Executive Summary

Summarising, what you get is a system that enables automated trading using Smart Contracts that are enacted on a private network, and where, due to the ability to share information with supply/health partners, using asymmetric cryptography, and also due to all database clusters acting as Masters in replication procedures, a partner organisation can access the shared data on their own local server. Sharing may also be completely revoked.

You also get a comprehensive Enterprise Application that works on Mobile devices and provides all accounting as part of the package, where the database we use (PostgreSQL) has zero licence fees. The accounts system can be interfaced in a READ-ONLY fashion to your broader system. We have the detailed understanding of Accounting Systems necessary to have built a fully integrated system from the ground up – we do not need to “partner” with insecure vendors, relying as they do on inferior software.

In addition you receive an economical and very security-conscious system, incorporating our ChubbyChecker Ultimate Cross-Checking package, which fills the security gap inherent in stand-alone distributed systems that employ either Crash- or Byzantine Fault Tolerance, as well as the normal security measures — in-transit encryption is TLS 1.3 and measured, while client-side at-rest encryption is BUILT but switched on nowhere today — together with the absence of risk of Man-In-The-Middle and Denial-Of-Service attacks (with the optional employment of libp2p/Kademlia, bypassing, as it does, the normal Domain Name System – DNS). The distributed nature of the system is what allows the operation of private-networked Smart Contracts, incorporating unlimited volumes of data per contract (and overall), and also it is what allows the secure sharing of information, as necessary, to enable business/health operations to function efficiently.

But what is the magnitude of the risk against which we are protecting? According to an independent analyst organisation (Analysis) there were 25,949,000 personal records compromised in the healthcare sector in 2023 alone.
“These are often called ’supply chain attacks.’ In fact, it is not just one
customer that can be attacked, but essentially every customer that uses
an (inferior) vendor’s services. Thus, a single vulnerability can threaten
many thousands of organizations, such as in the 2023 MOVEit attack where
already over 2,600 companies in more than 30 countries admitted to
being attacked, with more than 80 million individuals’ data being
compromised. In fact, 98% of organizations have a relationship with an
(inferior) vendor that experienced a data breach within the last two years.
In some studies, the number of data compromises due to supply chain
attacks in 2023 jumped 78% over 2022.”
Stuart Madnick – Harvard Business Review
The problem is no longer a case of “if” but now a case of “when” will your systems be attacked.

There are many vectors by which attacks may be mounted. Our use of kademlia avoids some, however, still, the most common and “fruitful” means of attack involve targeting individuals using Social Engineering. As an example of Social Engineering, the attackers may use knowledge gained in any fashion about an employee’s vulnerabilities, contacting that employee and using this knowledge to obtain the employee’s cooperation in an attack or in the exfiltration of information from your database. It is very important to have multiple offline data backups in place in the case of an attack, which may also arrive in the form of Ransomware. The basic process involves the attackers accessing your data and re-encrypting the data to prevent your access, then demanding a Ransom for decrypting the data. If you have a good back-up system, and your data is strongly encrypted, this is simply not a problem. Note that the backups need to be kept offline and thus inaccessible to an infiltrator online.

In the case of a Ransomware Hack,

where (typically Russian) attackers gain access to a company’s
online data, the simple strategy necessary to survive the
attack is to ensure the maintenance of regular
(eg. half-hourly) backup procedures which MUST store the
backed-up (and, naturally encrypted) data OFFLINE so that no
network connection is presented for Hackers to access backups.
Thus, armed with encrypted backups, (all data both in-transit
and at-rest must be encrypted, not just backups) a company
can ignore Ransom Demands in the event of a successful attack,
and simply restore business data from offline backups, then
carry on with business (losing not more than a day’s work).
Better than paying 100’s of 1,000’s or millions in Ransom
to regain decrypted data, originally stolen by Hackers.

Security 101 in Business

– – It should be obvious that Business Data is very valuable, and – the above simple strategy of
a. encrypting all data and –
b. regularly backing up data to offline locations, should be: –

Security 101 in Business.

– – Of course, after such an attack, the company needs to harden the security of their systems to prevent further successful attacks. –
Talk to us. ‘The Minders’.

