Skip to main content
The Verifiable Compliance Suite (AV-VCS) is a single encrypted, offline-verifiable deliverable for regulated long-term data (health, insurance, defense). It ships the post-quantum Substrate-2 core, the Compliance Command Center console, the records and compliance estate, and supply-chain provenance, as one licence-gated .algv bundle. Everything runs on your own infrastructure: no account with the vendor, no outbound call, no phone-home. Your Falcon-1024-signed bundle licence is both the decryption key and the runtime licence.

​
1. What is in the bundle (25 wheels)

​
2. Install

Prerequisites: a Linux host with Python 3.10+ (Docker optional but recommended for isolation), and your bundle licence saved as licence.key.
The extractor verifies your Falcon-1024 licence against the embedded issuer key (no network), decrypts, and writes the 25 wheels with integrity checks. It is fully offline and air-gap capable. Every service is licence-gated by the same bundle licence, provided via the environment:

​
3. First run: the Command Center console

The console (the hub) is the operator-facing surface. Point it at a data directory and serve it over TLS. Required environment (persist these; the data dir holds keys, records and the audit chain):
Serve it (self-signed TLS shown; use a real certificate in production):
On first start the admin account is bootstrapped from the env. Browse to https://<host>:8443/ and sign in. Add the rest of the estate services (each runs under the same bundle licence, on its own port):

​
4. Accounts, roles and two-factor

Roles. The console has four roles: admin, compliance officer, auditor, viewer. Create accounts on the Users page (admin only). Role separation is enforced: a viewer cannot reach /users or user management (it returns 403). Two-factor sign-in (TOTP). The console discovers the TOTP add-on automatically (it ships in the bundle). On the Security page each user can Enroll: scan the QR code with an authenticator app (Google Authenticator, Authy, 1Password) or type the setup key, then confirm a 6-digit code. Enrollment is opt-in then required per user; once enrolled, password alone cannot sign in. Every enrollment and two-factor sign-in is written to the signed console audit chain. SCIM auto-provisioning (optional). The console discovers the SCIM 2.0 add-on automatically when it ships in the bundle, exposing a /scim/v2 endpoint your identity provider (Okta, Azure AD, OneLogin) uses to create, update and deactivate accounts. It authenticates with a dedicated bearer token, COMMAND_CENTER_SCIM_TOKEN (set it, or the console writes one to the data dir at mode 0600). SCIM groups map 1:1 onto the four RBAC roles, deprovisioning is a soft deactivate that blocks sign-in, and every provisioning change is written to the signed audit chain. Full setup for each provider is in the SCIM provisioning guide. Step-up re-check. Sensitive actions (evidence export, the validation pack) require a password re-check first: the console redirects to /verify, and after you confirm, the action proceeds. This is by design, not an error.

​
5. Console pages

APIs (/api/posture, /api/records, /api/containers, /api/ingest, /api/services, /api/updates) back the pages and are available for integration. Interactive API docs are at /docs and /redoc.

​
6. Security model

  • Offline, air-gap capable: verifies and decrypts with no network; no phone-home.
  • Post-quantum signing: Falcon-1024 and ML-DSA-65 keep evidence verifiable for decades; .acv containers use ML-KEM-1024.
  • Write-once, tamper-evident: records are content-addressed, encrypted at rest, RFC-3161 timestamped, offline-verifiable; a legal hold blocks deletion, and disposal leaves a signed erasure tombstone.
  • Signed audit chain: every privileged action is hash-linked; re-verify from the Audit page or via the validation pack.
  • RBAC + step-up + TOTP 2FA, as above.
  • Optional SIEM forwarding: stream the signed audit chain to your SOC over syslog (RFC 5424 / CEF) or webhook when configured.
  • Bring-your-own-key custody: HSM, KMS, HashiCorp Vault, PKCS#11 adapters for the doc archive.

​
7. Supply chain and disaster recovery

  • SBOM + provenance: the download ships sbom.cyclonedx.json, sbom.spdx.json, and a SLSA v1 provenance.json signed with the AlgoVoi release key (provenance.sig.json, key in release_pubkey.json). Load the SBOM into Dependency-Track / Grype / Trivy, or verify offline with algovoi-sbom verify.
  • DR: DR_RUNBOOK.md in the bundle documents RTO/RPO, backup and restore, and the signed key-ceremony and backup-restore attestation chain.
  • Volume import: docs/USAGE.md (bulk import a document estate) and docs/SECURE_INGEST.md (hardened per-tenant SFTP/rsync landing zone). The console Import tab drives these too.

​
8. Verification checklist (what a clean install proves)

Run these after install to confirm the deployment is healthy: This exact sequence was run against a fresh clean install of the shipping bundle and passed on every line, including two-factor enrollment.