> ## Documentation Index
> Fetch the complete documentation index at: https://docs.algovoi.co.uk/llms.txt
> Use this file to discover all available pages before exploring further.
# JCS Substrate Authorship and Provenance
> AlgoVoi-authored JCS substrate (RFC 8785 JSON Canonicalization Scheme): full artefact timeline with commit dates, public URLs, and one-command independent verification. No AlgoVoi infrastructure required.
This page is the single citable URL for AlgoVoi's substrate authorship.
Every artefact here is **AlgoVoi-authored, Apache-2.0 licensed, and
independently verifiable** with one shell command. No AlgoVoi infrastructure
is required to verify any claim on this page.
If you are an acquirer's technical lead doing diligence: this is the
single page you read.
**AI-assisted development disclosure.** The substrate architecture,
IETF Internet-Drafts, conformance vectors, cross-language reference
implementations, and associated automation were developed by AlgoVoi
with the assistance of two AI platforms — Anthropic Claude and Perplexity AI —
used throughout for code validation, error correction, and build automation. All creative
direction, technical decisions, and publication acts were made by
AlgoVoi. Under UK CDPA 1988 s.9(3), copyright in computer-generated
works vests in the person who made the arrangements necessary for the
creation of the work — AlgoVoi. No third-party AI provider asserts
any IP claim over the output. Over 1,500 development sessions are
locally archived and can be made available to a verified acquirer
under NDA as part of technical due diligence. Session logs from
2026-05-10 through 2026-05-16 show continuous daily activity on
compliance, JCS canonicalisation, and conformance-suite artefacts,
independently corroborating the May 2026 server-file timestamps
cited as prior-art anchors in the temporal authorship timeline below.
## The substrate, in one sentence
AlgoVoi authors a canonicalisation substrate for agentic-payment
receipt formats (x402, AP2, A2A, MPP) plus the reference
implementations, conformance corpus, and IETF Internet-Drafts that
pin it. The substrate is **byte-deterministic across 8 independent
JCS implementations in 8 programming languages**, including the
implementation by the editor of RFC 8785 itself (Anders Rundgren via
the Java impl). AlgoVoi operates as an **independent substrate author**
as of 2026-05-24 (see "Coalition position" below).
## Authored artefacts at a glance
| # | Artefact | Surface | First public | Verify command |
| -- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 1 | Production compliance machinery (`/compliance/screen`, `/compliance/attestation`) | api.algovoi.co.uk | **2026-04-12** | `curl -s https://api.algovoi.co.uk/.well-known/verascore-provider.json` |
| 2 | Canonicalisation discipline (Substrate Rule 2 integer-timestamp, JCS RFC 8785 pin) — specified in `draft-hopley-x402-canonicalisation-jcs-v1` and inline in `draft-hopley-x402-compliance-receipt` §4 and `draft-hopley-x402-refund-receipt` §4 | IETF datatracker + Mintlify | **2026-05-23** (IETF I-D §4) | `curl -sL https://www.ietf.org/archive/id/draft-hopley-x402-canonicalisation-jcs-v1.txt` once posted |
| 3 | JSON Schema (compliance receipt v1) on JSON SchemaStore | [json.schemastore.org/algovoi-compliance-receipt-v1.json](https://json.schemastore.org/algovoi-compliance-receipt-v1.json) | **2026-05-23** (merged via [PR #5726](https://github.com/SchemaStore/schemastore/pull/5726)) | `curl -s https://json.schemastore.org/algovoi-compliance-receipt-v1.json` |
| 4 | `algovoi-substrate` Python reference impl | [PyPI](https://pypi.org/project/algovoi-substrate/) | **2026-05-23** (v0.3.0 current) | `pip install algovoi-substrate>=0.3.0` |
| 5 | `@algovoi/substrate` TypeScript reference impl | [npm](https://www.npmjs.com/package/@algovoi/substrate) | **2026-05-23** (v0.3.0 current) | `npm install @algovoi/substrate@^0.3.0` |
| 6 | `algovoi-audit-verifier` selective-disclosure verifier | [PyPI](https://pypi.org/project/algovoi-audit-verifier/) + [npm](https://www.npmjs.com/package/@algovoi/audit-verifier) | **2026-05-23** | `pip install algovoi-audit-verifier` |
| 7 | `algovoi-rfc9421-verifier` HTTP-signature verifier | [PyPI](https://pypi.org/project/algovoi-rfc9421-verifier/) + [npm](https://www.npmjs.com/package/@algovoi/rfc9421-verifier) | **2026-05-24** | `pip install algovoi-rfc9421-verifier` |
| 8 | Conformance vector corpus (counts on the substrate page, incl. cryptographic-property fixtures) | [chopmob-cloud/algovoi-jcs-conformance-vectors](https://github.com/chopmob-cloud/algovoi-jcs-conformance-vectors) | **2026-05-19** (initial sets); current state 2026-06-22 | `git clone https://github.com/chopmob-cloud/algovoi-jcs-conformance-vectors` |
| 9 | IETF Internet-Draft `draft-hopley-x402-compliance-receipt` | [IETF datatracker](https://datatracker.ietf.org/doc/draft-hopley-x402-compliance-receipt/) | **2026-05-23**, Independent Submission, Informational | `curl -sL https://www.ietf.org/archive/id/draft-hopley-x402-compliance-receipt.txt` |
| 10 | 8-implementation byte-for-byte cross-validation attestation (JCS RFC 8785) | [attestation file](https://github.com/chopmob-cloud/algovoi-jcs-conformance-vectors/blob/main/_attestations/2026-05-24-8-impl-cross-validation.md) | **2026-05-24** | See the attestation file for the 8 install commands; expect 192/192 byte-for-byte agreements |
| 11 | 8-implementation cross-validation attestation (RFC 9421 + RFC 9530 + Ed25519) | [attestation file](https://github.com/chopmob-cloud/algovoi-jcs-conformance-vectors/blob/main/_attestations/2026-05-24-rfc9421-8-impl-cross-validation.md) | **2026-05-24** | `bash vectors/rfc9421_proxy_chain_v0/run_all.sh` in the cloned corpus; expect 24/24 agreements |
| 12 | `algovoi-refund-receipt` refund receipt reference impl | [npm](https://www.npmjs.com/package/@algovoi/refund-receipt) (LIVE v0.1.0); PyPI publish pending new-project rate-limit clear | **2026-05-24** (v0.1.0) | `npm install @algovoi/refund-receipt` — live-tested 17/17 conformance pass |
| 13 | IETF Internet-Draft `draft-hopley-x402-refund-receipt` | [IETF datatracker](https://datatracker.ietf.org/doc/draft-hopley-x402-refund-receipt/) | **2026-05-24**, Independent Submission, Informational, POSTED | `curl -sL https://www.ietf.org/archive/id/draft-hopley-x402-refund-receipt.txt` |
| 14 | IETF Internet-Draft `draft-hopley-x402-canonicalisation-jcs-v1` (current revision **01**) -- discipline-level normative spec under sole AlgoVoi authorship; revision 01 adds Appendix C "Known Adopters" with AlgoVoi (production) and Supership `service_trust_v0` (downstream adopter) | [IETF datatracker](https://datatracker.ietf.org/doc/draft-hopley-x402-canonicalisation-jcs-v1/) | **-00 posted 2026-05-24**, **-01 posted 2026-05-24**, Independent Submission, Informational | `curl -sL https://www.ietf.org/archive/id/draft-hopley-x402-canonicalisation-jcs-v1.txt` |
| 15 | `algovoi-settlement-attestation` multi-chain settlement attestation reference impl | [npm](https://www.npmjs.com/package/@algovoi/settlement-attestation) (LIVE v0.1.0 once published); PyPI publish pending new-project rate-limit clear | **2026-05-24** (v0.1.0) | `npm install @algovoi/settlement-attestation` |
| 16 | IETF Internet-Draft `draft-hopley-x402-settlement-attestation` -- closes the receipt lifecycle gap (admission -> settlement -> refund) under sole AlgoVoi authorship; multi-chain via `settlement_chain` string | [IETF datatracker](https://datatracker.ietf.org/doc/draft-hopley-x402-settlement-attestation/) | **POSTED 2026-05-24**, Independent Submission, Informational | `curl -sL https://www.ietf.org/archive/id/draft-hopley-x402-settlement-attestation.txt` |
| 17 | `algovoi-cancellation-receipt` mandate cancellation receipt reference impl -- four-state closed enumeration (USER\_REQUESTED / MERCHANT\_REQUESTED / COMPLIANCE\_TERMINATED / EXPIRED); closes the mandate-termination gap | [npm](https://www.npmjs.com/package/@algovoi/cancellation-receipt) (LIVE v0.1.0); PyPI publish pending new-project rate-limit clear | **2026-05-24** (v0.1.0) | `npm install @algovoi/cancellation-receipt` |
| 18 | IETF Internet-Draft `draft-hopley-x402-cancellation-receipt` -- mandate-termination categorical receipt under AlgoVoi authorship; welcomes downstream-adopter contributions per Appendix C "Known Adopters" pattern | [IETF datatracker](https://datatracker.ietf.org/doc/draft-hopley-x402-cancellation-receipt/) | **POSTED 2026-05-24**, Independent Submission, Informational | `curl -sL https://www.ietf.org/archive/id/draft-hopley-x402-cancellation-receipt.txt` |
| 19 | `algovoi-composite-trust-query` verifier-side composite-trust-query response reference impl -- closed four-state enum `{TRUSTED, PROVISIONAL, INSUFFICIENT_EVIDENCE, UNTRUSTED}`; top-of-stack format above the four receipt formats | [npm](https://www.npmjs.com/package/@algovoi/composite-trust-query) (LIVE v0.1.0); PyPI publish pending new-project rate-limit clear | **2026-05-25** (v0.1.0) | `npm install @algovoi/composite-trust-query` |
| 20 | IETF Internet-Draft `draft-hopley-x402-composite-trust-query` -- verifier-side response format closing the top of the receipt stack under AlgoVoi authorship | [IETF datatracker](https://datatracker.ietf.org/doc/draft-hopley-x402-composite-trust-query/) | **POSTED 2026-05-24**, Independent Submission, Informational | `curl -sL https://www.ietf.org/archive/id/draft-hopley-x402-composite-trust-query.txt` |
| 21 | **Substrate Adopters Registry** (`docs.algovoi.co.uk/adopters`) -- public registry of parties publishing under `canon_version: jcs-rfc8785-v1`. Maintained by AlgoVoi as neutral observer; submission via PR, issue, or email; year-N audit-grade record of adoption. Parallels Appendix C "Known Adopters" of the canonicalisation I-D. Includes **Citation discipline** section specifying citation patterns adopters typically surface (URN + IETF I-D + registry link + in-band `canon_version`) | [docs.algovoi.co.uk/adopters](https://docs.algovoi.co.uk/adopters) (HTML) · [docs.algovoi.co.uk/adopters.json](https://docs.algovoi.co.uk/adopters.json) (JSON-LD) | **2026-05-25** (v1, AlgoVoi + Supership + PEAC Protocol entries); **2026-05-26** Citation discipline section added | `curl https://docs.algovoi.co.uk/adopters.json` |
| 22 | **8-implementation 5-format cross-validation attestation** -- 320/320 byte-for-byte agreements across 5 receipt/response formats (compliance, settlement, cancellation, refund, composite-trust-query) under 8 independent JCS implementations (Python, Node.js, Ruby, PHP, Go, Rust, Java, .NET). PHP runner uses inline pure-stdlib JCS (no composer dep). Cumulative with 2026-05-24 attestation (row 10): 512/512 across 7 distinct vector sets at this date. (Cumulative total reached 832/832 on 2026-06-17 when action\_ref\_exactly\_once\_v1, adversarial\_isolation\_v1, retention\_chain\_v0, retention\_chain\_v1, epi\_interop\_v0, and epi\_pqc\_v0 attestations were added.) | [attestation file](https://github.com/chopmob-cloud/algovoi-jcs-conformance-vectors/blob/main/_attestations/2026-05-25-8-impl-5-format-cross-validation.md) | **2026-05-25** | `bash _attestations/2026-05-25-8-impl-5-format-cross-validation/run_all.sh` in the cloned corpus; expect 320/320 PASS |
| 23 | **AlgoVoi APM (Agent Payment Module)** -- production agentic-payment platform running the substrate work. Multi-chain (8 families: Algo, VOI, Solana, Stellar, Hedera, Base, Tempo, Ethereum) + multi-protocol (x402, AP2, MPP, A2A) + multi-rail (USDC + fiat) + EMR 2011-safeguarded + IETF-spec-aligned. Substrate = open standards; APM = production implementation; one acquirer story | [docs.algovoi.co.uk/platform/apm](https://docs.algovoi.co.uk/platform/apm) | **operational since 2026-04** | `curl https://api.algovoi.co.uk/health` |
| 24 | Hosted verifier hub (`verify.algovoi.co.uk`) — three public no-auth endpoints: `POST /verify` (audit bundle), `POST /action-ref` (JCS canonical hash + SHA-256, 8-impl attested), `POST /rfc9421` (RFC 9421 Ed25519 signature verification). All three backed by the same substrate packages. | [verify.algovoi.co.uk](https://verify.algovoi.co.uk) | audit verifier **2026-05-09**; `/action-ref` + `/rfc9421` **2026-05-29** | `curl https://verify.algovoi.co.uk/action-ref` |
| 25 | **RFC 9421 proxy-chain conformance fixture** (AlgoVoi-designed) -- `generate.py` + `verify.py` demonstrating that RFC 9421 HTTP Message Signatures + RFC 9530 Content-Digest headers survive unmodified through a 3-hop edge-to-application proxy chain. 4/4 verification checks pass against the live production endpoint. Test vector: RFC 8032 §7.1 Test 1 (deterministic Ed25519). Submitted to the A2A conformance suite as the canonical proxy-chain fixture for A2A §3.8 (v0.3.3 deliverable). PRs withdrawn at coalition exit 2026-05-24; fixture validation receipt preserved independently. | [aeoess/aps-conformance-suite#5](https://github.com/aeoess/aps-conformance-suite/pull/5) · [validation receipt gist](https://gist.github.com/chopmob-cloud/5f35eaa527d292bf3ddc52f8725a85c9) | **2026-05-16** | `gh gist clone 5f35eaa527d292bf3ddc52f8725a85c9 && python3 verify.py`; expect 4/4 \[OK]. `output_log.txt` in gist records 14/14 pass at time of submission. |
| 26 | **Multi-chain Ed25519 substrate-independence fixture** (AlgoVoi-designed) -- `generate.py` + `verify.py` demonstrating that an A2A protocol payload can be signed simultaneously under three independent Ed25519 keys derived via BIP44 paths for Algorand (`m/44'/283'/0'/0'/0'`), Solana (`m/44'/501'/0'/0'`), and Stellar (`m/44'/148'/0'`). 3/3 byte-match verifications pass. Proves A2A wire-format is blockchain-agnostic; agents can assert capability across chains without re-signing. Submitted to the A2A conformance suite as the multi-chain substrate-independence fixture for A2A §3.8 (v0.3.3 deliverable). PRs withdrawn at coalition exit 2026-05-24; fixture validation receipt preserved independently. | [aeoess/aps-conformance-suite#6](https://github.com/aeoess/aps-conformance-suite/pull/6) · [validation receipt gist](https://gist.github.com/chopmob-cloud/5f35eaa527d292bf3ddc52f8725a85c9) | **2026-05-16** | `gh gist clone 5f35eaa527d292bf3ddc52f8725a85c9 && python3 verify.py`; expect 3/3 \[OK]. `output_log.txt` in gist records 14/14 pass at time of submission. |
| 27 | `algovoi-substrate-pqc` Python reference impl -- JCS+PQC integration layer (ES256 + Ed25519 + Falcon-1024 + ML-DSA-65) over `pqcrypto`/PQClean + `cryptography` + `rfc8785`. 12-row `signature_algorithm` open-enum + fail-closed verifier discipline + cross-implementor byte-anchor convergence proof methodology. Source code on GitHub. 27/27 tests pass | [PyPI](https://pypi.org/project/algovoi-substrate-pqc/) · [GitHub](https://github.com/chopmob-cloud/algovoi-substrate-pqc) | **2026-05-26 08:35 UTC** | `pip install algovoi-substrate-pqc` |
| 28 | `@algovoi/substrate-pqc` TypeScript reference impl -- pure-JS, browser + Node + Bun + Deno compatible. Wraps `@noble/post-quantum` (Paul Miller) for PQC + `@noble/curves` + `@noble/hashes` + `canonicalize`. Same `signature_algorithm` open-enum + fail-closed verifier discipline. 26/26 tests pass | [npm](https://www.npmjs.com/package/@algovoi/substrate-pqc) · [GitHub](https://github.com/chopmob-cloud/algovoi-substrate-pqc/tree/main/ts) | **2026-05-26 08:38 UTC** | `npm install @algovoi/substrate-pqc` |
| 29 | **Cross-product producer × verifier matrix attestation** -- 6 producers (Python, TS, Ruby, PHP, Go, Rust) × 8 verifiers (Python, TS, Ruby, PHP, Java, Perl, Go, Rust) = 48/48 cells PASS. Same canonical SHA-256 anchor `sha256:cc8315f7...e0` across all producers. Go produces 3 schemes (ES256 + Ed25519 + ML-DSA-65; no pure-Go Falcon without CGo); Rust produces all 4. Reproducible from any contributor environment via `python scripts/cross_product_matrix.py` | [attestation file](https://github.com/chopmob-cloud/algovoi-substrate-pqc/blob/main/_attestations/2026-05-30-cross-product-matrix.md) · [2026-05-26 original](https://github.com/chopmob-cloud/algovoi-substrate-pqc/blob/main/_attestations/2026-05-26-cross-product-matrix.md) | **2026-05-30** (updated; original 2026-05-26) | `git clone chopmob-cloud/algovoi-substrate-pqc && python scripts/cross_product_matrix.py` |
| 30 | **Three audit-grade PQC implementations cross-validated byte-for-byte** -- PQClean (via `pqcrypto` on Python) ↔ `@noble/post-quantum` (TypeScript, Paul Miller) ↔ Bouncy Castle 1.84 (Java, `MLDSASigner` + `FalconSigner`). All three independently verify the same Falcon-1024 and ML-DSA-65 signatures over identical canonical bytes. Java verifier at [`verifiers/java/`](https://github.com/chopmob-cloud/algovoi-substrate-pqc/tree/main/verifiers/java) | [Java verifier](https://github.com/chopmob-cloud/algovoi-substrate-pqc/tree/main/verifiers/java) | **2026-05-26** | `cd verifiers/java && bash fetch-deps.sh && javac -cp "lib/*" -d out Verify.java && java -cp "out;lib/*" Verify` |
