Run GOVP everywhere your evidence lives.
A protocol only matters if it reaches the places work actually happens. GOVP is the same GOVP-1 record whether it is issued from a desktop app, a WordPress site, a build pipeline or a sensor gateway — and verifiable from a browser with nothing installed.
One record format · One conformance suite · Verifiable offline · Free software
Four ways to issue and verify — same protocol underneath
Each surface is a full participant in the protocol. Pick the one that fits where your records are created; a record issued on any of them verifies on all of them.
GOVP Studio
The reference desktop application. Generate keys, fix statements into GOVP-1 records and verify — on your own machine, offline when required. The signing key never leaves your device.
- macOS (Apple Silicon) — signed & notarized
- Published SHA-256 for every build
- Intel macOS, Linux & Windows in preparation
WordPress plugin
Turn any WordPress site into a GOVP issuer and verifier — no sidecar service. The critical engine is PHP (libsodium) on the server and JavaScript in the client, so it runs even on shared hosting.
- Publishes .well-known identity & records
- Browser verification with server fallback
- External signing (KMS/HSM/Vault) supported
Browser verifier
The full GOVP-1 check — including the Ed25519 signature — runs entirely in your browser. Nothing is uploaded, no account is needed. Load a sample, verify it, change one byte and watch it fail.
- Native WebCrypto Ed25519 + audited fallback
- Works offline; a single self-contained page
- Verify by paste or by canonical URL
Self-hosted & libraries
Publish govp.txt at your own domain and integrate GOVP into any system with a reference library or CLI. Fix records from a build pipeline, an ERP export or a device gateway — the protocol has no platform lock-in.
- Libraries in Python, JavaScript, Kotlin, PHP
- Domain-bound identity via .well-known
- Same golden vectors keep them in lockstep
What each surface does
Every surface can verify. They differ in whether they issue, publish and hold keys.
| Capability | Studio | WordPress | Browser | Library / CLI |
|---|---|---|---|---|
| Verify a record | Yes | Yes | Yes | Yes |
| Issue & sign records | Yes | Yes | — | Yes |
| Publish .well-known | — | Yes | — | Yes |
| Offline / no network | Yes | Server | Yes | Yes |
| External signer (KMS/HSM) | Roadmap | Yes | — | Yes |
| Needs no install | — | — | Yes | — |
WordPress: the reference for "GOVP inside any platform"
The WordPress plugin proves the protocol can live natively inside a platform millions already run — not as an external service, but as a first-class part of the site. It is the template we are replicating everywhere: issue on the platform, publish at the platform's own domain, verify from anywhere.
- No sidecar — pure PHP (libsodium) engine, runs on shared hosting.
- Serves govp.txt, a discovery index and each record under .well-known.
- Ships the golden vectors and a self-test that proves byte-identical verification.
- Production-safe keys: blocks issuing if the key sits in the web root; supports KMS/HSM signing.
Publish once, verify anywhere
A verifier fetches the canonical record and checks the domain binding — no call to us, no dependency on the plugin staying online once a copy of the record survives.
Four implementations, kept in lockstep
The same protocol is implemented in four languages, each held to the identical GOVP-CORE-CONFORMANCE-1 golden vectors — byte-identical canonical bytes, IDs and verdicts. Embed GOVP wherever your records are born.
Because verification is standard and reproducible, anyone can write a fifth implementation and prove it correct against the same vectors. See the conformance suite →
More surfaces, honestly marked
We only claim what exists. These are in preparation — each will publish its checksums and pass the same conformance suite before it ships.
Every surface is free software — and headed for the FSF.
The reference implementations are MIT-licensed, and we are preparing their submission to the Free Software Foundation Free Software Directory, starting with WordPress. An evidence protocol should belong to the commons, not to a vendor.