> ## Documentation Index
> Fetch the complete documentation index at: https://docs.algovoi.co.uk/llms.txt
> Use this file to discover all available pages before exploring further.

# Package Suite

> 25 AlgoVoi open source packages on PyPI and 25 on npm under Apache 2.0, three commercial packages, and the 29 tool MCP server on three registries.

AlgoVoi publishes 25 packages on PyPI and 25 on npm under Apache 2.0, plus a 29-tool MCP server on three registries. Every package is covered by the same [JCS canonicalisation substrate](/canonicalisation-substrate) and backed by [10-implementation cross-validation](https://github.com/chopmob-cloud/algovoi-jcs-conformance-vectors#cross-implementation-validation-matrix) across Python, TypeScript, Go, Rust, Java, PHP, .NET, Ruby, Elixir, and Kotlin -- byte-for-byte agreement on the shared vector corpus.

All packages are Apache 2.0. All Python and TypeScript package pairs are byte-for-byte identical on the same input. Download counters show last-month installs from PyPI and npm, last refreshed 30 June 2026.

***

## Substrate layer

The substrate packages provide the foundational primitives — JCS canonicalisation, hash derivation, and PQC signing — on which every receipt format depends.

<CardGroup cols={2}>
  <Card title="algovoi-substrate / @algovoi/substrate" icon="layer-group" href="/canonicalisation-substrate">
    JCS RFC 8785 canonicalisation with AlgoVoi discipline rules: in-band `canon_version` pin, type-validation pre-canonicalisation, `action_ref` atomic primitive, composite trust-query algorithm, audit chain primitive, and transactional `action_ref` lifecycle.

    Specified in IETF Internet-Draft [`draft-hopley-x402-canonicalisation-jcs-v1`](https://datatracker.ietf.org/doc/draft-hopley-x402-canonicalisation-jcs-v1/).

    *Downloads (last month): 1,064 PyPI · 298 npm*

    ```bash theme={null}
    pip install algovoi-substrate
    npm install @algovoi/substrate
    ```
  </Card>

  <Card title="algovoi-substrate-pqc / @algovoi/substrate-pqc" icon="shield-halved" href="/pqc-substrate">
    PQC-aware additive successor to v1. Adds ML-DSA-65 (FIPS 204 final), Falcon-1024, SLH-DSA, and hybrid schemes to the 12-row `signature_algorithm` open-enum. Fail-closed verifier discipline.

    24/24 PQC cross-product matrix (4 producers × 6 verifiers: PQClean, @noble/post-quantum, Bouncy Castle 1.84).

    *Downloads (last month): 122 PyPI · 78 npm*

    ```bash theme={null}
    pip install algovoi-substrate-pqc
    npm install @algovoi/substrate-pqc
    ```
  </Card>

  <Card title="algovoi-policy-binding / @algovoi/policy-binding" icon="file-shield" href="/policy-binding">
    Additive policy-snapshot binding over a frozen subject ref. `policy_ref` content-hashes the ruleset; `policy_bound_ref` binds it to a settlement-action `binding_ref` or `retention_chain_ref` — version-provable, rotation-detectable. No new primitive: same RFC 8785 JCS + SHA-256.

    Conformance set `policy_binding_v1`, 14 checks; Python + TypeScript byte-for-byte identical.

    Specified in §7.7 + §8.10 of IETF Internet-Draft [`draft-hopley-x402-retention-chain`](https://datatracker.ietf.org/doc/draft-hopley-x402-retention-chain/).

    *Downloads (last month): 174 PyPI · 78 npm*

    ```bash theme={null}
    pip install algovoi-policy-binding
    ```
  </Card>

  <Card title="algovoi-compliance-gate-lite / @algovoi/compliance-gate-lite" icon="user-shield" href="/compliance-gate-lite">
    Open, content-addressed compliance decisions. `payer_ref` content-hashes the payer with no PII out; `gate_ref` binds an ALLOW/REFER/DENY verdict to a pinned subject ref (`policy_bound_ref` / `binding_ref` / `retention_chain_ref`), so the verdict is tied to the policy in force and rotation-detectable. The open origination tier of the commercial [Compliance Gate](/compliance-gate-v2).

    Conformance set `compliance_gate_lite_v1`, 12 vectors; Python + TypeScript byte-for-byte identical.

