Clear actions.
Accountable outcomes.

Accountable roles: COTO trade coordinator owns the workflow; the seller and buyer approve the contract; a separate finance reviewer checks receipt evidence. Legal title is determined by the executed sale and applicable law.

Start with: Sale/order version; item/lot identifiers; quantity and unit; seller/buyer authority; location and custodian; express title trigger; USD milestones; inspection period and remedies; restricted beneficiary-verification reference; permitted evidence sources.

1. Fix the legal trigger
   Responsible: Seller + buyer

   Complete Sale Agreement 05 and Schedule 13. Specify whether title depends on payment, delivery or another enforceable event; record risk separately. Both approve the same version. No default seven-day hold or AMN coin is adopted from the presentation.

2. Register the physical scope
   Responsible: Seller + custodian

   Identify every rug or the precise controlled lot, record count/condition and tag mapping, and disclose any lien or retained-title interest. Reviewer checks authority to sell; unresolved competing claims block an ownership assertion.

3. Record dispatch and receipt
   Responsible: Seller then buyer/custodian

   Record sender/receiver, timestamps, location, count, transport reference and supporting fingerprints. The receiver independently confirms what arrived. Custody change alone never marks legal title or payment as complete.

4. Inspect and allocate exceptions
   Responsible: Buyer + quality reviewer

   Approve conforming quantity and identify disputed pieces separately, with evidence and an agreed cure. Respect the sale inspection period and hidden-defect rights. Do not infer acceptance from silence unless the executed lawful terms expressly permit it.

5. Confirm the payment condition
   Responsible: Finance reviewer + actual beneficiary

   Use a lawful agreed bank route outside COTO. Independently verify beneficiary instructions and confirm the exact invoice, USD amount, fees and available-funds event. A screenshot, chain transaction or operator attestation alone cannot establish final bank credit.

6. Review entitlement and close
   Responsible: Authorized seller/buyer representatives

   When the contractual trigger is evidenced and unresolved rights claims are cleared, record the agreed entitlement event and approval references. Correct later reversals through a new linked event and legal review; do not make an irreversible automatic title decision from a payment webhook.

States: Record lifecycle: draft > contract-agreed > dispatched > received > inspection-accepted OR disputed > entitlement-reviewed > closed. Payment is a separate ledger: unpaid / provisional / credited / available / reversed. An entitlement record is not a negotiable warehouse receipt or statutory document of title.

Short/damaged delivery: quarantine the identified quantity and seek a signed resolution. Payment shortfall/reversal: keep the payment state unresolved and reassess the contractual title trigger. Conflicting claims or lost tag: freeze the affected entitlement view and require evidence; never mint a replacement as a shortcut. Timeouts create reminders, not automatic fund release.

Keep the executed agreement, bank evidence and identities off-chain. A future approved relayer may anchor the salted digest and opaque record/version; this proves consistency, not title validity. AI may extract invoice fields into a draft, but a person verifies parties, currency, quantities and dates. No AI or smart contract adjudicates disputed title or sends bank funds.

Current/manual route: Use existing orders, separate approvals, protected audit records, invoices, operator-attested receipts and balances. Add a coordinator-maintained entitlement/exception schedule with signed approval references. The pilot has no dedicated legal-title register, partial acceptance or provider webhook.

Still to build: Add item-level custody/entitlement records, partial inspection lines, amendment approvals and a separate payment-event table. Only after provider approval: signed-webhook verification, event deduplication, server-side amount/order matching, reversals and daily bank reconciliation. A checkout page alone is insufficient.

Synthetic scenario: Synthetic example: 20 rugs at USD 500, received 20, accepted 19, one disputed. The order remains USD 10,000; an agreed USD 9,500 invoice with USD 3,000 confirmed test receipt leaves USD 6,500 invoiced unpaid plus USD 500 not yet invoiced/disputed. Do not call the full USD 7,000 order balance all overdue.

Test before release: Reject a repeated receipt reference; preserve a reversed payment as a new event; block entitlement confirmation with a missing title trigger; keep one disputed rug outside accepted quantity; verify no real payment or public-chain write occurs.

Measure: Title-trigger evidence completeness; unexplained custody/title differences; accepted-delivery-to-confirmed-funds time; unreconciled reversals. Pilot gate: all scripted exception cases remain visible and no unresolved event is represented as settled.

Proposed payer: seller/buyer under a disclosed service order. Unit: enabled agreement/reconciliation service or subscription; no percentage charge on principal is implied. Track staff minutes per exception and integration cost before setting a USD tariff.

Accountable roles: A data steward owns the event dictionary; producers and custodians attest their own events; an independent quality/source reviewer checks claims according to the agreed scope.

Start with: Unique item/lot IDs; parent-child material batches; event ID; event time plus time-zone offset and received time; actor/business/site reference; event type; quantity/unit; source document version/digest; claim scope and review status; correction/reversal references.

1. Create one identity and vocabulary
   Responsible: Data steward

   Allocate an opaque item/lot ID and documented event types: received, transformed, packed, dispatched, received-at-site, inspected, split, merged and corrected. Record units and location definitions. A future EPCIS mapping is a standards-alignment proposal, not current GS1 certification.

2. Capture at the actual source
   Responsible: Producer/site custodian

   Record what happened, when, where, why and by whom, with the evidence reference. Assisted/offline intake is permitted but must preserve the original event time and the coordinator who entered it. Do not backdate an upload as if it were real-time capture.

3. Validate quantity and duplication
   Responsible: Rules + data steward

   Reject duplicate external event IDs, impossible units, unknown actors, negative balances and child-lot quantities exceeding their parent. Quarantine inconsistent events instead of silently correcting them. Document legitimate process yield/waste separately.

4. Review the claim rather than just the file
   Responsible: Qualified reviewer

   Label supplier-declared, evidence-checked, independently inspected, expired or disputed claims. Check the issuer, site/product scope and validity of certificates where relied on. Assess labour evidence through a proportionate human process, never facial/age inference or hash-based certification.

5. Reconcile the handover
   Responsible: Sender + receiver

   Match dispatch and receipt by item/lot, place and quantity. A sender cannot confirm the receiver on their behalf. Physical stock counts and source records resolve differences; a one-sided handover remains visibly incomplete.

6. Present a permissioned timeline
   Responsible: COTO operator

   Show source, review scope and last-updated time beside each material assertion. Export only the viewer-permitted fields. Append a correction with reason and superseded event reference, preserving the original and any necessary legal hold.

States: Event: captured > validated > attested > reviewed OR rejected > corrected/superseded. Handover: sender-attested > receiver-confirmed OR discrepancy. Anchor: pending > submitted > confirmed OR failed/recheck-required, tracked separately from evidence review.

Missing source: mark unknown and request evidence; do not fill it with a model guess. Broken handover: show the gap. Duplicate IDs: quarantine both suspect uses until resolved. Expired certificate: remove the current-valid badge, retain historical scope. Suspected coercion: protect the reporter and route to the sourcing/grievance process, not an automatic supplier conviction.

Store full evidence in a proposed private evidence vault with restricted signed retrieval and retention rules; the current pilot stores descriptions/fingerprints, not document uploads. The existing canonical salted SHA-256 audit approach can anchor opaque digests through the disabled relayer after activation approval. Optional OCR/AI flags inconsistencies for people; deterministic quantity checks remain authoritative.

Current/manual route: Use lots, maker-group reference, origin/location, evidence description/digest and protected audit exports. Pilot richer event capture in the supplied event register with named attestations and manual document review through an agreed secure channel.

Still to build: Add a structured event store with issuer permissions, idempotency, parent-child lineage, custody countersignatures, evidence-vault retention and event-level review status. Add import/export adapters only after testing the shared dictionary. A review-status field is not a certification service.

Synthetic scenario: Trace one synthetic yarn lot into two carpet lots, then dispatch 12 pieces to warehouse A and eight to B. Reconcile all 20 with independent receipts; deliberately omit B's receipt and show the provenance gap until it is supplied.

Test before release: Try an over-sized split, duplicate import, changed evidence file and reversed handover; confirm the history remains visible, quantities conserve within the declared process and each viewer sees only permitted fields.

Measure: Percent of required events with source and accountable actor; physical-to-record differences; missing handovers; certificate expiry detection; correction resolution time. Pilot gate: detect every deliberately injected lineage and quantity exception.

