Email node@zeropoint.bg. Please do not open a public issue for anything exploitable — send the details privately first.

Include what you did, what you expected, and what happened. If a receipt or content-uuid is involved, include the value: everything here is content-addressed, so the id reproduces the state.

• Fold addresses (src/0 toUuid): deterministic FNV-based UUIDs for cheap content addressing and memoization. Not collision-resistant against a resourced adversary.
• Content-uuids (src/integrity/content-uuid.ts): RFC 8785 JCS → SHA-256 → UUID version 8. Use for sealed proofs, manifests, and verify-on-read.

Never hand-mint identifiers. Same content ⇒ same id. a432.uuid random/Math.random paths are purged — they fold through kernel toUuid.

Do not mix digital-root paths without adapters (a432.roots.ts): kernel 0→9, legacy VBM 0→0, harmonic base-12 1–12.

verifyContentUuid(obj) recomputes the digest after stripping storage meta (uuid, id, timestamps). Mismatch ⇒ tamper.

Import/export census (foldA432ImportExportGraph) is computed, not hand-inventoried.

Local stdio server (.mcp.json). Tools are pure math / integrity ops. Do not expose without an allowlist if bound to a network.

This repository is not an ERP and does not implement Payload access control, multi-tenant D1 isolation, or GDPR crypto-shred. Those patterns live in erpax and are intentionally not ported.