Immutable QC
Document
IQC-OV-01
Revision
Draft 6
Updated
2026-10-07
Status
Independent project · Open alpha · Synthetic demo data · No customers yet
Use
Informational draft. Not a controlled document; not a regulatory assessment or a validation statement.

Tokenized lab data.

1Scope

Each result becomes a sealed record: a SHA-256 fingerprint of five of its recorded fields, signed and linked to the record before it, so a later change shows. Built for automated research labs in biotechnology, microbiology, chemistry and materials science, where results arrive faster than people can review them and models train on them. Anchoring batches on a public network is an upcoming feature; only a fingerprint will go on the network, never the values.

Change a value and watch the checks

Where it would fit in an automated lab

Fig. 1

One sealed record

Simulated · demo data

Record 6 of 8 · sequence SEQ-0914-02 · Assay of Product 200 mg tablets

Sealed fields

Instrument
HPLC-02
Measurement
hplc
Peak area
1508811
Unit
counts
Captured (UTC)
2026-09-14T08:47:50Z

Context · not sealed in the alpha

Injection
06
Sample
P200-S1, preparation 1
Retention time
4.82 min
  1. Fingerprint recomputedSHA-256 of the five fields vs r6Match
  2. Signature checkedECDSA P-256, demo public keyValid
  3. Link recomputedSHA-256 of h5 + r6 + “6” vs h6Intact

Checked at build. Live checking in your browser needs JavaScript.

Check any record yourself

Raw data · the values the checks above recompute

Payload · instrumentId|sensorType|value|unit|capturedAt

HPLC-02|hplc|1508811|counts|2026-09-14T08:47:50Z

Fingerprint r6

eb1690bc5922a312d90ee139fdf8e20b92bf2cb0feae8ee0e70bd24fbd2b54d7

SHA-256 of the 48-byte payload. One changed character gives a completely different fingerprint.

Previous h5 · link of record 5
c04af03f4b9c69a30d06e27d9906e4e7f2bc176b7ba0a212582ad8c65f6bdfd5
Link h6 · carried by record 7 as its previous link
c427b83a4e29adf9380bef67d00302e12ddfd558ae8f5a558547b2b0cf3cba23

Signature · ECDSA P-256 over r6 · demo key 7A15F562… · public key in Method

fd3cfca2c73346e6 … 6cadf2dfeb420279

Fig. 1 · Record 6 of the synthetic HPLC sequence SEQ-0914-02, as an auditor or an AI agent would read it. Basis Same five fields, order and link rule as the alpha app’s HPLC import, where the instrument field is the app’s internal instrument number; SHA-256 is FIPS 180-4. Demo signatures. In the alpha, one server key signs imported rows; per-analyst signatures are upcoming.

2Why: one wrong value snowballs

Most bad data is not malicious. But when results arrive faster than people can review them, and models train on them and choose the next experiment, an ordinary mistake travels before anyone sees it.

A wrong value usually comes from ordinary software and operations:

  • a script that “fixed” the units
  • a sync conflict between two copies
  • a crash halfway through a write
  • a backup restored from last week
  • a migration that rounded values
  • an outage that dropped a batch
  • a model that filled in a blank

One wrong value does not stay put: it feeds an analysis, the analysis feeds a model, and the model picks the next experiment, so a concentration a script wrote in mg/mL where the pipeline expects µg/mL can end up in a dose-response fit, a training set and tomorrow’s plates. Today a seal shows a value changed after it was sealed; upcoming, a restored backup or a dropped batch would show against an anchor, a filled-in blank with measured and derived records, and lineage would find every analysis, model and decision recorded as using a wrong value.

Deliberate changesA value changed on purpose after sealing, by someone without the signing key, fails the same checks as one changed by accident. A history rewritten with the key, or a record deleted and the rest relinked (which needs no key), passes each record’s checks; question 5.7 on the About page says what would show it, and what is not covered.

In an intelligence explosion, human review can’t keep up with every result; records have to verify themselves.

