> ## Documentation Index
> Fetch the complete documentation index at: https://docs.algovoi.co.uk/llms.txt
> Use this file to discover all available pages before exploring further.
# Substrate comparison
> A layered comparison of methods for building tamper evident agentic payment records, decided by reproducible bytes at L1 and by capability above it.
Several methods are in use for building tamper-evident records of agentic payments.
This page puts them side by side with **reproducible bytes, not opinion**. The
reference is the AlgoVoi JCS (RFC 8785) substrate; the alternatives are compared by
**technique**, no implementation named. Every number here is produced by a script you
can run, and was last measured in a clean `python:3.12-slim` container.
Full source and one-command reproduction:
[chopmob-cloud/substrate-comparisons](https://github.com/chopmob-cloud/substrate-comparisons).
The comparison runs up the stack. **Layer 1**, the canonicalisation substrate, is
settled by reproducible bytes: hash a record and read the result. That is everything
from the at-a-glance figures through measured throughput below. **Layer 2**, the trust
chain, and **Layer 3**, settlement, are settled by capability rather than a byte race:
every alternative works, so the question is which properties it keeps, offline-verifiable,
fail-closed, non-custodial, and bound to the transacting parties.
## At a glance
action references, **zero collisions**byte-for-byte across **ten implementations**independent implementations **fail closed**action references, single core
## The number that decides it: payments kept at scale
A payment identity built on a coarse timestamp collapses distinct payments into one,
so the second payment looks like a retry and is silently dropped. An integer
millisecond identity keeps them apart. These are counted from real hashes, not
modelled.
**AlgoVoi integer-millisecond: 100% of payments kept.** All 1,000 unique, zero collisions.
**Second-precision timestamp: 0.2% kept.** 99.8% lost as silent collisions.
At 100,000 payments over 100 seconds the gap widens to 99.9% lost versus 0.0%. Counted from real hashes, not modelled.
## Cross-validation: the property a single implementation cannot show
A vector set is only trustworthy if independent implementations agree on it byte for
byte. A single-implementation conformance set cannot demonstrate that, and it cannot
show that independent implementations reject the same attack the same way.
**AlgoVoi substrate: ten independent implementations agree, 1226 of 1226 byte for byte.**
**Single-implementation vector set: 1 implementation, no independent agreement.**
Ten independent JCS implementations in ten languages, including the RFC 8785 author's Java. See the [canonicalisation substrate](/canonicalisation-substrate) page for the corpus.
And on the adversarial path, eight independent implementations all accept the valid
control and reject each of the eleven isolated attacks identically: **96 of 96
fail-closed verdicts**. A single implementation cannot reproduce that.
## Where each method differs (by technique)
Every cell is decided by hashing a real record and reading the result. The reference
holds every property; each alternative technique fails at least one.
| Technique | Exactly-once | Byte-reproducible | Offline-verify | Adversarial-safe |
| ----------------------------------------- | :----------: | :---------------: | :------------: | :--------------: |
| **AlgoVoi JCS (RFC 8785) substrate** | yes | yes | yes | yes |
| second-precision timestamp | **no** | yes | yes | yes |
| RFC 3339 string timestamp | yes | **no** | yes | yes |
| bare concatenation | **no** | yes | yes | **no** |
| camelCase field naming | yes | **no** | yes | yes |
| forward-id / operator-report binding | yes | yes | yes | **no** |
| operator-attestation (no content-address) | yes | yes | **no** | yes |
| amount as JSON number (float64) | **no** | yes | yes | yes |
Two **bindings** sit on a separate axis: whether a later tamper or a silent policy
change is detectable from the record alone. A content-addressed binding catches it; an
operator-assigned id or a version label does not.
| Binding technique | Change detected from the record alone |
| ----------------------------------------------------------------- | :-----------------------------------: |
| **content-addressed `binding_ref`** (action swap) | yes |
| forward-id / operator-report (action swap) | **no** |
| **content-addressed `policy_bound_ref`** (silent policy rotation) | yes |
| policy id/version label or operator attestation | **no** |
## What the field is built on
A survey of the independent agentic-payment canonicalization implementations in this
space, each read from its own primary source and recorded in the public [substrate
adopters registry](/adopters), finds the field still converging on one canonicalization
identifier. As of 2026-07-15 the registry records **thirteen independent parties
anchoring the `jcs-rfc8785-v1` canonicalization identifier** in their own specs or code
(as `preimage_format`, `canon_version`, or a canonicalization constant), up from six at
the first survey on 2026-06-21. A further **seven convergent implementations**
independently use the RFC 8785 JCS plus SHA-256 content-address technique under their own
label, and two more cite the identifier at the model level. The implementations that adopt
neither use naive serialization or no canonicalization at all, which is exactly where the
technique table above marks them down.