Proposed payer: business subscriber or scoped supply-chain programme. Unit: supported lot/event volume and review service, with independent inspection quoted separately. Measure review effort, storage and connector maintenance; do not sell an unsubstantiated ethical badge.

Accountable roles: The passport administrator controls ID issuance and revocation; the manufacturer binds the tag to the rug; qualified reviewers approve claim scope; owners/custodians attest only their authorized events.

Start with: Opaque carpet ID; batch/design revision; construction/materials/dimensions; maker-group/site references; tag serial and issuance/replacement record; product photographs under permission; claim/evidence status and expiry; care/repair information; permitted public fields.

1. Define the minimum passport
   Responsible: Passport administrator

   Choose the essential fields and audience: public product/care summary, partner trade history and restricted evidence. Identify supplier declarations distinctly. Do not expose worker identity, home address, bank information, private prices or the buyer's personal details.

2. Bind a physical identity
   Responsible: Manufacturer + checker

   Print a durable label with a random ID, a first-party HTTPS scan link and a human-readable fallback. Attach it without damaging the rug, photograph the association and verify the scan against the right product. A QR code can be copied; it is a link, not proof of authenticity.

3. Check before publication
   Responsible: Reviewer

   Match specifications and lawful design permissions to the rug; inspect relied-on certificates and issuer/scope/expiry. Publish only fields actually supported. Missing evidence stays marked pending or unknown rather than displaying an unconditional verification badge.

4. Serve the appropriate view
   Responsible: Passport service

   Public scans show only approved product/care details and current claim status. Signed-in businesses receive authorized information. Rate-limit retrieval, use unguessable references and enforce authorization server-side; obscurity alone does not protect private records.

5. Maintain the journey
   Responsible: Authorized custodian/service partner

   Append receipt, repair and authorized claim updates with evidence and timestamps. Replacing a tag requires a reason, old/new serial linkage and reviewer approval. Revoke the old scan mapping or show a replacement notice; do not issue a second independent product identity.

6. Review expiry and anomalies
   Responsible: Administrator + reviewer

   Queue certificate expiry, repeated anomalous scans or a reported counterfeit for investigation. Do not treat scan geography as definitive identity or use tracking without a lawful purpose. Suspend disputed claims while preserving safe access to basic care information.

States: Passport: draft > identity-bound > reviewed > published > updated OR suspended > retired. Tag: issued > attached > checked > replaced/revoked. A public passport scan has no power to change ownership, payment or private data.

Lost/damaged tag: validate against batch, photos and custody evidence before reissue. Duplicate tag: mark disputed and investigate both physical goods. Sold rug: do not publicly expose its new owner. Recalled/unsafe item: display the authorized service notice and retain a safe reporting route. Withdrawal of image permission: remove affected publicity where required without falsifying product history.

The public passport resolver is a new service, not currently deployed. Add signed QR/RFID issuance records if needed, but physical checks remain essential. Future blockchain anchoring can record a version digest and revocation reference, never personal ownership details. AI may draft care text from approved materials/specifications; a qualified person verifies it before publication.

Current/manual route: Create the source product sheet, record the pilot lot and evidence fingerprint, and test printed QR labels against controlled prototype product sheets. Do not distribute a public scan URL until the resolver and privacy filtering have passed testing.

Still to build: Add item-level records, a permission-filtered public resolver, tag serial registry, claim/expiry fields, revocation/reissue workflow, access logging and abuse controls. RFID is optional and must be costed per reading site; no requirement to buy it for the first pilot.

Synthetic scenario: Prepare ten synthetic item passports across two batches. Use QR labels, then simulate one copied tag, one expired certificate and one legitimate replacement. Confirm a public visitor cannot retrieve buyer, wage, price or restricted evidence records.

Test before release: Guess another identifier; open a revoked tag; substitute a label onto another rug; inspect the public API response for restricted fields; confirm scan itself cannot change title. The test must include a physical mismatch, not just working URLs.

Measure: Correct physical-to-record matches; unauthorized field exposure (target zero in the test); successful legitimate reissues; expired-claim suppression; cost per maintained passport. No counterfeit-prevention guarantee is inferred.

Proposed payer: manufacturer/retailer under a passport service order. Unit: issued and maintained item/batch, plus optional tagging or inspection cost. Quote external tag/reader costs transparently; no extra fee for inventing a claim.

Accountable roles: Trade operations coordinates; the actual buyer/seller accept terms; producers approve understandable work orders; warehouse parties attest custody; finance reconciles without COTO holding money.

Start with: Business roles/authority; location and dispatch/destination; capacity and available volume/unit; quality brief; RFQ/quote validity and disclosed intermediary fees; landed-cost components; accepted order version; production work orders; delivery/inspection evidence; USD invoice/receipt references.

1. Qualify a comparable demand brief
   Responsible: Buyer + coordinator

   State quantity/unit, construction, tolerances, destination, deadline, minimum conditions, USD price basis and precise Incoterm/place. Confirm what costs are included. Producers can use an assisted route; coordinators record who supplied and approved the information.

2. Collect and compare offers fairly
   Responsible: Approved sellers + buyer

   For the manual pilot, collect time-stamped written quotes with available volume, dispatch point, quality evidence and expiry. Apply disclosed eligibility checks first, then compare normalized landed-cost components and delivery feasibility. Mark unknown costs instead of manufacturing a cheapest offer. Document conflicts and selection reasons; do not guarantee an optimal clearing price.

3. Agree allocation and freeze terms
   Responsible: Actual seller + buyer

   Permit partial/multiple-supplier allocation only with explicit buyer approval and separate accountable seller obligations. Each resulting order has an agreed quantity and USD terms. Both approve the exact version; reserve stock atomically. No model or coordinator silently changes an accepted price, quantity or supplier.

4. Create fair production work orders
   Responsible: Contracting payor + producer/group

   Identify the real payor, material ownership, piece/hour rates, quality and dates in an understandable language. International trades remain USD, but wages follow local lawful currency/rules. Do not let hidden access fees or intermediary deductions consume earned pay. A producer complaint does not cancel earned remuneration.

5. Reconcile site movements and exceptions
   Responsible: Sender + each warehouse/receiver

   Record separately owned, physically held, reserved, in-transit, quarantined and available quantities. Require receiving confirmation at each site, inspect and assign differences to an owner. Returns do not become sellable stock automatically; a documented restock inspection is needed.

6. Compile and reconcile obligations
   Responsible: Seller finance + buyer + reviewer

   Issue authorized invoices for agreed milestones, present accepted and disputed amounts separately, and record bank evidence through the approved process. A consolidated statement references the original invoice lines; it is not a second invoice. Issue recipient-created invoices only where legally authorized and agreed. Keep worker pay obligations distinct from customer collection.

States: Demand: draft > qualified > quotes-open > evaluated > selected/expired. Sale: proposed > separately approved by both > accepted. Fulfilment: not-started > production-started > dispatched > received > inspection-accepted OR disputed. Allocation and finance are separate subledgers.

Expired quote or missing landed cost: obtain a new comparable quote. Capacity shortfall: seek a signed variation, not forced subcontracting. Duplicate allocation: reject the second reservation. Partial rejection: quarantine lines and seek agreed cure; do not withhold unrelated lawful wages. Late payment: assign an escalation owner and show aging rather than pretending to release funds automatically.

Current atomic order/lot versions reduce double reservation, and private audit records show approvals. A future RFQ/offer engine should use time-stamped access-controlled offers, explicit closing/allocation rules and auditable awards; no real auction is active. Optional AI extracts/comparisons only from approved quotes, showing source fields and uncertainty. It cannot set a collusive price, assess creditworthiness or approve people.

Current/manual route: Run comparable quotes in the supplied RFQ/allocation register, then use existing lot/order approvals and invoice/balance endpoints. Use manual signed work-order and warehouse registers; the pilot has no RFQ service, multi-user business teams or multi-site stock subledger.

Still to build: Add RFQs/offers/expiry, normalized cost components, allocation/stock locations, producer work orders and pay obligations, partial delivery/inspection lines, amendments/cancellation and controlled consolidated statements. Real bidding needs separate anti-manipulation and competition review before activation.

Synthetic scenario: Use a synthetic brief for 20 rugs, a 12-piece seller in Jaipur and an eight-piece seller at another dispatch point. Compare freight and deadlines separately, approve any split explicitly, and create two seller-specific orders. Do not merge their liabilities into an unapproved single contract.

Test before release: Reject an expired offer, a non-comparable unit and a double reservation; account for one warehouse quarantine; ensure producer pay is not inferred from customer payment; confirm no bid, fee or bank transfer is executed by the planning register.