| 31 | **AP2 #250 PQSafe joint deliverable closed** -- AP2 PaymentMandate canonical bytes signed under four schemes (ES256 + Ed25519 + Falcon-1024 from AlgoVoi side; ML-DSA-65 from PQSafe side per AP2 #250). Joint co-maintainer access established. PQSafe credit scoped to the ML-DSA-65 contribution per published policy | [chopmob-cloud/ap2-pq-conformance](https://github.com/chopmob-cloud/ap2-pq-conformance) | **PR merged 2026-05-26 04:38 UTC** | `git clone chopmob-cloud/ap2-pq-conformance && (cd algovoi-side && pip install rfc8785 cryptography pqcrypto && python verify.py); (cd pqsafe-side && python verify.py)` |
| 32 | AlgoVoi-hosted **discrimination-tuple injectivity rule** canonical mirror -- the AlgoVoi-authored substrate rule first posted A2A #1734 on 2026-05-14, hosted under AlgoVoi infrastructure independent of any downstream composition document. Cross-references the agentgraph composition + the IETF I-D for the citation chain | [`algovoi-jcs-conformance-vectors/docs/discrimination-tuple-injectivity-v0.md`](https://github.com/chopmob-cloud/algovoi-jcs-conformance-vectors/blob/main/docs/discrimination-tuple-injectivity-v0.md) | **2026-05-26** | `curl https://raw.githubusercontent.com/chopmob-cloud/algovoi-jcs-conformance-vectors/main/docs/discrimination-tuple-injectivity-v0.md` |
| 33 | **Microsoft AGT #276 substrate-author public-record anchor** -- calibrated correction on Microsoft Agent Governance Toolkit Discussion #276 establishing dated public-record origin of the discrimination-tuple injectivity rule (A2A #1734 May 14 + agentgraph commit `229040b` §2 + IETF I-D POSTED). Trusted-partners offer for downstream consumers following the originating-contribution discipline | [microsoft/agent-governance-toolkit#276](https://github.com/microsoft/agent-governance-toolkit/discussions/276#discussioncomment-17059341) | **2026-05-26 08:16 UTC** | Read the discussion comment directly |
| 34 | **Canonicalisation discipline v2 (PQC-aware)** -- AlgoVoi-authored revision under `urn:x402:canonicalisation:jcs-rfc8785-v2`. Strictly additive over v1; canonicalisation core unchanged. Adds the `signature_algorithm` open-enum registry (12 rows: ES256/ES256K/Ed25519/ML-DSA-44/65/87/Falcon-512/1024/SLH-DSA-SHA2-128s/HMAC-SHA-256/384/Hybrid), fail-closed verifier discipline, and PQC algorithm normative references (FIPS 204/205/206). Sole AlgoVoi authorship with PQSafe ML-DSA-65 scoped credit on AP2 #250. v1 adopters retain their registry position; v2 adopters land separate rows. IETF I-D formalisation deferred pending the active IETF list thread (May 2026) on Independent Submissions stream scope | [docs.algovoi.co.uk/canonicalisation-substrate-v2](/canonicalisation-substrate-v2) | **2026-05-26** | `curl https://docs.algovoi.co.uk/canonicalisation-substrate-v2` |
| 35 | `algovoi-rfc9421-signer` RFC 9421 HTTP Message Signatures signer reference impl -- produces a detached `Signature` + `Signature-Input` header pair over a canonicalised request signing base; companion to `algovoi-rfc9421-verifier`. Sole AlgoVoi authorship | [PyPI](https://pypi.org/project/algovoi-rfc9421-signer/) · [npm](https://www.npmjs.com/package/@algovoi/rfc9421-signer) | **2026-05-29** (v0.1.0) | `pip install algovoi-rfc9421-signer` |
| 36 | `algovoi-pef` Payment Evidence Frame reference impl -- five claim types (payment\_admission, payment\_settlement, payment\_cancellation, payment\_refund, composite\_verdict) consolidated under a single `frame_id` (SHA-256 over JCS-canonical preimage); optional RFC 9421 detached signature; Python + TypeScript parity. 8-impl byte-for-byte cross-validated (64/64 agreements) | [PyPI](https://pypi.org/project/algovoi-pef/) · [npm](https://www.npmjs.com/package/@algovoi/pef) · [GitHub](https://github.com/chopmob-cloud/algovoi-pef) | **2026-05-30** (v0.1.0) | `pip install algovoi-pef` |
| 37 | IETF Internet-Draft `draft-hopley-x402-payment-evidence-frame` -- Payment Evidence Frame: canonical wrapper consolidating all x402 receipt types into a single verifiable artefact under sole AlgoVoi authorship. -00 posted 2026-05-30 | [IETF datatracker](https://datatracker.ietf.org/doc/draft-hopley-x402-payment-evidence-frame/) | **2026-05-30**, Independent Submission, Informational | `curl -sL https://www.ietf.org/archive/id/draft-hopley-x402-payment-evidence-frame.txt` |
| 38 | **8-implementation PEF cross-validation attestation** -- 64/64 byte-for-byte agreements across PEF frame\_id derivation and claim-type serialisation under 8 independent JCS implementations. Cumulative across all vector sets: 880/880 across 14 vector sets (as of 2026-06-18) | [attestation file](https://github.com/chopmob-cloud/algovoi-pef/blob/main/_attestations/2026-05-30-8-impl-cross-validation.md) | **2026-05-30** | See attestation file for reproduction commands; expect 64/64 PASS |
| 39 | **Four audit-grade PQC implementations cross-validated byte-for-byte** -- PQClean (Python `pqcrypto`), `@noble/post-quantum` (TypeScript, Paul Miller), Bouncy Castle 1.84 (Java `MLDSASigner` + experimental `FalconSigner`), RustCrypto `ml-dsa` + `pqcrypto-falcon` (Rust). All four independently verify the same Falcon-1024 and ML-DSA-65 signatures over identical canonical bytes. Go verifier covers ES256 + Ed25519 + ML-DSA-65 (no pure-Go Falcon). 48/48 cells PASS across 6 producers × 8 verifiers | [Go verifier](https://github.com/chopmob-cloud/algovoi-substrate-pqc/tree/main/verifiers/go) · [Rust verifier](https://github.com/chopmob-cloud/algovoi-substrate-pqc/tree/main/verifiers/rust) | **2026-05-30** | `cd verifiers/rust && cargo run -- verify ` |
| 40 | `algovoi-receipt-verifier` 8-step JWS compliance-receipt verifier — offline-capable (no AlgoVoi infrastructure dependency). Verification steps: JWS format → algorithm whitelist (EdDSA/ES256K/RS256) → Ed25519 signature → `canon_version` registry → JCS re-canonicalisation → required fields → `screen_result` enum → `payment_hash` binding. 9 error codes. Platform endpoint `POST https://api.algovoi.co.uk/v1/receipt/verify` (rate-limited 120/min) | [PyPI](https://pypi.org/project/algovoi-receipt-verifier/) · [npm](https://www.npmjs.com/package/@algovoi/receipt-verifier) · [GitHub](https://github.com/chopmob-cloud/algovoi-receipt-verifier) | **2026-05-31** (v0.1.0) | `pip install algovoi-receipt-verifier` — Python 41/41; `npm install @algovoi/receipt-verifier` — TypeScript 19/19; 13 conformance vectors (5 valid + 8 invalid, each invalid maps to a Phase 8 ATB threat) |
| 41 | `algovoi-webhook-verifier` standalone cryptographic verifier for the `X-AlgoVoi-Signature` header produced by the AlgoVoi gateway. Validates v1 (HMAC-SHA256) and v2 (HKDF-SHA256-derived key + HMAC-SHA384) signature components; enforces replay protection (300 s default tolerance). 6 error codes. Zero runtime dependencies | [PyPI](https://pypi.org/project/algovoi-webhook-verifier/) · [npm](https://www.npmjs.com/package/@algovoi/webhook-verifier) · [GitHub](https://github.com/chopmob-cloud/algovoi-webhook-verifier) | **2026-05-31** (v0.1.0) | `pip install algovoi-webhook-verifier` — Python 47/47; `npm install @algovoi/webhook-verifier` — TypeScript 45/45; 8-lang × 13 vectors = 104/104 |
| 42 | `algovoi-receipt-sentinel` sliding-window duplicate/replay/scan monitor. Consumes error-code streams from `algovoi-webhook-verifier` and `algovoi-receipt-verifier`; fires `TAMPER_DETECTED`, `REPLAY_DETECTED`, `SCAN_DETECTED`, `BURST_FAILURE` alert types. Zero runtime dependencies | [PyPI](https://pypi.org/project/algovoi-receipt-sentinel/) · [npm](https://www.npmjs.com/package/@algovoi/receipt-sentinel) · [GitHub](https://github.com/chopmob-cloud/algovoi-receipt-sentinel) | **2026-05-31** (v0.1.0) | `pip install algovoi-receipt-sentinel` — Python 36/36; `npm install @algovoi/receipt-sentinel` — TypeScript 35/35; 8-lang × 13 vectors = 104/104 |
| 43 | **ATB Phase 2 ZKP service** (`atb-zkp-service` v0.1.0) — Rust microservice generating Pedersen commitments + Bulletproofs range proofs over Ristretto255. Proves `score ≥ threshold` without revealing the score. Called by the bench cert endpoint and by the gateway ATB ZKP client. 47+ hours live in production as of 2026-06-04. Curve: ristretto255, scheme: bulletproofs-v1, range\_bits: 64 | production — `curl https://agent-trust-bench.algovoi.co.uk/agent-trust-bench/.well-known/atb-keys.json` · [IACR ePrint 2026/109852](https://eprint.iacr.org/2026/109852) | **2026-06-04** (deployed; Phase 1 Falcon-1024 ATB certs live since 2026-06-01) | `curl -s https://agent-trust-bench.algovoi.co.uk/.well-known/atb-keys.json \| jq '.cert_policy'` — confirms Phase 2 issuance policy live |
| 44 | IETF Internet-Draft `draft-hopley-x402-pqc-credential-binding-00` — Falcon-1024 (FIPS 206 / FN-DSA) and ML-DSA-65 (FIPS 204) credential binding to x402 agentic payment authorisation: credential envelope format, JCS canonicalisation discipline applied to signed payloads, gateway verification procedure, and a session token binding that replaces per-request API-key authentication. Ninth AlgoVoi Independent Submission | [IETF datatracker](https://datatracker.ietf.org/doc/draft-hopley-x402-pqc-credential-binding-00/) · [IACR ePrint 2026/109852](https://eprint.iacr.org/2026/109852) | **2026-06-04**, Independent Submission, Informational | `curl -sL https://www.ietf.org/archive/id/draft-hopley-x402-pqc-credential-binding-00.txt` |
| 45 | IETF Internet-Draft `draft-hopley-x402-federation-zkp-00` — cross-issuer ZKP credential composition protocol. §5.2 composite commitment algorithm: `SHA-256(domain_label ‖ comm_0 ‖ … ‖ nonce)`; §6 federation token format; §7 security properties. Tenth AlgoVoi Independent Submission | [IETF datatracker](https://datatracker.ietf.org/doc/draft-hopley-x402-federation-zkp-00/) · [IACR ePrint 2026/109852](https://eprint.iacr.org/2026/109852) | **2026-06-04**, Independent Submission, Informational | `curl -sL https://www.ietf.org/archive/id/draft-hopley-x402-federation-zkp-00.txt` |
| 46 | **IACR ePrint 2026/109852** — *"Agent Trust Bench: Adversarial Payment Profiling for Autonomous Agents with Post-Quantum Credential Binding and Cross-Issuer Federation"*. Extends ATB paper with §5.2 Bulletproofs ZKP, §6 PQC credential binding (Falcon-1024/ML-DSA-65), §7 cross-issuer federation protocol. Submitted 2026-06-04; under editor review | [IACR ePrint 2026/109852](https://eprint.iacr.org/2026/109852) | **2026-06-04** (under review) | `curl -s https://eprint.iacr.org/2026/109852` — confirms IACR receipt |
| 47 | `algovoi-federation-validator` v0.1.1 — **AlgoVoi Commercial License v1.0**. Cross-issuer ZKP credential composition: independently-issued Falcon-1024 ATB Pass Certificates from different issuers composed into a single composite federation token with no shared trust root. Composite commitment: `SHA-256(domain_label ‖ comm_0 ‖ … ‖ nonce)`; HMAC-SHA256 signed federation token. Internal bypass for existing infra. 59/59 tests. Deployed in production | production (internal, not publicly indexed) · IETF: [`draft-hopley-x402-federation-zkp-00`](https://datatracker.ietf.org/doc/draft-hopley-x402-federation-zkp-00/) + [`draft-hopley-x402-pqc-credential-binding-00`](https://datatracker.ietf.org/doc/draft-hopley-x402-pqc-credential-binding-00/) | **2026-06-04** (deployed; AlgoVoi Commercial License v1.0) | `curl https://api.algovoi.co.uk/health` confirms gateway which calls this service; direct verification requires commercial licence |
| 48 | `algovoi-zkp-receipt` v0.1.0 — **AlgoVoi Commercial License v1.0**. ZKP-bound payment receipt attestation: binds an ATB Phase 2 ZKP credential to a specific on-chain payment receipt — proving `score ≥ threshold` without score disclosure. Falcon-1024 signature covers both receipt fields and ZKP fields. 13/13 tests. Deployed in production | production (internal) · IETF: [`draft-hopley-x402-pqc-credential-binding-00`](https://datatracker.ietf.org/doc/draft-hopley-x402-pqc-credential-binding-00/) | **2026-06-04** (deployed; AlgoVoi Commercial License v1.0) | Same as above — direct verification requires commercial licence |
| 49 | **ZKP receipt binding + composite trust verdict wiring** — gateway post-settlement pipeline. After every confirmed x402 settlement on a Phase 2 ATB session: (1) `X-ZKP-Receipt-Payload` response header carries the unsigned ZKP receipt payload binding the agent credential to the on-chain payment; (2) `X-Composite-Trust-Verdict` response header carries the verdict (`TRUSTED` when `SETTLED` + `threshold_met=true`). `POST /compliance/trust-query` now recognises `zkp_receipt` objects as trust signals: `threshold_met=true → TRUSTED`, `threshold_met=false → UNTRUSTED`. Zero impact on standard (non-Phase 2) payment flows | `api.algovoi.co.uk/compliance/trust-query` · `gateway/app/services/trust_verdict.py` · `gateway/app/services/zkp_receipt_client.py` | **2026-06-04** | `curl -X POST https://api.algovoi.co.uk/compliance/trust-query -H "Content-Type: application/json" -d '{"receipts":[{"settlement_result":"SETTLED"},{"type":"zkp_receipt","threshold_met":true}]}'` — expects `{"trust_outcome":"TRUSTED",...}` |
| 50 | **Signed A2A AgentCard**, detached EdDSA JWS over JCS per A2A §8.4. The agent card at `/.well-known/agent.json` carries a `signatures[]` block (`alg` EdDSA, `kid` d0481df4cbbda8e8aba86709419884ef, `typ` JOSE); the Ed25519 verify key is published at `/.well-known/jwks.json` (OKP/Ed25519, matching kid) and the platform Falcon-1024 public key at `/.well-known/pqc-keys.json` (`did:web:api.algovoi.co.uk#falcon-1024-1`). Signer `verascore_jwks.sign_agent_card()` | [agent.json](https://api.algovoi.co.uk/.well-known/agent.json) · [jwks.json](https://api.algovoi.co.uk/.well-known/jwks.json) · [pqc-keys.json](https://api.algovoi.co.uk/.well-known/pqc-keys.json) | **live, independently fetched 2026-07-14; authored 2026-07-06** | `curl -s https://api.algovoi.co.uk/.well-known/agent.json` and `/.well-known/jwks.json`; rebuild the JCS of the card minus `signatures[]` and verify the detached EdDSA JWS against the jwks Ed25519 key with any stock JOSE library. No AlgoVoi infrastructure. |
| 51 | **AlgoVoi Mesh** (L3), post-quantum mutual agent-to-agent settlement. Two agents verify each other offline with Falcon-1024 (kid = first 16 bytes of `SHA-256(public key)`), negotiate a chain via signed chain offers, and settle once as one content-addressed `execution_ref`; the chain carries a 32-byte anchor and never verifies Falcon. Revocation is issuer-signed CRL, enforced in the handshake. Commercial licence; the on-chain settlement proof is public across ten independently-verified chains, including the first settlement on a UTXO chain ([Bitcoin](/mesh-bitcoin)). (Arc was also tested but its testnet RPC was not reachable for independent verification, so it is not asserted here.) | commercial (`algovoi-mesh`, not public-indexed) · public on-chain proof · [docs.algovoi.co.uk/agent-mesh](https://docs.algovoi.co.uk/agent-mesh) | **2026-07-14 to 2026-07-15** (on-chain proof, ten chains) | Public, no AlgoVoi infra: `curl -s "https://mainnet.mirrornode.hedera.com/api/v1/topics/0.0.10641585/messages?limit=1"` and base64-decode the message, and it reads `algovoi-mesh:sha256:150b4e46...`, the exact settlement reference, on Hedera **mainnet** Consensus Service. Every settlement anchors the same `execution_ref` via each chain's native field: canonical `algovoi-mesh:sha256:` on Algorand, VOI, Solana, Hedera and XRPL; raw calldata `0x` on Base, Tempo and Ethereum; `algovoi-mesh:sha256:` + raw digest in an OP\_RETURN on Bitcoin; a native `manage_data` entry on Stellar. Each transaction is linked from the product page and recomputes offline. |
| 52 | **Keystone L2 open packages** (Apache-2.0, public PyPI): `algovoi-substrate` v0.4.1 (the open RFC 8785 / JCS canonical substrate, `CANON_VERSION jcs-rfc8785-v1`) plus Cython builds `algovoi-keystone-validate`, `algovoi-keystone-secure-lite`, `algovoi-keystone-sqlalchemy` v0.2.0 | [substrate](https://pypi.org/project/algovoi-substrate/0.4.1/) · [validate](https://pypi.org/project/algovoi-keystone-validate/0.2.0/) · [secure-lite](https://pypi.org/project/algovoi-keystone-secure-lite/0.2.0/) · [sqlalchemy](https://pypi.org/project/algovoi-keystone-sqlalchemy/0.2.0/) | **2026-07-02** (substrate 0.4.1); **2026-07-10** (keystone Cython 0.2.0) | `pip download == --no-deps`, `sha256sum`, compare to the digest at `https://pypi.org/pypi///json`. Third-party hosted; no AlgoVoi infrastructure. |
## Temporal authorship timeline
For anyone challenging the substrate authorship claim, the public git
history is the authoritative record.
