> ## Documentation Index > Fetch the complete documentation index at: https://docs.algovoi.co.uk/llms.txt > Use this file to discover all available pages before exploring further. # Application matrix > How every AlgoVoi package, platform service and integration interacts: dependency graph, data flow diagram, and a full cross reference table. The AlgoVoi stack is organised in four layers: a canonicalisation substrate at the base, receipt formats above it, verifiers that validate those receipts, and platform services and integrations that produce and consume them. Every arrow in the diagram below is a verifiable, production-deployed dependency. *** ## Architecture layers ### 1 — Package dependency stack How the open-source packages depend on each other, from substrate up to the top-of-stack aggregator. ```mermaid theme={null} flowchart TB subgraph F["Foundation"] SUB["algovoi-substrate\nJCS RFC 8785 + receipt emitter"] SUBPQC["algovoi-substrate-pqc"] VEC["jcs-conformance-vectors"] end subgraph R["Receipt formats"] SA["settlement-attestation"] RR["refund-receipt"] CR["cancellation-receipt"] PEF["payment-evidence-frame"] end subgraph V["Verifiers"] RV["receipt-verifier"] AV["audit-verifier"] R9V["rfc9421-verifier"] R9S["rfc9421-signer"] CTQ["composite-trust-query"] end subgraph D["Decision / binding (lite, additive over substrate)"] PB["policy-binding"] CGL["compliance-gate-lite"] SGL["spend-guardrail-lite"] SG["substrate-guard"] end SUBPQC -->|extends| SUB VEC -. tests .-> SUB SUB --> SA & RR & CR SUB -->|JCS + canon_version| RV SUB -->|JCS + SHA-256| AV SUB -->|additive, pinned refs| PB & CGL & SGL & SG SA & RR & CR --> PEF RV -->|signal| CTQ SA -->|signal| CTQ ``` ### 2 — Platform services How the gateway uses the package layer and feeds the platform services. ```mermaid theme={null} flowchart LR subgraph PKG["Open-source packages"] SUB["substrate"] RV["receipt-verifier"] R9V["rfc9421-verifier"] SA["settlement-attestation"] RR["refund-receipt"] CR["cancellation-receipt"] end subgraph SVC["Platform services"] GW["Gateway\napi.algovoi.co.uk"] CE["Compliance Engine"] AC["Audit Chain\nB2 WORM"] RE["Recurr Engine"] end SUB -->|build_compliance_receipt| GW RV -->|/v1/receipt/verify| GW R9V -->|request verification| GW GW -->|emits| SA & RR GW -->|emits via Recurr| CR GW -->|enforces| CE GW -->|hash-chained rows| AC GW -->|MPP subscriptions + pull executor| RE ``` ### 3 — Integration layer What calls the gateway and what the Agent Trust Bench exercises. ```mermaid theme={null} flowchart LR subgraph INT["Integrations"] MCP["algovoi-mcp-server\n29 tools"] REFA["algovoi-reference-agent"] SHOP["algovoi-shopify-app"] X402["algovoi-x402-widget"] XCHAIN["algovoi-xchain-runtime"] RECURR["recurr.algovoi.co.uk\nMPP subscriptions"] AP2["AP2 mandate client\nAgent Payments Protocol"] A2A["External A2A agents\nA2A v0.3 — only live agent"] WHV["algovoi-webhook-verifier\ntenant inbound"] RS["algovoi-receipt-sentinel\ntenant monitoring"] end GW["Gateway\napi.algovoi.co.uk"] ATB["Agent Trust Bench\n187 profiles"] AV["algovoi-audit-verifier"] AC["Audit Chain"] RV["algovoi-receipt-verifier"] MCP -->|MPP + x402 + A2A tools| GW REFA -->|reference impl| GW SHOP -->|checkout| GW X402 -->|x402 protocol| GW XCHAIN -->|bridge + settle| GW RECURR -->|MPP subscriptions| GW AP2 -->|mandate flow| GW A2A -->|agent card + skills| GW GW -->|X-AlgoVoi-Signature| WHV WHV -->|error codes| RS RV -->|error codes| RS ATB -->|probes tools| MCP ATB -->|probes receipts| GW AC -->|bundle| AV ``` *** ## Interaction cross-reference Rows = producer / source. Columns = what it depends on, calls, or feeds. | Package / Service | Depends on | Calls / feeds | Verified by | | ----------------------------------- | ---------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **algovoi-substrate** | — | Receipt formats, platform gateway, verifiers | jcs-conformance-vectors (1226/1226) | | **algovoi-substrate-pqc** | algovoi-substrate (extends) | Future PQC receipt formats | PQC cross-product matrix (48/48) | | **algovoi-jcs-conformance-vectors** | — | Tests substrate across 10 languages | — | | **algovoi-settlement-attestation** | algovoi-substrate | algovoi-pef, composite-trust-query, gateway | substrate conformance vectors | | **algovoi-refund-receipt** | algovoi-substrate | algovoi-pef, gateway | substrate conformance vectors | | **algovoi-cancellation-receipt** | algovoi-substrate | algovoi-pef, gateway (via Recurr) | substrate conformance vectors | | **algovoi-pef** | settlement-attestation, refund-receipt, cancellation-receipt | Top-level receipt container | — | | **algovoi-receipt-verifier** | algovoi-substrate (JCS, canon\_version) | composite-trust-query, gateway `/v1/receipt/verify` | 13/13 cross-validation vectors, Python 41/41, TypeScript 19/19 | | **algovoi-webhook-verifier** | — | Tenant webhook consumer (validates `X-AlgoVoi-Signature`) | 104/104 cross-validation (8 langs × 13 vectors), Python 47/47, TypeScript 45/45 | | **algovoi-receipt-sentinel** | webhook-verifier + receipt-verifier error streams | Sliding-window tamper/replay/scan monitor — fires `TAMPER_DETECTED`, `REPLAY_DETECTED`, `SCAN_DETECTED`, `BURST_FAILURE` | 104/104 cross-validation (8 langs × 13 vectors), Python 36/36, TypeScript 35/35 | | **algovoi-audit-verifier** | algovoi-substrate (JCS + SHA-256) | Standalone offline audit | 103 tests (Python 65, TypeScript 38) | | **algovoi-rfc9421-verifier** | — | Inbound request verification (gateway) | 24/24 cross-implementation agreements | | **algovoi-rfc9421-signer** | — | Outbound signed request creation | 24/24 cross-implementation agreements | | **algovoi-composite-trust-query** | receipt-verifier signal, settlement-attestation | Top-of-stack `TRUSTED` / `PROVISIONAL` / `UNTRUSTED` verdict | — | | **AlgoVoi Gateway** | substrate, receipt-verifier, rfc9421-verifier, compliance-engine | Audit chain, settlement-attestation, refund-receipt, cancellation-receipt | ATB 128/138, E2E 88/88 | | **Audit Chain** | Gateway feed | algovoi-audit-verifier | B2 Object Lock COMPLIANCE 7-year retention | | **Compliance Engine** | Gateway enforces | Wallet screening, KYC/KYB | OFSI, OFAC SDN, EU Consolidated + 7 URL/IP threat feeds | | **Recurr Engine** | Gateway delegates | Cancellation receipts, pull executor (7 chains) | — | | **Agent Trust Bench** | — | Probes gateway + mcp-server | 187 profiles / 42 categories | | **algovoi-mcp-server** | — | Gateway HTTP API (29 tools) | ATB 128/138 pass rate | | **algovoi-reference-agent** | algovoi-substrate | Gateway (A2A), settlement-attestation | End-to-end Base chain worked example | | **algovoi-shopify-app** | — | Gateway HTTP API | Gateway E2E 88/88 (scripts/e2e\_external.sh, commit 59ff40f8) — all consumed API endpoints route-tested | | **algovoi-x402-widget** | — | Gateway (x402 protocol) | x402 v2 live: all 7 chain test resources return correct 402 envelopes (health-check 2026-05-16) · ATB Phase 8 receipt probes | | **algovoi-xchain-runtime** | — | Gateway + Allbridge + CCTP V2 | CCTP V2 Solana live (\~50s settlement) · Allbridge EVM→Stellar live · both production-deployed | | **recurr.algovoi.co.uk** | — | Gateway (MPP subscriptions, Tier 1 + Tier 2 pull executor, 7 chains) | MPP subscription external validation 2026-05-16: dual-envelope 402 verified + 4/4 negative-path tests pass (bogus credential → 400, nonexistent resource → 404, wrong tenant → 404, non-subscription via subscription endpoint → 404). Public fixture: api.algovoi.co.uk/mpp/sub/demo/mpp-sub-test-daily-base | | **AP2 mandate client** | — | Gateway (mandate authorisation + on-chain settlement across 7 chains) | AP2 `open_mandate_hash` v0 — 7/7 PASS (confirmed 2026-05-26) | | **External A2A agents** | — | Gateway (A2A agent card, 3 skills: verify-payment, create-checkout, check-status) — only live A2A payment agent | Agent card live at api.algovoi.co.uk/.well-known/agent.json · ATB 187 profiles · AlgoVoi-authored RFC 9421 proxy-chain fixture 4/4 OK (submitted to aps-conformance-suite, withdrawn 2026-05-24) · AlgoVoi-authored multi-chain Ed25519 fixture 3/3 OK · cross-extension v0 5/5 PASS (dogfood-B 2026-05-19) · only confirmed live A2A payment agent (2026-04-22) | *** ## Data-flow by receipt lifecycle Each payment event produces a structured receipt chain. All receipts share `canon_version: jcs-rfc8785-v1` from the substrate. ``` Payer initiates payment │ ▼ AlgoVoi Gateway ├─► Compliance Engine — screens wallet + URL (OFSI, OFAC, 7 feeds) ├─► build_compliance_receipt() [substrate] → compact JWS → Payer ├─► Facilitator — on-chain verification (7 chain families) ├─► build_settlement_attestation() [substrate] → stored + returned ├─► Audit Chain — JCS hash-chained row appended (B2 WORM) └─► (on refund) build_refund_receipt() [substrate] (on cancellation) build_cancellation_receipt() [substrate] Recipient