José A. Fernández Abreu, founder

3How a result becomes a sealed record

One record from the demo sequence, record 6 of SEQ-0914-02, in seven steps from the instrument run to its place in the record history. Every value shown is computed from the signed demo data when the site is built.

  1. 3.1Captured

    Injection 06 on HPLC-02. The chromatography data system (CDS) integrates the peak at 4.82 min, and its area, 1508811 counts, becomes the value of record 6, with four more fields: the instrument, the measurement type, the unit and the capture time.

    Fig. 2.1

    Captured

    Simulated · demo data

    Injection 06illustrative trace

    4.82 min Area 1508811 counts

    Record 6 · five fields

    Instrument
    HPLC-02
    Measurement
    hplc
    Peak area
    1508811
    Unit
    counts
    Captured (UTC)
    2026-09-14T08:47:50Z
    Fig. 2.1 · Injection 06 on HPLC-02, an illustrative trace. The shaded peak at 4.82 min has an area of 1508811 counts, the value of record 6; with four more fields it forms the record.

  2. 3.2Fingerprinted

    The five fields are joined by a vertical bar into one line of 48 bytes: HPLC-02|hplc|1508811|counts|2026-09-14T08:47:50Z. SHA-256 turns that line into a 64-character fingerprint, r6. One changed character gives a completely different fingerprint.

    Fig. 2.2

    Fingerprinted

    Simulated · demo data

    Record 6 · five fields

    Instrument
    HPLC-02
    Measurement
    hplc
    Peak area
    1508811
    Unit
    counts
    Captured (UTC)
    2026-09-14T08:47:50Z

    Payload · five fields · 48 bytes

    HPLC-02|hplc|1508811|counts|2026-09-14T08:47:50Z

    SHA-256Fingerprint r6

    eb1690bc5922a312d90ee139fdf8e20b92bf2cb0feae8ee0e70bd24fbd2b54d7

    Fig. 2.2 · The five fields joined by bars, 48 bytes, and their SHA-256 fingerprint r6, shown in full.

  3. 3.3Signed

    The fingerprint is signed with the demo key (ECDSA P-256, key id 7A15F562…), and anyone with the public key can check that the signature covers this fingerprint and no other.

    Demo signature. In the alpha, one server key signs imported rows; per-analyst signatures are upcoming.

    Fig. 2.3

    Signed

    Simulated · demo data

    Record 6 · five fields· signed

    Instrument
    HPLC-02
    Measurement
    hplc
    Peak area
    1508811
    Unit
    counts
    Captured (UTC)
    2026-09-14T08:47:50Z

    Payload · five fields · 48 bytes

    HPLC-02|hplc|1508811|counts|2026-09-14T08:47:50Z

    SHA-256Fingerprint r6

    eb1690bc5922a312d90ee139fdf8e20b92bf2cb0feae8ee0e70bd24fbd2b54d7

    ECDSA P-256Signature · over r6 · demo key 7A15F562…

    fd3cfca2c73346e6…6cadf2dfeb420279valid

    Fig. 2.3 · The fingerprint signed with the demo key 7A15F562…: the signature is valid and the record’s ring is drawn; its dot fills once the record is linked.

  4. 3.4Linked

    Record 6 also stores the link of record 5, h5. Its own link is h6 = SHA-256(h5 + r6 + “6”), and record 7 carries h6 forward as its previous link. So every record is tied to the one before it, back to the fixed start value of 64 zeros.

    Fig. 2.4

    Linked

    Simulated · demo data

    Sequence SEQ-0914-02

    h5h6
    1. 1
    2. 2
    3. 3
    4. 4
    5. 5
    6. 6
    7. 7
    8. 8

    simulated anchor: h8 0a35688a…

    h6 = SHA-256(h5 c04af03f… + r6 eb1690bc… + “6”) = c427b83a…

    Fig. 2.4 · Records 1 to 8, each linked to the one before. Record 6 takes in h5 and passes h6 on to record 7; signed and linked, it is sealed, and its dot fills.