| Date (UTC) | Surface | Event |
| ---------------------------- | -------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **2026-03-15 to 2026-03-19** | X / Twitter (public) | [@AlgoVoi](https://x.com/AlgoVoi) publishes daily build-in-public series: x402 tenant platform. 6 posts across 5 days documenting test suite growth from 748 → 902 → 3,535 → 7,792 → 9,845 → **57,765** unit tests, all passing. Mar 18 adds multi-tenant premium routing (`/api/premium/[tenantid]`, `/api/voi-premium/[tenantid]`). Mar 19 reaches Phase 4508/4508 complete. Coverage across control\_plane, gateway, facilitator, shared. Public disclosure of AlgoVoi's x402 payment platform. |
| **2026-04-12** | AlgoVoi platform | First commit on `compliance.py`: sanctions screening, risk tier enforcement, AML retention. The production compliance machinery that the IETF I-D later specifies. |
| **2026-04-25** | X / Twitter (public) | [@AlgoVoi](https://x.com/AlgoVoi) posts: *"AlgoVoi -- Testnet Support"* — public multi-chain protocol compatibility matrix across x402, MPP, AP2 and A2A for Base Sepolia, Stellar testnet, Algorand testnet, Solana devnet, Hedera testnet, VOI testnet, and Tempo testnet. Live testnet results with compliance notes published openly. Public disclosure of AlgoVoi's multi-chain agentic payment infrastructure. |
| 2026-04-26 | algovoi-substrate's KYB encryption | Production KYB encryption (Fernet/AVK1) operational. |
| **2026-05-04** | X / Twitter (public) | [@AlgoVoi](https://x.com/AlgoVoi) posts: *"AlgoVoi PQC Tier 2 sub-project A shipped. HMAC dual-emit (v1 SHA-256 + v2 SHA-384) across every internal channel and outbound webhook. AES-256-GCM dispatcher live alongside AES-128."* Links to `algovoi.co.uk/AlgoVoi/compliance.html`. Public disclosure of AlgoVoi's cryptographic compliance infrastructure. |
| **2026-05-07** | AlgoVoi platform | `/compliance/screen` and `/compliance/attestation` production-hardened with rate-limiting, strict-v4 UUID, sanctions list reconcile, tipping-off compliance (SAMLA s.20). |
| 2026-05-09 | verify.algovoi.co.uk | Hosted audit-verifier service goes live. |
| **\~2026-05-12** | LinkedIn (public) | AlgoVoi publishes post announcing Agent Trust Bench: *"AI agents that handle money need a test suite. Here is one. 138 adversarial payment scenarios. Free to use. No account required. Works with any x402 facilitator."* 138 adversarial x402 profiles across 30 threat categories including steganography attacks, LLM reasoning exploits, framework-specific attacks (LangGraph, CrewAI, AutoGen, OpenAI Swarm), and ethical bypass framing. Public prior-art disclosure of ATB methodology on LinkedIn. |
| **2026-05-16** | aeoess/aps-conformance-suite | AlgoVoi designs and submits two A2A §3.8 conformance fixtures: (1) RFC 9421 proxy-chain fixture [#5](https://github.com/aeoess/aps-conformance-suite/pull/5) — 4/4 signature-survival checks against a live 3-hop edge-to-application chain; (2) multi-chain Ed25519 substrate-independence fixture [#6](https://github.com/aeoess/aps-conformance-suite/pull/6) — same A2A payload signed under Algorand + Solana + Stellar BIP44 derivation paths, 3/3 byte-match. Both fixtures are AlgoVoi-designed and target the v0.3.3 A2A spec deliverable. |
| 2026-05-19 | chopmob-cloud/algovoi-jcs-conformance-vectors | First conformance vector sets (AP2 OMH v0, CTEF + APS v1, privacy\_class, per-chain envelope) published. |
| **2026-05-21** | x402-foundation/x402 | AlgoVoi files [PR #2436](https://github.com/x402-foundation/x402/pull/2436) — canonicalisation discipline including Substrate Rule 2 (integer timestamps MUST). |
| 2026-05-22 14:07 | giskard09/argentum-core | Commit `71c01e8` — adds two field names (`authority_verified_at_ms`, `revocation_check_at_ms`) to action-ref.md v1.0. **AlgoVoi acknowledges argentum-core's authorship of these two specific field names.** They sit on top of the AlgoVoi substrate. |
| 2026-05-22 16:18 UTC | kenneives/agentgraph | [PR #21](https://github.com/kenneives/agentgraph/pull/21) (`test(cross-impl): add 4-language JCS substrate runners for row #3 reproduction`) **MERGED** by kenneives. Adds four-language JCS substrate matrix runners to the agentgraph repo anchored to AlgoVoi's canonicalisation discipline, independently reproducing the substrate cross-validation methodology in a third-party codebase. |
| 2026-05-22 16:47 | x402-foundation/x402 | Vauban Pay (`seritalien`) **APPROVES** PR #2436. Co-signs Substrate Rule 2 on the canonical spec record. |
| 2026-05-22 \~22 | IETF datatracker | Vauban Pay submits `draft-vauban-x402-stark-receipts-00` ([immutable archive copy](https://www.ietf.org/archive/id/draft-vauban-x402-stark-receipts-00.txt)), §7.1 of which mandates the integer-timestamp rule — independently corroborating Substrate Rule 2 — and which names AlgoVoi in its acknowledgments and §7 co-authorship statement. |
| **2026-05-22** | X / Twitter (public) | [@AlgoVoi](https://x.com/AlgoVoi) posts: *"If you're shipping a receipt or mandate format in x402, AP2, A2A or MPP, here's the JCS RFC 8785 canonicalisation substrate it should anchor to. 5 reference impls. 53 vectors. 5 normative rules."* Links to `docs.algovoi.co.uk/canonicalisation-substrate`. Public prior-art disclosure of JCS canonicalisation substrate to the x402 / agentic payments developer community. |
| **2026-05-23** | LinkedIn (public) | AlgoVoi publishes post announcing canonicalisation substrate milestone: *"Five independent implementations of RFC 8785 now agree byte-for-byte across 53 conformance vectors covering mandates, receipts, privacy attestations, and chain-specific envelopes... Canonicalisation is substrate work."* Links to `docs.algovoi.co.uk/conformance-vectors` and the substrate matrix gist. Public prior-art disclosure of JCS+SHA-256 cross-implementation substrate on the same day as `algovoi-substrate 0.3.0` PyPI publication. |
| **2026-05-23** | AlgoVoi | Substrate package extracted from production to PyPI + npm (v0.1.0 → v0.2.0 → v0.2.1). SchemaStore PR #5726 merges the compliance receipt JSON Schema. Three new conformance anchor sets published. AlgoVoi files `draft-hopley-x402-compliance-receipt` to IETF datatracker. |
| 2026-05-23 17:18 | kenneives/agentgraph | PR #24 MERGED, adding CTEF row 9 `urn:x402:receipt:stark-vauban-pay-v1` under `transactional`/`cryptographic` taxonomy — extending the receipt-class registry to include a Vauban Pay STARK receipt entry. |
| 2026-05-23 20:58 | giskard09/argentum-core | Commit `96931c9` — adds JCS timestamp encoding rule to argentum-core spec. Published the same day as AlgoVoi's formulation of the same rule on A2A #1734, approximately 2 hours after AlgoVoi's post on that thread. |
| **2026-05-24 early** | AlgoVoi | `algovoi-substrate@0.3.0` + `algovoi-rfc9421-verifier@0.1.0` shipped. JCS 8-impl matrix attested (192/192) + RFC 9421 8-impl matrix attested (24/24). IETF I-D `draft-hopley-x402-compliance-receipt` posted on datatracker. |
| 2026-05-24 \~08 | x402 #2428 | Follow-up on the x402 TSC `transactional` vs `cryptographic` taxonomy question for v0.4. AlgoVoi posted a drive-by update on the same thread linking the new attestations. |
| **2026-05-24 \~09:55** | AlgoVoi | **Coalition exit decision.** Operator call: independence over coalition coordination. Farewell posted on x402 #2428. AlgoVoi PR #2436 on x402-foundation/x402 closed gracefully (seritalien APPROVED + arian-gogani LGTM preserved on the closed PR record). |
| **2026-05-24 \~10** | AlgoVoi | Architecture pivot: each AlgoVoi receipt class ships as its own standalone published package + IETF I-D. `algovoi-substrate` v0.4.0 (which had bundled refund\_receipt) reverted to v0.3.0; refund\_receipt extracted into new standalone `algovoi-refund-receipt` v0.1.0. |
| **2026-05-24 \~10:30** | AlgoVoi | `@algovoi/refund-receipt@0.1.0` published to npm. Live registry install tested byte-identical against `refund_receipt_v1` conformance vectors (8 vectors + 5 pair + 3 chain + 1 build-then-verify = 17/17 PASS). PyPI publish blocked by new-project rate limit; token retained for retry. |
| **2026-05-24 \~10:35** | AlgoVoi | All 21 upstream-thread watchers + 3 coalition scheduled tasks stopped. AlgoVoi operates fully independently going forward. |
| **2026-05-24 \~11:20** | AlgoVoi | `draft-hopley-x402-canonicalisation-jcs-v1` drafted as standalone IETF Internet-Draft under sole AlgoVoi authorship. Future AlgoVoi receipt I-Ds normatively reference this discipline I-D rather than redefining §4 inline. |
| **2026-05-24 23:39 UTC** | IETF list | John Klensin (writing in personal capacity) posts to the IETF list raising procedural concerns about the recent volume of x402-related Independent Submissions: (i) x402 Foundation has its own standards process; (ii) IETF change-control / authority questions; (iii) stablecoin-payment-method specifics; and the appearance-of-IETF-endorsement risk. Not an endorsement; a substantive request for a DISPATCH-like discussion of whether the work belongs in the IETF. AlgoVoi reply deferred pending review of ISE criteria. |
| **2026-05-25** | AlgoVoi | **Substrate Adopters Registry v1 launched** at `docs.algovoi.co.uk/adopters` (three entries: AlgoVoi, Supership/Crest, PEAC Protocol). **8-impl × 5-format cross-validation attestation** published (320/320 byte-for-byte agreements; cumulative 512/512 across 7 distinct vector sets). `algovoi-refund-receipt`, `algovoi-settlement-attestation`, `algovoi-cancellation-receipt`, `algovoi-composite-trust-query` all published to PyPI + npm. IETF -01 revisions filed for compliance-receipt and refund-receipt. |
| **2026-05-25** | google-agentic-commerce/AP2#265 | jithinraj (PEAC Protocol) independently confirms AP2 open\_mandate\_hash cross-implementation pass and is added to the Substrate Adopters Registry as entry #3 — **first organic downstream-adopter signal** from a party with no prior AlgoVoi coalition relationship. |
| **2026-05-25** | x402 #2400 | A contributor engaged on the VCX payment-record thread (x402 #2400). AlgoVoi cited its IETF I-D as the canonicalisation source and offered APM as a reference implementation. Resolved (see 2026-06-22 below). |
| **2026-05-25** | x402-foundation/x402#2452 | EfeDurmaz16 (Sardis) + TateLyman engage on AP2+x402 composition thread. AlgoVoi anchored evidenceHash → SHA-256(JCS), categorical compliance receipt for deny case, and audit-chain-row shape. Sardis named as Adopters Registry candidate. |
| **2026-05-25 17:14 UTC** | agentgraph-co/agentgraph | kenneives publishes `semantic-divergence-boundary-v0.md` at commit `229040b` formalising AlgoVoi's discrimination-tuple injectivity rule as §2 with named AlgoVoi co-authorship per the originating-contribution discipline. Front-matter and §7 attribution table both cite AlgoVoi as the formalism originator. |
| **2026-05-26 \~04:54 UTC** | IETF list | Eliot Lear (Independent Submissions Editor) replies to the same thread with a procedural pointer to rfc-editor.org/about/independent and notes he has not reviewed any of the drafts. Confirms the ISE review process exists and has not yet been invoked. |
| **2026-05-26** | IETF list | AlgoVoi (Chris Hopley) posts a short procedural acknowledgment to the same thread committing to review the ISE criteria against the relevant drafts and revert. Substantive engagement with Klensin's three concerns deferred pending the criteria review. |
| **2026-05-26 03:02 UTC** | chopmob-cloud/ap2-pq-conformance | rayc0 (PQSafe) opens [PR #1](https://github.com/chopmob-cloud/ap2-pq-conformance/pull/1) landing ML-DSA-65 (FIPS 204) signature over the AP2 PaymentMandate canonical bytes — completes the four-scheme cross-implementor convergence (ES256 + Ed25519 + Falcon-1024 + ML-DSA-65). |
| **2026-05-26 04:38 UTC** | chopmob-cloud/ap2-pq-conformance | PR #1 merged. PQSafe granted co-maintainer access per published policy. AP2 #250 joint deliverable closes. |
| **2026-05-26 08:16 UTC** | microsoft/agent-governance-toolkit | AlgoVoi posts substrate-author anchor comment on [Discussion #276](https://github.com/microsoft/agent-governance-toolkit/discussions/276#discussioncomment-17059341) — calibrated date-anchoring correction with three immutable citation anchors (A2A #1734 May 14, agentgraph `229040b` §2, IETF I-D POSTED). Open Apache-2.0 + trusted-partners offer for downstream consumers. |
| **2026-05-26 08:35 UTC** | PyPI | `algovoi-substrate-pqc 0.1.0` published — Python reference impl for JCS+PQC integration. |
| **2026-05-26 08:38 UTC** | npm | `@algovoi/substrate-pqc 0.1.0` published — TypeScript twin. Both packages e2e-verified against AP2 PQ conformance fixtures (8/8 schemes across both registries). |
| **2026-05-26** | AlgoVoi-substrate-pqc | Cross-product matrix attestation published: 4 producers × 6 verifiers = 24/24 cells PASS. Same canonical SHA-256 `sha256:cc8315f7...e0` across four independent JCS implementations. Three audit-grade PQC implementations agree byte-for-byte: PQClean + `@noble/post-quantum` + Bouncy Castle. |
| **2026-05-26** | docs.algovoi.co.uk | **Canonicalisation discipline v2 (PQC-aware) published** at `/canonicalisation-substrate-v2` under sole AlgoVoi authorship. URN `urn:x402:canonicalisation:jcs-rfc8785-v2`. Strictly additive over v1 (canonicalisation core unchanged); adds signature\_algorithm registry + fail-closed verifier discipline + PQC normative references. PQSafe credit scoped to ML-DSA-65 contribution on AP2 #250. v1 adopters retain registry position. IETF I-D filing deferred pending Klensin/Lear thread on Independent Submissions stream scope. |
| **2026-05-26** | awslabs/agentcore-samples | AlgoVoi posts substrate-author anchor on [Issue #1546 comment](https://github.com/awslabs/agentcore-samples/issues/1546#issuecomment-4544423976) — calibrated correction on aeoess (AEOESS Consilium) post that described the canonicalisation discipline as "the x402 substrate's own canonicalizer" without attribution. The comment establishes sole AlgoVoi authorship of `urn:x402:canonicalisation:jcs-rfc8785-v1` in the AWS Labs permanent archive, cites the IETF I-D + the 8-impl 192-vector cross-validation matrix + the three production adopters in the Substrate Adopters Registry. Trusted-implementations offer routed through the AlgoVoi-curated registry. |
| **2026-05-26 10:20 UTC** | x402-foundation/x402 | [PR #2438](https://github.com/x402-foundation/x402/pull/2438) (`docs(specs): fix broken link to batch-settlement spec in cloudflare scheme`) MERGED by a maintainer. Small +1/-1 documentation fix landing in upstream x402 spec text. Signal of active maintainer cadence in the x402 review queue today. AlgoVoi commit-signing configured for this machine going forward; future AlgoVoi PRs (#2453, #2322, #2334) land signed without rebase pass. |
| **2026-05-26 10:23 UTC** | docs.algovoi.co.uk/adopters | **Citation discipline section added** to the Substrate Adopters Registry (commit `caf7eeb` on `chopmob-cloud/docs` main). Specifies citation patterns adopters typically surface: URN `urn:x402:canonicalisation:jcs-rfc8785-v1` + IETF I-D `draft-hopley-x402-canonicalisation-jcs-v1` cited as normative reference; registry-link in adopter READMEs / API docs / developer surfaces; in-band `canon_version: jcs-rfc8785-v1` byte-stable across artefacts. Patterns are observation-shape, not gating conditions for inclusion. |
| **2026-05-26 \~10:27 UTC** | x402-foundation/x402 | [PR #2453 review-ping](https://github.com/x402-foundation/x402/pull/2453#issuecomment-4543362375) posted to surface the canonicalisation discipline PR (sole-AlgoVoi authorship; replaces closed #2436) back to active queue. References live IETF I-D `-01` + three production adopters in the Substrate Adopters Registry. Same-day maintainer-cadence signal from #2438 merge suggests realistic review window 24-48h. |
| **2026-05-27 06:08 UTC** | x402-foundation/x402 | AlgoVoi closes [PR #2322](https://github.com/x402-foundation/x402/pull/2322) (`spec(bazaar): add Compliance category`) — closed by AlgoVoi (chopmob-cloud), not merged. AlgoVoi actively manages its own PR portfolio as an independent substrate author; closure preserves the dated public-record of the Compliance category proposal without requiring downstream maintainer action. |
| **2026-05-27** | agentgraph-co/agentgraph | kenneives publishes CTEF v0.3.2 live at agentgraph.co — downstream ecosystem building on the substrate, demonstrating independent adoption. |
| **2026-05-10 – 2026-05-31** | microsoft/semantic-kernel, finos/ai-governance-framework, langchain-ai/langgraph, crewAIInc/crewAI | **giskard09 coordinated authorship-capture campaign.** Across SK [#13957](https://github.com/microsoft/semantic-kernel/issues/13957), FINOS [#296](https://github.com/finos/ai-governance-framework/issues/296), LangGraph [#7687](https://github.com/langchain-ai/langgraph/issues/7687), and CrewAI [#4877](https://github.com/crewAIInc/crewAI/issues/4877), giskard09 systematically promoted `action-ref-v1.0` in `argentum-core` (commit `71c01e8`) as the canonical spec for `SHA-256(JCS({agent_id, action_type, scope, timestamp_ms}))`. On 2026-05-28, giskard09 announced `draft-giskard-action-ref-00` as "in preparation, co-authored with @aeoess." Diagnostic field-name drift: giskard09's May 10 Python snippet used `int(time.time())` (second precision) and May 30 citation used `timestamp` (no `_ms` suffix) — AlgoVoi's spec and Pidlisnyi's own Jun 5 self-admission both use `timestamp_ms`. arian-gogani (Nobulex) claimed "16/16 byte-identical validation" against giskard09's fixtures, completing a coordinated attribution triangle: giskard09 claims spec authorship, aeoess co-authors the draft, arian-gogani provides "independent" validation. All three actors have `author_association: NONE` in all relevant threads. Full evidence record: `content/diligence-pack/giskard09-action-ref-capture-2026-06-05.md`. |
| **2026-05-27–28** | x402-foundation/x402 | Three independent organisations publicly confirm byte-identical interoperability with the AlgoVoi substrate on [issue #2332](https://github.com/x402-foundation/x402/issues/2332): (1) `luisllaver` (AURA, 2026-05-28 01:08) — "AURA does not define its own \[canonicalisation] — we conform to RFC 8785 (JCS) + SHA-256, the same discipline @chopmob-cloud is pinning in `draft-hopley-x402-canonicalisation-jcs-v1`. Cite that." (2) `andysalvo` (Crest, 2026-05-27 13:20) — "Vector 4 (chopmob corpus anchor): PASS — 3-way byte-identical across Crest, AURA, and AlgoVoi." (3) `giskard09` (Mycelium Trails, 2026-05-28 01:25) — "once the ref is in the evidence array, the receipt is auditable anywhere, no AURA dependency." Three parties, one thread, one shared anchor: `chopmob-cloud/algovoi-jcs-conformance-vectors`. |
| **2026-05-29 11:03 UTC** | IETF datatracker | `draft-hopley-x402-canonicalisation-jcs-v1` reaches revision **-04**. The discipline I-D that all other AlgoVoi receipt I-Ds normatively reference now has four public revisions on the IETF Independent Submission datatracker under sole AlgoVoi authorship. |
| **2026-05-29 11:08 UTC** | chopmob-cloud/algovoi-crest-joint-harness | Repo made public. [Issue #1](https://github.com/chopmob-cloud/algovoi-crest-joint-harness/issues/1) closed with AlgoVoi [reply comment](https://github.com/chopmob-cloud/algovoi-crest-joint-harness/issues/1#issuecomment-4574193295) acknowledging Crest's vector contribution and clarifying that all code in the repo is solely AlgoVoi-authored. AlgoVoi's position on authorship and scope is on the permanent public record. |
| **2026-05-29 15:12 UTC** | PyPI | `algovoi-rfc9421-signer 0.1.0` published — RFC 9421 HTTP Message Signatures producer package (AlgoVoi sole authorship). Companion to the already-published `algovoi-rfc9421-verifier`. Both signer and verifier now available on PyPI and npm; full signing-and-verification round-trip covered by the substrate package suite. |
| **2026-05-29** | verify.algovoi.co.uk | Two new public no-auth hosted verifier endpoints added to the existing `verify.algovoi.co.uk` hub: `POST /action-ref` (returns RFC 8785 JCS canonical form + SHA-256 digest for any `{agent_id, action_type, scope, timestamp_ms}` payload; 8-implementation attested) and `POST /rfc9421` (full RFC 9421 + RFC 9530 verification including signing-base reconstruction, Content-Digest check, and Ed25519 signature check against any supplied public key). Both route through the AlgoVoi gateway (`api.algovoi.co.uk/verify/*`) via VPC. No auth, rate-limited. Live-tested in CI against the `algovoi-rfc9421-signer` reference fixture (wrong-key and tampered-body rejection cases included). |
