One protocol for evidence anyone can verify.

GOVP-1: a portable, self-describing receipt

A GOVP-1 record is a small UTF-8 text file that carries its own public key and signature. It is self-contained: a verifier needs nothing but the record, and optionally the declared asset to confirm its hash. It can be published at a .well-known URL or kept entirely apart — the proof travels with the record.

This exact record is vector 01-valid-document in the conformance suite and passes the online verifier. The Canonical field binds the record to its issuing domain, so a record cannot be silently re-hosted under another identity.

One record, one signing input, one fingerprint

Before signing, the fields are normalized to a single canonical form so that semantically identical records always produce identical bytes — independent of field order or trailing whitespace. Each non-empty field (except Signature) becomes a lowercased key: value line; the lines are sorted alphabetically and prefixed with a domain separator. Verification recomputes this exact byte string.

A content-derived identifier

The GOVP-ID is not assigned by a registry — it is derived from the content itself, so two parties independently arrive at the same identifier for the same asset. It cannot be minted to point at content it does not describe.

The verifier recomputes the ID and rejects any record whose declared ID does not match its content.

Honest about time — anchoring is a profile, not a promise

A bare record's Generated-At is asserted by the issuer. GOVP states this openly and makes independent time-anchoring an explicit profile, so the record declares exactly how strong its time claim is.

Transparency logs and independent witnesses (Layer 3) provide a further, registry-free way to anchor ordering. The point is the same throughout GOVP: never imply a guarantee the record does not carry.

No source validates itself

Real evidence is not one signed statement — it is many heterogeneous signals: in-toto attestations, sensors, robots, calibration certificates, firmware, PLC/ERP exports, human approvals. GOVP normalizes every source to a common model and then runs a type-specific verifier against it before it is allowed to count.

Each verifier checks the signature, checks that the origin is authorized in an anchor registry the source does not control, and applies the rules of that source type (range, validity window, revocation, provenance). The outcome is a verifiable state — never a bare true/false:

What "verified" means — and does not: that a signal passed the independent checks of its type (authenticity, authorization, validity), not that its value is physically true. The truth of the content is the issuer's responsibility. GOVP verifies the chain of trust of each signal and weights it by independence and quality; it does not replace an evaluator with formal guarantees.

Trust you can compute, not assert

Verified sources feed a mesh of independent observers. Trust is not a badge — it is a number derived from how many independent, well-verified sources corroborate a claim. The model is deliberately hostile to Sybil attacks: a hundred sources controlled by one party do not out-weigh three genuinely independent ones.

Only sources in state verified contribute. The defensible sentence: "GOVP verifies each source by the rules of its type before including it, and trust is derived from the number, quality and independence of the sources that passed" — never "every signal is proven true".

A recomputable end-to-end chain

Verified sources are chained in a DAG whose terminal node is a conclusion — itself recomputable. A conclusion is marked "verified end-to-end" only when every input in its subgraph passed real verification. Anyone can replay the graph and reach the same result.

One suite, byte-identical across languages

An open protocol is only real if independent implementations agree to the byte. GOVP ships GOVP-CORE-CONFORMANCE-1: golden vectors with pinned signing-input hashes, run against every reference implementation. A conforming implementation must produce the exact same canonical bytes, the exact same GOVP-ID, and the exact same pass/fail verdict.

The WordPress reference plugin bundles these vectors and a self-test, so an operator can prove, inside their own install, that it verifies byte-for-byte like the Python, JavaScript and Kotlin references.

Open by design, so the proof outlives the vendor

Evidence should not depend on trust; verification should not depend on a vendor. Every GOVP reference implementation is released as free software under the MIT license. The specification, the conformance vectors and the verifier are public and reproducible — if Gemacode disappeared tomorrow, every record would still verify.

• ✓
  Inspect the code. The verifier is open — read exactly how a record is checked.
• ✓
  Audit the process. The verification spec is public and reproducible byte-for-byte.
• ✓
  Run it yourself. Verify offline, on your own machine, with no account and no server.
• ✓
  Fork it. Reimplement from the spec in a few lines; the conformance suite keeps you honest.

What the protocol deliberately does not claim

A precise protocol earns trust by being explicit about its limits.