  5. 3.5A change shows

    Suppose the peak area is changed after sealing, from 1508811 to 1508911: the recomputed fingerprint differs from the stored r6, the signature fails and the link into record 7 breaks, while records 7 and 8 still pass their own checks. So a changed value fails that record’s fingerprint and signature and breaks only the link into the next record. Replayed from 64 zeros, the head (the newest record’s link) no longer matches the anchored fingerprint, which is simulated here.

    Values in full
    Recomputed fingerprint of record 6
    3cafb26418ae173c328561dcc93084e7deec8bf90d91256182d563b673a554b2
    Recomputed link h6
    9b5c58aa6abab7daa23c1f4e53775232309c59ee360fa24342e2888fadcd8a86
    Link h6 that record 7 carries
    c427b83a4e29adf9380bef67d00302e12ddfd558ae8f5a558547b2b0cf3cba23
    Replayed head
    75d3969cb8e256fdaa255eeaf895a3c57ec59e4ad68158850a6731bfb9cd05d3
    Simulated anchor, h8
    0a35688a4c3ec82a5e621cede1f173a6d436ade0e20f159dca92c2a3711e3dc1

    Fig. 2.5

    A change shows

    Simulated · demo data

    Record 6 · sealed· changed after sealing

    Instrument
    HPLC-02
    Measurement
    hplc
    Peak area
    15088111508911
    Unit
    counts
    Captured (UTC)
    2026-09-14T08:47:50Z

    Payload · five fields · 48 bytes

    HPLC-02|hplc|15088111508911|counts|2026-09-14T08:47:50Z

    SHA-256Fingerprint r6Fingerprint, recomputed≠ stored r6 eb1690bc…

    eb1690bc5922a312d90ee139fdf8e20b92bf2cb0feae8ee0e70bd24fbd2b54d73cafb26418ae173c328561dcc93084e7deec8bf90d91256182d563b673a554b2

    ECDSA P-256Signature · over r6 · demo key 7A15F562…

    fd3cfca2c73346e6…6cadf2dfeb420279validfails

    Sequence SEQ-0914-02

    h5h6 ≠
    1. 1
    2. 2
    3. 3
    4. 4
    5. 5
    6. 6
    7. 7
    8. 8

    simulated anchor: h8 0a35688a…replayed head 75d3969c… ≠ simulated anchor 0a35688a…

    h6 = SHA-256(h5 c04af03f… + r6 eb1690bc… + “6”) = c427b83a…

    link 6→7 broken: recomputed h6 9b5c58aa… ≠ c427b83a… · records 7 and 8 pass

    Fig. 2.5 · The peak area changed to 1508911: the recomputed fingerprint differs, the signature fails, link 6→7 breaks and the replayed head no longer matches the simulated anchor. Records 7 and 8 pass their own checks.

  6. 3.6A correction is appended

    Made the right way, the same change is a correction: record 6 stays as sealed, and a new record 9 holds the new value, 1508911, with its own fingerprint, a link from record 8 and a signature. Its reason (“Peak reintegrated in the CDS after review; result imported again”) and “corrects #6” sit beside the seal, not inside it; all 9 records pass, and the new head, h9, is not yet anchored.

    Record 9 is signed with a one-time demo key (key id FEE1BE86…), made at build and then discarded, as Check a record signs a correction with a one-time demo key made in your browser; the demo key that signed records 1 to 8 was discarded too, so it cannot sign anything new.