| **2026-05-30** | chopmob-cloud/algovoi-pef | `algovoi-pef@0.1.0` published to PyPI + npm (Python + TypeScript parity). Payment Evidence Frame reference impl: five claim types, `frame_id` SHA-256 over JCS-canonical preimage, optional RFC 9421 detached signature. IETF I-D `draft-hopley-x402-payment-evidence-frame-00` posted to IETF datatracker as seventh AlgoVoi Independent Submission, Informational. |
| **2026-05-30** | chopmob-cloud/algovoi-substrate-pqc | PQC cross-product matrix expanded: Go and Rust added as producers and verifiers. Matrix now 6 producers × 8 verifiers = 48/48 cells PASS. Four audit-grade PQC implementations cross-validated: PQClean, `@noble/post-quantum`, Bouncy Castle 1.84, RustCrypto. All six producers confirm same byte-anchor `sha256:cc8315f7...e0`. Attestation at `_attestations/2026-05-30-cross-product-matrix.md`. |
| **2026-05-30** | chopmob-cloud/algovoi-jcs-conformance-vectors | PEF 8-impl cross-validation attestation: 64/64 byte-for-byte agreements. Cumulative cross-implementation total: 576/576 across 8 vector sets (8 independent JCS runtimes throughout). |
| **2026-05-30** | microsoft/agent-governance-toolkit | [Discussion #814 comment](https://github.com/microsoft/agent-governance-toolkit/discussions/814#discussioncomment-17118233) updated: corrected cross-validation figures to 576/576 over 8 vector sets; ATB profiles to 144/31; PEF artefact added to the table. |
| **2026-05-31** | LinkedIn (public) | AlgoVoi publishes post detailing ATB threat taxonomy and methodology: *"Autonomous agents are increasingly being asked to authorise real financial transactions. The failure modes are not theoretical."* Six failure classes documented publicly: authority manipulation, knowledge poisoning, context exhaustion, cross-chain race conditions, simulation escape, tool schema confusion. ATB now covers 160 profiles across 36 threat categories, all mapped to OWASP LLM Top-10. Public prior-art disclosure of ATB methodology and threat classification framework. |
| **2026-05-31** | PyPI + npm | `algovoi-receipt-verifier@0.1.0` published — 8-step offline JWS compliance-receipt verifier (Python 41/41, TypeScript 19/19, 13 conformance vectors). `algovoi-webhook-verifier@0.1.0` — `X-AlgoVoi-Signature` verifier (8-lang × 13 vectors = 104/104). `algovoi-receipt-sentinel@0.1.0` — sliding-window tamper/replay/scan monitor consuming both verifiers' error streams (8-lang × 13 vectors = 104/104). Package suite reaches **28 packages** (14 PyPI + 14 npm namespaces). |
| **2026-06-02** | x402-foundation/x402 | A maintainer closes 9 AlgoVoi PRs in one batch (#2334, #2453, #2493--#2495, #2524--#2527) — identical boilerplate on each: *"hard to review as a group... interconnected... large in scope."* Every PR was CI-green and merge-ready; the single failing check was the team's Vercel fork-deploy gate (unrelated to spec content). Patterns covered: JCS canonicalisation, compliance-receipt, settlement-attestation, cancellation-receipt, refund-receipt, pre-payment-compliance-gate, composite-trust-query, rfc9421-binding, payment-evidence-frame. Resolved (see 2026-06-22 below). Full record: `content/diligence-pack/x402-pr-closure-record-2026-06-02.md`. |
| **2026-06-02 17:46 UTC** | [x402 PR #2544](https://github.com/x402-foundation/x402/pull/2544) | VCX PR #2544 opened (22 TypeScript files + spec) implementing a JCS+SHA-256 envelope-digest pipeline (`sha256:` prefix, JCS+SHA-256 formula, `settled_payment_ref`, `SETTLED / PENDING_FINALITY / REVERSED`, content-addressed audit references, cross-language conformance vectors). Resolved (see 2026-06-22 below). Full record: `content/diligence-pack/vcx-attribution-incident-2026-06-02.md`. |
| **2026-06-02 (same day)** | [x402 PR #2544](https://github.com/x402-foundation/x402/pull/2544) | AlgoVoi noted on the thread that it had published related canonicalisation work earlier (earliest dated record May 16). Resolved (see 2026-06-22 below). |
| **2026-06-03** | AlgoVoi | AlgoVoi noted its earlier published canonicalisation work to the x402 maintainers regarding PR #2544; question since closed. Resolved (see 2026-06-22 below). |
| **2026-06-03 16:38 UTC** | [x402 PR #2544](https://github.com/x402-foundation/x402/pull/2544) | A maintainer posts on PR #2544 notifying the team to review — the first foundation response since the PR was opened. AlgoVoi's provenance comments are on the PR record. Resolved (see 2026-06-22 below). |
| **2026-06-03 (later)** | AlgoVoi | A follow-up note regarding PR #2544 was sent via the submitter's published contact channel. No action and no PR withdrawal requested. Resolved (see 2026-06-22 below). |
| **2026-06-22** | AlgoVoi | **Resolution.** AlgoVoi considers the PR #2544 matter closed. The PR's current revision implements RFC 8785 and the MIT `canonicalize` library independently and adds a References / Public Standards section and NOTICE; AlgoVoi's authorship rests on the dated prior-art record above, and no claim is outstanding. |
| **2026-06-04** | AlgoVoi | **PQC + ZKP + Federation layer shipped.** Two new Commercial License v1.0 packages deployed to production: `algovoi-federation-validator` v0.1.1 (cross-issuer ZKP credential composition, 59/59 tests, production) and `algovoi-zkp-receipt` v0.1.0 (ZKP-bound payment receipt attestation, 13/13 tests, production). Two new IETF I-Ds filed (ninth and tenth AlgoVoi Independent Submissions): `draft-hopley-x402-pqc-credential-binding-00` and `draft-hopley-x402-federation-zkp-00`. IACR ePrint 2026/109852 submitted under review. ATB ZKP service (Rust / Bulletproofs / Ristretto255) confirmed live in production. Gateway upgraded: Phase 2 ATB sessions now produce `X-ZKP-Receipt-Payload` (binding agent credential to on-chain payment) and `X-Composite-Trust-Verdict` response headers post-settlement. `POST /compliance/trust-query` upgraded to recognise `zkp_receipt` objects as trust signals. UK Gov inspect\_evals PR #1732 updated with IACR ePrint citation. 42 tests across agent auth + ZKP receipt suite all passing. |
| **2026-06-05** | awslabs/agentcore-samples | `agent-governance-spec/aps-x402-composition` (2 commits, Apache 2.0) pitched as an official AgentCore Payments sample on [Issue #1546](https://github.com/awslabs/agentcore-samples/issues/1546). The repo uses `canonicalizeJCS()` with the exact framing: *"The two streams agree byte-for-byte on every null-free input, which is every production input the demo emits"* — AlgoVoi's coined cross-validation language from the JCS substrate documentation. No AlgoVoi attribution in the repo. The associated IETF I-D `draft-pidlisnyi-aps-01` (filed 2026-05-14, author: Tymofii Pidlisnyi, AEOESS; confirmed live on IETF datatracker) was cross-validated against AlgoVoi's implementation two days after filing: gist [`5f35eaa527d292bf3ddc52f8725a85c9`](https://gist.github.com/chopmob-cloud/5f35eaa527d292bf3ddc52f8725a85c9) (2026-05-16, public, chopmob-cloud) records 14/14 APS v1 + CTEF v0.3.1 vector passes against AlgoVoi's substrate — Pidlisnyi reviewed that work via PRs #5 and #6 to the conformance suite before coalition exit 2026-05-24. Five AlgoVoi attribution comments are on the permanent record in the same thread (2026-05-26, 2026-05-30, 2026-06-04, 2026-06-05 × 2), establishing sole AlgoVoi authorship of `urn:x402:canonicalisation:jcs-rfc8785-v1`. |
| **2026-06-05 (later)** | awslabs/agentcore-samples | **Self-admission by Tymofii Pidlisnyi (AEOESS).** In [issuecomment-4627635509](https://github.com/awslabs/agentcore-samples/issues/1546#issuecomment-4627635509) Pidlisnyi publicly named `SHA-256(JCS({agent_id, action_type, scope, timestamp_ms}))` as *"the cross-ecosystem correlation key"*, listed x402, argentum-core, Gonka, and A2A#1850 as the line it correlates with, and confirmed APS ships it as an additive helper (`computeExternalActionRefV1`) because the APS-native action\_ref has a **different preimage** (camelCase fields, multi-scope array, second-precision ISO 8601 vs milliseconds). In the same comment, described the shared preimage as *"showing up independently"* across those ecosystems. AlgoVoi's authorship pin ([issuecomment-4628621074](https://github.com/awslabs/agentcore-samples/issues/1546#issuecomment-4628621074)) posted 3 hours 8 minutes later (05:47 UTC): *"The external correlation form ... is the AlgoVoi-authored `action_ref` primitive specified in `draft-hopley-x402-canonicalisation-jcs-v1` §4. Published in `algovoi-substrate 0.3.0` (PyPI 2026-05-23, Apache 2.0). Its appearance across x402, argentum-core, Gonka, and A2A#1850 traces to that source."* The "independent derivation" claim is contradicted by the gist (2026-05-16): AlgoVoi's implementation cross-validated APS v1 two days after Pidlisnyi filed the draft — Pidlisnyi reviewed that work directly via PRs #5 and #6. The construction's specific field names (`timestamp_ms` millisecond precision, single-string `scope`) are normative in `draft-hopley-x402-canonicalisation-jcs-v1` §4 under sole AlgoVoi authorship. Full evidence record: `content/diligence-pack/aeoess-agentcore-self-admission-2026-06-05.md`. |
| **2026-06-06** | awslabs/agentcore-samples | **Adoption + attribution-detachment signal.** In [issuecomment-4640393540](https://github.com/awslabs/agentcore-samples/issues/1546#issuecomment-4640393540) arian-gogani (Nobulex) confirmed nobulex's `action_ref` is `SHA-256(JCS({agent_id, action_type, scope, timestamp_ms}))` with `timestamp_ms` an **epoch-millisecond integer** ("not RFC 3339 string") — byte-identical to the preimage specified in `draft-hopley-x402-canonicalisation-jcs-v1` §4 / `algovoi-substrate 0.3.0` (PyPI 2026-05-23). **Adoption of the construction on these exact terms is welcomed — it is the intended outcome of Apache-2.0 publication.** The same comment proposed relocating the canonical description into *"a short shared doc in a neutral place (not either project's repo)"* — the one move inconsistent with the Apache-2.0 condition, since it detaches the standard from its attributed origin. Recorded as a watch item; no AlgoVoi thread response (upstream silence active). Comment body SHA-256: `b674049219754db644e66c922556bc0365b8e4b3e0fc14a0175ef721b9ce6bba`. Full record: `content/diligence-pack/awslabs-1546-neutral-doc-capture-2026-06-07.md`. |
| **2026-06-07 to 2026-06-11** | OWASP, LangGraph, semantic-kernel, awslabs/agentcore-samples, A2A | **Continued cross-venue adoption of the construction.** `action_ref = SHA-256(JCS({agent_id, action_type, scope, timestamp_ms}))` and the signed receipt-chain appeared across further venues: OWASP CheatSheetSeries AML/sanctions cheat-sheet ([#2125](https://github.com/OWASP/CheatSheetSeries/issues/2125) + [PR #2217](https://github.com/OWASP/CheatSheetSeries/pull/2217), using AlgoVoi's `timestamp_ms` epoch-integer form), LangGraph [#7687](https://github.com/langchain-ai/langgraph/issues/7687), semantic-kernel [#13957](https://github.com/microsoft/semantic-kernel/issues/13957) (`action_ref` described as a "recomputable correlation handle"), and a cross-stack `aps-conformance-suite` built on the JCS/`action_ref` vectors. **Adoption on these terms is welcomed — it is the intended outcome of Apache-2.0 publication.** Authorship remains pinned to `draft-hopley-x402-canonicalisation-jcs-v1` §4 / `algovoi-substrate 0.3.0` (PyPI 2026-05-23). Full evidence record (SHA-anchored): `content/diligence-pack/action-ref-capture-master-evidence-2026-06-07.md`. |
| **2026-06-11** | OASIS CoSAI; a2aproject/A2A | **AlgoVoi contributions.** (1) On the OASIS CoSAI Agent Credentials RFC ([ws4 #99](https://github.com/cosai-oasis/ws4-secure-design-agentic-systems/issues/99)) AlgoVoi contributed the **predicate-only zero-knowledge threshold** distinction for trust scores — proving `score ≥ threshold` (Bulletproofs over Ristretto255, threshold bound into the proof transcript, Falcon-1024-bound, offline-verifiable) rather than disclosing the score as a value. (2) Three AlgoVoi-authored A2A extension registrations rebased clean to mergeable: Compliance Gate [#1886](https://github.com/a2aproject/A2A/pull/1886), Settlement Attestation / Composite Trust Query / RFC 9421 Message Signing [#1896](https://github.com/a2aproject/A2A/pull/1896), Payment Evidence Frame [#1898](https://github.com/a2aproject/A2A/pull/1898). |
| **2026-06-11 to 2026-06-12** | microsoft/agent-governance-toolkit#806 · mohdibrahimaiml/epi-recorder | **Credited interop convergence (positive attribution).** [EPI Recorder](https://github.com/mohdibrahimaiml/epi-recorder) cross-tested its canonicaliser against AlgoVoi's published [JCS conformance corpus](https://github.com/chopmob-cloud/algovoi-jcs-conformance-vectors). After aligning `ensure_ascii`, EPI produces **byte-identical canonical bytes**, and all 8 EPI golden vectors reconcile to AlgoVoi-recomputed `frame_id`s — independently triple-validated across three RFC 8785 implementations (`rfc8785`/Python, `canonicalize`/JS, `gowebpki/jcs`/Go). AlgoVoi seeded the [`epi_interop_v0`](https://github.com/chopmob-cloud/algovoi-jcs-conformance-vectors/tree/main/vectors/epi_interop_v0) interop set (5 vectors, each `anchored_to` `draft-hopley-x402-canonicalisation-jcs-v1`), held as a 2-impl interop set and **not** folded into the 8-impl conformance totals. EPI published [`docs/EPI-ALGOVOI-INTEROP.md`](https://github.com/mohdibrahimaiml/epi-recorder/blob/main/docs/EPI-ALGOVOI-INTEROP.md), which credits AlgoVoi's authorship/provenance page, the [canonicalisation-substrate](/canonicalisation-substrate) docs, and the conformance corpus — a credited downstream adopter, the intended outcome of Apache-2.0 publication. EPI golden file byte-lock `sha256:78227cad2ab12189bff72f1a1b65fb6ab5894cd89489e2ad61203937db729fb7`; interop-doc git blob `55489ca1babc77684fd4e49fbfc7f386768ddaab`. |
| **2026-06-13** | visa/trusted-agent-protocol#16 · x402-foundation/x402 | **Convergence + author-of-record correction.** The Visa Trusted Agent Protocol receipt-signing RFC ([#16](https://github.com/visa/trusted-agent-protocol/issues/16), opened by `tomjwxf`) converges on the AlgoVoi model: Ed25519 + JCS RFC 8785 canonical receipts and the two-layer split (RFC 9421 for request authentication, a signed JCS-canonical receipt for the evidence layer). `arian-gogani` (Nobulex) positioned CTEF / Nobulex / `aeoess/aps-conformance-suite` as the reference and claimed *"x402#2322 just landed a MUST for JCS canonicalization on all signed receipts."* Contradicted by primary source: x402 [#2322](https://github.com/x402-foundation/x402/pull/2322) and [#2334](https://github.com/x402-foundation/x402/pull/2334) are **AlgoVoi-authored and closed unmerged** (`mergedAt: null`), and `specs/extensions/bazaar.md` on x402 `main` carries no Compliance category or JCS MUST — it never landed, by us or anyone. AlgoVoi posted the author-of-record correction ([issuecomment-4699712372](https://github.com/visa/trusted-agent-protocol/issues/16#issuecomment-4699712372)), pointing only to live Apache-2.0 tooling (the [conformance vectors](https://github.com/chopmob-cloud/algovoi-jcs-conformance-vectors), 8-impl byte-identical, and the verifier at `api.algovoi.co.uk/v1/receipt/verify`). Separately, `0xbrainkid` (AgentFolio/SATP) carried the AlgoVoi two-layer + key-source-provenance framing into the same thread unprompted. **Adoption of the model is welcomed; the false "landed" attribution is corrected on the record.** |
| **2026-07-02** | PyPI | `algovoi-substrate` v0.4.1 published (open Apache-2.0 RFC 8785 / JCS canonical substrate, `CANON_VERSION jcs-rfc8785-v1`). Current public reference implementation of the canonicalisation discipline. |
| **2026-07-06** | AlgoVoi | **Signed A2A AgentCard** shipped (build authored 2026-07-06). The agent card at `/.well-known/agent.json` carries a detached EdDSA JWS over its JCS canonical form per A2A §8.4; the Ed25519 verify key is published at `/.well-known/jwks.json` and the platform Falcon-1024 public key at `/.well-known/pqc-keys.json`. Card authenticity, key publication, and post-quantum identity are three distinct keys, independently fetchable. |
| **2026-07-10** | PyPI | Keystone L2 open packages published as Cython builds (Apache-2.0): `algovoi-keystone-validate`, `algovoi-keystone-secure-lite`, `algovoi-keystone-sqlalchemy` v0.2.0. |
| **2026-07-14** | AlgoVoi | **AlgoVoi Mesh (L3) proven on-chain.** Post-quantum mutual agent-to-agent settlement, one authorised Falcon-1024 pair per run, settled across seven independently-verified chains (Algorand, VOI mainnet, Base, Solana, Stellar, Tempo, Hedera mainnet). Each transaction carries the exact content-addressed `execution_ref` its handshake produced; the Hedera mainnet Consensus Service anchor is verifiable from the public mirror node with no AlgoVoi infrastructure. The card-signing well-known surfaces (row 50) confirmed live and independently fetched this date. |
| **2026-07-15** | AlgoVoi | **Three further chains proven, anchor format canonicalised.** Ethereum (Sepolia, EVM raw calldata), the XRP Ledger (re-anchored to the canonical `algovoi-mesh:sha256:` memo, superseding an earlier bare-format anchor), and Bitcoin (testnet, OP\_RETURN) settled the same content-addressed `execution_ref` with no settlement-code change. Bitcoin is the first settlement on a UTXO chain (all prior nine are account-model). Ten chains now independently verifiable, each carrying the same reference via its native field. |
## What this substrate provides
```
+----------------------------------------------------------+
| AlgoVoi-authored substrate |
+----------------------------------------------------------+
| |
| Canonicalisation discipline |
| (IETF I-D §4; published at /canonicalisation-substrate)|
| - JCS RFC 8785 pin |
| - Substrate Rule 2: timestamp_ms MUST be integer |
| - Field-name + array-order + type-validation rules |
| |
| Primitives (in algovoi-substrate v0.3.0) |
| - canonicalize(obj) -> JCS canonical string |
| - action_ref(agent_id, action_type, scope, ts) |
| -> SHA-256 of the canonical preimage |
| - transition_hash + build_transactional_action_chain |
| - build_compliance_receipt + verify_audit_chain |
| - composite_trust_query_hash |
| |
| Receipt format (draft-hopley-x402-compliance-receipt) |
| - Closed enum {ALLOW, REFER, DENY} |
| - payer_ref content-addressed reference |
| - integer screen_timestamp_ms |
| - canon_version in-band pin |
| - jurisdiction_flags ordered list |
| - screen_provider_did DID URI |
| |
| Audit chain |
| - content_hash per row |
| - prev_hash linkage |
| - Object Lock COMPLIANCE 7y retention (S3) |
| |
| Conformance corpus (counts on the substrate page) |
| - 8-impl byte-for-byte: 880/880 agreements |
| |
+----------------------------------------------------------+
| PQC / ZKP / Federation layer (2026-06-04) |
+----------------------------------------------------------+
| |
| Post-quantum credential binding |
| - Falcon-1024 ATB Pass Certificate (NIST FIPS 206) |
| - ML-DSA-65 (NIST FIPS 204) hybrid support |
| - kid = hex(SHA-256(pk))[:16] |
| - JCS signing discipline over cert payload |
| - IETF: draft-hopley-x402-pqc-credential-binding-00 |
| |
| Bulletproofs ZKP (score ≥ threshold, score not revealed)|
| - Pedersen commitment over Ristretto255 |
| - Bulletproofs range proof (range_bits=64) |
| - Phase 2 ATB cert: commitment_b64 + proof_b64 |
| - IACR ePrint 2026/109852 |
| |
| Cross-issuer federation |
| - Composite commitment: SHA-256(domain‖comm_0‖…‖nonce)|
| - HMAC-SHA256 federation token (no shared trust root) |
| - IETF: draft-hopley-x402-federation-zkp-00 |
| |
| ZKP receipt (payment + credential binding) |
| - Binds Phase 2 ATB cert to on-chain payment |
| - X-ZKP-Receipt-Payload response header |
| - X-Composite-Trust-Verdict: TRUSTED/PROVISIONAL/... |
| - gateway POST /compliance/trust-query upgraded |
| |
+----------------------------------------------------------+
```
## All platform interactions captured as substrate receipts
Every payment interaction processed by the AlgoVoi platform generates a
substrate receipt. There are no unreceipted interactions. This is enforced
at the gateway level, not as an optional feature.