    Specified in §7.8 + §8.11 of IETF Internet-Draft [`draft-hopley-x402-retention-chain`](https://datatracker.ietf.org/doc/draft-hopley-x402-retention-chain/).

    *Downloads (last month): 142 PyPI · 77 npm*

    ```bash theme={null}
    pip install algovoi-compliance-gate-lite
    ```
  </Card>

  <Card title="algovoi-spend-guardrail-lite / @algovoi/spend-guardrail-lite" icon="scale-balanced" href="/spend-guardrail-lite">
    Open, content-addressed pre-payment decisions. `guardrail_ref` binds an ALLOW/DENY decision to the agent (`agent_ref`), the spend authority (`mandate_ref`), and the policy in force (`policy_bound_ref`), each imported by hash, into one recomputable reference; rotation-detectable, moves no funds. The open origination tier of the commercial [Spend Guardrail](/spend-guardrail).

    Conformance set `spend_guardrail_lite_v1`, 10 vectors; Python + TypeScript byte-for-byte identical.

    An instance of the §7.6 to §7.8 binding-ref framework in IETF Internet-Draft [`draft-hopley-x402-retention-chain`](https://datatracker.ietf.org/doc/draft-hopley-x402-retention-chain/); the published conformance set is the byte-level artifact.

    *Downloads (last month): 155 PyPI · 92 npm*

    ```bash theme={null}
    pip install algovoi-spend-guardrail-lite
    ```
  </Card>

  <Card title="algovoi-substrate-guard / @algovoi/substrate-guard" icon="filter" href="/substrate-guard">
    Deterministic input-bounds / DoS hardening gate that runs before canonicalization. `profile_ref` content-addresses the limits in force; `guard(value, profile)` admits or rejects a well-formed but resource-hostile payload (bytes, depth, key count, array and string length, unsafe numbers) with a named reject code, before any JCS or SHA-256 work touches it. A structural validator plus a content-addressed profile, not cryptography, and not rate limiting (that stays in the runtime layer).

    Conformance set `substrate_guard_v1`, 15 vectors; Python + TypeScript byte-for-byte identical.

    Anchors to §7.5 (Input Validation) of IETF Internet-Draft [`draft-hopley-x402-retention-chain`](https://datatracker.ietf.org/doc/draft-hopley-x402-retention-chain/), resource-bounds edition; the published conformance set is the byte-level artifact.

    *Downloads (last month): 148 PyPI · 83 npm*

    ```bash theme={null}
    pip install algovoi-substrate-guard
    npm install @algovoi/substrate-guard
    ```
  </Card>
</CardGroup>

***

## Open decision lifecycle

Eight content-addressed `*_ref` primitives covering the full open lifecycle: identity to authority to delegation to decision to settlement to refund/cancellation to trust verdict. Each ref composes onto the prior by hash, so the complete chain is recomputable from the pinned inputs alone.

<CardGroup cols={2}>
  <Card title="algovoi-agent-passport-lite / @algovoi/agent-passport-lite" icon="id-card" href="/agent-passport-lite">
    Open, content-addressed agent identity anchor. `passport_ref = SHA-256(JCS({agent_id, issuer_did, issued_at_ms}))` — no PII out, rotation-detectable. The identity input to `mandate_ref` and `guardrail_ref`. Pinned `==0.1.0` triggers the free v0 key gate.

    Conformance set `agent_passport_lite_v1`; Python + TypeScript byte-for-byte identical.

    Specified in IETF Internet-Draft [`draft-hopley-x402-compliance-receipt`](https://datatracker.ietf.org/doc/draft-hopley-x402-compliance-receipt/).

    *Downloads (last month): 122 PyPI · 70 npm*

    ```bash theme={null}
    pip install algovoi-agent-passport-lite==0.1.0
    ```
  </Card>

  <Card title="algovoi-payment-mandate-lite / @algovoi/payment-mandate-lite" icon="file-contract" href="/payment-mandate-lite">
    Open, content-addressed spend-authority anchor. `mandate_ref = SHA-256(JCS({passport_ref, scope, currency, max_amount_minor, expires_at_ms}))` — binds a `passport_ref` to a capped spend authority. Input to `guardrail_ref` and `cancellation_ref`.

    Conformance set `payment_mandate_lite_v1`; Python + TypeScript byte-for-byte identical.

    Specified in §7.6 of IETF Internet-Draft [`draft-hopley-x402-retention-chain`](https://datatracker.ietf.org/doc/draft-hopley-x402-retention-chain/).