Measure: Complete comparable quotes; RFQ-to-agreed-order time; unallocated/over-reserved volume; undisputed overdue USD; producer payment timeliness; time spent re-entering data. Track baseline before claiming savings.

Proposed payer: buyer/seller subscription or a disclosed scoped coordination programme. Charge legitimate logistics/review partners transparently; removing opaque intermediation does not eliminate real transport, inspection or support costs. Any future bidding fee needs explicit enabled-service terms.

Accountable roles: A designer owns the brief and rights review; a weaver/production specialist checks manufacturability; the buyer approves the physical sample and final specification. The AI operator does not decide those approvals.

Start with: Rights-cleared references and permitted uses; construction/loom limits; dimensions and tolerances; palette/material availability; repeat/grid resolution; target effort/cost assumptions; buyer constraints; prohibited motifs/uses; model/vendor/data-handling permission; sample acceptance criteria.

1. Freeze the constraints
   Responsible: Buyer + designer + weaver

   List fixed versus flexible attributes, including technique, colour count, material, scale and tolerances. Estimate production effort with the maker; do not let a visually attractive rendering conceal an unworkable weave or unpaid labour.

2. Clear the input rights and data route
   Responsible: Rights holder + data owner

   Log each reference, owner/licence, permitted generation/use and confidentiality restriction. Obtain separate maker image/story permission if relevant. If the selected AI vendor/data-processing route is not approved, use a rules-based/manual design trial instead of uploading customer files.

3. Generate a bounded candidate set
   Responsible: AI operator + designer

   Propose a small fixed maximum set per brief and log model/version, prompt/template, input references, date and cost. Keep drafts clearly synthetic and private. Limit budget and retries; generation is not evidence of ownership, originality or production performance.

4. Screen and shortlist
   Responsible: Designer + production specialist

   Apply deterministic checks for dimensions, repeat geometry, palette count and known technique constraints. Review possible copied motifs and licensing issues manually. A similarity tool is a warning aid, not IP clearance. Reject impractical detail before spending on samples.

5. Sample and cost the actual work
   Responsible: Weaver + quality reviewer + buyer

   Produce the agreed physical sample, record materials, hours, cost and deviations from the rendering. Buyer and maker assess appearance and feasibility; quantify acceptable handmade variation. Do not release based only on a screen image or inferred AI confidence.

6. Release one approved specification
   Responsible: Designer + buyer + planner

   Record authorized approvals, final design version/fingerprint, sample reference, dimensions, materials, tolerances and work instructions. Production uses only that version. Further change requires a documented reapproval and a decision on price/time and work already completed.

States: Brief draft > rights-cleared > candidates-generated > feasibility-screened > sampled > buyer-approved > production-version-released. Rejected candidates never replace the approved design. A new material/design revision repeats the required checks.

Unclear input licence: stop generation using that reference. Vendor outage: retain manual design route. Repeated constraint failure: stop the run at its budget cap. Suspected copying: escalate before sampling/publication. Sample mismatch or maker effort increase: revise or reject the candidate with buyer agreement; never force unchanged pay for a materially harder design.

Begin with a human-operated design tool and structured approval register. A specific model/provider is not selected or integrated. External AI processing needs an approved contract/data route and no-training terms where required. An optional later ledger digest timestamps the approved version only; it does not grant copyright or prove originality.

Current/manual route: Use a manually prepared brief, rights register, candidate log and physical sample approval. The existing lot can reference an approved design version through its title/evidence description, but that is not a structured design-management service.

Still to build: Add private asset/version storage, input licences, prompt/run metadata, deterministic feasibility rules, sample approval records and a model-cost ceiling. Link released designs to production work orders. Benchmark before choosing an AI subscription or making efficiency claims.

Synthetic scenario: Compare five representative rights-cleared briefs against the same manual baseline. Allow up to six candidates and two samples per brief as proposed pilot limits, not service promises. Keep original maker inputs and record all rejected candidates and reasons.

Test before release: Supply an unlicensed reference, ask for a fourth colour in a three-colour brief, change the buyer-approved file and simulate vendor unavailability. Confirm no rejected design enters a work order and manual fallback remains possible.

Measure: Time from complete brief to approved physical sample; maker hours and sample cost; constraint-failure rate; rights exceptions; buyer rejection/rework. A useful pilot must reduce total effort/cost without worsening quality, rights or producer remuneration.

Proposed payer: manufacturer/buyer under a fixed design-support or clearly capped project order. Track vendor generation cost, designer time, maker sample pay and rework. No undisclosed licence transfer, unlimited generation charge or free extraction of artisan designs.

Accountable roles: An operations coordinator owns the exception queue; each event source attests its facts; the designated recipient accepts an action. Business representatives alone approve changes to contractual commitments.

Start with: Order/lot and event IDs; source and source time; observed versus estimated status; freshness limit; affected site/quantity/date; recipient roles and agreed channel/consent; required action; due time/time zone; escalation owner; confidentiality classification.

1. Define the event-to-action rules
   Responsible: Coordinator + trading parties

   Start with five events: approval needed, dispatch change, receipt mismatch, invoice due and quality concern. For each, define source, intended recipient, allowed fields, due time and escalation. Timing targets are pilot configuration, not a universal SLA.

2. Validate source and freshness
   Responsible: Rules + source owner

   Require the matching order and permitted actor. Reject duplicate event IDs and mark late/stale status. Store event time and ingestion time separately; display the last-update time. Conflicting sources enter review rather than letting a model select the more convenient one.

3. Prepare a factual message
   Responsible: Template engine; optional AI editor

   Include what changed, quantity/location, source timestamp, action requested, deadline and a safe first-party reference link. Start with deterministic templates. If AI translates or summarizes, retain the source, disclose estimates and require review for commercial/legal or sensitive messages.

4. Route privately and track delivery
   Responsible: Notification service + coordinator

   Use authorized role recipients and agreed contact preferences. Do not include personal wage data, bank instructions or confidential prices in public notifications. A future provider queue uses idempotency, bounded retries and a failed-delivery queue. No email/SMS provider integration is currently asserted.

5. Require an accountable response
   Responsible: Recipient

   Acknowledge receipt separately from accepting a new commercial term. Add a reason, evidence or proposed revised date. A revised price/date/quantity becomes a pending order amendment requiring the proper parties, never an automatic contract update.

6. Escalate and close with evidence
   Responsible: Coordinator + responsible party

   Escalate unacknowledged or overdue actions to the named backup, then record resolution and supporting reference. The coordinator cannot close a disputed physical fact just because the message was delivered. Export the action history and measure recurring causes.

States: Event: received > validated > routed. Action: open > notified > acknowledged > action-complete > reviewed/closed. Delivery failed, stale-source, overdue and disputed are explicit exception states. Notification delivered does not mean goods delivered or action accepted.

Wrong recipient or changed authority: revoke access and reroute. Failed channel: use the agreed manual/telephone fallback and record it. AI translation ambiguity: show the original and request human clarification. Stale logistics feed: label unknown and contact the source, rather than promising an arrival date. Urgent safety concerns follow the separate safeguarding/emergency route.

Add an outbox in the same database transaction as the business event so an accepted change cannot silently lose its notification task. A worker sends with retry/deduplication, records provider status and never treats a delivery callback as business approval. AI is optional; blockchain stores only an approved audit digest after activation, not message content or contact details.

Current/manual route: Use existing order/fulfilment records and a coordinator-managed action register; send agreed messages manually from authorized business channels. Capture acknowledgements and failures in the register. There is no active platform SMS/email-notification worker or automated AI translator.

Still to build: Add transactional outbox, event templates, role/contact preferences, retry/dead-letter handling, acknowledgements, due-time escalation and amendment records. Complete provider privacy/security review and country/channel rules before sending live automated messages.

Synthetic scenario: Simulate a dispatch delay, one lost email, duplicate event ingestion, a receiver mismatch and a stale feed. Set an agreed test acknowledgement target, then measure actual latency and the fallback burden; do not advertise instant updates from manual sources.

Test before release: Deliver the same event twice; change a recipient's authorization; inject an invented ETA; fail the provider; try to amend a price via acknowledgement. Each must preserve one action record, appropriate access and explicit contract reapproval.

Measure: Event-to-notice latency with freshness disclosed; acknowledgement time; overdue actions; delivery failures resolved; messages causing a false commitment (target zero in scripted tests). Compare manual coordination time before and after.

