Keystone: the agentic-payment trust layer
A chain-agnostic verification layer that sits above the settlement rails. Keystone answers, in one recomputable chain, who an agent is, what it may do, whether an action was authorized, what it actually did, and one final verdict, byte-verifiable offline with no issuer contact. It is an application-level trust layer, not a settlement blockchain.
What Keystone is
Every agentic payment raises the same questions in order. Keystone binds each answer to the next as a content-addressed reference, so the whole chain is verifiable end to end without contacting an issuer.
How verification works
Each reference is "sha256:" + SHA-256(JCS(...)) over the reference before it, canonicalized under RFC 8785. Recompute any input field and that reference, and everything downstream of it, diverges. A decision made for one agent, authority or policy cannot be silently re-attributed; an execution recorded under one decision cannot be claimed by another. Anyone can recompute the chain from its own bytes, offline, with nothing of AlgoVoi's in the trust path. References can optionally be post-quantum signed (Falcon-1024, ML-DSA-65) so the evidence stays verifiable as cryptography evolves.
from algovoi_substrate import build_keystone
k = build_keystone(
passport_ref="sha256:b3594e33...", # identity
mandate_ref="sha256:a4f8cb5e...", # authority
policy_bound_ref="sha256:aaee2091...", # policy in force
verdict="ALLOW", action_type="payment", scope="bilateral",
outcome="COMMITTED", trust_outcome="TRUSTED",
)
k["execution_ref"] # decision-bound execution evidence
k["trust_query_ref"] # one verdict over the whole ordered chainPython and TypeScript (buildKeystone) produce byte-identical output.
Keystone and AlgoVoi Pay: two different jobs
| AlgoVoi Pay (the rail) | Keystone (the trust layer) | |
|---|---|---|
| Answers | How and where did payment settle? | Who was authorized, under which policy, and what evidence supports the verdict? |
| Does | Negotiates a lane, moves USDC, records settlement evidence | Establishes and verifies the trust context around the action |
| Moves funds | Yes, from your own wallet | No |
| Evidence | Settlement receipt | Trust chain and verdict |
The rail settles; Keystone proves the action was authorized. Settlement evidence and trust evidence are separate, and both recompute offline.
Keystone components
The trust chain is composed from tiers you can adopt independently. The cross-party bindings are open source (Apache-2.0) on public GitHub; Journey, Revocation and Delegation ship on PyPI too:
- Keystone Journey Open: bind a whole multi-agent task into one content-addressed
journey_ref; verify continuity, scope and completeness offline.algovoi-journey-ref - Keystone Revocation Open: offline-verifiable revocation references for agentic credentials and keys; chain revocations tamper-evidently and verify from the bytes.
algovoi-revocation-ref - Keystone Delegation Open: tamper-evident, chainable references for cross-party hand-offs, with delegation depth and scope narrowing.
algovoi-delegation-ref - Recurr Open: recurring, capped, revocable Tier-2 standing authorities; the signed descriptor's
authority_refcomposes into a keystone chain byte for byte, and each cycle pull verifies inside the cap offline.algovoi-recurr - Compliance Gate Open: a no-PII, seven-field Compliance Receipt bound to A2A and AP2 mandates, byte-identical in Python and Node.
algovoi-compliance-gate-a2a
These open bindings construct and verify the content-addressed references offline. The cross-party proofs (scope-consistency, cascade, aggregation) are the commercial Keystone Orchestrator. Upstream tiers (Agent Passport, Payment Mandate, Policy Binding) issue the identity, authority and policy references the chain composes.
Keystone is an application-level trust and verification layer. It is not a blockchain, rollup, consensus network, bridge or custody system, it does not move funds, and a trust verdict verifies the defined evidence and policy chain, it does not assert an agent is benevolent.