SAJI: Food Safety Attestation for Free School Meals

Concept screens. Left: kitchen staff sign each checkpoint. Right: what a teacher sees after scanning the meal box QR.
BPOM's own case: cooked 01:00, served 12:00. With SAJI the same batch turns EXPIRED_UNSAFE at 05:00.
Three small contracts on Base Sepolia hold the record. The scan page can read a batch's status straight from the chain.

The problem

Between January 2025 and August 2026, 43,838 people were poisoned by meals from Indonesia's Free Nutritious Meals programme (MBG), across 36 provinces. Most of them were schoolchildren.

BPOM traced one outbreak to food that was cooked at 01:00 and served at 12:00. That is eleven hours against a four hour safety limit. The rule already existed. Nobody noticed until children were in hospital.

The records that should have caught this are kept on paper or in editable spreadsheets, by the same operators whose contracts depend on those records looking clean. BGN already requires photo and video reports, but only every two weeks, and the upload is what releases the operator's own payment. A report filed every two weeks cannot police a four hour window.

What SAJI does

SAJI gives every batch of food a Batch Passport. Kitchen staff sign four HACCP checkpoints from an ordinary phone, and each signature goes onto a public blockchain with a timestamp nobody can move later.

Four things make it different from a normal dashboard.

The four hour rule lives inside a smart contract. When a kitchen signs "cooking complete", a clock starts. If the school's "served" confirmation arrives after the window closes, the batch resolves to EXPIRED_UNSAFE by itself. No scheduled job, no inspector, no override.

Staying silent becomes the record. Every checkpoint has a deadline set when the batch is opened. If it passes with no signature, the batch resolves to UNVERIFIED and its QR code turns amber, permanently and in public. Not reporting stops being a way out.

Parents do not have to trust us. Anyone can work out a batch's status straight from a public block explorer, without our servers, without BGN's cooperation, and without our company still existing.

The trace runs backwards. Most blockchain food projects run farm to fork to back up a premium claim. An outbreak needs the opposite. When symptom reports arrive from several schools, SAJI expands through the kitchens and supplier lots those batches share, then intersects the sets to find the shared lot upstream. Seconds instead of days, while the rest of that lot is still sitting in other kitchens.

An AI model also scores each batch before it leaves the kitchen, using cook to dispatch time, holding temperature, ambient weather from the BMKG public API, delivery distance, the menu's microbiological risk class, and how punctual that kitchen has been with its own checkpoints.

How we plan to build it

Phase 1 is conceptual, so there is no code yet. The planned stack is Solidity 0.8.24 with Foundry and OpenZeppelin on Base Sepolia, wallet bound DIDs using EIP-4361 sign in and EIP-2771 meta transactions so kitchen staff never touch gas, IPFS for content addressed photos, a Node.js and viem indexer into PostgreSQL, a Python FastAPI service running XGBoost, and a Next.js 14 PWA.

Three contracts: SAJIRegistry, BatchAttestation and IncidentTrace. The whole trust argument depends on that code staying small enough to read through by eye.

What the live demo will show

The contract takes the safety window as a constructor parameter. The production value is four hours, the BPOM limit. For the Phase 2 stage we will also deploy an instance on Base Sepolia with a four minute window, so the judges can watch the rule fire instead of taking our word for it.

Open a batch, sign "cooking complete", keep talking for four minutes, then refresh the public scan page. The batch will have turned EXPIRED_UNSAFE by itself, with no transaction sent in between. The same run shows a skipped checkpoint turning UNVERIFIED once its deadline passes.

What we expect to be hard

We are a two person team building this in 24 hours, so we cut the scope to fit instead of promising features we cannot reach. No computer vision, no map layer, three small contracts rather than an upgradeable suite.

We also do not have access to real BGN operational data, so the risk model trains on a synthetic dataset calibrated to published time and temperature growth curves for B. cereus, Salmonella and E. coli. We would rather say that openly than claim a dataset we do not have.