopt
neither use naive serialization or no canonicalization at all, which is exactly where the
technique table above marks them down.
jcs-rfc8785-v1 is the registered canonicalization identifier, first published
2026-05-22. The strongest alternative surveyed reports an eight-language matrix and a
post-quantum proof system, and it too pins jcs-rfc8785-v1. The substrate the field
recomputes against is this one.
Measured throughput
In a clean container, on a single core, the substrate computes about 118,000 action references per second with zero collisions at one million, and the fullpolicy_ref plus policy_bound_ref plus gate_ref chain at about 44,000 per
second. Collision freedom is a property of the construction and is the same on any
host; throughput is the host’s and scales with cores.
Layer 2: the trust chain
Layer 1 settles bytes. Layer 2 settles whether the whole agent lifecycle, identity through verdict, recomputes as one content-addressed chain, and whether an authority once granted can be pulled in a way that still holds when the network is gone. These are capability properties, so every alternative in the table works; the question is which properties it keeps.
The load-bearing row is revocation. Every network-dependent technique fails open the
moment the verifier is offline: it honours a credential that was already killed, because
it could not check. A content-addressed revocation reference is read from the bytes, so a
revoked authority stays revoked with no responder to reach and no fail-open window. The
same content-addressing binds a whole multi-agent task into one reference whose
continuity, scope, and completeness verify offline, which an unstructured execution log
cannot show.
Layer 3: settlement
Layer 3 is where value moves, agent to agent or human to agent. The comparison is about custody and structure: who holds the funds, whether the primitive is bound to the two transacting parties or resold as an operator platform, and whether one integration covers every chain or one per chain.
The payment attestation is offline-verifiable as a confirmation, that the provider
confirmed the payment, not as an independent proof that funds moved. On-chain settlement
is the finality proof; the rail attestation is a bound external confirmation, and stating
that difference is the point.
No technique in the set holds the full combination on the reference lines: non-custodial,
bound to the two transacting parties, and one primitive across every chain including UTXO.
Custodial escrow holds the funds and is per-chain; operator platforms hold custody and
resell settlement; single-rail tools cover one rail. The reference layer holds all of it
because it anchors a content-addressed reference and never touches the money.
Run it yourself
Layer 1 is the reproducible layer, so this is where the bytes are yours to check. Layers 2 and 3 are capability properties you verify against your own deployment, not a script.composition/adversarial_gauntlet/.