– – While the additional problems relating to “insider jobs” are – partially preventable by our higher-level systems, by – combining our security with the use of AI-led supervision of users, excursions of behaviour to criminal activities, – from within, can be prevented (see the Elastic Company) by systems using AI. These systems get smarter as they work. –
Also consider the number of people who send passwords via email to themselves as a record, or to others to access their account in an “emergency”. If these emails are compromised in external third-party attacks outside your system, your system may become compromised by a malicious agent. This touches on the concept of an Attack Surface, meaning the myriad vulnerabilities any system may have.

Thus, there is a multitude of possible attack vectors threatening your system. Sealing it with the use of kademlia goes a long way towards total security. But there are many other practices that should be used to defend against Hacking, Hijacking and System Penetration. We can only offer advice to be vigilant and aware of the size of the threat, and to take appropriate counter measures (and there are many measures to take). As noted elsewhere our use of client side encryption will assist, as will the frequent, programmed running of Backup operations (stored offline) and our ChubbyChecker. Insider jobs via Social Engineering techniques and third-party breaches are still high on the list of threats. Education of all staff can help here, as can monitoring of database access patterns, and vigilance (automated with AI) against abnormal patterns of use. Also, the use of Artificial Intelligence in this monitoring can make a difference when it comes to detection of “insider jobs”. An AI system can be trained to recognise excursions from normal usage patterns, and its performance is actually enhanced over time as it gains “experience”.

 

—————————————————————————–

‘The Medical‘™

Tx-Rails never reads patient records. Clinical notes, diagnoses, prescriptions, test results, and personally identifying information stay encrypted on the hospital’s side under the hospital’s own keys.

The integrity layer we provide — anchored to the public Hedera ledger, cross-checked by our 98-check ChubbyChecker — verifies that what was recorded is what was committed, without us ever needing to see the patient. This is the privacy posture required for NSQHS clinical-evidence audit, GDPR-equivalent patient-data sovereignty, and the trust the public requires of any health-system audit infrastructure.

There are four modes of connecting your existing systems to our Underlay:

The four modes

Mode	What customer does	Metadata fidelity	Use case
A. Hash-only	One value, a hash. Your commit path computes a digest of the committed transaction and publishes it through a signed call	11 of the 36 record fields carry a value. No content crosses — a digest only — and no semantic intent	Low-stakes flows where the audit just needs “this row existed at time T”
B. CDC observation	You run an observer against your database’s logical-replication stream — pglogrepl decoding pgoutput directly, with no Debezium or Kafka dependency	Content crosses: the changed row, as JSON. CRUD intent comes from the WAL operation itself. Coarse service-account attribution, not per-user	Mid-stakes flows; most existing apps that already write created_by / modified_by to their rows
C. Gateway-mediated	You run a gateway inline, in front of your own backend; the application is unchanged	Content crosses: the request body. Semantic intent comes from the matched route. The only preventative mode — it can refuse before your backend sees the request	High-value flows; new app deployments where touching the network edge is cheap
D. SDK / atomic dual-write	Your application writes to an outbox in the same transaction as its business write, and a relay forwards it	Content crosses: the outbox payload. The only mode carrying explicit REVERSAL / CORRECTION / RESTATEMENT	The very-high-value flows where the customer wants explicit REVERSAL / CORRECTION / RESTATEMENT tagging

Mode A is what you would be buying today, and it remains the only mode we offer for onboarding. Modes B, C and D are now deployed in our own development estate, and each has carried a real change through to a committed attestation on a live validator mesh. They remain reference implementations your own team adapts, not packaged products you can install. No customer has been onboarded through any mode.

---

[How this works in detail →](/how-it-works/privacy)

—————————————————————————–

 

—————————————————————————–

The six levels, and where a district sits in them

The same six levels carry banking and social housing. The architecture does not change between sectors. What changes is exactly one thing — what counts as a set of LIKE members — and which levels carry the weight follows from it.

Health uses TWO axes, and it is the first sector to use both deliberately. Level 1, the registry, is keyed by the DISTRICT: who is a member, and who vouches for them. Level 2 is keyed by the SECTOR: what may cross, under which regime, and the record that it did. This is not a new capability — an identity claim already records a sector and a country.

A district holds both extremes at once. A tertiary hospital has the capability of a bank. A single-handed rural practice has the capability of a one-person joinery. Both are members of the same district, and any structure that works for one fails the other. That is the case this level model was designed for.