Proposed payer: business subscription or scoped coordination service, with message overage capped and disclosed in USD. Cost drivers are provider messages, support and exception handling, not the mere number of blockchain transactions.

Accountable roles: The site planner owns production commitments; the stock custodian owns material counts; the maintenance engineer owns equipment decisions; an integration/data steward owns connector quality and permissions.

Start with: Approved design/order revision; production site and technique; bill of materials and units; opening/received/issued/returned stock; actual output, rework and scrap; work-centre status; approved maintenance intervals; event/source timestamps; labour capacity and safe operating limits.

1. Map one real process first
   Responsible: Planner + producer/site team

   Select one site and technique; document its actual work stages, units and local safety authority. Begin with signed CSV/manual intake rather than an invasive machine connector. Agree collection intervals that match the process and do not imply continuous telemetry from hand weaving.

2. Reconcile the input data
   Responsible: Stock custodian + data steward

   Match approved design revision, materials and quantities. Convert units only with documented factors. Check opening plus receipts minus issues plus returns against counted stock; declare yield/waste and quarantine separately. Missing readings are not zeros.

3. Establish a deterministic baseline
   Responsible: Planner + engineer

   Use the approved bill of materials, lead times and scheduled maintenance to calculate initial material requirements and checks. Proposed replenishment = max(0, planned demand + agreed safety stock - usable stock - reliable due receipts). Do not count reserved, quarantined or unconfirmed inbound stock as free supply.

4. Trial analytical recommendations in shadow mode
   Responsible: Data analyst + planner

   Only after adequate representative history, compare forecasts/anomaly scores to the baseline without executing them. Record training window, input quality, model version and uncertainty. Exclude invalid sensors and document drift; a handwoven process may not have meaningful predictive-maintenance data.

5. Approve operational work
   Responsible: Authorized planner/engineer

   Approve a replenishment or inspection request against budget, supplier capacity and safe procedures. A purchase needs its own agreed order; an engineer controls maintenance and isolation/lockout. The integration must not send autonomous machine commands or override safety interlocks.

6. Close the work and learn
   Responsible: Site team + reviewer

   Record material receipt, completed work, actual output/quality and authorized downtime. Reconcile consumption and productivity without exposing individuals unnecessarily or using unsupported performance scores. Investigate errors and authorize any model/rule revision before reuse.

States: Production: planned > materials-checked > work-authorized > in-progress > quality-check > accepted/rework/quarantine > complete. Recommendation: proposed > reviewed > approved/rejected > executed > outcome-checked. A safety stop remains under local authorized control.

Material shortfall: propose resequencing or an approved purchase, not unapproved substitution. Faulty sensor or late CSV: mark data stale and revert to local records. Quality hold: quarantine output and maintain the buyer update. Safety alarm: follow site procedures; COTO cannot clear it. Capacity pressure must not be resolved by unlawful hours, pay cuts or hidden child participation.

Use read-only connectors initially, per-site credentials, validation and an append-only event log. Future AI is a decision-support component with model/version and uncertainty, not equipment control or worker scoring. Blockchain is optional for selected approved production milestones; most operational measurements should stay in the private production system.

Current/manual route: Link the existing order and lot to a manual production/BOM/material register and record the permitted high-level production_started and dispatch events. Current API does not implement bills of materials, site stock, machine telemetry or maintenance work orders.

Still to build: Add read-only imports with schema validation, site/unit maps, BOM and batch consumption, work orders, reconciliation and stale-feed indicators. Establish safe connector access and recovery. Add models only after adequate data, a baseline and shadow validation; exact sample size depends on the process and must be justified.

Synthetic scenario: At one synthetic site, plan 20 rugs using an approved BOM. Inject a unit-conversion error, insufficient yarn, a delayed receipt and a maintenance flag. Compare material requirements to a manual calculation; no machine command or procurement payment is sent.

Test before release: Do not count quarantined yarn as available; reject an unknown unit; retain the last approved design; mark a stale sensor unknown; confirm only the engineer may approve maintenance. Model output must not change an order or safety state.

Measure: Material balance differences; stockout hours; rework; schedule adherence; forecast error versus baseline; false maintenance alerts and actual downtime. Pass only if visibility improves without bypassing safe work or increasing unexplained inventory differences.

Proposed payer: manufacturer/site under a scoped integration and support order. Price initial mapping separately from connector upkeep, hardware and any model service. Validate measurable benefit before adding sensors or paying for large cloud-model workloads.

Accountable roles: A service coordinator owns each case; a qualified quality reviewer assesses evidence; the contracting seller/buyer authorize remedies; a safeguarding lead handles labour concerns through a separate confidential route.

Start with: Item/passport or lot/order reference; report date and reporter authority; issue category; observed facts versus opinion; safe permitted photographs; care/use context; warranty/claims terms; inspection results; authorized remedy and refund references; consent/retention requirements.

1. Open an accessible case
   Responsible: Customer/retailer + coordinator

   Accept a simple first-party form or agreed email/assisted route, assign a case reference and explain the next step. Collect only necessary product/contact data. A carpet does not automatically report its use; sensors or tracking must not be assumed or introduced without a real purpose and proper controls.

2. Link the right product and contract
   Responsible: Coordinator + counterparty

   Check item/lot, seller/buyer, delivery date and applicable claims terms. Lost tags use a documented fallback against purchase and product evidence. Do not publish customer identity or reject a claim automatically merely because a tag is missing.

3. Assess evidence fairly
   Responsible: Quality specialist

   Separate visible damage, construction issue, colour variation, care issue, delivery loss and uncertain cause. Request proportionate additional evidence or an inspection; preserve original reports and note ambiguity. A score cannot establish blame or displace statutory/contractual rights.

4. Offer an authorized response
   Responsible: Actual contracting parties

   Choose clarification, care guidance, inspection, repair, replacement, agreed price adjustment or refund according to the contract/law. Specify who pays logistics, timing and what happens to returned goods. COTO coordinates records; it does not adjudicate the dispute or refund funds it never held.

5. Confirm the remedy and payment record
   Responsible: Recipient + finance reviewer

   Track return custody, repair/replacement completion and recipient confirmation separately. Link a credit/refund to the original invoice and authorized route, retain reversals and prevent duplicate credits. An operator attestation remains separate from bank confirmation.

6. Review patterns and prevention
   Responsible: Quality + design/production team

   Aggregate confirmed case categories by batch/design/material with privacy safeguards and exposure counts. Start with descriptive trends; apparent clusters trigger investigation. Update an approved production/design specification only after evidence review and formal version control.

States: Case: received > identity-linked > evidence-needed > assessed > remedy-proposed > authorized > performed > confirmed/closed OR appealed/reopened. A suspected defect is not a confirmed defect; a request to close is not proof the remedy was delivered.

Wrong/missing item match: investigate rather than invent a link. Safety issue: escalate urgently to competent parties and consider an authorized notice/recall process. Labour grievance: protect individuals and use the sourcing route. Disputed cause: keep uncertain and offer agreed independent assessment. Inactivity closes no legal rights; reopening/appeal remains recorded.

A case-management store with restricted contacts and linked evidence is a new feature. Optional AI can classify or summarize reports in shadow mode with confidence and source references. Defect prediction requires sufficient labelled representative outcomes and denominators; do not publish a defect rate from selected complaints. No model may reject a warranty or make a high-impact eligibility decision.

Current/manual route: Use an agreed manual case register and the existing order disputed state/audit export for a relevant accepted trade. Current API has no general case portal, repair workflow, credit notes, refunds, reopened disputes or defect-prediction model.

Still to build: Add cases, secure evidence requests, rights/claims terms, remedy approvals, returns and credit/refund accounting, escalation/reopening and controlled batch analytics. Complete the actual provider arrangement before linking any refund instruction to a payment service.

Synthetic scenario: Use ten synthetic reports including duplicate claims, one lost tag, ambiguous care damage, a genuine batch issue and a labour concern. Verify case ownership and routing; do not display any test case as a customer review or count it as commercial traction.

Test before release: Prevent duplicate credit for the same claim; block one business from another's cases; retain an appeal; route a safeguarding concern privately; keep suspected versus confirmed defect categories separate; confirm no automatic refund or warranty rejection occurs.

Measure: Time to acknowledge/resolve with staffed targets agreed first; evidence completeness; reopened cases; confirmed defect rate only with an exposure denominator; repeated root cause; remedy completion verified by recipient. Track fairness and false rejection as well as speed.

