Back to wiki menu

Platform: Reality Apps (mobile)

Deep Dive: Internal Architecture

Last updated: August 30, 2026 at 23:19

Deep Dive: Internal Architecture, API & Forensic Chains

Overview

This article provides a technical overview of how Verified Reality (VRA) operates internally, how data flows between the native application and the Command Center (web), and the exact cryptographic mechanisms used to construct a tamper-evident forensic chain of custody.

1. The CC-App Bridge (Command Center to Native Shell)

The VRA application architecture is a secure hybrid shell. While native code handles resource-intensive tasks like sensor polling, camera interaction, and cryptographic operations, mission management is handled via a trusted web application (Command Center). Data flows between these two environments over a bidirectional communication channel known as the AppSyncBridge.

Bidirectional Communication Flow

DirectionCommunication MechanismKey Native Access PointsNative $\rightarrow$ CCCommand Center JavaScript reads from the final.js object.DeviceModule, nativeDeviceModuleCC $\rightarrow$ NativeCommands are sent from Command Center to Native through explicit bridge calls.Direct native module calls (e.g., StartCapture).

  • Sharing Context (nativeDeviceModule): The shared data object includes the current device profile (class/capabilities), active session UUID, upload vault metadata, calibration status, and current GPS state.

  • Data Security: Data tokens are explicitly stripped from persisted session blobs within the native storage layer to maintain hygiene.

2. API & Filesystem Architecture

VRA adheres to a strict "Zero Trust" architecture regarding data access. Native modules possess unique access keys that prevent third-party or user access to local truth packets.

The Basecamp Upload Vault

All data captured during a session is stored natively in internal application storage within a structured vault directory known as Basecamp.

  • Structure: Each session utilizes a unique UUID for its internal file storage path.

  • Contents: A final sealed truth packet (ZIP) contains:

    • A comprehensive asset manifest (manifest.json).

    • Original raw media files (JPEG/MP4).

    • Encrypted telemetry and forensic logs.

    • Device calibration data (calibration.zip).

Local Data Sharing (ShareModule)

The app does not support open file browsing. Internal files (such as captured photos/videos) are accessed by the React web shell exclusively through secured native URI references provided by the ShareModule. Direct local path access is blocked.

3. Forensic Chain of Custody (Cryptographic Trust)

VRA constructs a complete, mathematically verifiable Forensic Chain of Custody (FCC) for all evidence. This chain ensures that any alteration or deletion of a single byte of data in any file breaks the cryptographic seal.

SHA-256 Daisy Chaining

VRA does not simply create individual hashes; it chains them together sequentially:

  1. A strict sequential write order is enforced for all files generated in a session (Media file 1, then Media file 2, then Telemetry Log 1, etc.).

  2. A SHA-256 hash is generated for the first file at the exact millisecond of creation.

  3. The hash of the previous file is combined with the hash of the current file to generate a chained hash.

If any file is reordered, altered, or deleted later, the mathematical chain "daisy chain" will fail validation, rendering the entire evidence bundle void. Final hashing updates occur post-C2PA signing to ensure the definitive state of the file is recorded.

Glossary

This glossary defines technical terms utilized across all Bizbio Inc. Verified Reality (VRA) technical wikis.

  • Active Interrogation: The structured process where the VRA application actively probes multiple device hardware channels (camera, motion sensors, microphones) in real-time to detect synthetic feeds, screens, or emulator usage.

  • Basecamp: The local internal filesystem directory on the Android device used to isolate, secure, and manage sealed truth packets waiting for cloud upload.

  • C2PA (Coal Coalition for Content Provenance and Authenticity): Open industry technical standard allowing publishers, creators, and consumers to trace the origin of various types of media. VRA integrates C2PA manifests natively.

  • Device Profile: A data object generated during preflight checks detailing a specific smartphone’s capabilities, sensor health, and integrity markers.

  • Deterministic Optical Aberration: A test induced by the VRA software where the phone's physical optics (e.g., Optical Image Stabilization actuators) are manipulated to produce a mathematically predictable optical change, proving the physical presence of the camera in 3D space.

  • FCC (Forensic Chain of Custody): The mathematically complete record of the history and integrity of evidence data, maintained in VRA via SHA-256 daisy-chaining.

  • Finalize (The Sacred Seal): The definitive session closure event where all evidence files, sensor logs, telemetry, and FCC metadata are packaged, hashed, and cryptographically sealed into the final truth packet (ZIP) within Basecamp.

  • Flag_Secure: Standard Android OS flag implemented in VRA to prevent OS-level screenshots or screen recording of the application’s capture UI.

  • Inertial Posture: VRA sensor check analyzing high-rate gyroscope and accelerometer data to differentiate between human handheld motion vs. artificial, static, or robotic stabilization.

  • Legacy Tier: The application behavioral state triggered on older or lower-specification Android devices (e.g., restricted RAM). It implements strict memory gates and slower pacing for the seal workflow.

  • Multimodal: The utilize of multiple independent, concurrent sensory input channels (visual, inertial, acoustic) to construct a trust decision.

  • PRNU (Photo Response Non-Uniformity): The unique, silicon-level "fingerprint" of an image sensor caused by physical manufacturing defects. VRA uses PRNU to match evidence files to a specific physical device.

  • Sacred Seal: See Finalize.

  • Sovereign Asset: Evidence that is self-describing, carrying its immutable forensic context, telemetry links, and integrity markers chemcially fused within the bytes of the raw media file itself.

  • State Machine: The structured Native workflow engine controlling critical capture transitions, ensuring steps like initialization, sensor calibration, liveness checks, and final sealing occur in the exact enforced order.

  • Super Tier: High-specification device state (e.g., flagship RAM) optimized for concurrent heavy workloads during capture.

  • TEE (Trusted Execution Environment): A secured area within a main processor. VRA targets future hardware hooks within Android TEE architectures.

  • Truth Packet: The final, cryptographically sealed ZIP evidence bundle produced by a VRA session containing the raw media, asset manifest, and encrypted forensic logs.