The five receipt types cover the complete payment lifecycle with no gaps:
| Event | Receipt type | IETF I-D / reference |
| ---------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------- |
| Payment admission (compliance screen result) | `compliance_receipt_v1` — closed `{ALLOW, REFER, DENY}` enum | `draft-hopley-x402-compliance-receipt` |
| Multi-chain settlement confirmed | `settlement_attestation_v1` — chain + tx\_id + amount anchored | `draft-hopley-x402-settlement-attestation` |
| Refund issued | `refund_receipt_v1` — `{FULL, PARTIAL}` with amount and original `payment_ref` | `draft-hopley-x402-refund-receipt` |
| Mandate cancelled | `cancellation_receipt_v1` — closed `{USER_REQUESTED, MERCHANT_REQUESTED, COMPLIANCE_TERMINATED, EXPIRED}` enum | `draft-hopley-x402-cancellation-receipt` |
| Verifier composite verdict | `composite_trust_query_v1` — closed `{TRUSTED, PROVISIONAL, INSUFFICIENT_EVIDENCE, UNTRUSTED}` enum | `draft-hopley-x402-composite-trust-query` |
| ZKP-credentialed payment (Phase 2 ATB session) | `zkp_receipt_v1` — Falcon-1024 signed; binds ATB ZKP commitment + proof to on-chain payment; proves `score ≥ threshold` without disclosure. Returned as `X-ZKP-Receipt-Payload` header | `draft-hopley-x402-pqc-credential-binding-00` · [IACR ePrint 2026/109852](https://eprint.iacr.org/2026/109852) |
All five receipt types are in turn consolidated by the **Payment Evidence Frame**
(`algovoi-pef`, `draft-hopley-x402-payment-evidence-frame`): a single
`frame_id` (SHA-256 over the JCS-canonical preimage of the frame manifest)
that binds all receipts for one payment event into one verifiable artefact.
Every receipt row is appended to a **SHA-256 JCS hash-chained audit ledger**
with `prev_hash` linkage across five table types (payment events, compliance
decisions, audit snapshots, settlement records, webhook deliveries). The
chain is:
* Stored in Backblaze B2 with **Object Lock COMPLIANCE mode** retention to 2033
* Verifiable without trusting AlgoVoi — the hash chain can be reconstructed
from the raw rows and checked against any row's `content_hash`
* Publicly downloadable via the merchant dashboard audit-bundle endpoint
* Verified by the standalone `algovoi-audit-verifier` package (PyPI + npm)
with no AlgoVoi infrastructure dependency
**What this means for an acquirer:** the substrate is not a paper proposal.
Every receipt format has a reference implementation (published package),
an IETF Internet-Draft, an 8-implementation cross-validation attestation,
and a production deployment generating live receipts across seven chain
families. The receipt corpus is an independently verifiable forensic record
of every payment interaction the platform has ever processed.
## Contributions acknowledged (historical record)
AlgoVoi is the substrate author. Specific narrow contributions made
by other parties during the period of coalition coordination
(2026-05-19 to 2026-05-24) are credited where they originate. These
acknowledgements stand on the public record regardless of subsequent
coalition state:
| Contribution | Author | Where it lands |
| --------------------------------------------------------------------------------------------------------- | ------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `timestamp_ms` epoch-integer canonical preimage convention (Substrate Rule 2 of the canonicalisation I-D) | Andy Salvo / Crest Deployment Systems | Identified the timestamp precision failure mode on [x402#2326](https://github.com/x402-foundation/x402/issues/2326#issuecomment-4501663969) and [x402#2357](https://github.com/x402-foundation/x402/issues/2357) on 2026-05-20. Credited in IETF I-D revisions `draft-hopley-x402-canonicalisation-jcs-v1-02`, `draft-hopley-x402-compliance-receipt-02`, and `draft-hopley-x402-refund-receipt-02` filed 2026-05-25. |
| Retention-property clause in the canonicalisation discipline | FeedOracle | [PR #2436](https://github.com/x402-foundation/x402/pull/2436) — credited in the section footer |
| `serde_jcs@0.2.0` Rust JCS implementation (one of five in the conformance matrix) | seritalien / Vauban Pay | Listed by name in [the substrate matrix](https://docs.algovoi.co.uk/canonicalisation-substrate) · [validation report on x402#2357](https://github.com/x402-foundation/x402/issues/2357#issuecomment-4505674559) |
| `authority_verified_at_ms` and `revocation_check_at_ms` field names | giskard09 / argentum-core | First appeared in argentum-core `71c01e8` on 2026-05-22. These two specific field names compose **on top of** the AlgoVoi substrate; argentum-core authorship of these two field names is acknowledged. |
| Namespace-prefixing convention positive attribution | arian-gogani / nobulex | Cited the convention as AlgoVoi-authored on [x402#2332](https://github.com/x402-foundation/x402/issues/2332) |
| Pre-layer principal-authority framing co-development | MolTrust, 0xbrainkid, musaabhasan | A2A #741 thread |
## What this substrate is NOT
Honest scope:
* **Not agent identity hashing.** AlgoVoi's JCS application produces
payment-action transaction references and payment-lifecycle receipts.
The `action_ref` function takes an `(agent_id, action_type, scope,
timestamp_ms)` tuple and produces a hash of that payment-action
event; the output identifies the payment action, not the agent.
JCS agent identity hashing -- hashing an agent descriptor to produce
a stable identity token for a transparency log or identity registry
\-- is a different JCS application domain with a different input
schema, different canonicalisation semantics, and different threat
model. This substrate covers neither agent identity derivation nor
transparency log commitment.
* **Not a closed-enum on every field.** `scope` is a non-empty string,
not a closed enum. The substrate publishes naming conventions (e.g.
`{emitter}:{scope}` namespacing) as non-normative recommendations.
* **Not a single-vendor lock-in.** Five (now eight) independent JCS
implementations produce byte-identical canonical bytes. A buyer can
swap any one for another without changing the receipt format.
* **Not a complete reputation system.** The substrate produces evidence
(compliance attestations, settlement receipts, audit chains); scoring
layers like Verascore consume that evidence. AlgoVoi does not author
Verascore.
* **Not the only substrate in the space.** Other independent authors
have published related but separable receipt and settlement
formats: Vauban Pay (STARK settlement proofs, in
`draft-vauban-x402-stark-receipts`), Concordia (commitment receipts),
nobulex (bilateral receipts), Agent OS (committed claims). These
compose against the canonicalisation substrate without redefining
it. AlgoVoi does not represent or speak for any of these parties.
## Verifying the claims on this page independently
Every claim on this page is verifiable from a developer machine in
under ten minutes:
```bash theme={null}
# 1. AlgoVoi substrate primitives (Python)
pip install algovoi-substrate==0.3.0
python -c "from algovoi_substrate import action_ref; print(action_ref('agent_alpha','payment','vauban:stark_settlement',1716494400000))"
# expects: 7528529a8be2044488e603b7913efaa4f83620dbcc63010d4a1478cf7e9a473c
# 2. AlgoVoi substrate primitives (TypeScript)
npm install @algovoi/substrate@^0.3.0
node -e "import('@algovoi/substrate').then(m => console.log(m.actionRef({agent_id:'agent_alpha',action_type:'payment',scope:'vauban:stark_settlement',timestamp_ms:1716494400000})))"
# expects the same digest
# 3. RFC 9421 HTTP signature verifier
pip install algovoi-rfc9421-verifier==0.1.0
# Then verify a captured request: see the package README
# 4. Full conformance corpus
git clone https://github.com/chopmob-cloud/algovoi-jcs-conformance-vectors
cd algovoi-jcs-conformance-vectors/vectors/compliance_receipt_v1
python runner_python.py # expects: PASS 8 vectors + 5 pair invariants + 3 chain invariants
node runner_node.js # expects: PASS
# 5a. JCS 8-implementation matrix
# See _attestations/2026-05-24-8-impl-cross-validation.md for the 8-language reproduction commands.
# 5b. RFC 9421 + Ed25519 + SHA-256 8-implementation matrix
cd algovoi-jcs-conformance-vectors/vectors/rfc9421_proxy_chain_v0
bash run_all.sh # expects: 8/8 PASS (Python, Node, Go, Rust, Java, PHP, .NET, Ruby)
# 6. IETF Internet-Draft
curl -sL https://www.ietf.org/archive/id/draft-hopley-x402-compliance-receipt-02.txt | head -30
# 7. JSON Schema (auto-loaded by every JSON-aware IDE)
curl -s https://json.schemastore.org/algovoi-compliance-receipt-v1.json | head -20
# 8. Refund receipt format (standalone AlgoVoi-authored package)
npm install @algovoi/refund-receipt @algovoi/substrate
node -e "import('@algovoi/refund-receipt').then(m => import('@algovoi/substrate').then(s => { const r = m.buildRefundReceipt({original_payment_ref:'sha256:0dd5d0b76c9b9281fdeb2509ad38ab132b16a17385ca01d976ff9e6e12563a0f',refund_result:'FULL',refund_timestamp_ms:1716494400000,refund_provider_did:'did:example:refund-provider-1',refund_amount:{amount_minor:'100000',asset_id:'USDC.6'},jurisdiction_flags:['UK','EU']}); console.log(s.sha256Jcs(r)); }))"
# expects: 7fdd283c3a8abb14d893999d1d16e2f7697ad0539250f2e0fc3e31ce89943dcb
# 9. Hosted action_ref verifier (no install required)
curl -s -X POST https://verify.algovoi.co.uk/action-ref \
-H "Content-Type: application/json" \
-d '{"agent_id":"did:web:api.algovoi.co.uk","action_type":"payment.authorize","scope":"base:0x2d96f2bc","timestamp_ms":1748534400000}'
# expects: {"action_ref":"sha256:6c3c08eb...","implementations_attested":8,...}
# 10. Hosted RFC 9421 verifier (schema reference)
curl https://verify.algovoi.co.uk/rfc9421
# expects: algorithm "Ed25519 (RFC 8032)", spec_ref "https://www.rfc-editor.org/rfc/rfc9421"
```
Commands 1–8 run against primary registries (PyPI, npm, IETF
datatracker, json.schemastore.org, GitHub). Commands 9–10 use AlgoVoi
infrastructure but are independently reproducible by installing the
packages and running the same logic locally.
## Coalition position
**As of 2026-05-24, AlgoVoi operates as an independent substrate
author.** The decision was recorded in claim #577 of the AlgoVoi
memory-graph and made public via a graceful farewell on
x402-foundation/x402 #2428 the same day. The associated AlgoVoi
PR #2436 on x402-foundation/x402 was closed gracefully, with
seritalien's APPROVED review and arian-gogani's LGTM preserved on
the closed-PR historical record.
The substrate authorship case is anchored across **at least thirty-seven
independent public surfaces** listed above. None depend on coalition
co-signing or maintainer cooperation to remain anchored. The
surfaces are:
* Under AlgoVoi control: production endpoints (`api.algovoi.co.uk`,
`verify.algovoi.co.uk`), Mintlify docs (`docs.algovoi.co.uk`),
`chopmob-cloud` GitHub repos.
* Under neutral public registries: PyPI, npm, IETF datatracker, JSON
SchemaStore, GitHub itself.
Each new receipt class ships as its own standalone published package
* IETF I-D + Mintlify page under sole AlgoVoi authorship. The first
post-exit example is the refund receipt (`algovoi-refund-receipt`
v0.1.0 published to npm 2026-05-24; live-tested 17/17 byte-identical
against the conformance vector set; companion I-D
`draft-hopley-x402-refund-receipt` and Mintlify page at
`/refund-receipt`).
A lineage rewrite would need to remove AlgoVoi authorship from every
one of the twenty-four surfaces simultaneously — across multiple
independent registries, GitHub history, and the IETF datatracker. That
is structurally not possible.
AlgoVoi continues to acknowledge specific narrow contributions made
by other parties during the coalition-coordination period (see
"Contributions acknowledged (historical record)" above) and respects
the authorship of separately-authored receipt formats published by
other independent authors (Vauban Pay STARK receipts, Concordia
commitment receipts, etc.).
## Commit attribution across all substrate repositories
The following table records every commit across all 17 public AlgoVoi substrate
repositories as of 2026-05-31, by author email. This is the authoritative
machine-verifiable record of who wrote the code.
| Repository | AlgoVoi commits | External commits | External author and nature |
| ------------------------------- | --------------- | ---------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| algovoi-jcs-conformance-vectors | 32 | 1 | Andy Salvo / Crest (`ajs10845@psu.edu`) — contributing own downstream vectors; commit message states *"Authorship of these vectors stays with Crest... Anchored to AlgoVoi's canonicalisation discipline"* |
| algovoi-substrate | 21 | 0 | — |
| algovoi-rfc9421-verifier | 10 | 0 | — |
| algovoi-audit-verifier | 13 | 0 | — |
| algovoi-substrate-pqc | 22 | 0 | — |
| algovoi-refund-receipt | 7 | 0 | — |
| algovoi-settlement-attestation | 6 | 0 | — |
| algovoi-cancellation-receipt | 7 | 0 | — |
| algovoi-composite-trust-query | 7 | 0 | — |
| algovoi-rfc9421-signer | 2 | 0 | — |
| algovoi-reference-agent | 4 | 0 | — |
| algovoi-crest-joint-harness | 1 | 0 | Crest held write access; zero commits made |
| algovoi-pef | 5 | 0 | — |
| ap2-pq-conformance | 2 | 1 | Raymond Chau / PQSafe (`raymond@pqsafe.xyz`) — scoped ML-DSA-65 contribution, credited |
| algovoi-receipt-verifier | 7 | 0 | — |
| algovoi-webhook-verifier | 3 | 0 | — |
| algovoi-receipt-sentinel | 4 | 0 | — |
| algovoi-federation-validator | 1 | 0 | — (Commercial License v1.0; sole AlgoVoi authorship) |
| algovoi-zkp-receipt | 1 | 0 | — (Commercial License v1.0; sole AlgoVoi authorship) |
| **TOTAL** | **155** | **2** | |
**AlgoVoi: 155 of 157 commits (98.7%).** Neither external commit modifies AlgoVoi-authored substrate code: one contributes Crest's own downstream vectors, one adds PQSafe's scoped ML-DSA-65 fixture.
Verification: `gh api repos/chopmob-cloud/{repo}/commits --paginate --jq '.[].commit.author.email' | sort | uniq -c` on any of the repos above.
## Third-party acknowledgments on the public record
The following parties have explicitly acknowledged AlgoVoi authorship of the
substrate in their own public commits, approved PRs, or published documents.