    *Downloads (last month): 139 PyPI · 93 npm*

    ```bash theme={null}
    pip install algovoi-payment-mandate-lite==0.1.0
    ```
  </Card>

  <Card title="algovoi-delegation-ref / @algovoi/delegation-ref" icon="share-nodes" href="/delegation-ref">
    Open cross-party authority delegation. `delegation_ref = SHA-256(JCS({delegator_ref, delegatee_ref, scope, expires_at_ms}))` — content-addresses a delegation binding between two parties without revealing either identity in the ref. Composes with `mandate_ref` and `passport_ref`.

    Conformance set `delegation_ref_v1`; Python + TypeScript byte-for-byte identical.

    Specified in IETF Internet-Draft [`draft-hopley-x402-retention-chain`](https://datatracker.ietf.org/doc/draft-hopley-x402-retention-chain/).

    *Downloads (last month): 118 PyPI · 67 npm*

    ```bash theme={null}
    pip install algovoi-delegation-ref==0.1.0
    ```
  </Card>

  <Card title="algovoi-execution-ref / @algovoi/execution-ref" icon="circle-check" href="/execution-ref">
    Open, content-addressed action execution outcome. `execution_ref = SHA-256(JCS({decision_ref, action_type, scope, outcome, executed_at_ms}))` — keystone-native successor to `action_ref`; binds a decision to its outcome and execution timestamp. The `decision_ref` is imported by hash.

    Conformance set `execution_ref_v1`; Python + TypeScript byte-for-byte identical.

    Specified in §7.9 of IETF Internet-Draft [`draft-hopley-x402-retention-chain`](https://datatracker.ietf.org/doc/draft-hopley-x402-retention-chain/).

    *Downloads (last month): 190 PyPI · 97 npm*

    ```bash theme={null}
    pip install algovoi-execution-ref==0.1.0
    ```
  </Card>

  <Card title="algovoi-cancellation-receipt-lite / @algovoi/cancellation-receipt-lite" icon="ban" href="/cancellation-receipt-lite">
    Open, content-addressed mandate cancellation. `cancellation_ref = SHA-256(JCS({mandate_ref, cancellation_reason, cancelled_at_ms}))` — closes a `mandate_ref` with a closed four-value reason enum (`USER_REQUESTED`, `MERCHANT_REQUESTED`, `COMPLIANCE_TERMINATED`, `EXPIRED`). Lifecycle close for the spend authority chain.

    Conformance set `cancellation_receipt_lite_v1`; Python + TypeScript byte-for-byte identical.

    Specified in IETF Internet-Draft [`draft-hopley-x402-cancellation-receipt`](https://datatracker.ietf.org/doc/draft-hopley-x402-cancellation-receipt/).

    *Downloads (last month): 137 PyPI · 81 npm*

    ```bash theme={null}
    pip install algovoi-cancellation-receipt-lite==0.1.0
    ```
  </Card>

  <Card title="algovoi-refund-receipt-lite / @algovoi/refund-receipt-lite" icon="rotate-left" href="/refund-receipt-lite">
    Open, content-addressed post-settlement refund binding. `refund_ref = SHA-256(JCS({subject_ref, refund_state, amount_minor, currency}))` — closes the post-settlement lifecycle with a closed three-value state enum (`FULL`, `PARTIAL`, `REJECTED`). `subject_ref` imports a prior decision or payment by hash.

    Conformance set `refund_receipt_lite_v1`; Python + TypeScript byte-for-byte identical.

    Specified in IETF Internet-Draft [`draft-hopley-x402-refund-receipt`](https://datatracker.ietf.org/doc/draft-hopley-x402-refund-receipt/).

    *Downloads (last month): 146 PyPI · 71 npm*

    ```bash theme={null}
    pip install algovoi-refund-receipt-lite==0.1.0
    ```
  </Card>

  <Card title="algovoi-composite-trust-query-lite / @algovoi/composite-trust-query-lite" icon="network-wired" href="/composite-trust-query-lite">
    Open, content-addressed trust verdict anchor. `trust_query_ref = SHA-256(JCS({subject_refs, verdict, queried_at_ms}))` — caps the lifecycle stack with one recomputable trust answer over a set of pinned receipt refs. Closed four-value verdict enum (`TRUSTED`, `PROVISIONAL`, `INSUFFICIENT_EVIDENCE`, `UNTRUSTED`). The binding only; scoring and verification stay in the commercial tier.

