GAMP 5 Category & Supplier Assessment¶
Document reference: GFTCL-CAT-001 · Framework: ISPE GAMP 5 (2nd ed.)
FortressAI Research Institute · Norwich, Connecticut Patents: USPTO 19/460,960 · USPTO 19/096,071 — © 2026 Richard Gillespie
This document classifies the GaiaFTCL vQbit Quantum VM under the GAMP 5 software categories and records the supplier assessment that sets the validation rigour.
Software category¶
| GAMP category | Description | Applies? |
|---|---|---|
| 1 — Infrastructure | OS, runtime | The host macOS only |
| 3 — Non-configured | Used as-is | No |
| 4 — Configured | Configured commercial product | No |
| 5 — Bespoke | Custom-developed | Yes — the whole system |
Determination: Category 5. The vQbit VM, the C⁴ algorithm rail, Franklin's orchestrator, the substrate store, and the qualification stack are all bespoke, purpose-built software. Category 5 mandates the most stringent lifecycle: full URS → FS → SDS → Configuration Spec, design review, and IQ/OQ/PQ plus module-level qualification (MQ). The system meets this through its self-contained qualification suite (156 build-time tests + 18–19 live in-app checks).
Supplier assessment¶
| Aspect | Finding |
|---|---|
| Supplier | FortressAI Research Institute (developer-operator) |
| Development model | Sovereign, single-repository, source-controlled (git) |
| Quality system | Pre-commit audit gates (doctrine, data-integrity, security) enforced on every change |
| Independence of testing | Build-time suite + in-app runtime runner are independent gates |
| Evidence retention | Append-only, federation-cosigned receipts retained in-repo |
Because the supplier and operator are the same sovereign entity, validation evidence is not taken on trust: it is re-verifiable — every qualification receipt re-computes its witness hash from its sealed canonical witness, so a third-party assessor reproduces the result without access to the developer.
Risk-based rigour¶
Category 5 + the system's role (autonomous value-bearing operation) place it at high GxP-equivalent criticality. The validation effort is scaled accordingly — see the Risk Assessment for the FMEA that drives test depth per function.
Cross-references: Validation Plan · Risk Assessment · GAMP 5 Test Authority.
Federation-cosigned
This page's source is sealed in the GaiaFTCL federation manifest — page SHA-256 7162d95c0c0a64d3…, manifest witness a090592e0609adc8…, signed 2026-06-02T18:58:22Z by cell gaiaftcl-mac-cell. Verify with gaiaftcl wiki sign --all and compare wiki-all-signatures.json.