docs(ap2): add Compliance Receipt - admission-time AlgoVoi attestation envelope bound to Payment/Cart Mandate

[chopmob-cloud]

Summary

Adds the Compliance Receipt specification to the AP2 documentation
set: the canonical AlgoVoi-authored seven-field attestation envelope
that records the admission-time compliance verdict (ALLOW / REFER /
DENY) bound to a Payment Mandate or Cart Mandate by sha256:
reference under RFC 8785 (JCS) canonicalisation.

AP2 references the format; AP2 does not redefine it. The wire format
matches the canonical AlgoVoi Compliance Receipt as specified in IETF
Internet-Draft draft-hopley-x402-compliance-receipt and documented at
docs.algovoi.co.uk/compliance-gate-v1.

Single new file at docs/ap2/compliance_receipt.md. No changes to
existing spec files. No code changes. No samples.

Why AP2 needs this

AP2 specifies the Cart Mandate and Payment Mandate primitives and the
agent-authorisation flow that produces them, but does not document the
admission-time compliance verdict format that a regulated verifying
party (Credential Provider, Network, Merchant Payment Processor) emits
before the mandate proceeds to settlement: "is this mandate permitted
to proceed?". This decision is required under SAMLA 2018 s.20, PSD2
sanctions-screening obligations, and MiCA Article 80 record-keeping.

Without a canonical format reference, every verifying party records
this verdict in a bespoke shape, breaking the property that a Shopping
Agent or downstream relying party can confirm an admission-time check
occurred by hashing a fixed-shape JSON object. This PR closes that gap
by referencing the AlgoVoi-authored format (already in production, on
IETF datatracker, with reference implementations on PyPI and npm) and
documenting how it composes with AP2's mandate primitives.

Production reference

The format is emitted in production by the AlgoVoi facilitator at
api.algovoi.co.uk/compliance/attestation,
live since 2026-05-06 across eight chain families. Documentation:
docs.algovoi.co.uk/platform/compliance-engine.
Public audit verifier: docs.algovoi.co.uk/audit-verifier.

This is not a theoretical proposal. The format described in this PR
has been emitting receipts against live settlement traffic for over
three weeks.

Authorship and substrate-author position

This PR is sole AlgoVoi authorship across the documented format,
normative seven-field shape, closed three-element verdict enumeration,
regulatory mapping, and the composition with the AlgoVoi-authored
canonicalisation pin (urn:x402:canonicalisation:jcs-rfc8785-v1 per
IETF I-D draft-hopley-x402-canonicalisation-jcs-v1).

Companion IETF Internet-Draft:
draft-hopley-x402-compliance-receipt
(Independent Submission, Informational, on IETF datatracker).

Reference implementation, AlgoVoi-authored, Apache 2.0:

• algovoi-substrate on PyPI
• @algovoi/substrate on npm

The canonicalisation layer underneath the receipt is byte-for-byte
cross-validated across eight independent implementations (Python,
TypeScript, Go, Rust, Java, PHP, .NET, Ruby) per the AlgoVoi 8-impl
matrix; the receipt's content_hash reproduces byte-identical under
any of the eight. Conformance corpus:
chopmob-cloud/algovoi-jcs-conformance-vectors.

The verdict enumeration is closed by design and may be amended
only by a normative successor specification authored by AlgoVoi or
with explicit AlgoVoi co-authorship. Re-publication of the format
under a different attribution does not constitute substrate authorship
of the elements defined here.

No coalition acknowledgements. This specification does not absorb
from, depend on, or share authorship with any other party's work.

Orthogonality

This specification defines the verdict format at the admission-time
sanctions and KYC screening layer. It is orthogonal to
counterparty-risk evidence formats, settlement-attestation formats
issued after on-chain settlement completes, post-settlement lifecycle
envelopes (covered by the sibling AlgoVoi-authored Payment Lifecycle
PR), and behavioural reputation, trust-scoring, or composable trust
evidence formats proposed elsewhere. The Compliance Receipt makes no
claims about, and depends on no fields from, any of the above.

Scope

Single new file at docs/ap2/compliance_receipt.md. No changes to
existing spec files. No code changes. No samples. No glossary additions.

-- AlgoVoi (chopmob-cloud)
https://docs.algovoi.co.uk/acquisition

[gemini-code-assist]

Code Review

This pull request introduces a new documentation file, docs/ap2/compliance_receipt.md, which specifies the Compliance Receipt format—a content-addressed attestation envelope used prior to settlement. The review feedback suggests a minor grammatical improvement to clarify a sentence fragment regarding the Apache 2.0 license.

[gemini-code-assist]

Improve the sentence fragment 'Both Apache 2.0.' to be grammatically complete and more professional.

Suggested change

	Both Apache 2.0.
	Both are licensed under Apache 2.0.