`jcs-rfc8785-v1` is the registered canonicalization identifier, first published
2026-05-22. The strongest alternative surveyed reports an eight-language matrix and a
post-quantum proof system, and it too pins `jcs-rfc8785-v1`. The substrate the field
recomputes against is this one.
## Measured throughput
In a clean container, on a single core, the substrate computes about **118,000
action references per second** with zero collisions at one million, and the full
`policy_ref` plus `policy_bound_ref` plus `gate_ref` chain at about **44,000 per
second**. Collision freedom is a property of the construction and is the same on any
host; throughput is the host's and scales with cores.
## Layer 2: the trust chain
Layer 1 settles bytes. Layer 2 settles whether the whole agent lifecycle, identity
through verdict, recomputes as one content-addressed chain, and whether an authority once
granted can be pulled in a way that still holds when the network is gone. These are
capability properties, so every alternative in the table works; the question is which
properties it keeps.
| Technique | Recomputable chain | Offline-verify | Revocation stays closed offline | No-PII | Continuity, scope, completeness |
| -------------------------------------------------------------------- | :----------------: | :------------: | :-----------------------------: | :----: | :-----------------------------: |
| **content-addressed trust chain (`journey_ref` / `revocation_ref`)** | yes | yes | yes | yes | yes |
| framework execution logs | **no** | **no** | n/a | **no** | **no** |
| identity-provider or gateway token revocation | n/a | **no** | **no, fails open offline** | varies | **no** |
| online CRL, OCSP, or status-list revocation | n/a | **no** | **no** | varies | **no** |
| mutable audit database | **no** | **no** | n/a | **no** | **no** |
The load-bearing row is revocation. Every network-dependent technique fails open the
moment the verifier is offline: it honours a credential that was already killed, because
it could not check. A content-addressed revocation reference is read from the bytes, so a
revoked authority stays revoked with no responder to reach and no fail-open window. The
same content-addressing binds a whole multi-agent task into one reference whose
continuity, scope, and completeness verify offline, which an unstructured execution log
cannot show.
## Layer 3: settlement
Layer 3 is where value moves, agent to agent or human to agent. The comparison is about
custody and structure: who holds the funds, whether the primitive is bound to the two
transacting parties or resold as an operator platform, and whether one integration covers
every chain or one per chain.
| Technique | Non-custodial | Bound to the two parties | One primitive, every chain | Post-quantum agent auth | Offline-verify |
| ---------------------------------------------------------- | :------------------------------: | :----------------------: | :------------------------: | :---------------------: | :-----------------: |
| **agent-to-agent settlement reference (`settlement_ref`)** | yes | yes | yes, including UTXO | yes | yes |
| **any-rail payment attestation (`fiat_settlement_ref`)** | yes | human to agent | rail-agnostic | rail's own | yes, as attestation |
| custodial smart-contract escrow | **no, the contract holds funds** | no, platform | no, per-chain | **no** | partial |
| operator or marketplace settlement | **no** | **no** | varies | **no** | **no** |
| single-rail receipt platform | yes | n/a | **no, one rail** | **no** | varies |
The payment attestation is offline-verifiable as a confirmation, that the provider
confirmed the payment, not as an independent proof that funds moved. On-chain settlement
is the finality proof; the rail attestation is a bound external confirmation, and stating
that difference is the point.
No technique in the set holds the full combination on the reference lines: non-custodial,
bound to the two transacting parties, and one primitive across every chain including UTXO.
Custodial escrow holds the funds and is per-chain; operator platforms hold custody and
resell settlement; single-rail tools cover one rail. The reference layer holds all of it
because it anchors a content-addressed reference and never touches the money.
## Run it yourself
Layer 1 is the reproducible layer, so this is where the bytes are yours to check. Layers 2
and 3 are capability properties you verify against your own deployment, not a script.
```bash theme={null}
git clone https://github.com/chopmob-cloud/substrate-comparisons
cd substrate-comparisons
pip install algovoi-substrate algovoi-policy-binding algovoi-compliance-gate-lite
python run_all.py # every method demo, real bytes
```
Each demo prints its comparison and exits zero when the demonstrated property holds.
The eight-language fail-closed run is in the conformance corpus at
`composition/adversarial_gauntlet/`.