Metadata-Version: 2.4
Name: algovoi-verified
Version: 0.1.2
Summary: Offline conformance verifier and self-serve Keystone badge for the AlgoVoi substrate (RFC 8785 JCS + SHA-256).
Author-email: AlgoVoi <chopmob@gmail.com>
License: Apache-2.0
Keywords: algovoi,keystone,conformance,rfc8785,jcs,verifier,badge
Requires-Python: >=3.9
Description-Content-Type: text/markdown
License-File: LICENSE
License-File: NOTICE
Requires-Dist: algovoi-substrate>=0.4.0
Requires-Dist: cryptography>=41
Dynamic: license-file

# algovoi-verified

Offline conformance verifier and self-serve Keystone badge for the AlgoVoi substrate
(RFC 8785 JCS + SHA-256). The free tier of the AlgoVoi-Verified mark.

It recomputes the Keystone reference chain against the AlgoVoi-signed public conformance
corpus and, for adopters who declare and pin the dependency, issues a badge that names
AlgoVoi as the verification authority. No network calls, no AlgoVoi service.

## What it proves

```
bundled AlgoVoi public key
  -> verifies the signature over the corpus attestation
    -> the attestation pins the sha256 of every bundled conformance file
      -> the local algovoi-substrate recomputes the whole Keystone chain byte-for-byte
```

A PASS means this environment speaks the AlgoVoi substrate byte-for-byte, proven against
a corpus whose authenticity AlgoVoi has signed. Standards-neutral: if you are on
RFC 8785 (JCS), your ref composes into the chain; the alias mechanism does the rest.

## Use

```
pip install algovoi-verified

algovoi-verified verify                 # verify corpus conformance in this environment
algovoi-verified verify <package>       # also check a package's keystone alias descriptor
algovoi-verified gate <project-dir>     # run the 4-check adoption gate
algovoi-verified badge <package> --project <dir> --ref sha256:...   # issue the badge

keystone-alias init my-thing --alias-of execution_ref   # scaffold a bolt-on in 1 command
```

## The badge

Two badges. **Keystone Enabled** is issued when your package is discovered by the control
panel (a valid alias descriptor). **AlgoVoi-Verified** additionally requires the 4-check
adoption gate: the AlgoVoi dependency declared and pinned, a canonical corpus hash present,
and a NOTICE naming AlgoVoi. A repacker who strips the NOTICE or unpins the dependency
cannot display it.

## Boundary

This package verifies against a signed **public** corpus and never signs adopter data.
Signing your own evidence (post-quantum + content-addressed compliance) and the hosted
attested issuance record are the commercial layer, not here.

## Licence

Apache-2.0. Copyright (c) 2026 AlgoVoi (chopmob-cloud).