verifies receipt └─► algovoi-receipt-verifier ├─ JWS decode + Ed25519 verify ├─ JCS re-canonicalisation check └─ Result → algovoi-composite-trust-query → TRUSTED / PROVISIONAL Auditor verifies chain └─► algovoi-audit-verifier ├─ Per-row content_hash check ├─ hash-chain continuity └─ HMAC-SHA256 bundle signature AI agent calls gateway └─► algovoi-mcp-server (29 tools) └─► gateway HTTP API └─► receipts / compliance / screening Tenant receives webhook └─► algovoi-webhook-verifier ├─ Header parse + timestamp check ├─ HMAC-SHA256 v1 verify ├─ HKDF-SHA256 key derive + HMAC-SHA384 v2 verify └─ JSON parse + event-type check → event dict │ error_code (on failure) ▼ algovoi-receipt-sentinel ├─ sliding window per source ├─ matches TAMPER / REPLAY / SCAN / BURST rules └─ SentinelAlert → notify security team (or null) ``` *** ## Package dependency graph (compact) Dependencies flow upward. Packages at each row depend only on packages at rows below them. | Layer | Packages | Depends on | | ----- | --------------------------------------------------------------------------- | ------------------------------------------------------------ | | 0 | substrate | — | | 0 | substrate-pqc | substrate | | 0 | jcs-conformance-vectors | — (tests substrate) | | 1 | settlement-attestation, refund-receipt, cancellation-receipt | substrate | | 1 | pef | settlement-attestation, refund-receipt, cancellation-receipt | | 1 | policy-binding, compliance-gate-lite, spend-guardrail-lite, substrate-guard | substrate (additive, pinned refs) | | 2 | receipt-verifier | substrate | | 2 | audit-verifier | substrate | | 2 | rfc9421-verifier, rfc9421-signer | — | | 2 | composite-trust-query | receipt-verifier signal, settlement-attestation | | 3 | Gateway | substrate, receipt-verifier, rfc9421-verifier | | 3 | Audit Chain | Gateway feed | | 3 | Recurr Engine | Gateway | | 3 | Agent Trust Bench | Gateway, mcp-server | | 4 | mcp-server, shopify-app, x402-widget, xchain-runtime, reference-agent | Gateway HTTP API | | 4 | webhook-verifier | Gateway webhook output (`X-AlgoVoi-Signature`) | | 4 | receipt-sentinel | webhook-verifier + receipt-verifier error streams | | 4 | recurr.algovoi.co.uk | Gateway (MPP subscriptions + pull executor) | | 4 | AP2 mandate client | Gateway (mandate flow + settlement) | | 4 | External A2A agents | Gateway (A2A v0.3 — agent card + 3 skills) | *** ## IETF I-D coverage Eight Internet-Drafts anchor the formats this stack implements. Each I-D maps to one or more packages. | Draft | Packages | | -------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------- | | [`draft-hopley-x402-canonicalisation-jcs-v1`](https://datatracker.ietf.org/doc/draft-hopley-x402-canonicalisation-jcs-v1/) | substrate, substrate-pqc, jcs-conformance-vectors | | [`draft-hopley-x402-compliance-receipt`](https://datatracker.ietf.org/doc/draft-hopley-x402-compliance-receipt/) | substrate (emitter), receipt-verifier | | [`draft-hopley-x402-settlement-attestation`](https://datatracker.ietf.org/doc/draft-hopley-x402-settlement-attestation/) | settlement-attestation | | [`draft-hopley-x402-refund-receipt`](https://datatracker.ietf.org/doc/draft-hopley-x402-refund-receipt/) | refund-receipt | | [`draft-hopley-x402-cancellation-receipt`](https://datatracker.ietf.org/doc/draft-hopley-x402-cancellation-receipt/) | cancellation-receipt | | [`draft-hopley-x402-composite-trust-query`](https://datatracker.ietf.org/doc/draft-hopley-x402-composite-trust-query/) | composite-trust-query | | [`draft-hopley-x402-payment-evidence-frame`](https://datatracker.ietf.org/doc/draft-hopley-x402-payment-evidence-frame/) | pef | | [`draft-hopley-x402-retention-chain`](https://datatracker.ietf.org/doc/draft-hopley-x402-retention-chain/) | policy-binding, compliance-gate-lite, spend-guardrail-lite, substrate-guard | *** ## See also * [Package suite](/package-suite) — full package listing with install commands and download counts * [Conformance vectors](/conformance-vectors) — the JCS conformance corpus used to validate substrate implementations * [Compliance gate](/compliance-gate-v1) — the gateway endpoint that emits the compliance receipts this stack verifies * [Audit chain](/platform/audit-chain) — the WORM ledger that `algovoi-audit-verifier` validates against * [Agent Trust Bench](https://agent-trust-bench.algovoi.co.uk/) — Phase 8 ATB profiles exercising the full receipt stack