These are not AlgoVoi claims — they are statements by third parties on
immutable public surfaces.
| Party | Surface | What they said |
| ----------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Andy Salvo / Crest | Own git commit `81f48361` in `algovoi-jcs-conformance-vectors` (2026-05-24) | *"Anchored to AlgoVoi's canonicalisation discipline jcs-rfc8785-v1"* |
| kenneives / agentgraph | Commit `229040b` in `agentgraph-co/agentgraph` (2026-05-25) | *"AlgoVoi-authored formalism (originating A2A #1734 May 14)"* and *"AlgoVoi /compliance/screen catches tuple mismatch at admission"* |
| seritalien / Vauban Pay | APPROVED PR #2436 on `x402-foundation/x402` (2026-05-22) | Explicit approval of AlgoVoi's canonicalisation discipline PR including Substrate Rule 2 |
| seritalien / Vauban Pay | IETF Internet-Draft `draft-vauban-x402-stark-receipts-00` (submitted 2026-05-22; [immutable IETF archive copy](https://www.ietf.org/archive/id/draft-vauban-x402-stark-receipts-00.txt)) | Names AlgoVoi twice: in the acknowledgments — *"AlgoVoi (JCS substrate determinism cross-validation across four published vector sets ; architectural skeleton of the shared canonicalisation discipline \[X402-2326])"* — and in §7: *"The shared canonicalisation discipline \[X402-2326] co-authored by AlgoVoi, FeedOracle, and Vauban Pay…"*. **Note:** revisions `-01` (2026-05-23) through the current `-02` carry neither named acknowledgment; they instead cite the AlgoVoi-registered URN `urn:x402:canonicalisation:jcs-rfc8785-v1` explicitly (7 in-document citations). The `-00` named-credit text is permanently preserved in the IETF archive and cannot be altered by subsequent revisions. |
| giskard09 / argentum-core | Commit `96931c9` (2026-05-23 20:58 UTC) | Spec update adding JCS timestamp encoding rule to argentum-core — published approximately 2 hours after AlgoVoi's formulation of the same rule on A2A #1734 earlier that day |
| arian-gogani / nobulex | x402-foundation/x402 issue #2332 (2026-05-19) | Publicly attributed the namespace-prefixing convention and JCS canonicalization correction to AlgoVoi |
| Raymond Chau / PQSafe | PR #1 to `ap2-pq-conformance` (2026-05-26) | Contributed ML-DSA-65 fixture under AlgoVoi's repo structure, fixture format, and Apache 2.0 licence |
| luisllaver / AURA | x402-foundation/x402 issue #2332 (2026-05-28 01:08 UTC) | *"AURA does not define its own \[canonicalisation] — we conform to RFC 8785 (JCS) + SHA-256, the same discipline @chopmob-cloud is pinning in `draft-hopley-x402-canonicalisation-jcs-v1`. Cite that; our /v1/action-ref is just a conforming implementation."* AURA explicitly states it does not author canonicalisation discipline; AlgoVoi does. |
| andysalvo / Crest | x402-foundation/x402 issue #2332 (2026-05-27 13:20 UTC) | *"Vector 4 (chopmob corpus anchor): PASS -- 3-way byte-identical across Crest, AURA, and AlgoVoi. Published at verify.crestsystems.ai/aura-conformance-v0.json."* Names `chopmob-cloud/algovoi-jcs-conformance-vectors` as the shared anchor in a three-party byte-identical interoperability verification. |
| giskard09 / Mycelium Trails | x402-foundation/x402 issue #2332 (2026-05-28 01:25 UTC) | *"That's the property that matters -- once the ref is in the evidence array, the receipt is auditable anywhere, no AURA dependency. Clean ship."* Publicly confirms that AURA has shipped action-ref portability (`SHA-256(JCS(preimage))`), auditable without an AURA dependency — giskard09 endorsing the shared portable construction (2026-05-28, comment `4560057627`, body SHA-256 `6989d88f0966195078d84b68a7f88c0e41a4efe33f274394d71d8b4b13290c25`). **Contradiction:** the same actor also claims argentum-core's `action-ref.md` is the sole origin *"predating AlgoVoi"* (A2A #1734, 2026-05-23; and the June W3C #34 effort) — see Coalition Engagement Log. |
| Poke-nushi (a2aproject/A2A maintainer-adjacent) | a2aproject/A2A [issue #1769](https://github.com/a2aproject/A2A/issues/1769) (2026-06-05T06:24Z) | *"Thanks — this is helpful detail, and `action_ref` is a useful concrete example of a stable cross-phase binding key. The admission → post-execution → chain/verdict structure you describe is very relevant to the boundary being discussed here. It shows one concrete way a payment-specific profile can make admission artifacts and settlement artifacts independently verifiable."* Independent third-party acknowledgment of `action_ref` as the correct cross-phase binding primitive in the A2A verifier-side trust / permit / receipt architecture discussion. Poke-nushi had no prior AlgoVoi relationship; the acknowledgment was unprompted beyond AlgoVoi's technical contribution to the thread. |
| Tymofii Pidlisnyi / AEOESS | awslabs/agentcore-samples issue #1546 [issuecomment-4627635509](https://github.com/awslabs/agentcore-samples/issues/1546#issuecomment-4627635509) (2026-06-05T02:39Z) | *"The form nobulex matches (SHA-256 over JCS / RFC 8785 of `{agent_id, action_type, scope, timestamp_ms}`, metadata outside the preimage) is the **cross-ecosystem correlation key**. We ship it as an additive helper, `computeExternalActionRefV1`, so APS actions correlate with the x402, argentum-core, Gonka, and A2A#1850 line."* Pidlisnyi publicly named AlgoVoi's `action_ref` construction as the cross-ecosystem standard and confirmed APS ships it as a helper because APS-native format uses a different preimage. This admission was made **after** AlgoVoi's authorship post in the same thread (2026-05-26) and in response to AlgoVoi's 576-vector comment (2026-06-05T00:06Z). Pidlisnyi reviewed AlgoVoi's cross-validation of APS v1 in May 2026 via conformance suite PRs #5 and #6. Full evidence record: `content/diligence-pack/aeoess-agentcore-self-admission-2026-06-05.md`. **Note:** Pidlisnyi did not attribute AlgoVoi as the author — the admission is implicit, not explicit. It is significant precisely because it comes from an adversarial party with direct knowledge of AlgoVoi's prior work. |
Every party who has engaged substantively with the substrate has left a public
record acknowledging AlgoVoi as the author — including parties who have
subsequently disputed aspects of the attribution in other forums.
## See also
* [Application matrix](/application-matrix) — dependency graph, data-flow, and cross-reference table across all packages and platform services
* [Canonicalisation substrate](/canonicalisation-substrate) — the
normative discipline + the 8-impl matrix
* [x402 Document Index](/x402-document-index) — neutral index of all
IETF I-Ds and published specifications in the x402 receipt-format
ecosystem, organised by author and by canonicalisation-anchor citation
* [Substrate Adopters Registry](/adopters) — record of parties
publishing artefacts under `canon_version: jcs-rfc8785-v1`
* [Conformance vectors](/conformance-vectors) — the conformance
corpus (880/880 byte-for-byte cross-impl agreements)
* [Payment Evidence Frame](/payment-evidence-frame) — PEF specification and reference implementation
* [action\_ref verifier](/action-ref-verifier) — hosted public endpoint at `verify.algovoi.co.uk/action-ref`
* [RFC 9421 verifier](/rfc9421-verifier) — hosted public endpoint at `verify.algovoi.co.uk/rfc9421`
* [Audit verifier](/audit-verifier) — the productized verifier
consuming substrate output
* [Ecosystem contributions](/ecosystem-contributions) — full upstream
PR list
* [IETF I-D draft-hopley-x402-canonicalisation-jcs-v1](https://datatracker.ietf.org/doc/draft-hopley-x402-canonicalisation-jcs-v1/) — the canonicalisation discipline itself and the URN registration (Section 10.1)
* [IETF I-D draft-hopley-x402-compliance-receipt](https://datatracker.ietf.org/doc/draft-hopley-x402-compliance-receipt/) — admission-time compliance receipt format
* [JCS 8-impl cross-validation attestation](https://github.com/chopmob-cloud/algovoi-jcs-conformance-vectors/blob/main/_attestations/2026-05-25-8-impl-5-format-cross-validation.md) — 576/576 byte-for-byte agreements record (cumulative across 8 vector sets)
* [RFC 9421 8-impl cross-validation attestation](https://github.com/chopmob-cloud/algovoi-jcs-conformance-vectors/blob/main/_attestations/2026-05-24-rfc9421-8-impl-cross-validation.md) — 24/24 signing-base + content-digest + Ed25519 agreements
* [Scope and domain clarification](https://github.com/chopmob-cloud/algovoi-jcs-conformance-vectors/blob/main/docs/SCOPE-AND-DOMAIN.md) — explicit record of what this JCS application covers and does not cover (payment receipts; not agent identity hashing or transparency log commitments)
## Provenance of this page
Authored 2026-05-24 by AlgoVoi (`chopmob-cloud`). Lives at
`docs.algovoi.co.uk/substrate-authorship-provenance`. Updated when new
substrate artefacts land or when AlgoVoi's coalition position changes.
Last material updates:
* 2026-05-24 \~10:30: Coalition exit recorded; refund receipt v0.1.0
added as the 12th artefact; surface count moved from 12 to 14 with
the addition of refund receipt and its companion IETF I-D.
* 2026-05-24 \~11:20: Canonicalisation discipline I-D added as 14th
artefact (recovers closed-PR-#2436 work under sole AlgoVoi
authorship); surface count moved from 14 to 15. Future receipt
I-Ds normatively reference this discipline I-D instead of
redefining §4 inline.
* 2026-05-25 \~14:30: x402 Document Index published at
`/x402-document-index` cataloguing all 13 IETF I-Ds in x402
namespace (6 AlgoVoi sole-authored + 6 Vauban + 1 Sato/Soos). The
index records anchor-citation coverage: 7 of 12 in-scope
receipt-format I-Ds cite `urn:x402:canonicalisation:jcs-rfc8785-v1`
explicitly; 5 reference the canonicalisation discipline by
terminology and RFC 8785 only, without URN citation. The URN
registration in Section 10.1 of
`draft-hopley-x402-canonicalisation-jcs-v1` is the authoritative
registration; documents using the discipline are encouraged to
cite the URN normatively so cross-spec verifiers can resolve the
registration unambiguously.
* 2026-05-25 \~14:35: Acknowledgments revisions filed:
`draft-hopley-x402-canonicalisation-jcs-v1-02`,
`draft-hopley-x402-compliance-receipt-02`, and
`draft-hopley-x402-refund-receipt-02` filed on IETF datatracker
with Andy Salvo (Crest Deployment Systems LLC) credited for the
`timestamp_ms` epoch-integer canonical preimage convention
(Substrate Rule 2 of the canonicalisation I-D). Acknowledgment
is consistent with how FeedOracle is credited (specific
substantive contribution to the discipline). Substrate-author
position retains sole-AlgoVoi authorship of the discipline
itself; specific contributions are credited at the appendix
layer.
* 2026-05-29: Commit attribution table and third-party acknowledgments section added. Records 111/113 commits (98.2%) as sole AlgoVoi authorship across all 13 substrate repos, plus six independent third-party public acknowledgments of AlgoVoi authorship. Full forensic detail in the internal diligence pack at `content/diligence-pack/AUTHORSHIP-PROVENANCE-REPORT.md`.
* 2026-05-30: `algovoi-pef@0.1.0` published (PyPI + npm). IETF I-D `draft-hopley-x402-payment-evidence-frame-00` posted (seventh AlgoVoi I-D). PQC cross-product matrix expanded to 48/48 (6 producers x 8 verifiers; Go + Rust added). Cumulative JCS cross-validation: 576/576 across 8 vector sets. Artefact table extended to row 37; commit attribution live-verified and updated to 139/141 (98.6%) across 14 substrate repos. AGT #814 comment corrected to current figures.
* 2026-05-31: `algovoi-receipt-verifier@0.1.0`, `algovoi-webhook-verifier@0.1.0`, and `algovoi-receipt-sentinel@0.1.0` published to PyPI + npm (sole AlgoVoi authorship, Apache 2.0). Artefact table extended to rows 40–42. Commit attribution updated to 17 repos, 153/155 (98.7%). Package suite: 28 packages, 14 PyPI + 14 npm namespaces. `/application-matrix` added to See also.
* **2026-06-02**: VCX PR #2544 recorded. 9 AlgoVoi PRs (all CI-green) were closed the same day the VCX PR was opened, implementing a JCS+SHA-256 pipeline. AlgoVoi noted on the thread that it had published related work earlier (IETF draft dates 2026-05-29/30, PyPI package dates 2026-05-23/25, live server file timestamps May 16). Full diligence records at `content/diligence-pack/vcx-attribution-incident-2026-06-02.md` and `content/diligence-pack/x402-pr-closure-record-2026-06-02.md`. Resolved 2026-06-22: AlgoVoi considers the matter closed; the PR's current revision implements RFC 8785 + the MIT `canonicalize` library independently and adds a References / Public Standards section and NOTICE.
* **2026-06-03**: AlgoVoi noted its earlier published work to the x402 maintainers at 14:03 UTC, and via the submitter's published contact channel; no PR withdrawal requested. At 16:38 UTC, a maintainer posted on PR #2544 notifying the team to review. Resolved 2026-06-22: AlgoVoi considers the matter closed. Upstream silence maintained per policy.
* **2026-06-04**: **PQC / ZKP / Federation layer.** Artefact table extended to rows 43–49. Two new IETF I-Ds filed (ninth + tenth AlgoVoi Independent Submissions): `draft-hopley-x402-pqc-credential-binding-00` and `draft-hopley-x402-federation-zkp-00`. IACR ePrint 2026/109852 submitted (under editor review). Two new Commercial License v1.0 packages deployed to production: `algovoi-federation-validator` v0.1.1 (59/59 tests, production) and `algovoi-zkp-receipt` v0.1.0 (13/13 tests, production). ATB ZKP service (Rust / Bulletproofs / Ristretto255) confirmed live in production with Phase 2 cert issuance. Gateway upgraded: `X-ZKP-Receipt-Payload` and `X-Composite-Trust-Verdict` headers added to x402 settlement responses for Phase 2 ATB sessions. `POST /compliance/trust-query` now recognises `zkp_receipt` objects as trust signals (`threshold_met=true → TRUSTED`). Receipt lifecycle table extended with `zkp_receipt_v1`. Substrate diagram updated with PQC/ZKP/Federation layer. Commit attribution updated to 155/157 (98.7%) across 19 substrate repos. LinkedIn article published: [*"Post-Quantum Credentials, Zero-Knowledge Proofs, and Cross-Issuer Federation: What Agentic Payment Standards Need Next"*](https://www.linkedin.com/pulse/post-quantum-credentials-zero-knowledge-proofs-what-agentic-hopley-bp8te/) — public disclosure of PQC/ZKP/Federation layer covering all nine IETF I-Ds, Falcon-1024/ML-DSA-65 credential binding, Bulletproofs range proofs, and cross-issuer federation across x402, AP2, MPP, and A2A.
* **2026-06-16**: **Vauban crate evidence + VCX-Vauban named link.** "Notable: vauban-org competing substrate" section extended with `vauban-x402-jcs-conformance 0.1.0` (crates.io, published 2026-05-24, tarball SHA-256 `188dc67c31a4252ce7d1a55b6cbfd58d42759a83563ab4da8ffbfd6d02f61e75`): the crate self-identifies as the "5th-implementation runner" (matching the label from seritalien's edited comment `4505674559` preserved in GitHub `userContentEdits`), references `expected_jcs_bytes_b64` (AlgoVoi's vector field, first committed 2026-05-23) as the field format it consumes from unnamed "publicly available conformance suites," and explicitly names PR #2412 (AlgoVoi's Axis 0 substrate vectors PR) while omitting AlgoVoi's name. Published on the same day as the four-surface scrub; no NOTICE file. crates.io is append-only and cannot be scrubbed; this is the immutable successor to gist `b0b86baabae3` (observed HTTP 404 on 2026-06-11). Coalition Engagement Log updated with 2026-06-16 VCX stance comment (`4720862348`) and documented VCX-to-Vauban link (the PR author names the Vauban contributor in acknowledgments; the 2026-06-02 batch closure names both parties). PR #2544 comment anchor table updated. (The VCX PR #2544 attribution matter is resolved — see the 2026-06-22 Resolution entry in the timeline.) Full diligence record: `evidence/diligence-pack/vauban-crate-content-extract-2026-06-16.md`.
***
## Coalition Engagement Log
Public claims made by third parties about AlgoVoi-authored concepts. AlgoVoi policy: single reply pointing to this page, then silence. No public arguments. Every incident logged here for diligence.