Level	What it is	What it means in a district
5 — the edge	Stateless. Authorises locally against a signed envelope and reconciles afterwards.	A ward scanner, a theatre, a loading dock, an ambulance. Disconnected operation is normal in regional health, not exceptional. A terminal forges a CLAIM, never a FACT.
4 — the Executive mesh	MEMBER-OWNED. A consensus tier in its own right: own validators, own quorum, own paired auditor.	A district plausibly runs one, with facility, service line and campus as tenancy SCOPES CARRIED BY that mesh. A single rural pharmacy never will.
3 — the member’s own node	MEMBER-OWNED. The member’s own validators, run by the member.	Where health differs from every other sector. A district runs a real cluster. A community pharmacy or single-handed practice runs nothing and reaches the network through a shared gateway. Both are members of the same district.
2 — gov-reg and gov-comm	SHARED, keyed by SECTOR. What may cross, under which regime, and the record that it did. Belongs to NEITHER side of a trade.	Not usable yet — deployed and committing, but its gates are unarmed and no regime rules are defined. Biomedical, cold-chain, sterile-processing. Regime evaluation by SECTOR lives here — a consignment arriving into health from a manufacturer, a logistics operator or a supplier. Inter-district movement and statewide recall do NOT: the re-keying of 30 September 2026 made the district a tenancy inside NATIONAL HEALTH, so those are ordinary level 3/4 transactions.
1 — the registry	SHARED, keyed by DISTRICT. Who is a member, in which district, with what standing.	The least foreign part of the model. Credentialling, scope of practice and facility accreditation already exist as registers with an owner.
0 — cross-border	SHARED. A protocol plane, not a deployment. No nodes run here.	Imported devices and consumables — a real and regulated path, and the least pressing of the four. Designed rather than built.

The numbering says where a level SITS, not what depends on what. Levels 3, 4 and 5 do not rest on 0, 1 and 2. Levels 0, 1 and 2 are shared and operated by no single member, but they do NOT share one state: Level 1, the registry, is BUILT — deployed at n=4 and committing; Level 0 is not deployed at all; and Level 2 is deployed and committing but has its gates UNARMED, with no regime rules defined, so nothing is evaluated yet. A statement about delivery, never about importance.

Most health evidence is of one shape, and it is the shape Mode A already produces. A sterilisation cycle against an instrument tray. A cold-chain excursion against a consignment. An implant serial for recall. A calibration record against a device. Each is “this record existed, unaltered, at this time, under this verified party”. Within a district, Mode A is sufficient.

Where it stops. The moment a consignment crosses into health from ANOTHER SECTOR — a manufacturer, a logistics operator, a supplier — or a regime must evaluate what a transaction IS rather than that it happened, Level 2 is required, and Level 2 needs Mode B or deeper. Inter-district transfer and statewide recall are NO LONGER in that class: a district is a tenancy inside national health, so they are ordinary level 3/4 transactions and Mode A covers them. It is a split, not a verdict.

—————————————————————————–

Who operates what

Decided, and it is the same arrangement we offer banks — with one condition added. Stated here rather than left for a reader to assume a difference.

	Operates	Holds
The district	Its own levels 3, 4 and 5 — its own validators, its own Executive mesh, its own edge. Its own data machinery.	Its own data.
ITOTCCA	The metadata workload for the auditors — the trace, aggregation and anchoring pipeline.	Nothing it can read. Transmitted metadata only: an entnum and a hash.
A national neutral body	The audit tier’s custody and control plane.	The keys ITOTCCA never sees. No body has yet been named, the arrangement is unsigned, and until one exists ITOTCCA CAN read these keys — measured 30 September 2026, not assumed. An auditor must hold its key to sign with it, so custody separation means the custodian OPERATES the auditor units; no key-storage change achieves it.

This is the same arrangement we offer banks. Banks are offered the sites that run the receivers of the bank’s transmitted metadata — the entnum and the hash of the metadata trace record — and those receivers are the metadata workload. In both domains ITOTCCA operates nothing inside the member boundary, reads no transaction content, and does not hold the audit keys or control the audit control plane. The one health-specific condition is the custodian’s scope: in banking the third party already exists and is already national, while in health districts are State entities and the regulated objects are Commonwealth, so the custodian must be explicitly national — and, unlike banking’s, it has not been named. That is the difference: a gap, not a different design. The trade is defensible in both — most districts will not want to run an audit pipeline, and a regional district plainly cannot — but it costs something specific, and the cost is published here rather than discovered. The audit tier is independent of the consensus and not of the operator; operating the metadata receivers makes that sharper, not softer, and it does so for the bank offering exactly as much as for this one.

