One protocol for evidence anyone can verify.
GOVP is not an app and not a service. It is an open, global protocol: a single record format, a single canonicalization, a single conformance suite — implemented in several languages, published as free software, and verifiable by anyone without trusting the issuer or us.
Four layers, one honest claim at each
GOVP is more than "a signed hash". It stacks a record, a source-verification layer, an independence-weighted mesh and a recomputable conclusion — and each layer states exactly what it does and does not prove.
GOVP-1: a portable, self-describing receipt
A GOVP-1 record is a small UTF-8 text file that carries its own public key and signature. It is self-contained: a verifier needs nothing but the record, and optionally the declared asset to confirm its hash. It can be published at a .well-known URL or kept entirely apart — the proof travels with the record.
This exact record is vector 01-valid-document in the conformance suite and passes the online verifier. The Canonical field binds the record to its issuing domain, so a record cannot be silently re-hosted under another identity.
One record, one signing input, one fingerprint
Before signing, the fields are normalized to a single canonical form so that semantically identical records always produce identical bytes — independent of field order or trailing whitespace. Each non-empty field (except Signature) becomes a lowercased key: value line; the lines are sorted alphabetically and prefixed with a domain separator. Verification recomputes this exact byte string.
| Domain separator | GOVP::record.v1\0 — prevents a signature being replayed as any other kind of message. |
| Field normalization | Keys lowercased; values trimmed (ASCII); NFC text normalization; empty fields dropped. |
| Ordering | Lines sorted alphabetically — no reliance on serialization order. |
| Fingerprint | SHA-256 over the canonical byte representation. |
| Signature | Ed25519 (RFC 8032) over the domain-separated signing input. |
A content-derived identifier
The GOVP-ID is not assigned by a registry — it is derived from the content itself, so two parties independently arrive at the same identifier for the same asset. It cannot be minted to point at content it does not describe.
The verifier recomputes the ID and rejects any record whose declared ID does not match its content.
Honest about time — anchoring is a profile, not a promise
A bare record's Generated-At is asserted by the issuer. GOVP states this openly and makes independent time-anchoring an explicit profile, so the record declares exactly how strong its time claim is.
Transparency logs and independent witnesses (Layer 3) provide a further, registry-free way to anchor ordering. The point is the same throughout GOVP: never imply a guarantee the record does not carry.
No source validates itself
Real evidence is not one signed statement — it is many heterogeneous signals: in-toto attestations, sensors, robots, calibration certificates, firmware, PLC/ERP exports, human approvals. GOVP normalizes every source to a common model and then runs a type-specific verifier against it before it is allowed to count.
Each verifier checks the signature, checks that the origin is authorized in an anchor registry the source does not control, and applies the rules of that source type (range, validity window, revocation, provenance). The outcome is a verifiable state — never a bare true/false:
What "verified" means — and does not: that a signal passed the independent checks of its type (authenticity, authorization, validity), not that its value is physically true. The truth of the content is the issuer's responsibility. GOVP verifies the chain of trust of each signal and weights it by independence and quality; it does not replace an evaluator with formal guarantees.
Trust you can compute, not assert
Verified sources feed a mesh of independent observers. Trust is not a badge — it is a number derived from how many independent, well-verified sources corroborate a claim. The model is deliberately hostile to Sybil attacks: a hundred sources controlled by one party do not out-weigh three genuinely independent ones.
Trust of a corroborated claim
Only sources in state verified contribute. The defensible sentence: "GOVP verifies each source by the rules of its type before including it, and trust is derived from the number, quality and independence of the sources that passed" — never "every signal is proven true".
A recomputable end-to-end chain
Verified sources are chained in a DAG whose terminal node is a conclusion — itself recomputable. A conclusion is marked "verified end-to-end" only when every input in its subgraph passed real verification. Anyone can replay the graph and reach the same result.
One suite, byte-identical across languages
An open protocol is only real if independent implementations agree to the byte. GOVP ships GOVP-CORE-CONFORMANCE-1: golden vectors with pinned signing-input hashes, run against every reference implementation. A conforming implementation must produce the exact same canonical bytes, the exact same GOVP-ID, and the exact same pass/fail verdict.
The WordPress reference plugin bundles these vectors and a self-test, plus a reproducible PHP↔Python harness, so an operator can prove conformance inside the installation and in CI.
Open by design, so the proof outlives the vendor
Evidence should not depend on trust; verification should not depend on a vendor. The GOVP-1 specification, schemas, conformance vectors and reference CLI are released under the MIT License. They are reproducible — if Gemacode disappeared tomorrow, every record would still verify.
- ✓Inspect the code. The verifier is open — read exactly how a record is checked.
- ✓Audit the process. The verification spec is public and reproducible byte-for-byte.
- ✓Run it yourself. Verify offline, on your own machine, with no account and no server.
- ✓Fork it. Reimplement from the spec in a few lines; the conformance suite keeps you honest.
GOVP is openly specified and designed to be implementable without permission or a Gemacode service. The WordPress reference implementation is released under MIT; every other component states its own licence at distribution. Openness is a property that must be inspectable, not a future affiliation we ask readers to assume.
What the protocol deliberately does not claim
A precise protocol earns trust by being explicit about its limits.
| Truth of content | GOVP proves a claim was published by a domain and is unaltered — not that the claim is true, legal, or that a physical event occurred as described. |
| Time (BASIC) | Under GOVP-BASIC the date is issuer-asserted. Use GOVP-RFC3161, GOVP-QTSP or independent witnesses for provable time. |
| Local transparency | A site-local transparency log is a useful journal but is not public transparency — a compromised admin could rewrite it. Strong transparency needs external anchoring. |
| Durability | Verification does not need the issuer to be alive, but it does need a surviving copy of the record (domain, mirror or exported bundle). Durability is availability, not magic. |
| Not a formal evaluator | GOVP verifies each source's chain of trust; it does not replace deterministic replay or bounded formal guarantees where those are required. |