    Values in full
    Fingerprint r9 (the same five fields as the change, so the same fingerprint)
    3cafb26418ae173c328561dcc93084e7deec8bf90d91256182d563b673a554b2
    Link h9
    128206a058f6bf9d72741d670e5ecd966c4eacfadc54137a4871a694d7a393aa
    Signature of record 9
    cb757702b66cf3984809b7c1c1dfb71f4731a5bf6526a4b43893aa95e89c207574cddb19cc97b97d2c40b1a82a33a85d249af2c721a58e26c5e053003ac985b3
    One-time public key (uncompressed point)
    040d586f9eeccc0c9e711002279871b277cca37e8bf05d52610d0415e044dcbfc8e9bb9c57500c81dd5dec6b1276a414a899f9e0a962eab91a9854841f07dbf817
    Its key id (first 16 bytes of SHA-256 of its SPKI)
    FEE1BE866091FC4D427FD85C383BDCA1

    Fig. 2.6

    A correction is appended

    Simulated · demo data

    Record 6 · stays as sealed · peak area 1508811

    Record 9 · other fields as in #6 · one-time demo key FEE1BE86…

    Peak area
    1508911
    Fingerprint r9
    3cafb264…
    Link h9
    128206a0…
    Signature
    cb757702b66cf398…c5e053003ac985b3 valid

    Beside the seal: corrects #6 · reason “Peak reintegrated in the CDS after review; result imported again”

    Sequence SEQ-0914-02

    h5h6corrects #6
    1. 1
    2. 2
    3. 3
    4. 4
    5. 5
    6. 6
    7. 7
    8. 8
    9. 9

    simulated anchor: h8 0a35688a…simulated anchor matches records 1 to 8 · record 9 not yet anchored

    h6 = SHA-256(h5 c04af03f… + r6 eb1690bc… + “6”) = c427b83a…

    h9 = SHA-256(h8 + r9 + “9”) = 128206a0… · all 9 records pass

    Fig. 2.6 · Record 6 stays as sealed. Record 9 holds the new value with its own fingerprint, a link from h8 and a signature with a one-time demo key; its reason and “corrects #6” sit beside the seal. All 9 records pass, and record 9 is not yet anchored.

  7. 3.7What comes next Upcoming

    Upcoming: the head of a batch, here h8, written to a public network. Only that fingerprint would go on the network, never the values. Upcoming too: an AI agent that checks fingerprint, signature, link and anchor before it uses a result.

    IQC-CK-01Check it yourself

    IQC-RD-01 §2Roadmap: what is upcoming

    Fig. 2.7

    What comes next

    Simulated · demo data

    Public network Upcoming

    h8 0a35688a…

    Only this fingerprint would go on the network, never the values.

    AI agent Upcoming

    1. Fingerprint
    2. Signature
    3. Link
    4. Anchor

    It would check all four before it uses a result.

    Sequence SEQ-0914-02

    corrects #6
    1. 1
    2. 2
    3. 3
    4. 4
    5. 5
    6. 6
    7. 7
    8. 8
    9. 9

    simulated anchor matches records 1 to 8 · record 9 not yet anchoredh8 0a35688a…, the head of records 1 to 8

    h9 = SHA-256(h8 + r9 + “9”) = 128206a0… · all 9 records pass

    Record 9 would go in the next batch.

    Fig. 2.7 · Upcoming: h8, the head of records 1 to 8, written to a public network, and an AI agent that checks fingerprint, signature, link and anchor. Nothing here touches a network.

4Record history

The whole synthetic sequence, as an auditor would page through it. When the table comes into view, your browser checks every record once and marks each result; after that nothing moves.

Fig. 3

Record history

Simulated · demo data

Sequence
SEQ-0914-02
Instrument
HPLC-02
Method
Assay of Product 200 mg tablets
Injections
2026-09-14, 08:12 to 09:01 UTC
8 injections, one record each: 5 system-suitability injections of the reference standard (STD-A), then 3 preparations of Product 200 mg tablets (P200-S1 to P200-S3).
SealRecordSample contextRT min · contextCaptured UTCPeak area countsFinger­printLink to nextDemo signatureDemo sig.
1STD-A · system suitability, replicate 14.8215238470135c779fingerprint checked at buildintactvalid
2STD-A · system suitability, replicate 24.8115199629892c300fingerprint checked at buildintactvalid
3STD-A · system suitability, replicate 34.821527410ae3ff253fingerprint checked at buildintactvalid
4STD-A · system suitability, replicate 44.831521188976c4d87fingerprint checked at buildintactvalid
5STD-A · system suitability, replicate 54.8215256031f00a3f2fingerprint checked at buildintactvalid
6P200-S1 · sample, preparation 14.821508811eb1690bcfingerprint checked at buildintactvalid
7P200-S2 · sample, preparation 24.811531274ebe86f04fingerprint checked at buildintactvalid
8P200-S3 · sample, preparation 34.82151603945752d11fingerprint checked at buildintactvalid