So the neutral body is the only thing that makes the arrangement honest, and it has three concrete jobs rather than a name to lend. It must hold keys ITOTCCA never sees. It must be able to verify our operation without trusting it — the checkers’ outputs recomputable from anchored evidence, so that the body can contradict us. A witness that can only agree is not a witness. And it must control the audit control plane.

Why national rather than state. Districts are state entities, so a state body auditing its own State’s health services is not neutral. Device recall, therapeutic goods and practitioner registration are already Commonwealth matters, and a state-scoped custodian cannot follow an implant across a border. INTERSTATE and cross-sector movement is the case Level 2 exists for — inter-district movement is not, since the re-keying; a custodian whose writ stops at a State line cannot witness the crossings that do matter. And an interstate rollout would need the arrangement renegotiated from zero in each State.

—————————————————————————–

What health depends on that is not usable yet

Stated here rather than found in month three. Health’s position is genuinely stronger than social housing’s — within a district — which makes it more important, not less, to be exact about where that stops.

What	What it blocks in health	State
Level 2 — gov-reg and gov-comm	Regime evaluation by SECTOR, and cross-sector arrivals into health. No longer inter-district movement or statewide recall — the re-keying took those off Level 2.	Not usable yet — deployed and committing, but its gates are unarmed and no regime rules are defined. Within national health, INCLUDING between districts, Mode A is sufficient and this does not bite. It bites at the SECTOR boundary.
A mode Level 2 can use	Level 2 needs Mode B or deeper, because a digest cannot be regime-checked.	Mode A is the only mode we offer for onboarding. B, C and D are deployed in our own development estate and each has committed a real attestation, and they remain reference implementations your own team adapts. No customer has been onboarded through any mode.
Committee rotation	How a district federation is operated when its members cannot all operate.	Designed, not operating. consensus.validator_set and consensus.rotation_approver exist in code; neither has yet run.
The custody arrangement	The independence claim entirely — and the operating split above depends on it.	Unsigned, and no national neutral body named. This gates a claim, not a component. It is the largest open item here.
Level 0 — cross-border	Imported devices and consumables whose chain leaves the country.	Designed rather than built. The least pressing of the five.

None of that gates a purchase, and the distinction matters. What is sold is levels 3, 4 and 5 — a district’s own nodes, its own Executive mesh, its own edge — and one member buys and runs those alone, waiting on no federation forming and on no agreement between States and Territories. Level 1 and Level 2 are not priced and are not a precondition on your purchase. Nor does Level 1 ask anyone for a NEW agreement: it keys on registers that already exist and already have a single national owner — AHPRA for practitioner registration, the TGA for therapeutic goods and recall, the ACSQHC for facility standards. We do not operate a new register that a State must admit members into. And the regime rules Level 2 is waiting on are an agreement between the two SECTORS that trade and their regulators, not between jurisdictions — movement inside health is an ordinary level 3/4 transaction and never reaches Level 2 at all.

—————————————————————————–

The health position, stated in full

Migrated here on 3 October 2026 from the second health page, which is now retired. These paragraphs are the author’s own words, unaltered.

Health is not a third point on a line between banking and social housing. It is both of them at once.

This is the first domain where the answer to “is what is built enough?” is partly yes. Both halves are stated with equal force.

Health holds both extremes at once — but so does social housing, and an earlier draft of this page made that health’s strongest argument when it is not. A tertiary hospital has the capability of a bank; a single-handed rural practice has the capability of a one-person joinery. True — and a large housing provider is a substantial organisation while a one-person joinery is not, so housing has the same spread. Levels 3, 4 and 5 being deep for some members and nothing for others within one federation is a property of the level model, not a finding about health.

What actually distinguishes health is how OFTEN members must work across an administrative line. A referral, a transfer, a consignment, a recall — all routine, all constant, and all lawful. That is what decided where the federation boundary belongs, and it is why this page was re-keyed on 30 September 2026.

District size varies on two scales and only one of them matters. A regional district may cover a large share of a State’s area; an inner-metropolitan district is geographically tiny and may serve a comparable population. Area is irrelevant. Member count and operator capability are what decide whether a district can staff a committee.

The scope is equipment and supply chain. No EMR contact, no clinical-information system, no patient record. Several conclusions below depend on that holding, and they are marked where they do.

