Docs · Worked examples

See exactly what a record says.

Two examples, nothing hidden: a real GOVP-1 record read field by field with its verification reproduced, then a multi-source claim carried through the sources layer and the trust model to a recomputable conclusion.


Example 1

A GOVP-1 record, field by field

This is conformance vector 01-valid-document — a real, signed record that passes the verifier. Every field is human-readable and self-describing.

Version: GOVP-1 Canonical: https://winery.example/.well-known/govp.txt Publisher: winery.example Asset-Type: document Asset-ID: aviso-legal Asset-SHA256: 71e5bb01f249ad18a551a218b0b5b9eb40263c64ae1c8f37dc48951622a54734 License: CC-BY-4.0 Profile: GOVP-BASIC Generated-At: 2026-05-31T10:00:00Z GOVP-ID: GOVP-DOC-39969a54190e Public-Key: A6EHv/POEL4dcN0Y50vAmWfk1jCbpQ1fHdyGZBJVMbg= Signature: uq+dPdfTRlEPPVOosgWAjpjAU+FO0E5SDl5Wo5m9RVK8Ysk/mAN907neMZMD7ISly/VF5Rxcq0JyKwHmjg9YAg==
VersionThe wire-format version. GOVP-1 is the current format.
CanonicalThe URL that binds the record to its issuing domain. A verifier can fetch and pin it; a record cannot be re-hosted under a different identity without detection.
PublisherThe declaring domain identity.
Asset-Type / Asset-IDWhat kind of thing is fixed (document, dataset, model, agent…) and its stable identifier.
Asset-SHA256The content fingerprint of the declared asset. Present the asset and the verifier confirms it matches.
LicenseHow the published evidence may be reused (here CC-BY-4.0).
ProfileThe time profile. GOVP-BASIC = issuer-asserted time; RFC 3161 / QTSP profiles anchor it independently.
Generated-AtThe issuance timestamp (asserted by the issuer under BASIC).
GOVP-IDDerived from the content: GOVP-DOC-39969a54190e. The verifier recomputes it and rejects a mismatch.
Public-KeyThe issuer's Ed25519 public key (base64), carried in the record so it is self-contained.
SignatureThe Ed25519 signature over the canonical signing input.

Reproduce the verification

Canonicalize, hash, verify. The signing-input hash is pinned by the conformance suite, so any correct implementation lands on the same bytes.

# 1. build the signing input: lowercased "key: value" lines, drop Signature, # sort alphabetically, prefix the domain separator DOMAIN = "GOVP::record.v1\0" msg = DOMAIN + "".join(sorted(f"{k.lower()}: {v}\n" for k,v in fields if k != "Signature")) # 2. the hash is pinned by the vector — must match exactly sha256(msg).hex() == "d3263b7c87442418f76768caa4048fbad6fa108583837966a2ff04d7e1df26ff" # 3. verify the signature and re-derive the id Ed25519_verify(public_key, signature, msg) # → true govp_id == "GOVP-" + TYPECODE[asset_type] + "-" + sha256(asset_type|asset_id|asset_sha256)[:12]
PASS signature valid · domain bound · GOVP-ID matches · signing-input hash matches the vector
Example 2

A multi-source claim, end to end

A single record proves one declaration. Here a claim — "battery cell lot BC-5521 passed end-of-line test" — is corroborated by four heterogeneous signals. Each is verified by the rules of its type before it counts; only verified signals feed the trust calculation and the conclusion.

SourceType verifier checksIndependent?State
Build attestationin-toto signature; origin authorized in the anchor registry; provenance intactYes — CI vendorverified
Calibration certificatelab signature; certificate within validity window; not revokedYes — external labverified
End-of-line sensordevice signature; reading in range; anchor authorization; freshnessPartly — same plantverified
Firmware billsignature valid, but the signing anchor was withdrawnrevoked
Operator notepresent but carries no verifiable signaturedeclared_only

From signals to a conclusion

Inputs
3 verified sources
The build attestation, the calibration cert and the sensor. The revoked and declared-only signals are recorded but do not count.
Trust
T = V × I × Q
Weighted by number (V), effective independence (I — the sensor shares the plant, so it adds less) and verification quality (Q).
Terminal
Conclusion node
Recomputable. Marked "verified end-to-end" because every counted input passed real verification.

What this proves: that three independent signals of their stated types passed authentic, authorized, in-date verification and corroborate the claim — not that the cell is physically good. The truth of the value stays with the issuer; GOVP proves the chain of trust behind each signal and how strongly independent sources agree.

← Gemacode Research