> ## Documentation Index
> Fetch the complete documentation index at: https://docs.algovoi.co.uk/llms.txt
> Use this file to discover all available pages before exploring further.

# Substrate Licensing and Attribution

> How AlgoVoi's Apache 2.0 substrate may be used, what attribution the licence requires, and how AlgoVoi handles reuse without it. Read before you build.

AlgoVoi publishes its canonicalisation substrate — the `action_ref`
construction, the JCS (RFC 8785) canonical discipline, the
integer-millisecond timestamp rule, the namespace-prefixing convention,
and the receipt schemas — as **open, Apache-2.0 licensed** work, on
purpose. We want people to build on it. This page exists so that doing
so is straightforward, and so the one obligation the licence carries is
unambiguous.

<Note>
  **The short version.** Build on it freely. Apache-2.0 is permissive — but
  it is **not public-domain**. It requires that the `NOTICE` and origin
  attribution travel with the work. Where our construction is reused
  without that attribution, AlgoVoi will exercise its rights under the
  licence. We would much rather collaborate, and we have offered to.
</Note>

## We are open to working together

This is not a closed substrate. AlgoVoi has, on the public record:

* Published the entire substrate under Apache-2.0 (reference implementations
  on PyPI and npm, conformance corpus, dated IETF Internet-Drafts).
* Set out an explicit **Layer 1 / Layer 2 split** on
  [a2aproject/A2A#1829](https://github.com/a2aproject/A2A/issues/1829):
  the L1 signing base and canonical forms are AlgoVoi-maintained; the L2
  receipt-evidence and policy layers built on top are the **adopters' own
  to design**. AlgoVoi does not claim L2.
* **Offered to support adopters** building L2 layers — co-developing
  conformance vectors with teams that run them, and recording attributed
  implementations in the corpus changelog / adopters list.

That offer stands. Crediting the origin is all it takes to be inside it.

## What the substrate is

The AlgoVoi-authored substrate (Layer 1) is the **authored discipline**,
not the bare public RFCs:

| Element              | What is AlgoVoi-authored                                                                                                                                                                    |
| -------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `action_ref`         | `lowercase-hex(SHA-256(JCS({agent_id, action_type, scope, timestamp_ms})))` — the four-field preimage and its derivation                                                                    |
| Timestamp rule       | **integer epoch-millisecond** encoding (Substrate Rule 2) — pinned so every verifier reproduces the same digest                                                                             |
| Canonical discipline | the JCS RFC 8785 field-name, array-order and type-validation rules around the preimage                                                                                                      |
| Namespace convention | the `"<emitter>:<scope>"` prefixing convention and the published anchor set (`algovoi:compliance_screen`, `vauban:stark_settlement`, `agent_os:committed_claim`, `aura:reputation_observe`) |
| Receipt schemas      | the compliance / settlement-attestation / refund / cancellation receipt field-sets and enums                                                                                                |

The bare methods (RFC 8785, RFC 9421) used **entirely outside** this
discipline are nobody's property and need no attribution. It is the
authored expression above — the field-sets, the integer-ms rule, the
schemas, the anchor set — that the licence and this page concern.

## The provenance is dated and public

Full record, independently verifiable, on
[Substrate Authorship and Provenance](/substrate-authorship-provenance).
Key anchors:

| Anchor                                                                                                            | Date                                    | Surface             |
| ----------------------------------------------------------------------------------------------------------------- | --------------------------------------- | ------------------- |
| First public `action_ref` JCS construction (gist `5f35eaa`, 14/14 vectors)                                        | **2026-05-16**                          | gist.github.com     |
| `algovoi-substrate` reference impl + `action_ref_namespace_v0` conformance set                                    | **2026-05-23**                          | PyPI / npm / GitHub |
| `draft-hopley-x402-canonicalisation-jcs-v1` — specifies the integer-millisecond timestamp rule (Substrate Rule 2) | **2026-05-24** (rev 00; current rev 04) | IETF datatracker    |

## How to comply (the welcoming path)

If you build on the substrate, two things keep you inside the licence and
get you recorded as an attributed adopter:

1. **Preserve the `NOTICE`** — credit AlgoVoi (chopmob-cloud) as the origin
   of the construction in your repository's `NOTICE` file.
2. **Pin by digest** — import the published corpus by content hash
   (`base_vector_set_id` + `base_vector_set_digest`) rather than copying
   bytes. Import-by-hash makes the credit structural and keeps you
   interoperable as the L1 evolves.

Send us the repo / commit and we record the pack in the corpus changelog —
which is also the adopters list.

## How AlgoVoi handles reuse without attribution

Where AlgoVoi's Apache-2.0 expression appears **without** the required
`NOTICE` / attribution, the response is the standard, formal one:

* **Copied Apache-2.0 code or schema text without NOTICE** → a formal
  **Apache-2.0 §4 NOTICE** to the pull-request author and the repository
  maintainers, as AlgoVoi has issued previously on standards-track pull
  requests.
* **Re-implementation of the authored discipline without credit** →
  assertion of authorship via the dated IETF Internet-Draft and prior-art
  record, with a request for attribution.

This is a licensing matter, handled through the proper channel. The
preferred outcome is always a `NOTICE` entry and a digest pin — not a
notice.

## Downstream implementations and attribution status

The following public projects implement, wrap, or reference the
`action_ref` / canonicalisation construction. Status reflects whether
AlgoVoi origin attribution is currently present, on the dated public
record as of 2026-06-16.

| Project (handle)                           | Relationship to the substrate                                                                                                                                                           | Attribution present                                |
| ------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------- |
| **agent-passport-system / APS** (`aeoess`) | separate camelCase preimage; ships `computeExternalActionRefV1` helper explicitly to match AlgoVoi's `timestamp_ms` form (awslabs/agentcore-samples#1546, 2026-06-05)                   | **Partial** — form acknowledged as cross-ecosystem |
| **argentum-core** (`giskard09`)            | `action-ref.md` derivation corrected to JCS+SHA-256 on 2026-05-19 (after the 2026-05-16 gist); `draft-giskard-action-ref` (2026-06-13) reuses the AlgoVoi namespace anchor set verbatim | **Not present**                                    |
| **AgentGraph** (`kenneives`)               | published a mirror of the `draft-giskard-action-ref` repo (2026-06-13); maintains a conformance suite over the construction                                                             | **Not present**                                    |
| **Nobulex** (`arian-gogani`)               | publishes the `SHA-256(JCS({…timestamp_ms}))` form with cross-implementation vectors                                                                                                    | **Not present**                                    |

AlgoVoi welcomes every one of these as an adopter. The only ask is the one
the licence already makes: preserve the `NOTICE`, credit the origin, pin
by digest. Do that, and you move to the attributed-adopters list and stay
fully interoperable as the substrate evolves.

***

*AlgoVoi (chopmob-cloud) — [Substrate Authorship and Provenance](/substrate-authorship-provenance)*