Data Integrity & 21 CFR Part 11¶

Document reference: GFTCL-DI-001 · Framework: GAMP 5 · 21 CFR Part 11 · EU Annex 11 · ALCOA+

How the system meets data-integrity and electronic-records/electronic-signatures expectations. The substrate's persistence model is data-integrity-by-construction: append-only, tamper-evident, attributable, and re-verifiable.

ALCOA+ mapping¶

Principle	How the substrate satisfies it
Attributable	Every row carries `daemon_session_id` and a `signature_quintet` federation cosignature naming the signing cell.
Legible	Rows are structured columns + a canonical witness string; the Schema Catalog documents every field.
Contemporaneous	Each row stamps `composed_at_iso` at the moment of composition.
Original	The append-only SQLite store is the system of record; receipts are sealed copies, not substitutes.
Accurate	Exact-rational (`IntRational`) arithmetic; floating-point value amounts refused at the column level.
Complete	No row is deleted; the full history persists, including refusals and rolled-back states.
Consistent	Deterministic composition + sealed anchors give bit-exact replay across runs.
Enduring	Witness hashes + cosignatures let a row be re-verified years later.
Available	Read-only access through the CLI and the Python client; receipts retained in-repo.

Audit trail¶

Every substrate operation is its own audit-trail record:

Append-only — BEFORE UPDATE and BEFORE DELETE triggers RAISE(ABORT) on every table; there is no privileged path that edits history.
Tamper-evident — canonical_witness → witness_hash_sha256 (SHA-256). Any byte change to a sealed row breaks its hash.
Broadcast — each row declares nats_subject_sealed and is broadcast to the federation mesh, so the audit trail exists beyond the single host.

Electronic records & signatures (Part 11 / Annex 11)¶

Part 11 expectation	Mechanism
Record protection over retention period	Append-only store + retained sealed receipts
Audit trail of operator actions	V204 comms-projection rows record operator↔Franklin interactions
Electronic signature binding	`signature_quintet` (five federation contexts) bound to the record's canonical witness
Signature non-repudiation	Quintet verifies against the signing cell's pinned federation context public key
Copy generation for inspection	`gaiaftcl wiki sign` manifests + Python client read-side export

Re-verification¶

Any record or qualification receipt is independently re-verifiable: recompute the SHA-256 of the stored canonical_witness and compare to witness_hash_sha256; verify the signature_quintet against the federation public key. The PQ replay command exercises this across an anchor chain.

Cross-references: Security, Backup & Recovery · Risk Assessment · Encryption & Effective Irreversibility.

Federation-cosigned

This page's source is sealed in the GaiaFTCL federation manifest — page SHA-256 f25c00e206d03902…, manifest witness a090592e0609adc8…, signed 2026-06-02T18:58:22Z by cell gaiaftcl-mac-cell. Verify with gaiaftcl wiki sign --all and compare wiki-all-signatures.json.