Every bundle that crosses between apps is content-hashed, re-verifiable, and treated as untrusted until it passes a formal reception ceremony on the receiving side. High-value cargo operations are typically staffed by teams that rotate every few months across different continents and networks — the trust model is designed for that reality.
SHA-256 signed bundlesEvery instruction, execution, and ROB snapshot carries an envelope hash over its full payload. Recipients recompute and re-verify before anything touches their audit chain.
Reception ceremony on importReplays are rejected by envelope hash (not just BundleId), bundle age is classified (Green / Yellow / Red at 30 & 90 days), and out-of-order arrivals from the same sender are flagged for operator review.
Tamper-evident audit chainBoth apps append every operation to a hash-chained audit log that can be independently re-verified. A single altered row breaks the chain and is surfaced in a red banner on every affected report.
Monotonic clock stampsAudit stamps use a persisted monotonic clock, so a wall-clock rollback on either side is detected and recorded instead of silently accepted.
QR-verified Certificate of QualityTrader CofQ PDFs embed a QR verification block encoding the instruction hash and audit-chain head at issue, so a downstream party can confirm the paper matches the source of record.
Offline-first, air-gap friendlyNo live network required. Bundles move over USB, email, or any file transport; the trust model does not depend on the pipe.
No cloud custody of your recordsDatabases and audit chains live on hardware you control. Nothing is shipped to a third-party service as a condition of running the software.
Provenance captured at importTransport medium, source media hint, importing operator, age at import, and any chain-continuity smell are stored alongside the bundle for later reconciliation.