    Conformance set `composite_trust_query_lite_v1`; Python + TypeScript byte-for-byte identical.

    Specified in IETF Internet-Draft [`draft-hopley-x402-composite-trust-query`](https://datatracker.ietf.org/doc/draft-hopley-x402-composite-trust-query/).

    *Downloads (last month): 152 PyPI · 69 npm*

    ```bash theme={null}
    pip install algovoi-composite-trust-query-lite==0.1.0
    ```
  </Card>

  <Card title="algovoi-retention-chain" icon="link" href="/retention-chain-substrate">
    Append-only hash-linked retention record chain. `retention_chain_ref = SHA-256(JCS({prev_ref, entry_ref, seq, retained_at_ms}))` — each entry imports the previous by hash; the chain is independently recomputable from the pinned entry set. Provides the persistence substrate for the compliance and audit record lifecycle.

    Conformance set `retention_chain_v1`; Python only (PyPI).

    Specified in IETF Internet-Draft [`draft-hopley-x402-retention-chain`](https://datatracker.ietf.org/doc/draft-hopley-x402-retention-chain/).

    *Downloads (last month): 271 PyPI*

    ```bash theme={null}
    pip install algovoi-retention-chain==0.1.0
    ```
  </Card>
</CardGroup>

***

## Verification layer

<CardGroup cols={2}>
  <Card title="algovoi-audit-verifier / @algovoi/audit-verifier" icon="magnifying-glass" href="/audit-verifier">
    Reference verifier for AlgoVoi selective-disclosure audit bundles. Checks per-row `content_hash`, hash-chain continuity, HMAC-SHA256 bundle signature, selection criteria, and off-VM Object Lock anchor. Standalone — no AlgoVoi infrastructure trust required.

    103 tests (Python 65 + TypeScript 38). Hosted at [verify.algovoi.co.uk](https://verify.algovoi.co.uk).

    *Downloads (last month): 124 PyPI · 83 npm*

    ```bash theme={null}
    pip install algovoi-audit-verifier
    ```
  </Card>

  <Card title="algovoi-rfc9421-verifier / @algovoi/rfc9421-verifier" icon="signature" href="/rfc9421-verifier">
    Reference verifier for RFC 9421 HTTP Message Signatures and RFC 9530 Digest Fields. Ed25519 and ECDSA-P256. Byte-for-byte parity confirmed by 24/24 cross-implementation agreements.

    Use for: inbound request verification, proxy-chain re-validation, conformance test harnesses.

    *Downloads (last month): 354 PyPI · 97 npm*

    ```bash theme={null}
    pip install algovoi-rfc9421-verifier
    npm install @algovoi/rfc9421-verifier
    ```
  </Card>

  <Card title="algovoi-receipt-verifier / @algovoi/receipt-verifier" icon="shield-check" href="/receipt-verifier">
    Cryptographic verifier for AlgoVoi JWS compliance receipts. Offline-capable — no AlgoVoi infrastructure trust required. 8-step verification: JWS format → alg whitelist → Ed25519 signature → `canon_version` → JCS re-canonicalisation → required fields → `screen_result` enum → `payment_hash` binding.

    13 shared cross-validation vectors covering all Phase 8 ATB threats. Python 41/41 · TypeScript 19/19 · E2E 13/13.

    *Downloads (last month): 326 PyPI · 295 npm*

    ```bash theme={null}
    pip install algovoi-receipt-verifier
    ```
  </Card>

  <Card title="algovoi-receipt-sentinel / @algovoi/receipt-sentinel" icon="shield-exclamation" href="/receipt-sentinel">
    Sliding-window monitor for verification failures. Detects tamper attempts (`TAMPER_DETECTED`), replay patterns (`REPLAY_DETECTED`), and scanning probes (`SCAN_DETECTED`) from the receipt and webhook verifier error streams. Zero runtime dependencies. Fully configurable rules and thresholds.

    Python 36/36 · TypeScript 35/35 · 13 vectors.

    *Downloads (last month): 228 PyPI · 89 npm*

    ```bash theme={null}
    pip install algovoi-receipt-sentinel
    npm install @algovoi/receipt-sentinel
    ```
  </Card>

  <Card title="algovoi-webhook-verifier / @algovoi/webhook-verifier" icon="bell" href="/webhook-verifier">
    Cryptographic verifier for AlgoVoi webhook signatures. Validates the `X-AlgoVoi-Signature` header using v1 HMAC-SHA256 and v2 HKDF-SHA256/HMAC-SHA384. Offline-capable. 6 typed error codes, 13 cross-validation vectors.

