GAMP 5 Category & Supplier Assessment

Document reference: GFTCL-CAT-001 · Framework: ISPE GAMP 5 (2nd ed.)

FortressAI Research Institute · Norwich, Connecticut

This document classifies the GaiaFTCL vQbit Quantum VM under the GAMP 5 software

categories and records the supplier assessment that sets the validation rigour.

---

Software category

GAMP category	Description	Applies?
1 — Infrastructure	OS, runtime	The host macOS only
3 — Non-configured	Used as-is	No
4 — Configured	Configured commercial product	No
5 — Bespoke	Custom-developed	Yes — the whole system

Determination: Category 5. The vQbit VM, the C⁴ algorithm rail, Franklin's

orchestrator, the substrate store, and the qualification stack are all bespoke,

purpose-built software. Category 5 mandates the most stringent lifecycle: full URS →

FS → SDS → Configuration Spec, design review, and IQ/OQ/PQ plus module-level

qualification (MQ). The system meets this through its self-contained qualification

suite (156 build-time tests + 18–19 live in-app checks).

Supplier assessment

Aspect	Finding
Supplier	FortressAI Research Institute (developer-operator)
Development model	Sovereign, single-repository, source-controlled (git)
Quality system	Pre-commit audit gates (doctrine, data-integrity, security) enforced on every change
Independence of testing	Build-time suite + in-app runtime runner are independent gates
Evidence retention	Append-only, federation-cosigned receipts retained in-repo

Because the supplier and operator are the same sovereign entity, validation evidence is

not taken on trust: it is re-verifiable — every qualification receipt re-computes

its witness hash from its sealed canonical witness, so a third-party assessor reproduces

the result without access to the developer.

Risk-based rigour

Category 5 + the system's role (autonomous value-bearing operation) place it at high

GxP-equivalent criticality. The validation effort is scaled accordingly — see the

Risk Assessment for the FMEA that drives test depth per function.

---

*Cross-references: Validation Plan ·

Risk Assessment · GAMP 5 Test Authority.*

*Federation cosignature: pending — gaiaftcl wiki sign --section GAMP5.*

Federation cosignature: pending operator signing host (v26). Witness (sha256 of rendered body): 0ce53b1c77839d4444a66abbd20e09651fa1434e2492af01e833c3e167c54e58. This page serves with a substrate-honest pending-signature notice until the operator's Franklin signer cosigns it.