Proposed payer: seller/manufacturer through an agreed support service, or a buyer-agreed service scope. Separate coordination fees from warranty/repair/refund liabilities. Do not charge a producer an undisclosed penalty based on an AI score.

Supplier attests its source lot; dyer/mill records transformation; manufacturer reconciles consumption; a competent reviewer/laboratory checks the specific claim scope.

Evidence: Supplier and batch references; material species/composition; purchase and processing documents; quantity/unit; process losses; segregated versus mass-balance accounting method; test method/sample chain; issuer/site/scope/expiry; input-output links.

1. Register the source lot

   Supplier + source reviewer

   Record the declared origin and material composition against an actual batch and invoice. Document how the claim was checked. A fibre test can support composition within its method, but does not automatically prove a geographic origin.

2. Track the transformations

   Mill/dyer + receiving site

   Link yarn preparation and dye batches to their inputs, outputs, sites and documented process losses. Require the receiver to confirm quantity. Mixed inputs need an explicit transformation event rather than a false single-source identity.

3. Reconcile physical and accounting claims

   Manufacturer + stock reviewer

   Keep segregated/identity-preserved material separate from any mass-balance accounting claim. Check units, yield and declared waste. Allocated certified quantity cannot exceed the verified eligible input adjusted for the applicable scheme; mass balance must not be described as proof of physical content in every rug.

4. Assist document checking

   AI operator + reviewer

   Extract material, date, batch, quantity and issuer fields from permitted documents into a draft; compare them to the register. Low-confidence extraction or contradictory country/batch data goes to a person, not a guessed replacement.

5. Approve the product claim

   Claim owner + competent reviewer

   State exactly what is supported: composition, declared source, tested sample or scheme allocation. Record reviewer competence, evidence scope and uncertainty. A disputed source cannot receive an unconditional origin badge.

6. Publish a limited lineage view

   Passport administrator

   Show approved lot relationships, declared versus reviewed claim status and review date to the permitted audience. Append corrections and expiry changes; do not disclose private supplier prices or individual worker details.

Blockchain: A future approved ledger records opaque source/transformation references, approved-event digests, issuer/reviewer attestations and correction/revocation links. Full invoices, lab reports and identities remain private. A laboratory signature attests only the tested scope; the ledger cannot turn a supplier declaration into scientific proof.

AI: OCR and entity matching identify inconsistencies and missing links. Begin with deterministic stock/mass calculations as the baseline. Do not infer origin from rug appearance, nationality or an unsupported model score. Evaluate extraction error on representative documents and keep the original evidence available to the reviewer.

Exceptions: Unknown source, missing document, mixed batch, impossible yield or a revoked scheme certificate triggers a visible claim hold. An accredited test or issuer confirmation is needed only for the claim actually relied on. A corrected declaration is versioned; it does not silently rewrite the batch journey.

Current/manual: Start with the existing lot evidence description/digest and an approved manual material-lineage register. No source-laboratory network, raw-material token or mass-balance service is currently active.

Still to build: Structured input-output batches, unit/yield rules, evidence vault, issuer/claim status, reviewer permissions and the passport visibility view. Laboratory/issuer interfaces require separate agreements and test methods.

Synthetic pilot: Synthetic input: 100 kg eligible yarn, 5 kg documented process loss and 95 kg output. Try allocating 110 kg of eligible claim, then mix a second batch. The system must flag over-allocation and prevent an identity-preserved claim on an unsegregated mixture.

Acceptance tests: Catch wrong units, altered report digests, missing transformation links and expired claim authority. Reviewer can state insufficient evidence. No source is fabricated, and a valid hash alone never clears the claim.

Measures: Source-link completeness; unexplained material balance; claim corrections; reviewer minutes; extraction errors. Compare like-for-like claims only.

Proposed economics: Proposed payer: manufacturer/brand under a lot-based traceability or scoped assurance service. Laboratory, scheme and independent review charges are separate and disclosed. A subscription does not purchase proof of origin.

Actual employer/contracting payor owes remuneration; the producer or authorized representative can query records; finance prepares evidence; an independent labour/accounting reviewer checks discrepancies. COTO is not the wage payor unless a valid actual contract says so.

Evidence: Understandable work order; payor; lawful employment/contract status; work quantity/time and agreed rates; required local payment currency; lawful conversion rule if relevant; permitted deductions; due date; restricted receipt evidence; safe correction/grievance route.

1. Agree an understandable work order

   Payor + producer/group

   Record the actual work, rate, input ownership, quality criteria, due date and permitted deductions. An authorized coordinator cannot waive individual mandatory rights. International trade amounts remain USD; wage payments follow the currency and rules required locally.

2. Record work and independent queries

   Producer + work supervisor

   Confirm completed work and provide an accessible statement. Preserve a channel outside the immediate supervisor to dispute quantities or deductions. No smartphone, publicity release or public biometric record is required to receive earned pay.

3. Prepare the remuneration statement

   Finance preparer

   Calculate gross entitlement, each lawful agreed deduction and net amount using exact arithmetic. Separate advances, credits, employer contributions and any COTO/service fee. Do not silently deduct platform charges from wages.

4. Flag mismatches for review

   Rules/AI + independent reviewer

   Detect arithmetic gaps, duplicate references, inconsistent rates, unusual repeated deductions and missing receipt evidence. AI may extract fields or prioritize missing paperwork only. It cannot determine a person's legal wage entitlement, employment status or eligibility.

5. Confirm payment through a lawful route

   Actual payor + beneficiary + reviewer

   Record separately payment instructed, credited and available, according to the real banking/payment arrangement. A supervisor's attestation is not proof the producer received money. Permit a safe producer challenge; handle cash evidence only with a lawful, proportionate procedure.

6. Share aggregates with scope

   Authorized reviewer + data owner

   Release only appropriately protected period/batch-level totals and methodology to authorized buyers or programme overseers. Small cohorts may be identifiable; suppress or aggregate further. Show wage evidence status and unresolved differences without claiming exploitation-free production.

Blockchain: Keep personal/payroll records off-chain, including individual complaint links. If needed, anchor only an approved aggregate statement digest and reviewer authority after a re-identification assessment. No worker wallet, wage token, public salary ledger or automatic deduction is created.

AI: Assist extraction and anomaly triage under a fixed documented purpose; baseline rules handle arithmetic and duplicate checks. Log evidence, model/version and human disposition. No biometric age inference, employment decision, punitive scoring or autonomous denial of pay is allowed.

Exceptions: Missing beneficiary confirmation remains unresolved; a lawful due wage must not be relabelled paid. Suspected coercion/retaliation goes to a competent independent safeguarding route. Customer non-payment does not automatically defer earned remuneration. Corrections retain the original statement and reason.

Current/manual: Trial a private remuneration register under appropriate labour/privacy advice and controlled evidence exchange. Existing carpet order balances do not represent individual payroll or prove worker payment.

Still to build: A separately permissioned producer-work/remuneration ledger, accessible statements, restricted evidence, aggregate disclosure, independent challenge and lawful retention. Local specialist review is needed before real worker data is processed.

Synthetic pilot: Use fictional work orders with one duplicate payment reference, one unexplained deduction and one payment marked sent but not credited. Confirm the producer can dispute it and buyers cannot view individual salaries or identities.

Acceptance tests: Block cross-person/payor data access, detect the duplicate and unexplained difference, preserve a challenge and prevent a supervisor from representing an unsupported receipt as final payment.

Measures: Undisputed amounts paid by lawful due date; unresolved statement differences; safe query accessibility; duplicate/short-payment detection; privacy exposure (target zero in scripted tests).

Proposed economics: Proposed payer: contracting manufacturer or responsible-sourcing programme under a scoped assurance order, never an undisclosed worker access fee. Review cost and remediation funding are distinct from wage principal.

The certificate issuer controls its attestation/revocation; the supplier submits evidence; a conflict-aware reviewer validates identity/scope; the claim publisher is accountable for the public wording.

Evidence: Issuer identity and verification channel; certificate reference/version; subject/site/products/batches; standard and scope; issue/expiry; status/revocation source and last check; document digest; reviewer authority; public claim wording.

1. Declare the precise claim

   Supplier/brand

   Identify the standard, issuing body and exact site/product/batch scope. A general company certificate must not be represented as certification of every carpet. Identify self-declared assertions separately.

