algovoi-validate

Don't trust AlgoVoi — verify it yourself. A standalone, offline validator for AlgoVoi signed compliance evidence. Its entire trust base is two public libraries — no AlgoVoi code, no secret key, no running service, no network.

pip install algovoi-validate

It re-derives every Falcon-1024 (FN-DSA-1024) signature and SHA-256 hash-link itself, from the published public key alone. If it prints VERIFIED, the evidence is genuine and unaltered; change a single byte and it fails at exactly that entry.

Use — auto-detect

Drop an AlgoVoi artifact; it identifies the type and validates it:

algovoi-validate <path>                     # auto-detect
algovoi-validate <path> <public_key.b64>    # ...for a bare receipt/chain

An evidence pack embeds its public key. A bare receipt or signed chain also takes the signer's published public key.

Explicit subcommands

algovoi-validate pack <pack_dir>
algovoi-validate receipt <receipt.txt> <public_key.b64>
algovoi-validate chain <chain.json> <public_key.b64>

Exit code is 0 iff everything verifies.

What it checks

• Falcon-1024 / FN-DSA-1024 signatures over RFC 8785 (JCS) canonical bytes, using the published public key only.
• Hash-linked chains — sequence, prev-hash linkage, and head, so a tampered, reordered, or removed entry is caught at exactly that point.
• Evidence packs — every signed chain in the pack, plus the trusted-timestamp binding (each timestamp's message imprint equals the hash of the archive receipt it stamps).

Library use

from algovoi_validate import autodetect, verify_pack, verify_chain, verify_receipt

Licence

Apache-2.0. Pairs with the production / custody side of AlgoVoi Records Vault; this verifier is free and always will be.