StatusChecked at build: 8 of 8 records pass · simulated anchor matches. Live checking in your browser needs JavaScript.

Head (link of the newest record), replayed from 64 zeros0a35688a matches the anchored fingerprint

Anchored fingerprint (simulated, no network call)0a35688a the head of records 1 to 8, stored on this page as a simulated anchor

Read only. Editing lives on Check a record.

Change a value on Check a record
Fig. 3 · The eight records of sequence SEQ-0914-02, oldest first. Your browser checks each one from the values in the table: the fingerprint of its five sealed fields, its signature, and the link it carries into the next record. The head is the link of the newest record, recomputed by replaying the whole history from 64 zeros. Sample and retention time are context, not sealed in the alpha. Signatures as in Fig. 1.

5Today, upcoming and not claimed

  • Alpha console · demo in your browserRuns on a synthetic lab, only in your browser. Each record gets a SHA-256 fingerprint, a link to the record before it (the first record links to a fixed start value of 64 zeros), and a signature from a demo key made in your browser. Corrections are new records with a reason, and every check is recomputed after each change. Its anchor is simulated, with no network call.
  • These pagesThe same construction on one synthetic sequence, signed with a demo key at build. Your browser recomputes every check.
  • Alpha app · not publicImports HPLC CSV exports. Each peak area becomes a record of instrument, measurement type, value, unit and capture time, fingerprinted, linked and signed by one server key. The capture time is an injection time typed at import, or the server’s clock if none is given.
  • UpcomingSealing at capture (SiLA 2 and OPC UA LADS adapters), measured and derived records, lineage and recall, agentic workflows, Merkle batches with salted leaves and inclusion checks, privacy on public networks, anchoring batch fingerprints on a public test network, an encrypted archive on Filecoin, per-analyst signatures, signatures that cover each record’s position, reviewer sign-off, server-side verification in the app, sample and method metadata in the seal, a shared registry, and post-quantum signatures and encryption, in the Roadmap’s order. Every anchor on this site and in the console is simulated.
  • Not claimedNo customers, no capture at the instrument or orchestrator, no electronic signatures and no validation. Nothing on this site or in the console writes to a public network.

BasisThe same five fields and link rule in the alpha app’s HPLC import and on these pages; in the app, the instrument field is its internal instrument number. The console documents its own payload in its Method panel.

6Where it fits

In an automated lab, software already sits between the instrument and the record: the scheduler or orchestrator, the device drivers and the data pipeline that feeds models and agents. Sealing each result in the orchestrator or driver, as the instrument produces it, over SiLA 2 or OPC UA LADS, is upcoming.

Today, Immutable QC sits beside an HPLC CSV export: the alpha app fingerprints, links and signs each peak area imported from it with one server key, and checking them in the app is upcoming. On these pages and in the console the record history is tamper-evident, so a later change to a sealed value fails its checks. Today a change made before import is not covered; with sealing at capture, only a change made before capture would be.

  1. Instrumentruns the method and produces each result
  2. Orchestrator or driverschedules the run and receives each result (SiLA 2, OPC UA LADS); sealing here is upcoming
  3. Data pipelinestores, converts, joins and exports results
  4. Models and agentsanalyze results, train on them and pick the next experiment

Upcoming: sealed here

Today: an HPLC CSV export

Immutable QC Alpha

Today: imports an HPLC CSV export, then fingerprints, links and signs each peak area. Upcoming: would seal each result as the orchestrator or driver receives it, before anything downstream could change it.

