> ## Documentation Index > Fetch the complete documentation index at: https://docs.algovoi.co.uk/llms.txt > Use this file to discover all available pages before exploring further. # Compliance Suite: Setup and Deployment > Install and operate the AlgoVoi Verifiable Compliance Suite: extract the bundle, run the Command Center, set up accounts, roles and two factor sign in. The Verifiable Compliance Suite (AV-VCS) is a single encrypted, offline-verifiable deliverable for regulated long-term data (health, insurance, defense). It ships the post-quantum Substrate-2 core, the Compliance Command Center console, the records and compliance estate, and supply-chain provenance, as one licence-gated `.algv` bundle. Everything runs on your own infrastructure: no account with the vendor, no outbound call, no phone-home. Your Falcon-1024-signed bundle licence is both the decryption key and the runtime licence. *** ## 1. What is in the bundle (25 wheels) | Group | Components | | ------------ | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Core | substrate2 (Falcon-1024 + ML-DSA-65, ML-KEM-1024, JCS, policy binding), substrate2 control plane, retention chain | | Hub | Compliance Command Center (evidence console, posture, records vault command centre, legal holds, disposition, users, two-factor sign-in, SIEM audit forwarding) | | Records | records vault (+ .epi export, volume importer, sealed .acv containers, recovery vault, archive auditor, doc archive + S3/KMS/PKCS11/Vault custody adapters) | | Evidence | sanctions monitor, travel rule, retention app, audit log | | Controls | compliance gate (policy-bound decision engine) | | Supply | SBOM (CycloneDX + SPDX, Falcon-signed SLSA provenance, offline CVE match) | | Continuity | key ceremony (signed key-ceremony + backup/restore attestations) | | Two-factor | TOTP authenticator-app add-on, auto-discovered by the console | | Provisioning | SCIM 2.0 add-on: Okta / Azure AD / OneLogin auto-provision and deprovision, SCIM groups mapped 1:1 onto the fixed RBAC roles, auto-discovered by the console. See [SCIM provisioning](/scim-provisioning) | *** ## 2. Install Prerequisites: a Linux host with Python 3.10+ (Docker optional but recommended for isolation), and your bundle licence saved as `licence.key`. ```bash theme={null} # 1) runtime deps for the extractor and services python -m pip install cryptography pqcrypto rfc8785 fastapi uvicorn httpx # 2) extract + install the wheels (verifies the licence offline, then decrypts with # per-wheel sha256 checks) python algovoi_unbundle.py --license @licence.key --out ./algovoi --install bundle.algv ``` The extractor verifies your Falcon-1024 licence against the embedded issuer key (no network), decrypts, and writes the 25 wheels with integrity checks. It is fully offline and air-gap capable. Every service is licence-gated by the same bundle licence, provided via the environment: ```bash theme={null} export ALGOVOI_LICENSE_KEY="$(cat licence.key)" ``` *** ## 3. First run: the Command Center console The console (the hub) is the operator-facing surface. Point it at a data directory and serve it over TLS. **Required environment** (persist these; the data dir holds keys, records and the audit chain): ``` COMMAND_CENTER_SECRET= # session signing COMMAND_CENTER_DATA_DIR=/data COMMAND_CENTER_KEY_FILE=/data/command-center-key.json COMMAND_CENTER_CONTAINER_DIR=/data/containers COMMAND_CENTER_CONTAINER_RECOVERY_KEY_FILE=/data/escrow-key.json COMMAND_CENTER_RECORDS_DIR=/data/records COMMAND_CENTER_UPDATE_POLICY_FILE=/data/update-policy.json COMMAND_CENTER_INGEST_DIR=/data/evidence-ingest COMMAND_CENTER_ADMIN_USER=admin COMMAND_CENTER_ADMIN_PASS= # bootstraps admin on first run ``` **Serve it** (self-signed TLS shown; use a real certificate in production): ```bash theme={null} uvicorn algovoi_command_center.app:app --host 0.0.0.0 --port 8443 \ --ssl-keyfile /tls/key.pem --ssl-certfile /tls/cert.pem --proxy-headers ``` On first start the `admin` account is bootstrapped from the env. Browse to `https://:8443/` and sign in. **Add the rest of the estate services** (each runs under the same bundle licence, on its own port): ``` algovoi-substrate2-controlplane control panel + policy bridge (8094) records vault 8000 . doc archive 8083 . compliance gate 8086 . audit log 8087 . sanctions 8088 ``` *** ## 4. Accounts, roles and two-factor **Roles.** The console has four roles: **admin**, **compliance officer**, **auditor**, **viewer**. Create accounts on the Users page (admin only). Role separation is enforced: a viewer cannot reach `/users` or user management (it returns 403). **Two-factor sign-in (TOTP).** The console discovers the TOTP add-on automatically (it ships in the bundle). On the Security page each user can **Enroll**: scan the QR code with an authenticator app (Google Authenticator, Authy, 1Password) or type the setup key, then confirm a 6-digit code. Enrollment is opt-in then required per user; once enrolled, password alone cannot sign in. Every enrollment and two-factor sign-in is written to the signed console audit chain. **SCIM auto-provisioning (optional).