2. Validate issuer and source

   Reviewer + actual issuer

   Use an independently verified issuer channel or registry where available, not only the uploaded PDF. Confirm its authority, reference and scope, and record the response/time. An issuer is not assumed to partner with COTO.

3. Extract and compare

   AI operator + reviewer

   OCR relevant fields from the permitted document, then match identifiers, dates and scope against source records. Flag inconsistent typography or metadata only as suspicion; a model cannot conclusively label a document forged.

4. Attest the reviewed status

   Issuer/authorized reviewer

   Set supplier-declared, document-checked, issuer-confirmed, expired, revoked, disputed or unknown with scope and last-check time. Only the issuer can make its own original certification; a reviewer attests the checks actually performed.

5. Monitor expiry and revocation

   Status service + reviewer

   Apply expiry reminders and verified issuer updates, keep a stale-source state and remove the current-valid badge when support lapses. Corrections do not erase the historical fact that a certificate was previously presented.

6. Expose a bounded assurance view

   Claim publisher

   Publish only the approved claim, evidence/status source, scope, date and limitations. Restrict confidential reports and personal data. A verifier page must not show a broader assurance level than the underlying issuer evidence.

Blockchain: Anchor document/version digests and authorized attestations with scope, status and revocation links after ledger activation. Issuer keys and authority need onboarding, rotation and revocation controls. A timestamped PDF hash alone is only evidence of the presented file, not issuer authenticity.

AI: Extract and reconcile, detect missing fields and route uncertain matches. Measure exact critical-field accuracy and false accusations on varied scans/languages. Approval remains human/issuer based; deterministic expiry rules do not require a language model.

Exceptions: Issuer unreachable: display not revalidated/stale, not confirmed. Name mismatch: resolve documented legal-name changes. Revoked certificate or compromised signing key: retract affected current claims and queue dependent passports. A paid review may not guarantee a positive status.

Current/manual: Record certificate references and review notes in controlled registers/evidence descriptions. The current business approval and lot fingerprint do not establish certification status.

Still to build: Issuer directory, claim-scope model, attestation/revocation events, independent verification evidence, expiration jobs and filtered public views. Issuer integrations require their actual consent/terms and operational testing.

Synthetic pilot: Use fictional certificates including an expired one, a real-looking altered reference, a revoked one and a company-level certificate wrongly applied to a rug. Each must receive the appropriate limited status.

Acceptance tests: Do not clear the altered reference from its hash; propagate revocation; mark stale checks; prevent a supplier from granting itself issuer-confirmed status; block a badge outside certificate scope.

Measures: Current claims with verified scope/source; expiry/revocation propagation delay; false confirmation rate; unresolved issuer queries; review effort per claim.

Proposed economics: Proposed payer: subscribing brand/manufacturer or scoped document-review customer. Fee buys documented checking, not certification or a favourable result. Independent issuer charges remain separate.

Manufacturer registers the reference rug; a trained examiner reviews suspected mismatches; tag administrators control replacement; the brand/rights holder approves any authenticity statement.

Evidence: Item/batch/design ID; authorized reference photos at defined angles/scale/lighting; distinctive construction/pattern features; sample/capture method; tag serial; issuance/custody history; examiner findings; known variations and test dataset.

1. Capture a trustworthy reference

   Manufacturer + examiner

   Photograph the actual item using a repeatable protocol and link it to the batch, design and tag attachment evidence. Check the reference source; a false initial registration would otherwise acquire a convincing digital history.

2. Issue and bind the identifier

   Tag administrator + custodian

   Create a random first-party ID and controlled label; document attachment and checking. Record reissues and revocation. Tags, NFC and RFID can be copied or moved, so the binding procedure is part of the evidence.

3. Collect a comparison safely

   Retailer/customer + examiner

   Request minimum product images or a physical examination through a controlled route. Avoid collecting customer location or personal information unnecessarily. Record image quality and whether the capture is adequate for comparison.

4. Compare in shadow mode

   Computer-vision tool + examiner

   A model may rank similarity against the right reference and flag possible mismatch or duplicate-tag use. Record model/version, capture conditions and uncertainty. Poor images, repairs and handmade variation must not become automatic fraud accusations.

5. Decide with physical/contextual evidence

   Trained examiner + accountable brand

   Review texture/construction, history, tag mapping and any available inspection. Record consistent, inconclusive or mismatch requiring investigation. An adverse finding needs a fair correction/appeal route and must not be based solely on machine vision.

6. Correct or reissue the record

   Authorized administrator

   Link a confirmed replacement/reissue to the original history; suspend an unsupported public claim when needed. Preserve the evidence and reason. A scan cannot transfer title, debit a buyer or permanently erase another claimant's record.

Blockchain: A future ledger can anchor the registered-reference digest, controlled tag lifecycle and authorized examiner attestation. Raw image files and customer details remain private. A persistent identity is a claim to be checked against the object, not an unforgeable physical guarantee.

AI: Use bounded similarity/anomaly assistance only after representative tests covering genuine variation, wear, repairs, copied labels and poor lighting. Report false match/non-match rates and an inconclusive option. No facial/person identification is needed.

Exceptions: No valid reference, inadequate image or substantial repair: request more evidence or in-person inspection. Duplicate tag: retain both reports and investigate. Disputed authenticity: prevent broad public accusation and permit qualified review.

Current/manual: Trial controlled photographs and a manual tag/examination register with fictional items. The current pilot has no trained authentication model, examiner network or public authenticity service.

Still to build: Reference-image storage, capture validation, tag-reissue records, examination/appeal workflow and a permissioned result view. Add computer vision only after a representative labelled evaluation and appropriate rights/data arrangements.

Synthetic pilot: Use genuine test-item variations, a moved/copied tag and poor-quality photographs. Blind reviewers to the model output for a baseline, then compare assisted decisions and confidence.

Acceptance tests: A copied tag must not prove authenticity; a poor photo must allow inconclusive; a genuine handmade variation must not automatically trigger fraud; unauthorized users cannot change the reference or examiner result.

Measures: False match/non-match and inconclusive rates; examiner time; physical mismatch detection; erroneous adverse claims; controlled reissue completeness.

Proposed economics: Proposed payer: brand/retailer under an examination or identity-maintenance service. Physical inspection cost is disclosed. Do not sell a guarantee of counterfeit elimination.

The manufacturer supplies source data; a qualified analyst selects the method and calculation; an independent reviewer checks relied-on claims; the publisher is accountable for the wording.

Evidence: Defined product/functional unit and life-cycle boundary; material amounts; energy/fuel/water/waste records; allocation rules; supplier factors with dates/geography/method; transport assumptions; uncertainty/data quality; calculation version and review scope.

1. Define one comparable question

   Claim owner + qualified analyst

   Specify the unit, product life/use scenario and included stages. Carbon, water use and chemical compliance need their own appropriate methods; do not collapse them into an unsupported universal eco-score. Define comparison rules before comparing suppliers.

2. Collect and classify source data

   Site/supplier + analyst

   Record measured bills/meters, material records and declared estimates separately, including periods and units. Missing information remains missing or uses a justified labelled estimate; it is not zero impact.

3. Assist extraction and detect gaps

   AI operator + analyst

   Extract figures from permitted bills/reports and check unit/period consistency. Flag improbable values or missing coverage. A language model must not invent an emission factor, meter reading or supplier certificate.

4. Calculate reproducibly

   Qualified analyst

   Use a versioned method/factor library and exact units; record each allocation and assumption. For carbon, use an appropriate product life-cycle accounting approach with documented scope/data quality. Compare alternatives only on consistent boundaries and declared uncertainty.

5. Review the claim and wording

   Independent reviewer + publisher

   Check material drivers, double counting, data quality, calculation and review scope. State measured versus modelled, period, boundary and uncertainty. No carbon-neutral, zero-impact or certified label follows merely from paying a subscription or anchoring a number.

6. Maintain and disclose selectively

   Claim publisher

   Publish the approved summary and method/reference dates, while restricting commercially sensitive bills and personal data. New factors or corrected inputs create a new calculation/claim version and a documented reason for changed results.

Blockchain: Anchor an approved calculation-package digest, method/factor version and scoped reviewer attestation after ledger activation. A later reader can check that the referenced package changed; the ledger does not validate a measurement or confer environmental certification.

AI: Assist document extraction and anomaly triage, with all critical values traceable to source pages. Use deterministic calculations as the numerical authority. Require a qualified person to approve substitutions, assumptions and comparative claims.

