Documents
How the mechanism works, written to be checked rather than believed.
servicesTwo services — merchant and cash-out
Float, till, change and end-of-shift settlement for a business; the three rails a holder can be paid on; and the controls a real deployment still needs.
designDigital cash without a chain — who owns a token
Every token lives in a slot on a bank chip; MongoDB holds who may spend it; the card in a hand is an authority copy. The ownership rule, and why a copied bit string is worth nothing.
hardwareHSM or smart card?
Why a vault of cards needs no fans and an HSM needs a rack: what each is for, and where the two belong in the same deployment.
reserveWhat backs a token — fiat, bonds, stablecoin
Why an interest-bearing instrument cannot rebase, how yield is actually paid, and the five decisions a bank cannot defer before backing a token with anything but cash.
walletThe phone wallet — StrongBox without Knox
No Knox SDK and no paperwork: a key in StrongBox or the TEE, attested by the device itself, and the reason value still cannot live in the phone.
merchantsOnline float, offline card — and what each can prove
A shop that trades both ways, why change comes from a float rather than a signature, and the reason an offline till cannot verify an issuer's signature over a note.
protocolBinding — what two cards prove to each other
Mutual proof of possession, what it permits, what it does not provide, and the key agreement plus random nonce that would turn it into an encrypted channel.
liveWhat the system holds
Instruments by state, value by currency, vault identifiers, last reconciliation — read from the issuer's records, refreshed every fifteen seconds.
briefCoinCard for banks
The three roles, the two verification tiers, what a bank would integrate, and what the system refuses to claim.
Sandbox deployment, USD, English. Values are test values and are not money. Documents are served from this host; this folder is the canonical copy.