Apps
The Windows app is where the ledger lives. The phone apps are not cut-down viewers bolted on afterwards — they are built against the same signed protocol, and one of them runs the whole hub.
Live · Cockpit
Session
Last session before a 4 day break — the closeout reserve is held back today.
Orders today
Today
Pod
Closing this window never stops it.
The pod screen, laid out as Cockpit. Five arrangements of the same panels; pick the one that suits how you watch. Sample figures
Android
The companion answers the three questions you ask from the couch — what did today make, why did it not trade, is anything parked. The administrator runs the fleet from behind a fingerprint.
Pair it to your computer by QR code. It carries a key your computer made; the hub in the middle only ever sees a sealed envelope it cannot open. Your ledger, your pods, your messages, and a refresh you can ask for from a train.
Opt-in, revocable from the desktop, and it works without the hub when your computer is reachable.
The whole hub from a phone: the fleet, a user's card, the inbox, releases, codes, broadcasts and the audit log. It makes its own key on the phone, behind your fingerprint, in hardware that will not give it up.
Lose the phone and you revoke that key alone — the laptop's key never travels, and a revoked key never comes back.
ChaCha20-Poly1305 between phone and computer, with keys derived per direction and per purpose.
The signing key is wrapped by hardware that requires authentication for every use, with a short in-memory window and nothing left behind.
The app refuses plain HTTP to anywhere but your own machine — an administrator app must never speak in the open.
Not yet on a store
They install as test builds while the product is in private testing. Nothing about them is a mock-up — they talk to the same signed endpoints the desktop app does.