Adopt VCC at the depth that fits your workflow.

Organisations keep the final number but lose the exact combination that produced it: the formula, its version, the normalized inputs, the dataset vintage, the rounding and the runtime. When the result is questioned months later, that combination has to be rebuilt by hand from spreadsheets, logs and email.

VCC turns much of that reconstruction into a structured, automatable verification workflow. Adopting it means your important numbers can travel with their proof — and anyone can check that proof independently, even offline.

These describe how deeply a system uses the protocol. They are not certification levels — there is no formal certification process, and reaching a level is not a badge we award. Most adopters start at L1 and never need more.

1. 01

   Decide your level

   Start at L1 (verify) — it needs no keys and no account. Move up only when a real workflow requires it.

2. 02

   Read the specification

   The data model, envelope and canonicalization rules are public. Nothing here depends on CalcFleet services.

3. 03

   Run the conformance suite

   Point the reference verifier at the published valid and negative vectors. Confirm each expected outcome.

4. 04

   Verify offline

   Disconnect from CalcFleet and verify a receipt locally. Vendor independence should be something you test, not something we assert.

5. 05

   Separate test from production

   Never let a test-key receipt look like a production one. The distinction must be visible to your users.

6. 06

   Declare your attestation

   State exactly what your issuer attests to — that it executed the declared formula on the declared inputs, not that the inputs are true.

7. 07

   Pin numeric behaviour

   Fix rounding, scale and units in a numeric profile so the same inputs always reproduce the same output.

8. 08

   Plan for lifecycle

   Decide up front how you will supersede, revoke and dispute receipts without erasing history.

A receipt does not have to expose its inputs. Privacy profiles let you keep it verifiable while controlling what is visible. The default is a private receipt; publication is explicit opt-in.

full

The receipt carries the actual inputs and outputs. Best for internal evidence where the data is not sensitive.

redacted

Selected fields are removed; the rest stays verifiable. For sharing a receipt while withholding specific values.

hash-only

Inputs are represented by digests. Proves what was used without disclosing it.

encrypted

Payload is encrypted for named recipients. Verification of integrity and signature still works.

The transparency log never publishes sensitive inputs. See what VCC does and does not prove.

1. 1

   Today: evidence is scattered

   The number lives in a database; the how lives in spreadsheets, logs, tickets and someone's memory. Reconstruction is manual.

2. 2

   Step 1: verify what you receive (L1)

   Add verification to the point where numbers arrive from a partner or an AI agent. No changes to your producers yet.

3. 3

   Step 2: issue for one workflow (L2)

   Pick one high-value, contestable calculation. Issue receipts for it. Keep the old evidence in parallel until you trust the new one.

4. 4

   Step 3: publish the formula (L3)

   Version and publish the package so those receipts remain reproducible after the formula changes.

5. 5

   Step 4: govern at scale (L4)

   Bring the registry, key lifecycle and impact analysis under one control plane once several workflows issue receipts.

Run the old and new evidence in parallel until you trust the receipts. Migration is incremental by design — you never have to re-issue history to start.

A public suite pins the expected outcome for valid receipts and for a set of tampered ones — invalid signature, modified payload, unknown formula, wrong digest, rounding mismatch, revoked key and more. A conformant verifier accepts the valid ones and rejects each negative case for the stated reason.

npx @calcfleet/vcc test

When the suite passes you may display “VCC conformance tests passed” as a technical badge. It is not a legal certification and does not imply endorsement.

“VCC” refers to the protocol and its receipts. When you issue with a test key, label it a sample. When you describe what a receipt proves, separate execution from reproduction from independent review — they are not the same and should not share one badge.

No system is secure against every attack, and we do not claim VCC is. Residual risk is documented. See the security notes and trust model.

The protocol can be implemented without using any CalcFleet commercial service. That neutrality is a condition for adoption, not an afterthought. The specification, schema, test vectors and reference verifier are public; normative changes follow a documented decision process that records the problem, the proposal, the alternatives, and the security, privacy and compatibility implications.

Is VCC a standard?

No. VCC is an experimental open protocol. It has a public specification, schema, reference verifier and test vectors. It is not an accepted industry standard, and we do not describe it as one until objective adoption gates are met.

Do I have to use CalcFleet to adopt VCC?

No. The protocol is designed to be implemented without CalcFleet services. Verification runs offline, and the data model, envelope and canonicalization are public. CalcFleet is the reference implementation, not a dependency.

Does a valid receipt mean the number is correct?

No. A receipt shows that a declared formula was executed on declared inputs and that the result reproduces. It does not prove the inputs are true, that the formula is appropriate, or that the result is legally or contractually valid.

What does the test issuer prove?

Only format and integrity. A test-key signature demonstrates that a receipt is well-formed and unmodified. It carries no production authority. Production issuance requires a verified issuer identity.

Can I verify a receipt after CalcFleet is gone?

Signature and integrity verification work offline with a standalone verifier. Reproduction additionally needs the formula package and datasets — publish or mirror them (L3) so they remain resolvable independently.

How much does adoption cost?

Nothing in the current phase. The calculators, API, MCP, issuance, verification, specification, schemas, test vectors, SDKs and verifiers are free, within documented rate limits. There is no paywall yet.