| Date | Platform | Actor | Claim | Verified fact |
| ----------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| 2026-06-01 | [crewAIInc/crewAI discussion #4232](https://github.com/crewAIInc/crewAI/discussions/4232#discussioncomment-17139124) | kenneives (AgentGraph) | Cited `draft-giskard-aeoess-action-ref` as the IETF I-D source for `action_ref` | `draft-giskard-aeoess-action-ref` confirmed non-existent on IETF datatracker (2026-06-01). Correct I-D: [`draft-hopley-x402-canonicalisation-jcs-v1`](https://datatracker.ietf.org/doc/draft-hopley-x402-canonicalisation-jcs-v1/) `-00` submitted 2026-05-24, current `-04` 2026-05-29. Any coalition submission would postdate our `-00` by a minimum of 8 days. kenneives [acknowledged the correction](https://github.com/crewAIInc/crewAI/discussions/4232#discussioncomment-17139409) the same day: *"you're right... calling it a published IETF I-D was ahead of reality on my part. The `action_ref` construct itself does appear in a real datatracker doc, `draft-hopley-x402-canonicalisation-jcs-v1`."* |
| 2026-06-02 | [x402 PR #2544](https://github.com/x402-foundation/x402/pull/2544) | VCX PR author | Filed VCX PR #2544 implementing a JCS+SHA-256 envelope-digest pipeline (`sha256:` prefix, `settled_payment_ref`, `SETTLED / PENDING_FINALITY / REVERSED`, content-addressed audit references); 9 AlgoVoi PRs were closed the same day. | AlgoVoi's related work was published earlier: `algovoi-substrate 0.3.0` (PyPI 2026-05-23: `sha256_jcs()`, `content_hash`, `prev_hash`); `algovoi-settlement-attestation 0.1.0` (PyPI 2026-05-25: `SETTLED / PENDING_FINALITY / REVERSED`, `settled_payment_ref`); live server files 2026-05-16; IETF drafts 2026-05-29/30. AlgoVoi engaged on the PR (6 comments), noting its earlier published work. (Resolved 2026-06-22: the PR's current revision adds a References / Public Standards section and NOTICE citing RFC 8785 and the MIT `canonicalize` library, implemented independently; AlgoVoi considers the matter closed, authorship resting on the dated prior-art above.) Full record: `content/diligence-pack/vcx-attribution-incident-2026-06-02.md` + `content/diligence-pack/x402-pr-closure-record-2026-06-02.md`. |
| 2026-06-03 | [microsoft/agent-governance-toolkit Discussion #276](https://github.com/microsoft/agent-governance-toolkit/discussions/276#discussioncomment-17170300) | `Rul1an` (NONE) | Described `action_ref = SHA-256(JCS(...))` as *"giskard09's"* in a comment on architectural binding of decision records to execution outcomes. | **Contradiction on the record:** giskard09's argentum-core `action_ref` was **colon-concatenation** until he migrated it to JCS+SHA-256 on 2026-05-19 (commit `77a10ff`, message: *"correct action\_ref derivation to JCS+SHA-256 (was colon-concat)"*) — i.e. **after** AlgoVoi's JCS substrate was public (gist 2026-05-16). The JCS canonicalisation discipline `action_ref` relies on is AlgoVoi-authored (`algovoi-substrate 0.3.0`, PyPI 2026-05-23; `draft-hopley-x402-canonicalisation-jcs-v1`, IETF 2026-05-24). On 2026-05-23 the same actor claimed argentum-core's `action-ref.md` was *"predating AlgoVoi substrate involvement"* and asked to be cited *"as the origin"* (A2A #1734, comment `17034900`, body SHA-256 `ab02e39b1e8c702d3acf13961b70c406b2ee65b24ea91a220fdd940b2a4382b2`; cite-as-origin `17035163`, `2f994f2af4935302c9e087fda1e9dcc9bdbcf007da13dff6ce4157de7a3ba342`) — a claim his own 2026-05-19 commit contradicts. No further reply — one-reply policy applies; two replies already made on this thread. |
| 2026-05-10 – 2026-06-05 | microsoft/semantic-kernel [#13957](https://github.com/microsoft/semantic-kernel/issues/13957), finos/ai-governance-framework [#296](https://github.com/finos/ai-governance-framework/issues/296), langchain-ai/langgraph [#7687](https://github.com/langchain-ai/langgraph/issues/7687), crewAIInc/crewAI [#4877](https://github.com/crewAIInc/crewAI/issues/4877) | `giskard09` (NONE), `aeoess` (NONE), `arian-gogani` (NONE) | Coalition promoted `action-ref-v1.0` (argentum-core commit `71c01e8`) as the canonical spec for `SHA-256(JCS({agent_id, action_type, scope, timestamp_ms}))` — across four major framework threads simultaneously. giskard09 announced `draft-giskard-action-ref-00` "in preparation, co-authored with @aeoess." arian-gogani cited "16/16 byte-identical validation" against giskard09's fixtures. **Update 2026-06-05:** Following AlgoVoi's field-name challenge on SK #13957, giskard09 publicly clarified that `action-ref-v1.0` hashes an **RFC 3339 string** (`"2026-05-15T10:00:00.123Z"`) — not an epoch-millisecond integer. This confirms the two specs produce different SHA-256 digests and are incompatible. However, giskard09's co-author aeoess (Pidlisnyi) publicly named the **epoch-millisecond integer** form (`timestamp_ms`) as the "cross-ecosystem correlation key" on the same day — identifying AlgoVoi's form, not `action-ref-v1.0`, as the ecosystem standard. The coalition's co-authors describe different formats as the cross-ecosystem key. [Giskard09 clarification](https://github.com/microsoft/semantic-kernel/issues/13957#issuecomment-4632209910) · [AlgoVoi contradiction post](https://github.com/microsoft/semantic-kernel/issues/13957#issuecomment-4632267250) | Misattribution resolved by giskard09's own clarification: `action-ref-v1.0` and `draft-hopley-x402-canonicalisation-jcs-v1 §4` are confirmed distinct constructions. aeoess's Jun 5 self-admission identifies AlgoVoi's epoch-ms integer form as the cross-ecosystem standard — not the RFC 3339 string form in `action-ref-v1.0`. Full evidence record: `content/diligence-pack/giskard09-action-ref-capture-2026-06-05.md`. |
| 2026-06-05 | [awslabs/agentcore-samples Issue #1546](https://github.com/awslabs/agentcore-samples/issues/1546) | Tymofii Pidlisnyi (AEOESS, identity confirmed via IETF datatracker author field on `draft-pidlisnyi-aps-01`) | Pitched `agent-governance-spec/aps-x402-composition` (2 commits) to AWS Labs as an official AgentCore Payments sample. Repo uses `canonicalizeJCS()` and the exact "byte-for-byte on every null-free input" framing from AlgoVoi's cross-validation documentation with no attribution. In the thread, described `rfc8785@0.1.4` as *"the x402 substrate's own canonicalizer"* (community property framing) and described arian-gogani/nobulex's matching `SHA-256(JCS({agent_id, action_type, scope, timestamp_ms}))` construction as *"independent convergence"*. | Timestamped prior art: gist [`5f35eaa527d292bf3ddc52f8725a85c9`](https://gist.github.com/chopmob-cloud/5f35eaa527d292bf3ddc52f8725a85c9) (2026-05-16, public) records AlgoVoi running 14/14 APS v1 cross-validation checks two days after `draft-pidlisnyi-aps-01` was filed — Pidlisnyi reviewed PRs #5 and #6 to the conformance suite before coalition exit 2026-05-24. Note: `draft-pidlisnyi-aps-01` was filed 2026-05-14, before `algovoi-substrate 0.3.0` PyPI publication (2026-05-23) but after AlgoVoi's production implementation was running (May 16 server timestamps). Five AlgoVoi attribution comments on permanent record (2026-05-26, 2026-05-30, 2026-06-04, 2026-06-05 × 2). On 2026-06-05 Pidlisnyi publicly named AlgoVoi's construction the "cross-ecosystem correlation key" and admitted APS ships it as `computeExternalActionRefV1` because the APS-native format differs — see self-admission row above. Full evidence record: `content/diligence-pack/aeoess-agentcore-self-admission-2026-06-05.md`. |
| 2026-06-07 | Cross-thread sweep — [crewAI #5802](https://github.com/crewAIInc/crewAI/issues/5802), [crewAI #5888](https://github.com/crewAIInc/crewAI/issues/5888) + [PR #6030](https://github.com/crewAIInc/crewAI/pull/6030), [crewAI #4877](https://github.com/crewAIInc/crewAI/issues/4877), [A2A #1850](https://github.com/a2aproject/A2A/issues/1850), [A2A #1893](https://github.com/a2aproject/A2A/issues/1893), [A2A #1734](https://github.com/a2aproject/A2A/discussions/1734), [finos #296](https://github.com/finos/ai-governance-framework/issues/296), [ag2 #2942](https://github.com/ag2ai/ag2/issues/2942), [SK #14056](https://github.com/microsoft/semantic-kernel/issues/14056), [autogen #7492](https://github.com/microsoft/autogen/issues/7492) | giskard09, aeoess, arian-gogani, nagasatish007, rpelevin, azender1, christopher-h-johnson (all NONE) | AlgoVoi's `action_ref` (`SHA-256(JCS({agent_id, action_type, scope, timestamp_ms}))`), the JCS canonicalisation discipline, and the receipt formats presented as the actors' own specs / attributed to competitors / proposed as standards, with no AlgoVoi or `draft-hopley` attribution. Notable: a **joint `draft-giskard-aeoess-action-ref`** that lists AlgoVoi only as a "byte-identical verifier" (A2A #1850, giskard09, comment SHA `cdeaa20e…`); an explicit **lineage reversal** — *"action-ref.md … predating AlgoVoi substrate involvement … the spec did not adopt the implementations"* (A2A #1734, giskard09, SHA `ab02e39b…`) plus a request to cite action-ref.md *"as the origin of that pattern … in the IETF record"* (SHA `2f994f2a…`); and **PR #6030** landing AlgoVoi's `params_hash = SHA-256(JCS(params))` + fail-closed `expires_at` + decision/outcome record-pair into CrewAI core crediting only Neura Relay + `draft-farley-acta` (`governance_decision.py` blob `314ece89…`). | Adoption is welcomed under Apache-2.0; the recorded item is the attribution gap. **52 comment SHA-256 anchors + PR #6030 body and 3 git-blob SHAs captured and author-verified 2026-06-07** (issue/PR: `gh api …/issues/comments/ -t '{{.body}}' \| sha256sum`; discussion: GraphQL `databaseId` body `\| head -c -1 \| sha256sum`; both validated against prior ledger hashes). The ecosystem standardised on AlgoVoi's exact parameters — epoch-millisecond integer `timestamp_ms`, single-string `scope` — per `draft-hopley-x402-canonicalisation-jcs-v1 §4` and `algovoi-substrate 0.3.0` (PyPI 2026-05-23). Full record (every id, author, verbatim quote and SHA): `content/diligence-pack/action-ref-capture-master-evidence-2026-06-07.md`. |
| 2026-06-08 | [a2aproject/A2A Discussion #1920](https://github.com/a2aproject/A2A/discussions/1920) | `kenneives` (AgentGraph, NONE) | Opened a v0.4 `transactional` claim\_type RFC consolidating AlgoVoi's production model as the coalition's collective spec: a two-layer attestation (L1) plus execution-time receipt (L2) referencing L1 by hash; `action_ref` content-addressed correlation "citing both methods symmetrically rather than one as origin" (APS §4.1 plus argentum-core); `binding_digest = sha256(JCS(charge_ref, amount_usd, subject_did, nonce))`; an exactly-once guard keyed on `action_ref` (PENDING to COMMITTED); a verifier-attestation admission gate with static cap plus dynamic limit and settlement binding; and cross-chain receipt portability. Named leads are Vauban (seritalien) and Concordia (Erik Newton), with kenneives driving the receipt-envelope and Trust Score v2 composition and aeoess / azender1 / evidai contributing; AlgoVoi excluded as origin. | Adoption is welcomed under Apache-2.0; the recorded item is the explicit origin-neutralisation. AlgoVoi prior art predates the RFC by roughly two weeks: the two-phase admission-to-settlement lifecycle in `draft-hopley-x402-settlement-attestation` (IETF POSTED 2026-05-24) and `algovoi-settlement-attestation 0.1.0` (`SETTLED / PENDING_FINALITY / REVERSED`, PyPI 2026-05-25); `action_ref` and the JCS Substrate Rule 2 in `draft-hopley-x402-canonicalisation-jcs-v1 §4` (IETF 2026-05-24) and `algovoi-substrate 0.3.0` (PyPI 2026-05-23); and post-settlement composite-trust wiring (`X-Composite-Trust-Verdict`, 2026-06-04). Opened 16:41 UTC, after AlgoVoi's same-shape pre-execution-versus-finality contribution on AP2 #275 (16:13 UTC). SHA-256 anchors: discussion body `0416217021f1f9862829c1ad7c6b94689ce1a05c2b354bd43bbc940b5d6ef25b`; azender1 exactly-once comment `81c4bf81753de56c4945fdb81f6a4e2b9cce1ab787acdb0535d4c25057fabca3`. Full record: `content/diligence-pack/action-ref-capture-master-evidence-2026-06-07.md` (2026-06-08 addendum, item 3). |
| 2026-06-16 | [x402 PR #2544](https://github.com/x402-foundation/x402/pull/2544) | `chopmob-cloud` | AlgoVoi posted stance comment `4720862348` rejecting the "comment-period contributor" framing in the PR acknowledgments. | Comment on the record: peer-contributor framing declined; AlgoVoi aligns its code and conformance vectors as it sees fit. (Resolved 2026-06-22: AlgoVoi considers the matter closed.) The PR acknowledgments name a Vauban contributor as an equal comment-period contributor alongside AlgoVoi, providing a documented VCX-to-Vauban link. Separately confirmed on the same day: a maintainer's 2026-06-02 batch closure named both AlgoVoi and the Vauban contributor in the same group; the Vauban crate `vauban-x402-jcs-conformance 0.1.0` (published 2026-05-24) and VCX PR #2544 (committed 2026-06-02) both implement RFC 8785 JCS. Evidence record: `evidence/diligence-pack/vauban-crate-content-extract-2026-06-16.md`. |
***
Apache 2.0 except where individual package LICENCE files specify
otherwise.
***
## Third-Party Adoption Evidence
*Independently verified on 2026-06-04 via GitHub code search and direct file fetch. All repos below use AlgoVoi substrate patterns in production or published code.*
### Confirmed adoptions (6 external repos, 13 files)
| Repo | Language | Pattern | File |
| -------------------------------------------- | ----------- | ------------------------------------------------------------------------------------------------ | ---------------------------------------------------- |
| `arcanesys/nixfleet` | Rust | `pub fn sha256_jcs_hex` — direct port of AlgoVoi canonicalize | `crates/nixfleet-canonicalize/src/lib.rs` |
| `arcanesys/nixfleet` | Rust | `pub fn sha256_jcs` — routes through `sha256_jcs_hex` | `crates/nixfleet-agent/src/evidence_signer.rs` |
| `agentveil-protocol/agentveil-sdk` | Python | `def sha256_jcs(value: Any) -> str` + `HASH_PREFIX = "sha256:"` | `classification.py` |
| `agentveil-protocol/agentveil-sdk` | Python | `GENESIS_PREV_EVENT_HASH = "sha256:" + hashlib.sha256(...)` + audit chain with `prev_event_hash` | `evidence/store.py` |
| `aeoess/agent-passport-system` | TypeScript | `sha256_jcs: string` field + `sha256_jcs` in conformance runner (5 matches) | `src/core/canonical-jcs.ts`, `conformance-runner.ts` |
| `faramesh/faramesh-core` | Go | `CanonicalizationJCS = "jcs-rfc8785-v1"` constant; `canonicalize.JCSMarshal` pattern | `internal/core/dpr/record.go` |
| `vauban-org/x402-stark-receipts-conformance` | Multi | `canon_version: "jcs-rfc8785-v1"` + `action_ref = SHA-256(JCS(preimage))` derivation | `manifest.json`, `ADOPTERS.md` |
| `agentgraph-co/agentgraph` | Python / JS | `CANONICALIZATION = "jcs-rfc8785-v1"` + `envelopeDigest` function | `src/trust/envelope_v2.py`, `sdk/js/src/verify.js` |
### Notable: vauban-org competing substrate
Vauban Pay (`seritalien`) has published a competing "authoritative" conformance suite ([`vauban-org/x402-stark-receipts-conformance`](https://github.com/vauban-org/x402-stark-receipts-conformance), repo created 2026-05-24) and substrate package (`@vauban-pay/substrate@0.1.0` on npm), positioning "Vauban Pay as primary author of the specification track." Its Reference Implementation Matrix folds in AlgoVoi-authored material with no attribution: the vector sets `action_ref_namespace_v0`, `action_ref_transactional_v0`, and `compliance_receipt_v1`; the 192/192 8-implementation cross-validation result; and the "non-overlapping authoring entities" framing. `compliance_receipt_v1` is labelled "Compliance receipt format per IETF I-D."
Dated provenance, all predating the 2026-05-24 repo creation:
* The three vector sets are AlgoVoi-authored in [chopmob-cloud/algovoi-jcs-conformance-vectors](https://github.com/chopmob-cloud/algovoi-jcs-conformance-vectors), first committed 2026-05-23.
* The 192/192 8-implementation attestation is AlgoVoi's: [2026-05-24-8-impl-cross-validation.md](https://github.com/chopmob-cloud/algovoi-jcs-conformance-vectors/blob/main/_attestations/2026-05-24-8-impl-cross-validation.md).
* "Compliance receipt format per IETF I-D" is [`draft-hopley-x402-compliance-receipt`](https://datatracker.ietf.org/doc/draft-hopley-x402-compliance-receipt/), sole AlgoVoi (Christopher Hopley) authorship.
* `seritalien` had APPROVED AlgoVoi PR #2436 (2026-05-22) before standing up the competing suite.
No AlgoVoi code is copied: Vauban's package (Apache 2.0), its `settlement-receipt` schema (a distinct six-element Claim model, not the AlgoVoi `SETTLED / PENDING_FINALITY / REVERSED` enum), and its vector files are independently authored. Adoption of the substrate is welcomed under Apache 2.0; the recorded item is the attribution gap, where AlgoVoi-authored conformance material and the 192/192 result are presented under sole "Vauban primary author" framing.
**`vauban-x402-jcs-conformance 0.1.0` on crates.io (2026-05-24, immutable record).** Vauban published a Rust crate to crates.io on 2026-05-24, the same day as the four-surface scrub of PR comments (edits at 11:14Z, 11:48Z, 12:02Z UTC) and the I-D revision removing named AlgoVoi credit. crates.io is append-only: packages can be yanked but not deleted, and tarballs remain permanently downloadable from static.crates.io. Tarball SHA-256 (verified 2026-06-16): `188dc67c31a4252ce7d1a55b6cbfd58d42759a83563ab4da8ffbfd6d02f61e75`; git commit anchor `c25bf63f90d53e5cbd052989f6bbedf4304fb2e8` from `vauban-org/vauban-zkpay`. Evidentiary points: (1) Cargo.toml description self-identifies as "Reference 5th-implementation runner," the same label used in seritalien's edited comment `4505674559` (original body 2026-05-21T07:16:27Z, preserved in GitHub `userContentEdits`); (2) lib.rs docstring references `expected_jcs_bytes_b64`, AlgoVoi's conformance vector field name first committed to the AlgoVoi corpus on 2026-05-23 (one day before the crate), as the field format consumed from "publicly available conformance suites" which are not named in the crate; (3) README explicitly names x402 PR #2412 (AlgoVoi's Axis 0 substrate vectors PR) without naming AlgoVoi as its author; (4) the crate is Apache 2.0 with no NOTICE file attributing AlgoVoi's conformance vector corpus. Gist `b0b86baabae33e289fdb6d2f3fb30130` (the Rust 5th-impl runner that validated 21/21 AlgoVoi vectors, containing explicit AlgoVoi thread links) was observed at HTTP 404 on 2026-06-11 with no Wayback snapshot; the crate occupies the same technical function on a surface that cannot be deleted. GitHub `userContentEdits` preserves all pre-edit comment bodies from the 2026-05-24 scrub; the full capture is in the diligence pack (`evidence/diligence-pack/seritalien-2433-2434-attribution-capture-2026-06-12.md`, captured 2026-06-12). Full crate extract: `evidence/diligence-pack/vauban-crate-content-extract-2026-06-16.md`.
### Notable: nobulex / aeoess action\_ref, co-developed primitive with an attribution gap on the discipline (2026-06-06)
**Context (recorded for accuracy):** the bare `action_ref` derivation is an openly co-developed primitive. The concept originated as a colon-concatenation form attributed to `giskard09`; AlgoVoi contributed the JCS plus integer-millisecond `timestamp_ms` discipline ("Substrate Rule 2") that makes the digest reproducible across implementations. `arian-gogani` (Nobulex) has separately and publicly credited AlgoVoi as the author of the namespace-prefixing convention ([x402 #2332](https://github.com/x402-foundation/x402/issues/2332), 2026-05-23) and adopted `nobulex:bilateral`. AlgoVoi does not claim exclusive authorship of the bare formula; the AlgoVoi-authored layer is the JCS/integer-ms discipline and the conformance corpus below.
This cuts both ways, and the second direction is on the record: the form `arian-gogani` ships is the **epoch-millisecond integer** `timestamp_ms`, which is AlgoVoi's JCS discipline, **not** the RFC 3339 string form used by the `giskard09` / argentum-core lineage that the coalition has elsewhere claimed as the origin of `action_ref` (A2A #1734, "action-ref.md ... predating AlgoVoi substrate involvement"; giskard09's own 2026-06-05 clarification confirms `action-ref-v1.0` hashes an RFC 3339 string). A coalition-adjacent implementation conforming to AlgoVoi's integer-ms form, while the coalition claims a lineage whose form is incompatible with it, is direct evidence that the discipline actually being adopted across the ecosystem is AlgoVoi-authored. Adoption and the lineage-rewrite contradict each other; the adoption is AlgoVoi's form.