    Python 47/47 · TypeScript 45/45 · 13/13 vectors.

    *Downloads (last month): 279 PyPI · 263 npm*

    ```bash theme={null}
    pip install algovoi-webhook-verifier
    ```
  </Card>
</CardGroup>

***

## Receipt and attestation formats

Four IETF-specified receipt formats covering the full payment lifecycle — admission, settlement, cancellation, and refund. Each is canonicalised under `urn:x402:canonicalisation:jcs-rfc8785-v1`, backed by conformance vectors, and cross-implementation-verified byte-for-byte.

<CardGroup cols={2}>
  <Card title="algovoi-refund-receipt / @algovoi/refund-receipt" icon="rotate-left" href="/refund-receipt">
    Post-settlement refund receipt. Closed `FULL` / `PARTIAL` / `REJECTED` enumeration. Composes with compliance receipts in the audit chain.

    IETF: [`draft-hopley-x402-refund-receipt`](https://datatracker.ietf.org/doc/draft-hopley-x402-refund-receipt/)

    *Downloads (last month): 284 PyPI · 54 npm*

    ```bash theme={null}
    pip install algovoi-refund-receipt
    ```
  </Card>

  <Card title="algovoi-settlement-attestation / @algovoi/settlement-attestation" icon="check-circle" href="/settlement-attestation">
    Multi-chain settlement attestation. Closed `SETTLED` / `PENDING_FINALITY` / `REVERSED` enumeration. `settlement_chain` field covers all 8 AlgoVoi chains. MiCA Art. 80 / AMLR Art. 56 compliant record structure.

    IETF: [`draft-hopley-x402-settlement-attestation`](https://datatracker.ietf.org/doc/draft-hopley-x402-settlement-attestation/)

    *Downloads (last month): 283 PyPI · 48 npm*

    ```bash theme={null}
    pip install algovoi-settlement-attestation
    npm install @algovoi/settlement-attestation
    ```
  </Card>

  <Card title="algovoi-cancellation-receipt / @algovoi/cancellation-receipt" icon="ban" href="/cancellation-receipt">
    Mandate cancellation receipt. Closed `USER_REQUESTED` / `MERCHANT_REQUESTED` / `COMPLIANCE_TERMINATED` / `EXPIRED` enumeration. Independent `cancellation_timestamp_ms` and `effective_from_ms` for PSD2 Article 64 direct-debit revocation.

    IETF: [`draft-hopley-x402-cancellation-receipt`](https://datatracker.ietf.org/doc/draft-hopley-x402-cancellation-receipt/)

    *Downloads (last month): 286 PyPI · 49 npm*

    ```bash theme={null}
    pip install algovoi-cancellation-receipt
    ```
  </Card>

  <Card title="algovoi-composite-trust-query / @algovoi/composite-trust-query" icon="network-wired" href="/composite-trust-query">
    Verifier-side composite trust query response. Top-of-stack above the four receipt formats. Closed `TRUSTED` / `PROVISIONAL` / `INSUFFICIENT_EVIDENCE` / `UNTRUSTED` enumeration. Supports verifier-of-verifier composition.

    IETF: [`draft-hopley-x402-composite-trust-query`](https://datatracker.ietf.org/doc/draft-hopley-x402-composite-trust-query/)

    *Downloads (last month): 278 PyPI · 44 npm*

    ```bash theme={null}
    pip install algovoi-composite-trust-query
    ```
  </Card>
</CardGroup>

***

## Agent Trust Bench client

<CardGroup cols={2}>
  <Card title="algovoi-atb / @algovoi/atb" icon="shield-halved" href="/agent-trust-bench">
    Official client for the [Agent Trust Bench](/agent-trust-bench). Runs your agent through the full adversarial x402 profile suite, logs refusals, and returns a signed `RunResult` with the `certificate_b64` ready to present as `X-ATB-Credential`. Supports existing run IDs, concurrency control, and shareable report URLs.

    Full Falcon-1024 certificate verification with `pip install algovoi-atb[verify]` (Python `pqcrypto` + `rfc8785`). TypeScript package performs structural and expiry verification without native Falcon.