Exceptions: Missing major data, incompatible boundaries or obsolete factors: publish insufficient/not comparable rather than a green ranking. Recycled-content and renewable-energy claims need evidence for their own allocation rules; do not count the same attribute twice.

Current/manual: Run a reviewed private source/calculation register. Existing lot descriptions may reference approved evidence but do not constitute an LCA/footprint engine or verified environmental claim.

Still to build: Versioned source inventory, method/factor library, calculation lineage, uncertainty/coverage fields, claim approval and controlled disclosures. Obtain specialist review and any scheme permissions before making certified/comparative statements.

Synthetic pilot: Use fictional site bills and material records. Change kg to tonnes incorrectly, remove a large input, mix two boundaries and update one factor. A reviewer must detect the errors and the published claim must retain its version and limitations.

Acceptance tests: Reject an unsupported factor, missing-data-as-zero and incomparable ranking; preserve earlier calculations; separate water/carbon metrics; require reviewer approval before claim publication.

Measures: Primary-data coverage; traceable critical inputs; sensitivity/uncertainty; corrected calculation errors; comparable scope coverage; reviewer effort. No untested reduction percentage is advertised.

Proposed economics: Proposed payer: manufacturer/brand under a scoped analysis and evidence-maintenance order. Analyst and independent assurance fees are separate. No trade in carbon credits or offsets is created.

Seller prepares documents; buyer/importer and its qualified customs/logistics adviser confirm their role-specific requirements; finance checks USD obligations; a named coordinator resolves mismatches.

Evidence: Accepted order/design version; USD invoice; packing list; quantities/units; shipping/custody references; origin and certificate references; permitted classification declarations; agreed Incoterm/place; document versions; issuer and approval references.

1. Freeze the comparison baseline

   Seller + buyer

   Use the exact accepted order, parties, quantities, USD prices, destination, Incoterm/place and document conditions. A different commercial assumption cannot be smuggled in through a later invoice.

2. Register document versions

   Document preparer

   Keep each authorized invoice/packing/shipping file and issuer reference in restricted storage. Assign a document ID and digest; mark drafts, superseded and issued versions. Avoid sensitive bank details in public comparisons.

3. Extract and normalize fields

   AI operator + rules

   OCR and match party names, item/lot IDs, counts, weights/units, dates and monetary fields. Use exact decimal/cents for USD and documented unit conversions. Preserve source snippets and confidence for each extracted critical field.

4. Run deterministic comparisons

   Finance/logistics reviewer

   Check arithmetic, invoice totals/milestones, duplicated references and packing counts against approved terms. AI may prioritize conflicting documents but cannot determine legal classification, origin entitlement, customs clearance or payment authorization.

5. Resolve with the correct issuer

   Responsible party + counterparty

   Obtain an authorized corrected document or a separately approved order variation, with reason and reference to the superseded version. A coordinator cannot edit another issuer's certificate or silently change an accepted quantity.

6. Release the checked package

   Authorized finance/importer reviewer

   Record which checks passed and which remain open. Only the legally responsible party/customs professional submits filings or approves actual payment. Document matching is a review service, not a clearance, banking or sanctions certification.

Blockchain: After activation, anchor the issued-package digest, approval scope and supersession events, using opaque references. Keep documents, bank information and counterparties' confidential terms off-chain. An anchored fraudulent invoice remains fraudulent.

AI: OCR/entity linking and mismatch triage with critical-field human checking. Measure false clearance and extraction error on scans, currencies and layouts. Prompt/document instructions are untrusted data; they cannot authorize changed beneficiaries or new system actions.

Exceptions: Unknown charge, non-USD price, changed beneficiary, duplicate invoice or unit mismatch: hold the affected package for review. Independent callback verifies beneficiary changes. A customs authority/query is handled by the actual importer/adviser, not an AI approval.

Current/manual: Compare issued documents manually with existing order/invoice/balance records and evidence digests. No document upload/OCR/customs connector or payment instruction service is active.

Still to build: Controlled document versions/vault, extraction schemas, source-field links, deterministic rule engine, resolution/approval workflow and export. Any customs/provider interface needs a separately authorized integration and role-specific review.

Synthetic pilot: Seed fictional document packs with 20-versus-19 count, an altered beneficiary, duplicate invoice and a different currency. Compare manual and assisted checking; include a valid unusual layout to measure false alarms.

Acceptance tests: Do not clear a critical mismatch from a model score; preserve issuer corrections; detect the duplicate; block unapproved beneficiary changes; ensure no filing, email or payment is sent automatically.

Measures: Critical-field accuracy; mismatch detection and false-clearance rate; review time; reissued document rate; disputes caused by unnoticed document differences.

Proposed economics: Proposed payer: exporter/importer through a per-package review or subscribed workflow, with specialist advice separately scoped. No percentage on client funds or promise of customs acceptance is implied.

Each actual custodian attests its handover; sender/receiver confirm independently; a qualified surveyor assesses damage; the contractual parties/carrier/insurer decide obligations under their actual agreements.

Evidence: Item/lot and package IDs; count/condition photographs; seal IDs; custodian/site references; dispatch/receipt times; agreed environmental limits; any sensor identity/calibration/clock; route/transport documents; inspection and exception records.

1. Agree the evidence protocol

   Trading parties + carrier/custodian

   Specify packaging, count, condition, seal handling, inspection and relevant environmental limits. Risk, ownership and carrier liability follow the sale/specialist contracts, not automatically the next scan.

2. Capture dispatch condition

   Sender + authorized checker

   Record package/lot mapping, count, visible condition, seal and time using controlled evidence. A seal number is not proof a package was never opened. Store only necessary location/site information; no public driver tracking.

3. Collect the transport record

   Custodian + approved data source

   Record handovers and source timestamps. If sensors are justified, verify device identity, calibration, clock, tamper status and outages. Begin with manual inspections where sufficient; sensors are not assumed to exist.

4. Flag anomalies

   Rules/AI + logistics reviewer

   Compare readings/condition reports with the agreed limits and known context. A model may prioritize suspected humidity/shock or photo changes, but an alert is not proof of causation, negligence or an insurance claim.

5. Countersign receipt and differences

   Receiver + sender/custodian

   Record actual count, seal and visible condition independently. Differences open a case linked to specific packages and contract terms. Preserve the one-sided dispatch record without inventing the receiver's acceptance.

6. Resolve and publish the scoped history

   Surveyor + actual parties

   Link inspection, survey and agreed outcome; preserve source gaps and corrections. Show approved custody status without disclosing confidential routes or personal contacts. Carrier/insurer decisions remain with authorized parties.

Blockchain: Anchor authorized dispatch/receipt/condition-event digests and linked exceptions after approval. Device data remains in a controlled evidence store with source metadata. A blockchain record prevents silent version substitution, not sensor malfunction or false reporting.

AI: Assist comparative image/condition triage and sequence anomaly detection, with a deterministic threshold/manual baseline. Test sensor gaps, clock errors and ordinary appearance variation. Never automatically assign liability or release an insurance payout.

Exceptions: Broken seal, missing sensor intervals, changed clock or count difference: label the affected leg incomplete/disputed. Quarantine affected goods where appropriate and preserve evidence. An outage is not an all-clear condition history.

Current/manual: Use existing dispatch/received/disputed events plus manual package/seal registers. The current pilot has no IoT feeds, carrier integration, surveyor service or insurance-settlement engine.

Still to build: Package/custodian model, independent handover confirmation, condition evidence, device/source validation, exception cases and authorized claims exports. Complete real transport/insurance contracts and integrations separately.

Synthetic pilot: Use fictional packages with one broken seal, a missing sensor interval, a clock shift and a receiver count mismatch. Preserve all observations without inferring who caused the damage.

Acceptance tests: Reject a fabricated receiver confirmation, duplicate handover and unsupported sensor identity; detect missing intervals; keep custody and title separate; prevent a model alert from issuing a liability or payout decision.

Measures: Countersigned handovers; package differences; missing-condition coverage; time to assemble a dispute file; false damage alerts and claim corrections.

Proposed economics: Proposed payer: exporter/importer or logistics customer under a scoped record/exception service. Devices, carrier services and independent surveys are separately priced; insurance is not provided by COTO.

The actual rights holder grants a defined licence; manufacturer records permitted production/sales; a rights/accounting reviewer checks scope and royalty statements; disputed ownership requires competent legal resolution.