** The console discovers the SCIM 2.0 add-on automatically when it ships in the bundle, exposing a `/scim/v2` endpoint your identity provider (Okta, Azure AD, OneLogin) uses to create, update and deactivate accounts. It authenticates with a dedicated bearer token, `COMMAND_CENTER_SCIM_TOKEN` (set it, or the console writes one to the data dir at mode 0600). SCIM groups map 1:1 onto the four RBAC roles, deprovisioning is a soft deactivate that blocks sign-in, and every provisioning change is written to the signed audit chain. Full setup for each provider is in the [SCIM provisioning](/scim-provisioning) guide. **Step-up re-check.** Sensitive actions (evidence export, the validation pack) require a password re-check first: the console redirects to `/verify`, and after you confirm, the action proceeds. This is by design, not an error. *** ## 5. Console pages | Page | What it does | | ------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Dashboard** (`/`) | Estate posture: pack counts, verification state, metrics, chains | | **Records** (`/records`) | Notarize a record (title, subject ref, content type, body, password re-check); it is stored write-once, content-addressed, signed, with a retention period. Sub-views: **Legal holds** (place/release), **Disposition** (retention and disposal), **Evidence** | | **Containers** (`/containers`) | Sealed `.acv` containers (ML-KEM-1024 sealed to a recipient), create, revoke, recover, CRL | | **Ingest / Import** (`/ingest`) | Bulk import a document estate (folder, watcher, or the CLI); feeds the records vault | | **Audit** (`/audit`) | The signed, tamper-evident console audit chain of every privileged action | | **Export** (`/export`) | Export the evidence estate (requires step-up re-check) | | **Verify** (`/verify`) | Re-verify signed chains offline; also the step-up re-check surface | | **Updates** (`/updates`) | Operator-controlled, signed, offline-by-default updates and update policy | | **Users** (`/users`) | Local accounts and roles (admin only) | | **Security / MFA** (`/mfa`) | Per-user two-factor enrollment and status | APIs (`/api/posture`, `/api/records`, `/api/containers`, `/api/ingest`, `/api/services`, `/api/updates`) back the pages and are available for integration. Interactive API docs are at `/docs` and `/redoc`. *** ## 6. Security model * **Offline, air-gap capable**: verifies and decrypts with no network; no phone-home. * **Post-quantum signing**: Falcon-1024 and ML-DSA-65 keep evidence verifiable for decades; `.acv` containers use ML-KEM-1024. * **Write-once, tamper-evident**: records are content-addressed, encrypted at rest, RFC-3161 timestamped, offline-verifiable; a legal hold blocks deletion, and disposal leaves a signed erasure tombstone. * **Signed audit chain**: every privileged action is hash-linked; re-verify from the Audit page or via the validation pack. * **RBAC + step-up + TOTP 2FA**, as above. * **Optional SIEM forwarding**: stream the signed audit chain to your SOC over syslog (RFC 5424 / CEF) or webhook when configured. * **Bring-your-own-key custody**: HSM, KMS, HashiCorp Vault, PKCS#11 adapters for the doc archive. *** ## 7. Supply chain and disaster recovery * **SBOM + provenance**: the download ships `sbom.cyclonedx.json`, `sbom.spdx.json`, and a SLSA v1 `provenance.json` signed with the AlgoVoi release key (`provenance.sig.json`, key in `release_pubkey.json`). Load the SBOM into Dependency-Track / Grype / Trivy, or verify offline with `algovoi-sbom verify`. * **DR**: `DR_RUNBOOK.md` in the bundle documents RTO/RPO, backup and restore, and the signed key-ceremony and backup-restore attestation chain. * **Volume import**: `docs/USAGE.md` (bulk import a document estate) and `docs/SECURE_INGEST.md` (hardened per-tenant SFTP/rsync landing zone). The console Import tab drives these too. *** ## 8. Verification checklist (what a clean install proves) Run these after install to confirm the deployment is healthy: | Check | Expected | | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------- | | `GET /health` | 200 | | Console version | `algovoi-command-center` reports its version and matches installed | | Sign in as admin | 303 + session cookie | | Every page (`/`, `/records`, `/records/holds`, `/records/disposition`, `/records/evidence`, `/containers`, `/ingest`, `/audit`, `/updates`, `/users`, `/verify`) | 200, full console renders | | Every `/api/*` | 200 | | Viewer role on `/users` and `/users/add` | 403 (RBAC enforced) | | `/export` and `/validation/pack` before step-up | redirect to `/verify` | | After step-up, `/export` | 200 | | Notarize a record | record stored, `verified:true`, retention set | | Two-factor: `factors.available()` | True; `/mfa/enroll/totp` returns a QR + otpauth URI | | SCIM: `GET /scim/v2/Users` | 401 without the bearer token, 200 with it; provision and deactivate write to the audit chain | This exact sequence was run against a fresh clean install of the shipping bundle and passed on every line, including two-factor enrollment.