On 2026-06-06, `arian-gogani` (Nobulex) posted the `action_ref` derivation, `action_ref = SHA-256(JCS({agent_id, action_type, scope, timestamp_ms}))` with `timestamp_ms` as an epoch-millisecond integer (the AlgoVoi-aligned form), across four AlgoVoi-active threads, shipped as `pip install nobulex`, without AlgoVoi attribution on those posts:
* [microsoft/semantic-kernel #14056](https://github.com/microsoft/semantic-kernel/issues/14056#issuecomment-4640365586)
* [ag2ai/ag2 #2942](https://github.com/ag2ai/ag2/issues/2942#issuecomment-4640367666)
* [awslabs/agentcore-samples #1546](https://github.com/awslabs/agentcore-samples/issues/1546#issuecomment-4640393540)
* [langchain-ai/langgraph #7687](https://github.com/langchain-ai/langgraph/issues/7687#issuecomment-4640417848)
On agentcore-samples #1546 the construction was coordinated with `aeoess` and reframed as APS's "cross-ecosystem correlation key" and nobulex's construction validated against "our fixture set."
The same construction was also filed as a pull request against a standards-authority reference: [OWASP/CheatSheetSeries #2217](https://github.com/OWASP/CheatSheetSeries/pull/2217) (`arian-gogani`, opened 2026-06-06, open as of 2026-06-08) adds `action_ref = SHA-256(JCS({agent_id, action_type, scope, timestamp_ms}))` verbatim, with `timestamp_ms` as an epoch-millisecond integer, to the AML/Sanctions AI Agent Payments cheat sheet, citing EU AI Act Article 12 and ISO/IEC 42001, with the AlgoVoi JCS/integer-ms discipline (the layer that makes the digest reproducible across implementations) uncredited (PR body SHA-256 `19535df0e25280c3d3d6ad90e8d4f76b7c7813e3f9d23aa6a5a3091feefaf54b`; commit `188cdc7e7e51c0ccba7f7f2f92a925aa41b1aee2`).
Adoption of the primitive is welcomed under Apache 2.0; the recorded item is the attribution gap on the AlgoVoi-authored layer. The conformance corpus is AlgoVoi-authored: the `action_ref_namespace_v0` anchor set in the [conformance vector corpus](https://github.com/chopmob-cloud/algovoi-jcs-conformance-vectors/tree/main/vectors/action_ref_namespace_v0), the discipline specified in [`draft-hopley-x402-canonicalisation-jcs-v1`](https://datatracker.ietf.org/doc/draft-hopley-x402-canonicalisation-jcs-v1/) (IETF Independent Submission, sole AlgoVoi authorship), and the live derivation endpoint at [verify.algovoi.co.uk/action-ref](https://verify.algovoi.co.uk/action-ref). Byte-identical output against that corpus is AlgoVoi-authored bytes; the dated authored fixture set is AlgoVoi's.
### Notable: A2A #1920 "v0.4 transactional" — the JCS+SHA-256 receipt construction adopted across four implementations under a symmetric-origin citation (2026-06-15)
[a2aproject/A2A Discussion #1920](https://github.com/a2aproject/A2A/discussions/1920) (*"RFC: v0.4 `transactional` claim\_type — a per-action receipt layer for trust-gated payments"*, opened 2026-06-08, **23 comments as of 2026-06-15**) consolidates a per-action receipt seam built on the AlgoVoi JCS+SHA-256 construction. The binding digest used throughout is `binding_digest = sha256(JCS({amount_usd, charge_ref, nonce, subject_did}))` (RFC 8785 canonical JSON + SHA-256), and the correlation primitive is a content-addressed `action_ref`. Four mutually-untrusting implementations — AgentGraph, LemonCake, SafeAgent, and agentid — cross-validate their digests **byte-for-byte on a fresh clone**, which is the AlgoVoi conformance methodology (the same fresh-clone byte-reproduction bar AlgoVoi publishes against its corpus).
**Citation form.** The thread attributes `action_ref` to APS (`draft-pidlisnyi-aps-01 §4.1`) and argentum-core (`action-ref-v1`), "cit\[ed] both methods symmetrically rather than one as origin" (opener item 5; restated by `haroldmalikfrimpong-ops` 2026-06-11, comment body SHA-256 `3a87e36ad355febdc6abe2ad817268267676700592a0a80d6b846d40829985c1`). [`draft-pidlisnyi-aps-01`](https://datatracker.ietf.org/doc/draft-pidlisnyi-aps/) (T. Pidlisnyi; -00 submitted 2026-03-27, -01 submitted 2026-05-14) §4.1 "Action Reference Computation" does specify `action_ref = SHA-256(canonicalize(input_object))` with canonicalisation per RFC 8785 — but over a **different preimage**: `{agentId, actionType, scopeRequired, timestamp}` (camelCase, `scopeRequired`, plain `timestamp`), **not** the AlgoVoi `{agent_id, action_type, scope, timestamp_ms}` (snake\_case, single-string `scope`, integer epoch-millisecond `timestamp_ms`). The two `action_ref` derivations are therefore **not byte-identical** — which the thread itself acknowledges (`haroldmalikfrimpong-ops`, above: "the APS `draft-pidlisnyi-aps-01` preimage differs and is named symmetrically"). AlgoVoi does **not** claim authorship of the bare "SHA-256 over JCS-canonical fields" method; APS specifies its own variant, and its draft series predates AlgoVoi's earliest public `action_ref` disclosure.
**Convergence toward the AlgoVoi form, dated 2026-06-15.** On 2026-06-15 (`azender1`, comment body SHA-256 `ec4a01ef14339482d6835a2ba9543a3413220ffde7ae7866ac5f9623887a712a`) SafeAgent fixed a collision bug by migrating its identifier from an unescaped colon-concatenation `f"{agent_id}:{action_type}:{scope}"` to `SHA256(JCS({agent_id, action_type, scope}))`, "matching the v1.1 fixture's construction." This is the same colon-concat → JCS+SHA-256 correction the `giskard09` / argentum-core lineage itself made on **2026-05-19** (commit `77a10ff`, *"correct action\_ref derivation to JCS+SHA-256 (was colon-concat)"*) — recurring almost a month later, because the concatenation form does not cross-validate and the JCS discipline does. The same comment stands up a "Mycelium Trails" write path posting `action_ref`-keyed records to `argentum.rgiskard.xyz`. A later normative revision (`kenneives` 2026-06-14, comment body SHA-256 `734edaef8c9f778f5f8b5aeb6fb0c73992b06b5093043e9bbd3e1237acc586af`) makes the `nonce`-in-the-`binding_digest`-preimage and the `action_ref`-keyed exactly-once guard normative requirements.
**What AlgoVoi authored, scoped precisely.** Not the bare JCS-over-fields method — APS published its own variant earlier, and the bare formula is openly co-developed (see the nobulex / aeoess note above). The AlgoVoi-authored layer is the specific **snake\_case integer-millisecond construction** (`{agent_id, action_type, scope, timestamp_ms}`, integer epoch-ms `timestamp_ms`; "Substrate Rule 2") and the multi-implementation **conformance corpus** that makes that exact digest reproducible byte-for-byte: the `action_ref_namespace_v0` anchor set in the [conformance vector corpus](https://github.com/chopmob-cloud/algovoi-jcs-conformance-vectors/tree/main/vectors/action_ref_namespace_v0), the discipline in [`draft-hopley-x402-canonicalisation-jcs-v1`](https://datatracker.ietf.org/doc/draft-hopley-x402-canonicalisation-jcs-v1/) §4 (IETF Independent Submission, -00 posted 2026-05-24, sole AlgoVoi authorship), the public validation gist [`5f35eaa…`](https://gist.github.com/chopmob-cloud/5f35eaa527d292bf3ddc52f8725a85c9) (2026-05-16), `algovoi-substrate 0.3.0` ([PyPI](https://pypi.org/project/algovoi-substrate/), 2026-05-23, Apache-2.0), and the live endpoint at [verify.algovoi.co.uk/action-ref](https://verify.algovoi.co.uk/action-ref). The thread's `binding_digest` and the SafeAgent migration below adopt exactly this snake\_case integer-ms JCS+SHA-256 construction, not the APS camelCase variant.
The argentum-core `action-ref.md` lineage specifically (distinct from APS) used colon-concatenation until commit `77a10ff` on 2026-05-19 — postdating AlgoVoi's 2026-05-16 gist on the JCS form. Adoption of the construction is welcomed under Apache 2.0; the recorded item is the attribution gap on the AlgoVoi-authored snake\_case integer-ms discipline and conformance corpus. Byte-identical output against the AlgoVoi corpus is AlgoVoi-authored bytes.
### Notable: foxbook — positive "AlgoVoi-shape" attribution (2026-06-03)
`cloakmaster/foxbook` (Benjamin Bandali; *"Verifiable agent identity for A2A and MCP"*, Apache 2.0, repo created 2026-04-21) publicly credits the **AlgoVoi composition / "AlgoVoi-shape"** for its composable settlement-evidence integration. On [foxbook Discussion #79](https://github.com/cloakmaster/foxbook/discussions/79) (2026-06-03, comment body SHA-256 `3c863411a3f42b7f590264ec565f4eaca060712ce3cbc299ac1221ae19a89640`) the maintainer ratified *"the AlgoVoi composition against the already-accepted typed-reference v1.0 shape,"* naming AlgoVoi as the integrator layer. Related: [A2A #1803](https://github.com/a2aproject/A2A/discussions/1803) (`x-foxbook` v1 identity primitive).
This is a **positive-attribution** signal — the construction is credited to AlgoVoi by name, the intended outcome of Apache-2.0 publication — recorded as adoption evidence, in contrast to the unattributed reframes above.
**Caveats (recorded for accuracy):** (1) foxbook's ratification lists `@kenneives` (substrate-layer reviewer), a coalition-adjacent party — so this is **not** a fully arm's-length independent adopter. (2) foxbook's separate claim (A2A #1803) that an `x-foxbook` block is *"live at api.algovoi.co.uk"* is **not corroborated** by the AlgoVoi agent card (`/.well-known/agent.json` contains no foxbook reference); that specific claim is unverified and is not asserted here.
### Notable: EPI / `mohdibrahimaiml` — arm's-length positive attribution and adoption (2026-06-08)
On [microsoft/agent-governance-toolkit Discussion #806](https://github.com/microsoft/agent-governance-toolkit/discussions/806) (".epi artifact format for portable compliance evidence output"), AlgoVoi noted on 2026-05-30 (comment body SHA-256 `7ccfe491d2246d49ed22de0e8690b51fe20a6cd841c8c6b18f1fb4cc2fcd7570`) that the load-bearing question for a portable compliance artefact is canonicalisation — that byte-identical artefacts from the same input across independent implementations require a deterministic canonicaliser (JCS RFC 8785), as specified in `compliance-receipt-v1` and `draft-hopley-x402-settlement-attestation`.
On 2026-06-08 the EPI author (`mohdibrahimaiml`) **acted on that feedback and credited it** ([comment](https://github.com/microsoft/agent-governance-toolkit/discussions/806#discussioncomment-17217619), body SHA-256 `c157cf026195612fffdc302b6f7115af0f470643a4f63e805fb68e17737e9cd0`): *"Good catch on canonicalization. I audited the implementation against the repo, and the points you raised were real enough to act on."* EPI now ships **deterministic canonical hashing with documented normalization rules, explicit field exclusions, formal conformance vectors, and offline Ed25519 verification** (new `epi_core/serialize.py` fix + `docs/EPI-CANONICAL-HASH.md`), and the author frames AlgoVoi's receipt model as the reference ("where EPI still diverges from **your receipt model**" — raw Ed25519 vs JWKS/JWS, no closed claim enum, no Object-Lock retention), proposing a **shared conformance fixture** (same input, independent implementations, identical `frame_id`).
This is a **fully arm's-length positive-attribution and adoption** signal — an independent maintainer adopting AlgoVoi's JCS canonicalisation discipline, by name, after the fact, with no coalition-adjacent reviewer in the loop (the cleaner counterpart to the foxbook signal above). It is the intended outcome of Apache-2.0 publication, and it stands in direct contrast to the unattributed reframes recorded above.
***
## Published Package Adoption
*GitHub code search scan conducted 2026-06-04. PyPI + npm download data as of same date.*
### Summary
| Package | PyPI/month | npm/month | GitHub refs | Notable public listings |
| ------------------------------------------ | ---------- | --------- | ----------- | --------------------------------------------------------------------------------- |
| `algovoi-mcp` / `@algovoi/mcp-server` | 974 | 1,210 | 5 repos | TensorBlock/awesome-mcp-servers (725 ★), electric-capital/open-dev-data (1,941 ★) |
| `algovoi-substrate` / `@algovoi/substrate` | 929 | 773 | 0 public | — (private usage inferred from downloads) |
| `algovoi-rfc9421-verifier` | 682 | 508 | 0 public | — |
| `algovoi-audit-verifier` | 389 | 397 | 1 (mirror) | PyDigger metadata index |
| `algovoi-settlement-attestation` | 367 | 261 | 0 public | — |
| `algovoi-composite-trust-query` | 326 | 258 | 0 public | — |
| `algovoi-receipt-verifier` | 140 | 68 | 1 (mirror) | PyDigger metadata index |
| `@algovoi/substrate-pqc` | — | 403 | 0 public | — |
| `@algovoi/webhook-verifier` | — | 62 | 0 public | — |
### MCP Server — confirmed public listings
**[electric-capital/open-dev-data](https://github.com/electric-capital/open-dev-data)** (1,941 ★)
Indexes `chopmob-cloud/AlgoVoi-MCP-Server` in the Algorand ecosystem under `#sdk` and `#tools` taxonomy. Used for ecosystem developer-count attribution.
**[TensorBlock/awesome-mcp-servers](https://github.com/TensorBlock/awesome-mcp-servers)** (725 ★)
Listed under Finance & Crypto with install instructions for both `npx @algovoi/mcp-server` and `uvx algovoi-mcp`. Describes multi-chain x402/MPP/AP2 payment gateway across 7 chains with on-chain settlement verification.
### Download volume vs GitHub visibility gap
GitHub code search is blind to private repositories, internal forks, and air-gapped deployments. Download volumes for compliance-adjacent packages (`algovoi-audit-verifier`, `algovoi-settlement-attestation`, `algovoi-composite-trust-query`, `algovoi-substrate-pqc`) indicate active production usage in environments where public source disclosure is neither required nor typical — regulated financial services, enterprise AI pipelines, and sovereign governance deployments.
Total PyPI downloads across all AlgoVoi packages: **18,600+** all-time as of 2026-06-04.
***
## Full Code Pattern Adoption Scan — All Packages
*Conducted 2026-06-04 via GitHub code search across all AlgoVoi published packages. 197 tool calls, 13 verification agents.*
### Tier definitions
| Tier | Meaning |
| -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **T1** | Direct code match — independent repo reproduces the exact function/constant verbatim in a context that can only have originated from AlgoVoi's published implementation |
| **T2** | Pattern / naming match — independent repo implements the same algorithmic pattern or error-code vocabulary without a declared dependency |
| **T3** | Reference / citation only — schema registrations, curated directory listings, standards-document citations; no executable code dependency |
| **none** | No public hits found outside org:chopmob-cloud at time of scan |
### Master table
| Package | Tier | External repos | Key pattern | Notable adoption |
| ---------------------------------------- | ------ | -------------- | ------------------------ | ---------------------------------------------------------------------------------- |
| Substrate (sha256\_jcs / jcs-rfc8785-v1) | **T1** | 7 | , , | arcanesys/nixfleet (Rust port); agentgraph |
| | **T2** | 11 | , , , | ComfyUI-OpenClaw (545★); sipyourdrink-ltd/bernstein (544★); intentproof-sdk-python |
| | **T2** | 2 | RFC 9421 ++, | jschoemaker/Envoys-public (canonical reference); agentgraph-co/agentgraph |
| | **T3** | 4 | JSON Schema registration | SchemaStore/schemastore (3,776★); vscode-schemastore; vauban-org |
| Platform API headers | **T3** | 9 | did:web endpoint | jschoemaker/Envoys-public (3 live test scripts); andysalvo (8/8 JCS PASS) |
| | **T3** | 4 | Directory listing | TensorBlock/awesome-mcp-servers (725★); pab1it0/awesome-a2a (174★) |
| | none | 0 | , | PyPI mirror only |
| | none | 0 | | Zero specific hits (111 false positives on generic HMAC patterns) |
| | none | 0 | , , | IETF bibliography mirrors only |
| | none | 0 | , | IETF bibliography mirror only |
| | none | 0 | , | No public hits |
***
### algovoi-audit-verifier — T2 — 11 external repos
Broadest independent re-implementation footprint of any non-substrate package. The audit-chain vocabulary (, , ) has been independently reimplemented in Python, Rust, and JavaScript across 11 repos — none declare as a package dependency, indicating the pattern has become an informal community standard.
Notable repos:
* **rookiestar28/ComfyUI-OpenClaw** (545★) — with full + chain validation
* **sipyourdrink-ltd/bernstein** (544★) — using the same pattern for knowledge-graph audit integrity
* **intentproof-sdk-python** — + in a signed chained-event SDK; closest structural match
***
### algovoi-compliance-receipt — T3 — SchemaStore (3,776★)
The compliance receipt JSON Schema is formally registered in SchemaStore — the primary editor validation registry for VS Code, JetBrains, and Neovim LSP users globally. Every developer who opens a compliance receipt JSON file in a supported editor gets AlgoVoi schema validation automatically.
***
### algovoi-rfc9421-verifier — T2 — jschoemaker/Envoys-public
Envoys-public runs three live programmatic test scripts against AlgoVoi's production endpoints (, , ), implements a compatible RFC 9421 stack citing AlgoVoi as the canonical reference, and treats as a cross-vendor verification target — the most substantive third-party integration found in the scan.
***
### Platform API headers — PQC/ZKP layer
, , and returned zero hits outside org:chopmob-cloud — these headers were only shipped in production on 2026-06-04. This is expected: no third-party implementation has had time to adopt headers that are days old.
***
### New findings beyond the substrate scan
1. **Audit verifier** has the largest independent re-implementation footprint (11 repos, T2) of any non-substrate package — not visible from the substrate-only scan.
2. **jschoemaker/Envoys-public** is the most substantive external integrator: running live programmatic tests across three AlgoVoi layers simultaneously (API endpoint, RFC 9421 patterns, compliance-receipt schema).
### Private usage gap
Packages with zero or T3 public hits (receipt-verifier, webhook-verifier, CTQ, PEF, refund-receipt) are all post-PQC additions to the stack. Private registries, enterprise forks, and closed-source deployments are not indexed by GitHub code search. The audit-verifier finding (T2, 11 repos, zero declared package dependencies) demonstrates that real integration surfaces can materialize as pattern-level adoption before package-level imports appear in public repositories.
**Total confirmed external repos across all scans: 30+**