Evidence: Design/reference digest and version; creator/rights-holder evidence; community/third-party permissions where applicable; licence territory/use/term/exclusivity; production units; royalty base/rate/exclusions; approval and payment references; restrictions on AI use.

1. Establish the rights chain

   Rights holder + reviewer

   Collect documented authorship/assignment/licence evidence and identify traditional, community or third-party elements. A timestamp alone does not prove creation or ownership. Do not ask a coordinator to grant rights it does not hold.

2. Agree a specific licence

   Actual rights holder + licensee

   Define the design/version, permitted products, territories, term, exclusivity, attribution, AI-input/training permissions and remuneration. Separate an image/publicity release from design rights and from wage obligations.

3. Bind approved production

   Designer + production planner

   Link the approved file and physical sample to its licence and work order. Record quantity and dates; stop new use if permission expires or is disputed, while addressing legally permitted existing goods and work already done under the real contract.

4. Assist scope checking

   AI tool + rights reviewer

   Compare submitted designs to authorized references and flag possible unlicensed reuse or out-of-scope variants. Similarity is not plagiarism proof; allow handmade variation, lawful independent creation and an inconclusive result.

5. Prepare transparent royalty statements

   Licensee finance + reviewer

   Use the exact contractual base and rate with declared units, returns and exclusions. Keep production, sales and payment states distinct; record the rights holder's queries. A contract may not use units produced and units sold interchangeably.

6. Confirm corrections and payment evidence

   Rights holder + finance reviewer

   Reconcile the statement to evidence and record agreed adjustments. Payment uses the actual lawful route outside COTO. Do not auto-transfer royalties, seize a design or publish a fraud accusation from a model score.

Blockchain: A future ledger may anchor permission/version digests, scoped approval and royalty-statement attestations with correction/revocation links. Contracts, confidential rates and personal information remain restricted. No NFT or registry entry conveys IP rights by itself.

AI: Similarity and document-extraction assistance with source links and human legal/creative review. Do not upload licensed/confidential designs to an external model without the actual permitted data route. No universal originality/ownership score is offered.

Exceptions: Unclear ownership, community permission gap, expired licence, copied source or disputed royalty base: hold the relevant claim/use for review and retain evidence. Do not withhold lawful wages to fund a rights dispute.

Current/manual: Use Draft Licence 09 after completion/legal review, a private licence/version register and the existing approved lot/order evidence references. No automated royalty or IP adjudication service exists.

Still to build: Structured licences/permissions, production/sale linkage, expiry/scope rules, restricted statements, queries/corrections and optional model evaluation. Enforce access and no-training permissions separately from copyright questions.

Synthetic pilot: Use fictional licences with 100 permitted units and a sales-based royalty, then submit an expired variant, unauthorized territory and returned units. Confirm the statement follows the agreed base, not an invented rule.

Acceptance tests: A timestamp cannot clear ownership; a similarity hit cannot condemn copying; expired/out-of-scope use is flagged; duplicate statements cannot create duplicate payment claims; confidential rates stay private.

Measures: Production linked to a valid scoped licence; royalty reconciliation differences; unresolved permissions; false similarity accusations; rights-holder query resolution.

Proposed economics: Proposed payer: licensee/brand under a transparent rights-administration service. The creator's contractual royalty is separate from COTO's fee. No unapproved deduction, compulsory assignment or automatic royalty collection is created.

Current custodian authorizes inspection; qualified repairer records work; seller confirms lawful disclosure; material reviewer checks recovery claims.

Evidence: Original item reference; authority and possession evidence; condition photos; repair materials; resale description; recovery weights and losses; consent and retention rules.

1. Identify the existing rug

   Custodian + reviewer

   Match physical references and existing identity. A scan does not prove legal title. Investigate missing tags without automatically rejecting an owner.

2. Inspect condition

   Qualified examiner

   Record wear, contamination and construction limits. Separate observed condition from assumptions; do not promise as-new quality without evidence.

3. Authorize and record repair

   Owner + repairer

   Agree work, cost and permitted materials. Link before/after evidence and replaced components to the original passport.

4. Disclose resale facts

   Actual seller

   Publish authorized condition and repair history without previous owner identities. Describe uncertainties and applicable terms.

5. Reconcile recovery

   Recycler + material reviewer

   Record input weights, recovered outputs, losses and downgraded uses. Allocate recycled attributes once; avoid counting the same content in two products.

6. Correct identity and close

   Identity steward

   Revoke replaced tags and preserve links. A retired rug cannot remain a second active item when its materials become a new batch.

Blockchain: Future anchors link approved repair, tag replacement and recovery attestations. Private ownership/contact records stay off-chain; no token automatically transfers title.

AI: Optional image sorting and repair suggestions, checked by an examiner. No automated safety clearance, resale valuation guarantee or invented recycled content.

Exceptions: Uncertain identity, unsafe contamination or disputed title triggers restricted review; incomplete recovery records cannot support a recycled-content claim.

Current/manual: Use manual passport/repair/material registers linked to existing lot/order references. There is no active resale marketplace or recycling connector.

Still to build: Lifecycle event types, tag revocation, condition reviews, permissioned resale views and mass reconciliation with double-count prevention.

Synthetic pilot: Synthetic repaired rug, lost-tag replacement, returned goods and a downcycled batch. Reconcile losses and show why repaired is not automatically as new.

Acceptance tests: Block two active identities; preserve original history after repair; reject excess recovered mass; hide previous owners; flag an unsupported as-new claim.

Measures: Identity match exceptions; repair evidence coverage; recovery reconciliation differences; duplicate attributes prevented; authorized disclosure completeness.

Proposed economics: Proposed payer: reseller, repair network or brand through a scoped service. Separate actual repair/logistics costs and avoid guaranteed resale returns.

A staffed safeguarding lead owns restricted intake; an independent reviewer assesses findings; responsible business implements remedy; affected person can respond and appeal.

Evidence: Minimal confidential report; safe contact preferences; permission to share; evidence references; allegation versus finding; protective actions; corrective plan; recipient feedback and appeal.

1. Provide safe access

   Safeguarding lead

   Offer assisted local-language intake, safe contact options and clear confidentiality limits. Ordinary feedback email is not a secure vulnerable-person grievance service.

2. Protect and triage

   Trained reviewer

   Assess immediate protection needs and route urgent concerns to competent services. Collect proportionate evidence; avoid exposing a complainant to a supervisor or alleged wrongdoer.

3. Review fairly

   Independent reviewer

   Separate allegations from supported findings; hear relevant parties safely. Translation or summary must preserve uncertainty and be checked by a person.

4. Agree corrective action

   Responsible business + reviewer

   Define action, owner, due date, resources and evidence of completion. Preserve legal rights and protection against retaliation; do not use a model to determine wage entitlements.

5. Check the affected outcome

   Independent reviewer + affected person

   Seek safe recipient feedback and corroborating evidence. An alleged wrongdoer cannot unilaterally close its own case.

6. Close, appeal or reopen

   Authorized independent lead

   Record reasons, outstanding concerns and appeal route. Publish only carefully privacy-assessed aggregate trends; no identifying case narrative or linkable complaint digest.

Blockchain: No personal complaint record or linkable individual digest belongs on a public chain. Only a separately approved, scoped aggregate assurance may be anchored after re-identification assessment; anchoring does not prove remediation.

AI: Optional translation, redaction and routing assistance under trained human review. No credibility score, labour-violation verdict, worker eligibility decision or automatic closure.

Exceptions: Retaliation concern, unsafe contact, mistranslation or reviewer conflict requires protective handling and independent reassignment. Missing response is not acceptance or proof of remedy.

Current/manual: Existing feedback/contact is an ordinary business route. Safeguarded intake, trained staff and independent review must be established before inviting sensitive reports.

Still to build: Restricted case store, safe contact controls, access logging, escalation, independent closure, appeal/reopening and privacy-safe aggregation; resource qualified people first.

Synthetic pilot: Fictional withheld pay, retaliation allegation, mistranslation, self-closure attempt and reopened appeal. Use no real vulnerable-person data.

Acceptance tests: Prevent alleged wrongdoer self-closure; block unauthorized access; preserve original language; require recipient-outcome review; stop identifying public exports.

Measures: Safe acknowledgement and outcome times; independent review coverage; recipient-confirmed remedies; reopening and retaliation concerns; privacy incidents.

Proposed economics: Proposed payer: participating businesses under a safeguarded service scope. Access must not depend on a worker paying a fee; financing cannot buy a favourable finding.