algovoi-keystone-secure-lite 0.2.0

Open, content-addressed flow-point hardening refs for the AlgoVoi keystone (decision audit binding + guard context + freshness window; L1 frozen)

algovoi-keystone-secure-lite

The open, lite flow-point hardening layer for the AlgoVoi keystone. Several canonical keystone flow points emit a ref that proves a fact was recorded, but not that it was recorded correctly or freshly. This package closes that with three securing refs, each a deterministic, offline-recomputable content address. Moves no funds; adds no new crypto.

decision_audit_ref = "sha256:" + SHA-256(JCS({decision_ref, passport_credential_ref, mandate_ref, policy_bound_ref[, screen_binding_ref]}))
guard_context_ref  = "sha256:" + SHA-256(JCS({canon_version, type, guard_timestamp_ms, policy_ref, mandate_ref, passport_credential_ref}))
with_validity / check_freshness  -- attach + enforce an integer-millisecond validity window on any ref preimage

Each input is imported by hash. Swap the passport, the mandate, the policy, the screen, or the moment and the ref diverges: a decision audited under policy P does not recompute under a rotated policy P', and a guard context is bound to the exact instant the gate evaluated it. Timestamps are epoch-millisecond integers hashed directly (Substrate Rule 2) -- no floating point, no RFC 3339 strings.

Lite vs commercial

	Lite (this package)	Keystone Secure
Licence	Apache-2.0, open	Commercial OEM
Hardening refs	content-addressed, recompute offline	same construction, Falcon-1024 signed
Evidence	bring your own	signed, hash-linked chain into the Compliance Command Center posture tiers
Enforcement	recompute + compare	fail-closed decision-audit, freshness, and guard-context enforcement

The lite ref you pin is byte-identical to the ref the commercial tier signs: pin lite, anchor a vector hash, carry the NOTICE → free v0 key; upgrade for post-quantum signing + CCC posture + enforcement.

Install & use

pip install algovoi-keystone-secure-lite

from algovoi_keystone_secure_lite import (
    decision_audit_ref, verify_decision_audit, guard_context_ref, with_validity, check_freshness,
)

# each input is imported by hash: a decision_ref, a passport_ref, a mandate_ref, a policy_bound_ref, a screen_ref
audit = decision_audit_ref(decision_ref, passport_ref, mandate_ref, policy_bound_ref, screen_binding_ref)
verify_decision_audit(audit, decision_ref, passport_ref, mandate_ref, policy_bound_ref, screen_binding_ref)  # True

# pin what the admission gate saw at a moment in time
gc = guard_context_ref(guard_timestamp_ms, policy_ref, mandate_ref, passport_ref)

# attach + enforce a validity window on any preimage
policy = with_validity({"required_scope": "payments.send"}, issued_at_ms=1_720_000_000_000, expires_at_ms=1_720_003_600_000)
check_freshness(policy, now_ms=1_720_000_060_000)   # True, inside the window

A decision audited under policy P returns a different decision_audit_ref if recomputed against the policy_bound_ref under a rotated P'; rotation is detectable. Malformed refs and non-integer timestamps are rejected, not hashed.

Conformance

• conformance/keystone_decision_audit_v1/: 2 positives, 3 divergence/omission negatives, 1 rejection negative, 2 invariants.
• conformance/keystone_guard_context_v1/: 1 positive, 2 divergence negatives, 2 rejection negatives, 2 invariants.

Each verifier imports only stdlib + rfc8785:

pip install rfc8785
python conformance/keystone_decision_audit_v1/verify.py
python conformance/keystone_guard_context_v1/verify.py

Adopters

The 4-check gate is scripts/check_v0_adoption.py (dependency + canonical hash anchor + NOTICE + version pin → ISSUE_V0_KEY). Apply: [e-mail].

License

Apache-2.0. Copyright 2026 AlgoVoi. Preserve the NOTICE in any distribution.