Trader and FSO are designed for high-value cargo operations where the two sides
may be on different continents, on different networks, and staffed by people who
rotate every few months. Every bundle that crosses between them is content-hashed,
re-verifiable, and treated as untrusted until it passes a formal reception
ceremony on the receiving side.
SHA-256 signed bundlesEvery instruction, execution, and ROB snapshot carries an envelope hash over its full payload. Recipients recompute and re-verify before anything touches their audit chain.
Reception ceremony on importThe FSO rejects replays by envelope hash (not just BundleId), classifies bundle age (Green / Yellow / Red at 30 & 90 days), and flags out-of-order arrivals from the same sender for operator review.
Tamper-evident audit chainBoth apps append every operation to a hash-chained audit log that can be independently re-verified. A single altered row breaks the chain and is surfaced in a red banner on every affected report.
Monotonic clock stampsAudit stamps use a persisted monotonic clock, so a wall-clock rollback on either side is detected and recorded instead of silently accepted.
QR-verified Certificate of QualityTrader CofQ PDFs embed a QR verification block encoding the instruction hash and audit-chain head at issue, so a downstream party can confirm the paper matches the source of record.
Provenance captured at importTransport medium, source media hint, importing operator, age at import, and any chain-continuity smell are stored alongside the bundle for later reconciliation.
Offline-first, air-gap friendlyNo live network required in either direction. Bundles move over USB, email, or any file transport; the trust model does not depend on the pipe.
No cloud custody of your recordsDatabases and audit chains live on hardware you control. Nothing is shipped to a third-party service as a condition of running the software.