
A Global Quality & CAPA System for Deviations, Evidence & Accountability
A QUEST toward truth. Follow the path until you know what actually happened.
Most quality systems can close a corrective action without fixing anything: the actor audits itself, UNKNOWN becomes permission, and a completed task passes for an effective one. A-QUEST TRACER makes those shortcuts structurally unavailable.
Powered by PBHP × Project Shadow.
The trace
Six phases you can explain to anyone
These phases are derived for orientation. Underneath, authority sits with the Project Shadow R1.0.1 registry — 26 canonical states and 71 guarded transitions — and the exact state is always shown beside the phase.
- Phase 01
Signal
Something happened. Record it before anyone explains it away.
- Phase 02
Contain
Stop the bleeding without pretending that is the fix.
- Phase 03
Investigate
Separate what is known from what is inferred from what is UNKNOWN.
- Phase 04
Correct
Name the action by its downstream effect, not its paperwork.
- Phase 05
Verify
An independent party checks whether the defect actually stopped.
- Phase 06
Remember
History is append-only. Rectification never becomes a memory hole.
What makes a trace different from a form
Claims carry their evidence
Every assertion is atomic and typed — fact, inference, speculation, contradiction or UNKNOWN — and links to a source span, not a summary.
Uncertainty stays uncertain
UNKNOWN is domain-typed and nonordinal. It never decays into low risk, completion or permission; a material UNKNOWN can pause the case.
Completion is not effectiveness
A CAPA cannot close because tasks finished. The effectiveness plan is sealed in advance and checked by someone who did not do the repair.
History is append-only
Corrections append successors. Nothing is edited away, so rectification cannot quietly become a memory hole.
Lineage is explicit
Forks, successors and secondary CAPAs are recorded relationships. A relation is documentary: it authorizes nothing on its own.
Receipts prove recording, not rightness
Every committed transition emits one chained receipt that says authorizes: false, with an explicit proof scope.
Trust architecture, in plain language
- The actor cannot be the only auditor. The person who performed the repair cannot verify it. Roles are separated at the server, not by convention.
- A refusal is a record. A denied command changes no state and issues no receipt — it is logged as a denied command with its blockers.
- Nothing is decided against “current”. Every evaluation pins the exact release, registry, schemas and rules it used, so a replay reaches the same verdict.
- Private by default. Records stay inside their workspace. Publication is a separate, separately approved artifact — there are no public case URLs.
Registry digest 30abc4525ee21fac… · profile BETA-ACTIVE-TESTING / PRELIVE