Your own nodes, your own edge, one hash, one anchor. Levels 3 and 4 are your nodes, level 5 is your edge, one cryptographic digest per transaction, and an anchor in a public ledger. Nothing else, and nobody else’s agreement. This is Mode A, the only mode we offer for onboarding. The public ledger is the neutral third party — what levels 1 and 2 would otherwise have to be, and it already exists, so the proof does not wait on an institution being founded.

What crosses at levels 3 and 4

Stated here because a reader who is not told will assume the opposite, and that misreading surfaces late, in security review, after the architecture has been agreed.

Both levels are the member’s own machines running the member’s own code. ITOTCCA operates nothing inside them and reads no transaction content. The scope is equipment and supply chain: no EMR contact, no clinical-information system, no patient record. What leaves is TRANSMITTED METADATA, emitted by member-owned code — an entnum, and a hash of the metadata transaction-trace record. No balances, no counterparties, no payloads, and a hash is not reversible into the transaction it came from.

The metadata is the member’s data; its design and specification are ITOTCCA’s. Which fields exist, how the trace record is formed, and how it is hashed. Ownership of the data and authorship of the schema are different questions, and answering only the first reads as though the schema came with it.

Which shared levels your mode can use

Which of the three shared levels a transaction can actually use is decided by the MODE, because they do not all need the same thing from you.

Mode A needs none of them, and Mode A remains the only mode we offer for onboarding. Within national health — including between districts — for existence-and-integrity evidence, that is sufficient. It is not sufficient for crossing into another sector, or for any regime that must read what a transaction IS. That sentence is the whole commercial shape of health, and the re-keying moved a great deal of routine work from the second half of it into the first.

The data-visibility ladder is less fraught here — and why

Less fraught because of the scope commitment, not because of a property of the ladder. The condition is the thing that could change.

YOURS. At rungs 1 and 2 — plaintext, or the platform’s own key — we can read, so Level 2 evaluates FULLY. At rungs 3 and 4 — your key, or a named partner’s — we cannot, so Level 2 records THAT something crossed but never WHAT. That is a real trade, and it is yours to make.

NOT YOURS, and the trade-off framing hides it. On ANY rung Level 2 ALSO needs its gates ARMED and regime rules DEFINED. Neither exists, both are OURS, and no rung you pick supplies either. At rung 1 — where everything actually runs today — Level 2 would read fully and still does nothing. The ladder is not why Level 2 is unavailable; we are.

AT MODE A THE LADDER DOES NOT ARISE: we receive no content, only an entnum and a hash, so the rungs matter only for the content-receiving modes — and no customer is on one. With no EMR contact there is no clinical content to protect either way. What crosses is equipment, consumable and consignment metadata. That is why this section is shorter here than on the banking or social-housing pages.

Two caveats, which belong here rather than in a footnote. Supplier pricing and contract terms in procurement records ARE commercially sensitive even when nothing clinical is present. And the moment anyone proposes extending the scope to clinical records, the ladder conversation restarts from the beginning — and the answer today is that rungs 2, 3 and 4 are BUILT TO DIFFERENT DEPTHS and switched on nowhere — rung 3 end to end, rung 2 in one action that has never run, rung 4 not deployed: no commitments have been written in any running deployment.

What counts as “like”

A federation is a set of LIKE members. That is the whole definition, and everything domain-specific is the choice of what counts as alike.

A federation must be big enough to staff a committee, and n is the size of a rotating COMMITTEE drawn from the membership, not the member count. Membership grows freely; the committee does not. Because the federation is national rather than district-scoped, the committee is drawn from the whole membership — which removes the too-few-operators problem a single district would have had, and creates the governance one below — which is one of the reasons the custodian question below is not cosmetic.

Tx-Rails for Health & Medical IIoT (Industrial Internet of Things)

Tx-Rails Smart Contracts for Health & Medical

 

The Medical uses …

Tx-Rails is based on a combination of
the Byzantine Fault Tolerant
CometBFT engine, formerly Tendermint (no mining)
supervised by ITOTCCA’s own ChubbyChecker

 

 

We pay blockchain fees, for trusted Authentication, and Network Transport security services

 

 

ITOTCCA is currently in a phase of completing development of our Chubby Register/Chubby Checker “Zero Trust Enforcer”.

 

 

 

Our imaginations are the only limiting factors in determining the possibilities for the use of secure Blockchain-backed Database/Datachain Networks, and automated IoT technology, in internetworked Supply Line Applications.