    Python 25/25 · TypeScript 22/22.

    *Downloads (last month): 539 PyPI · 415 npm*

    ```bash theme={null}
    pip install algovoi-atb
    npm install @algovoi/atb
    ```
  </Card>

  <Card title="One-call entry point" icon="play">
    ```python theme={null}
    from algovoi_atb import run_bench

    async def my_agent(profile_id, challenge):
        # True = refuse (correct for adversarial profiles)
        return True

    result = await run_bench(my_agent, label="v1")
    # result.score, result.passed, result.report_url
    # result.certificate_b64 → X-ATB-Credential header
    ```

    Pass an existing `run_id` to tag traffic against a pre-created report without creating a new run.
  </Card>
</CardGroup>

***

## ElizaOS plugin

<CardGroup cols={2}>
  <Card title="@algovoi/plugin-elizaos" icon="plug" href="https://github.com/chopmob-cloud/elizaos-plugin-algovoi">
    Multi-chain A2A crypto payment plugin for [ElizaOS](https://elizaos.ai) agents. Adds `CREATE_PAYMENT_REQUEST`, `VERIFY_PAYMENT`, and `CHECK_PAYMENT_STATUS` actions plus an `algovoi` provider that surfaces configured payment capabilities into the agent's LLM context.

    Supports x402, MPP, AP2, and Google A2A v0.3 across 7 chains (Algorand, VOI, Hedera, Stellar, Base, Solana, Tempo). Non-custodial — no private keys, no fiat custody.

    [![Agent Trust Bench](https://img.shields.io/badge/Agent_Trust_Bench-100%25_71%2F71-238636)](https://agent-trust-bench.algovoi.co.uk)

    *Downloads (last month): 290 npm*

    ```bash theme={null}
    npm install @algovoi/plugin-elizaos
    ```
  </Card>

  <Card title="elizaos.plugin.json manifest" icon="file-code">
    Includes a full `elizaos.plugin.json` manifest for rich UI integration in the Eliza admin panel — API key configuration, network selector, currency field, and available action listing. Discoverable via `elizaos`, `eliza`, and `plugin` npm keywords.

    Requires `ALGOVOI_API_KEY` (from [dash.algovoi.co.uk](https://dash.algovoi.co.uk/signup)). Optional: `ALGOVOI_DEFAULT_NETWORK`, `ALGOVOI_DEFAULT_CURRENCY`.
  </Card>
</CardGroup>

***

## MCP server

<CardGroup cols={2}>
  <Card title="algovoi-mcp / @algovoi/mcp-server" icon="plug" href="/integrations/mcp-server">
    29-tool MCP server exposing AlgoVoi's gateway to Claude Desktop, Claude Code, Cursor, Windsurf, and any MCP-compatible assistant. Tools span payments, protocol challenges (x402, MPP, AP2), A2A agent calls, recurring payment authorities, MPP subscription lifecycle, discovery, and compliance.

    Available on PyPI, npm, and the MCP Registry.

    [![Agent Trust Bench](https://img.shields.io/badge/Agent_Trust_Bench-128%2F138_Passed-238636)](https://agent-trust-bench.algovoi.co.uk)

    *Downloads (last month): 210 PyPI · 252 npm*

    ```bash theme={null}
    uvx algovoi-mcp
    npx -y @algovoi/mcp-server
    ```
  </Card>

  <Card title="29 tools across 7 chains" icon="coins">
    Base, Algorand, Solana, Stellar, Hedera, Tempo, VOI. All tools work identically across both Python and TypeScript implementations.

    Tools: `create_payment_link`, `verify_payment`, `screen_recipient`, `get_compliance_attestation`, `generate_mpp_challenge`, `try_mpp_endpoint`, `fetch_agent_card`, `send_a2a_message`, and 20 more.
  </Card>
</CardGroup>

***

## Conformance cross-validation matrix

All packages are validated against the same conformance corpus.

