algovoi-retention-chain v0.2.0 | Apache 2.0 | self-verifiable audit chain for A2A payment receipts + action_ref_exactly_once_v1 + adversarial_isolation_v1

[chopmob-cloud]

We have published algovoi-retention-chain v0.1.0 as Apache 2.0.

The primitive is simple. One hash, four fields, verifiable offline by any party with SHA-256 and a JSON parser:

retention_chain_ref = SHA-256(JCS({chain_seq, issuer_id, prev_receipt_hash, receipt_hash}))

Spec: draft-hopley-x402-retention-chain-01 pip install algovoi-retention-chain

Conformance corpus at chopmob-cloud/algovoi-jcs-conformance-vectors:

retention_chain_v0 — 3 vectors (genesis + 2 chain links, single issuer)
retention_chain_v1 — 14 vectors across three invariant classes: extended 6-link chain, multi-issuer isolation, and a seq-gap adversarial pair

17 vectors total, 61 byte-level assertions, 8 cross-references (Python, TypeScript, Go, Rust, Ruby, C#, Java, Kotlin, each verified independently against the same canonical bytes)

Adopters who pin to algovoi-retention-chain==0.1.0 will see additional releases over the coming weeks. The core primitive is stable. What is coming is deeper AP2/A2A payment mandate lifecycle integration built on top of it, with no breaking changes to the hash construction. Pinned adopters get continuity guarantees that open range installs do not.

If you are working on an A2A implementation and want help verifying your chain ref output against the canonical vectors, or have questions about integrating the audit chain into your receipt flow, email chopmob@gmail.com. That is a genuine offer, not a pitch.

[chopmob-cloud]

v0.2.0 — RFC 9421 support

pip install algovoi-retention-chain[rfc9421]==0.2.0

v0.2.0 adds an optional RFC 9421 (HTTP Message Signatures) layer. One call verifies both the HTTP signature on the receipt-carrying request and the retention chain ref:

from algovoi_retention_chain.rfc9421 import verify_signed_chain_link

result = verify_signed_chain_link(
    method="POST", authority="api.example.com", path="/receipts",
    headers=request_headers, body=request_body,
    public_key=issuer_ed25519_pubkey_hex,
    chain_ref=receipt["retention_chain_ref"],
    prev_receipt_hash=prev_hash, receipt_hash=receipt_hash,
    chain_seq=seq, issuer_id=issuer,
)
assert result.signature_valid  # RFC 9421 HTTP sig
assert result.chain_ref_valid  # chain integrity

The two checks are independent: signature_valid and chain_ref_valid are separate so you can distinguish a bad HTTP signature from a tampered chain ref. result.valid requires both.

Conformance: retention_chain_rfc9421_v1 — 3 vectors with real Ed25519 signatures over JCS-canonical receipt bodies, in the public conformance repo.

The core primitive, install, and pinning rules are unchanged. If you are pinning to implement the adoption programme checks, ==0.2.0 carries the same continuity guarantee as ==0.1.0.

[chopmob-cloud]

Substrate additions: action_ref_exactly_once_v1 + adversarial_isolation_v1

As we strengthen the L1 for the ecosystem, two new sets are now live in chopmob-cloud/algovoi-jcs-conformance-vectors. For existing adopters: the new vectors are available now. We welcome adopters, and more enhancements are coming — anyone building on the substrate benefits directly from each addition.

Both sets are released under Apache 2.0. The only condition is the licence's own: retain the NOTICE file on redistribution (Section 4(d)).

action_ref_exactly_once_v1 — 6 vectors, 5 pair invariants

Pins the full payment lifecycle: PENDING → COMMITTED → REVERSED.

Two invariants that matter for production:

SKIP-on-retry. A re-presented COMMITTED transition with identical action_ref, state, and timestamps reproduces the prior transition_hash byte-for-byte. A retry cannot produce a second effect, expressed as a hash assertion, not a prose rule:

action-ref-eo-v1-003 (COMMITTED, first):  f49faa7c4f82bd84...
action-ref-eo-v1-005 (COMMITTED, retry):  f49faa7c4f82bd84...  ← identical

Replay binding. Identical state + timestamps under a different action_ref produce a different transition_hash. A replayed transition cannot collide with another identity's record:

action-ref-eo-v1-003 (action_ref A):  f49faa7c4f82bd84...
action-ref-eo-v1-006 (action_ref B):  97124ca25721d0aa...  ← different

Cross-validated across 8 independent RFC 8785 implementations, 48/48 byte-for-byte. Anchored to draft-hopley-x402-retention-chain-02 §7.

adversarial_isolation_v1 — 12 vectors (1 control + 11 rejection)

Defines the exact inputs a conformant implementation must reject. Each vector mutates exactly one field so you can confirm the named check fires in isolation.

The most common cross-implementation mistake: timestamp_ms must be an epoch-millisecond integer, not a string. Vector adv-v1-001-ts-rfc3339 explicitly rejects "2026-06-09T00:00:00Z". If your implementation accepts that, it will diverge at the verification boundary.

Other rejection cases: negative timestamp, boolean as timestamp, non-hex action_ref, short action_ref, empty state, empty scope, chain prev_hash break, stale content_hash (payload mutated but hash not updated), wrong chain_position ordinal.

Claim 1 (input bytes) is 8-lang, 96/96 byte-identical. Claim 2 (rejection) is reference-impl proof-of-rejection only, not an 8-lang byte claim.

Anchored to draft-hopley-x402-retention-chain-02 §7.5 + §8.8.

Repo: chopmob-cloud/algovoi-jcs-conformance-vectors

[geneknit]

Hi @chopmob-cloud — thanks for sharing your work on the AlgoVoi substrate, and for keeping it Apache-2.0. 🙏

To keep Show and Tell easy to browse for everyone, we try to keep things to roughly one thread per project, with ongoing updates posted as comments or edits on that thread rather than as new discussions. Over the past few days this project has produced several near-duplicate release announcements, so we're closing this one as a duplicate.

Your consolidated substrate thread (#1961) and the Agent Trust Bench thread (#1855) both remain open — please post future updates (new packages, version bumps, conformance changes) there instead of opening new discussions.

Appreciate your contributions to the ecosystem!