Record model
A GOVP-1 record is UTF-8 text. It declares the protocol version, canonical publisher URI, publisher, asset type and identifier, SHA-256 digest, evidence URI, public key, signature and content-derived GOVP-ID.
- The issuer hashes the exact artifact bytes with SHA-256.
- All non-empty fields except
signatureare canonicalized into a byte-exact signing input. - The issuer signs that input with Ed25519.
- A verifier reconstructs the same bytes, verifies the signature and recomputes the GOVP-ID and optional asset digest.
Offline core
Core verification requires only the record and, for the asset check, the asset bytes. Remote verification is an additional transport check: the final HTTPS URL must equal the signed canonical URI.
What it establishes
- Control of the private key corresponding to the embedded public key.
- Integrity of the signed record fields.
- Identity of the declared asset through SHA-256 when bytes are supplied.
What it does not establish
- The truth, legality or quality of a signed claim.
- Independent trust in the publisher.
- An independently anchored time unless a separate profile provides one.