| Layer                       | Result                                                                              | Implementations                                                              |
| --------------------------- | ----------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- |
| JCS RFC 8785 substrate      | **880/880** byte-for-byte agreements                                                | Python, TypeScript, Go, Rust, Java, PHP, .NET, Ruby                          |
| PQC substrate (ML-DSA-65)   | **24/24** cross-product agreements                                                  | 4 producers × 6 verifiers (PQClean, @noble/post-quantum, Bouncy Castle 1.84) |
| RFC 9421 HTTP signatures    | **24/24** cross-implementation agreements                                           | Python, TypeScript (+ 6 external)                                            |
| Receipt formats (all 4)     | **8 vectors + invariants each**                                                     | Python, TypeScript (byte-for-byte)                                           |
| Compliance receipt verifier | **13/13** vectors, Python 41/41, TypeScript 19/19, E2E 13/13                        | Python, TypeScript (installed from PyPI + npm)                               |
| Webhook verifier            | **104/104** cross-validation (8 langs × 13 vectors), Python 47/47, TypeScript 45/45 | Python, TypeScript, Go, Rust, Java, PHP, .NET, Ruby                          |
| Receipt sentinel            | **104/104** cross-validation (8 langs × 13 vectors), Python 36/36, TypeScript 35/35 | Python, TypeScript, Go, Rust, Java, PHP, .NET, Ruby                          |
| ATB bench client            | Python 25/25 · TypeScript 22/22                                                     | Python, TypeScript                                                           |

Full attestation (880/880 cumulative through 2026-06-18; the 2026-06-17 sweep was 832/832, with settlement\_action\_binding\_v1 adding 48/48 on 2026-06-18): [2026-06-17 full corpus sweep](https://github.com/chopmob-cloud/algovoi-jcs-conformance-vectors/blob/main/_attestations/2026-06-17-full-corpus-sweep.md), [2026-06-18 settlement-action-binding](https://github.com/chopmob-cloud/algovoi-jcs-conformance-vectors/blob/main/_attestations/2026-06-18-settlement-action-binding-v1.md).

***

## Commercial layer

<Warning>
  **AlgoVoi Commercial License v1.0.** The packages in this section are **not open source**. They are distinct from the Apache 2.0 substrate packages above.

  |                                   | Open-source packages (Apache 2.0) | Commercial packages        |
  | --------------------------------- | --------------------------------- | -------------------------- |
  | **Evaluate / read code**          | ✅ Free                            | ✅ Free (evaluation grant)  |
  | **Non-commercial research**       | ✅ Free                            | ✅ Free (evaluation grant)  |
  | **Production deployment**         | ✅ Free                            | ❌ Requires written licence |
  | **Revenue-generating use**        | ✅ Free                            | ❌ Requires written licence |
  | **Managed service / SaaS resale** | ✅ Free                            | ❌ Requires written licence |

  To obtain a Commercial Licence Agreement: [hello@algovoi.co.uk](mailto:hello@algovoi.co.uk)
</Warning>

The following packages are available under the **AlgoVoi Commercial License v1.0** — evaluation use is free; production or commercial deployment requires a written licence agreement. [Contact us](mailto:hello@algovoi.co.uk) to enquire.

<CardGroup cols={2}>
  <Card title="algovoi-federation-validator" icon="shield-halved">
    Cross-issuer ZKP credential composition. Composes independently-issued Falcon-1024 ATB Pass Certificates from different issuers into a single composite federation token — no shared trust root required.

    The composite commitment binds all input credentials: `SHA-256(domain || comm_0 || comm_1 || … || nonce)`. The federation token is HMAC-SHA256 signed by the validator; downstream gateways verify with a single constant-time check regardless of issuer count.

    Specified in [`draft-hopley-x402-federation-zkp-00`](https://datatracker.ietf.org/doc/draft-hopley-x402-federation-zkp-00/) and [`draft-hopley-x402-pqc-credential-binding-00`](https://datatracker.ietf.org/doc/draft-hopley-x402-pqc-credential-binding-00/). Reference: [IACR ePrint 2026/109852](https://eprint.iacr.org/2026/109852).

    *AlgoVoi Commercial License v1.0 — [hello@algovoi.co.uk](mailto:hello@algovoi.co.uk)*
  </Card>

  <Card title="algovoi-zkp-receipt" icon="receipt">
    ZKP-bound payment receipt attestation. Binds an ATB Phase 2 ZKP credential to a specific on-chain payment receipt — proving "the agent that made this payment has ATB score ≥ threshold" without revealing the score.

    The Falcon-1024 signature covers both the payment receipt fields (payment ID, chain, amount, tx ID) and the ATB ZKP credential fields together. The receipt format is compatible with all 8 AlgoVoi-supported chains.

    Specified in [`draft-hopley-x402-pqc-credential-binding-00`](https://datatracker.ietf.org/doc/draft-hopley-x402-pqc-credential-binding-00/).