Upcoming: agents would check the sealed history before use

Fig. 4 · Where Immutable QC would sit in an automated lab. Today it imports an HPLC CSV export (solid line); sealing at the orchestrator or driver, and the check by models and agents, are upcoming (dashed lines).

6.1When your process moves into GMP

Your instrument, CDS, LIMS and QA review stay as they are. In the alpha, Immutable QC sits beside the CDS export; nothing is sent back to the CDS or LIMS, and the sealed history is what a reviewer or an auditor would check.

  1. Instrumentacquires the run
  2. CDSintegrates peaks and keeps its own audit trail
  3. LIMSholds results and specifications
  4. QA reviewsecond-person review, approval and release

CSV export from the CDS

Immutable QC Alpha

Imports the HPLC CSV export, then fingerprints, links and signs each peak area.

Upcoming: QA review would check the sealed history

Fig. 5 · Where Immutable QC sits in a GMP lab. The CDS export feeds it; nothing is sent back to the CDS or LIMS. The dashed link to QA review is upcoming (reviewer sign-off).

Built toward the audit-trail expectations of 21 CFR Part 11, EU Annex 11 and ISO/IEC 17025:2017. Not validated. No electronic signatures yet. Not a substitute for your computerized-system validation or SOPs.

Read the regulatory map

7What would go public Upcoming

Stays with the lab

  • Peak areas and every other value, in readable form
  • Sample, method and sequence records
  • Names, reasons and review notes
  • The record history itself

Would go on a public network

Nothing on this site writes to a network. Once anchoring becomes available, by default one batch fingerprint will go on it for a whole run of records. It is a 64-character code; here it is the link of record 8, which depends on records 1 to 8.

0a35688a4c3ec82a5e621cede1f173a6d436ade0e20f159dca92c2a3711e3dc1

Simulated here, with no network call. Anyone who holds the records can recompute it and see whether they still match.

Only if a lab chooses the encrypted archive, also upcoming: its records as ciphertext, encrypted in the lab with keys that stay there, never readable on the network.

A fingerprint is not encryption. How a record is sealed, section 9, explains why, and what is upcoming: salted batches, and an encrypted archive that would hold nothing readable.

IQC-HS-01 §9Privacy on public networks

8Agentic workflows Upcoming

An agent would run the same four checks as Check a record before it uses a result. Passing them says a result has not changed since it was sealed; it does not say the result was right when it was captured, or that it was ever measured.

Measured and derived records, upcoming: only a record sealed at capture, by the instrument’s or orchestrator’s key, would count as measured. Anything an agent, a script or an analysis produces would be a derived record, under a different signer, citing the fingerprints of the sealed records it came from. So a number an agent gives either traces back to a measurement or it does not, and one that does not would be flagged before use. A derived number that cites real measurements but was computed or copied wrongly would still pass; a checker would re-run the analysis from its cited inputs where it is deterministic.

Check a record shows one record as an agent would receive it. There is no API yet.

IQC-RD-01 §2.4Agentic workflows

IQC-RD-01 §2.2Measured and derived records

9The document set

  • IQC-HS-01How a record is sealed

    The payload, the fingerprint, the link rule, demo signatures, corrections, what a check shows, upcoming anchoring and the privacy note.

  • IQC-CK-01Check a record

    Change any sealed field and watch the checks; rewrite the history to hide it, or append a correction instead.

  • IQC-RM-01Regulatory map

    Expectation by expectation for 21 CFR Part 11, EU Annex 11, ISO/IEC 17025:2017, ALCOA+, GMP and TNI, with what exists today and what is not covered. A reading aid, not an assessment.

  • IQC-RD-01Roadmap

    What works today, and what is upcoming, the automated-lab items first.

  • IQC-AB-01About

    Who builds it, status, and questions.

  • DemoAlpha console

    A synthetic lab that runs only in your browser.