 

However, we can only say this ethically, if the Military, and the Accountants, MBAs and other “monetisers” are kept out of the scene. You require Ethics to call yourself a Professional. These groups, too often, display a total absence of social ethics. Their Members seem to be taught to behave this way, and mutually reinforce their confidence in doing so. They can be rip-off merchants, and peddlers of the idea that these excesses of “Commercial Reality” should be accepted. Greed is NOT good.

 

We have a new dApp called The Medical, and it’s taking shape on Bitbucket. Here are 14 screenshots of the front end, as it exists so far. This Front End is intended to connect to a Backend, following the Bucordo design principles, which is also developing on Bitbucket, & is called “the-medical-backend”.

 

 

 

 

 

 

 

 

 

 

 

 

 

 

At this point it is worth noting that due to the nature of our Datachain/Blockbase System, which is intended to mimic a real Blockchain, no database records are ever completely deleted. All details are retained in some form, indefinitely. Obviously this gives rise to a need to protect information in strict adherence to the Commonwealth Government’s 13 Principles of Information Privacy.

 

As mentioned elsewhere, all but the minimum necessary data to provide our security services and to manage the system remains secret from us and others. You value your Information. We respect that – and we provide our services with Privacy and Security as our highest priorities. The Metadata you “channel” to us, via your devices, automatically using our Public Key for encryption, and sent to our Metadata Stores, thence Anchored as a Trace of Traces to Hiero, amounts to a list of 36 Metadata fields encrypted with our Public Key, and sent to our Metadata Stores.

___________________________________________________________

 

In addition to these fields, any client data which is indicated by any of the following conditions will likewise be encoded with ITOTCCA’s Public Key, processed then encrypted with the Customer’s Public Key before storage.

Spatial Data: Geometries and geospatial properties.

Metadata: Transactional and spatial metadata.

Non-Spatial Data: Attributes linked to spatial entities.

Logs and Results: Audit logs, processed query results.

Operations Requiring Decryption

• Spatial queries and transformations (e.g., ST_Within, ST_Buffer).
• Joins, aggregations, and proximity calculations.
• Validation, filtering, and indexing operations.
• Processing and formatting results for client delivery.

 

ALL DATA IS ENCRYPTED BOTH IN TRANSIT AND AT REST

GENERALLY USING YOUR OWN PRIVATE KEYS, BUT USING OUR PUBLIC KEY,

OR PARTNERS’ PUBLIC KEYS, TO SEND US CHANNELED, PRIVATE COMMUNICATIONS

Your set of cryptographic keys remains yours to manage with utter secrecy for different roles and users. We are not privy to customer crypto keys, with the exception of the common, business sub-network-wide, shared list of member public keys, intended to enable channeled secure and private communication.

 

We employ Electronic and Mechatronic Engineers to undertake the high level design of IoT control systems, which are interfaced with your software and hardware components. The safe and secure operation of your Operational Technology Domain in concert with your Information Technology Domain is our driving goal, here. The low level purchasing and tuning of hardware components in order to carry this through, however, is your responsibility as our customer, with the full cooperation of ITOTCCA participating in Project Management.

Some Topical Nostalgia .. the Flying Dogtor & the Monster

 

And, the Real Thing .. sometimes even with “monsters”:

“I love a sunburnt country
A land of sweeping planes“

“Of ragged mountain ranges,
Of droughts and flooding rains.
I love her far horizons,
I love her jewel-sea,
Her beauty and her terror –
The wide brown land for me!”

with apologies, and acknowledging the original copyright (1907) by
Dorothea MacKellar, of ‘My Country’.

The original wording was “plains”, Bruce.

URL for IBM article

Please note there are 2 possible senses of the words Order and Orderer. One is intended to refer to the ordering of Health supplies. This is not the sense intended in the following paragraphs. The sense intended is the Ordering of Transactions – ie putting submitted transactions into an order determined by a consensus process on a virtual machine, and then committing or aborting them in that order. The order will appertain to each Virtual Machine independently.

A possible Fully Developed National Database Network

The tableau shows an array of 22 Hardware On-Prem Canonical OpenStack Cloud Servers, positioned around the nation at State and Territory locations (minimum 8 in a fully developed network) and at Royal Flying Doctor Entity locations (minimum 7), of which 7 Hardware Servers represent the 7 Supplier Classes.