algovoi-tap-verifier

Verify an AlgoVoi TAP receipt offline, with no AlgoVoi software. For the Visa Trusted Agent Protocol ecosystem (trusted-agent-protocol#16, post-authentication receipt signing).

An AlgoVoi TAP receipt is a JCS-canonical (RFC 8785) preimage carrying the two-sided audit fact (authorization_ref + transaction_hash + timestamp/sequence), a content-addressed receipt_id, an Ed25519 signature (TAP-native), and optionally a Falcon-1024 post-quantum signature. This package re-derives receipt_id and checks Ed25519 with only cryptography + rfc8785; install the pqc extra to also check Falcon-1024.

from algovoi_tap_verifier import verify_tap_receipt
r = verify_tap_receipt(receipt, ed25519_public_key=ed_pub_raw_32_bytes)
assert r.ok

algovoi-tap-verifier receipt.json --ed25519 <b64>            # CLI

TAP bilateral receipts (0.2.0)

Also verifies the two-sided shape proposed on trusted-agent-protocol#16: an agent-signed authorization receipt plus a merchant-signed outcome receipt, each a detached JWS over the JCS payload (Ed25519, b64:false), both binding the same TAP request hash and transaction payload hash, the outcome receipt chained to the authorization. Verified byte-for-byte against the maintainer's own reference fixtures.

from algovoi_tap_verifier import verify_tap_bilateral
r = verify_tap_bilateral(tap_request=req, authorization=authz, outcome=outcome, keys=keys)
assert r.ok

algovoi-tap-verifier --bilateral --request tap-request.json \
  --authz authorization-receipt.json --outcome outcome-receipt.json --keys keys.json

Apache-2.0. Receipt emission (keystone → signed TAP receipts) is a separate commercial AlgoVoi product.