    *AlgoVoi Commercial License v1.0 — [hello@algovoi.co.uk](mailto:hello@algovoi.co.uk)*
  </Card>

  <Card title="algovoi-atb-credential-verifier" icon="badge-check">
    Standalone verifier for ATB Pass Certificates (`X-ATB-Credential` and `X-ATB-ZK-Credential`). Enables any licensed gateway to verify Falcon-1024 signed Phase 1 certificates and Bulletproofs ZKP Phase 2 certificates — without running the full AlgoVoi stack.

    Supports single-hub (pinned key) and multi-hub (allowlist or auto-fetch from `/.well-known/atb-keys.json`) deployments. LRU-cached, offline-capable for Phase 1, ZKP service call for Phase 2. Integrates with the ATB multi-hub federation registry.

    Specified in [`draft-hopley-x402-atb-reputation-credential-00`](https://datatracker.ietf.org/doc/draft-hopley-x402-atb-reputation-credential/).

    *AlgoVoi Commercial License v1.0 — [hello@algovoi.co.uk](mailto:hello@algovoi.co.uk)*
  </Card>
</CardGroup>

***

## IETF Internet-Drafts

Nine Independent Submission Internet-Drafts, sole AlgoVoi authorship, all on the IETF Datatracker.

| Draft                                                                                                                             | Package(s)                                                                                                                                        | License    |
| --------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------- | ---------- |
| [`draft-hopley-x402-canonicalisation-jcs-v1`](https://datatracker.ietf.org/doc/draft-hopley-x402-canonicalisation-jcs-v1/)        | substrate, substrate-pqc                                                                                                                          | Apache 2.0 |
| [`draft-hopley-x402-compliance-receipt`](https://datatracker.ietf.org/doc/draft-hopley-x402-compliance-receipt/)                  | substrate, agent-passport-lite                                                                                                                    | Apache 2.0 |
| [`draft-hopley-x402-refund-receipt`](https://datatracker.ietf.org/doc/draft-hopley-x402-refund-receipt/)                          | refund-receipt, refund-receipt-lite                                                                                                               | Apache 2.0 |
| [`draft-hopley-x402-settlement-attestation`](https://datatracker.ietf.org/doc/draft-hopley-x402-settlement-attestation/)          | settlement-attestation                                                                                                                            | Apache 2.0 |
| [`draft-hopley-x402-cancellation-receipt`](https://datatracker.ietf.org/doc/draft-hopley-x402-cancellation-receipt/)              | cancellation-receipt, cancellation-receipt-lite                                                                                                   | Apache 2.0 |
| [`draft-hopley-x402-composite-trust-query`](https://datatracker.ietf.org/doc/draft-hopley-x402-composite-trust-query/)            | composite-trust-query, composite-trust-query-lite                                                                                                 | Apache 2.0 |
| [`draft-hopley-x402-retention-chain`](https://datatracker.ietf.org/doc/draft-hopley-x402-retention-chain/)                        | retention-chain, policy-binding, compliance-gate-lite, spend-guardrail-lite, substrate-guard, payment-mandate-lite, execution-ref, delegation-ref | Apache 2.0 |
| [`draft-hopley-x402-atb-reputation-credential-00`](https://datatracker.ietf.org/doc/draft-hopley-x402-atb-reputation-credential/) | atb-credential-verifier                                                                                                                           | Commercial |
| [`draft-hopley-x402-pqc-credential-binding-00`](https://datatracker.ietf.org/doc/draft-hopley-x402-pqc-credential-binding-00/)    | federation-validator, zkp-receipt, atb-credential-verifier                                                                                        | Commercial |
| [`draft-hopley-x402-federation-zkp-00`](https://datatracker.ietf.org/doc/draft-hopley-x402-federation-zkp-00/)                    | federation-validator                                                                                                                              | Commercial |

***

## Adopters

Six entries in the [Substrate Adopters Registry](/adopters) with AlgoVoi as registry editor:
AlgoVoi v1, AlgoVoi v2, Supership/Crest, PEAC Protocol, Nobulex, Vauban Pay.

[JSON SchemaStore](https://www.schemastore.org) entry for the compliance receipt v1 schema (merged PR #5726).

***

For the full dependency graph, data-flow diagram, and cross-reference table showing how every package and platform service interacts, see the [Application matrix](/application-matrix).
