Changelog

​

Invariant: Auditor Packet, OOS and equipment schedules (3 November 2026)

• Auditor Packet, where enabled per organization: Administrators and QA Managers can choose Auditor Packet under Reports to download one print-ready PDF of the deviation, CAPA, change-control, complaint, training and equipment registers for a date range. The range uses whole days in your organization’s time zone. Each register counts only rows in the range, and a packet that is too large is refused rather than cut short. The equipment register lists calibration pass and fail counts and any out-of-service or return-to-service events in the range. See Auditor Packet.
• OOS records, where the OOS extras are enabled: add PNG, JPEG or PDF evidence to an OOS record, download an OOS record PDF, get an in-app reminder before and after the Phase I due date, and show Phase I due dates on the Quality Calendar. See OOS Records.
• Equipment, where the equipment schedule is enabled: show calibration and PM due dates on the Quality Calendar, give equipment owners in-app reminders when a calibration or PM is due within 30 days or overdue, and download an equipment record PDF. See Equipment Register.
• Training, where deactivation ends memberships: a reactivated user who still has open group memberships now receives the groups’ current training requirements.

​

Invariant: assigned change-control approvals, document closure gate and idle sign-out (2 November 2026)

• Assigned approvals for change control, where enabled per organization: choose an approver roster of 1 to 25 people, each with a function label, and one Final QA approver before submission. Each required approver signs as their function; Final QA signs last. Approvers see their pending work under Awaiting your approval. A return for changes ends the review and needs a fresh roster. See Change Controls.
• Document closure gate for change control, where enabled per organization: impacted documents are frozen into obligations when QA approves the change. Implementation is blocked until each document is revised and approved, or an independent QA signer waives the obligation. See Change Controls.
• Idle sign-out, where enabled per organization: sessions end after 15 minutes without activity or 8 hours after sign-in. A warning offers Stay signed in two minutes before the end, and an unsaved form stays on the page while you sign in again. See System administration.
• Signature refusals: the signing dialog marks your password as wrong only when the password check failed. Independence, status and role refusals now appear as plain messages, and a role refusal names the roles that can perform the action.
• Notifications, where enabled: a notification sent to the whole organization is marked read only for the person who reads it. Unread counts and mark all read are per person.
• Record PDFs, where enabled: each record PDF now lists the sections it includes and the ones it does not include.
• Training, where enabled per organization: deactivating a user can end their open employee-group memberships, so inactive people leave group counts, coverage and new group training. Legacy free-text training labels can be limited to roles, department keywords and exact group names, without matching people’s names. See Training Management.

​

Invariant: certificate expiry alerts (31 October 2026)

• Certificate expiry alerts, where enabled per organization: the holder of a certificate or licence gets an in-app notification 30 days and 7 days before it expires, and for 30 days after it expires. Expiry dates can also be shown on the Quality Calendar with Show certificate expiry dates. Alerts are reminders, not a validity or competency decision. See Training Management.
• Change controls: the Type and Impact badges are now read from the stored values exactly.

​

Invariant: OOS records, equipment register, internal audits and more (28 October 2026)

• OOS records: record an out-of-specification result as first reported, complete a five-check Phase I laboratory investigation, and have it reviewed or returned with an independent QA signature. Phase I review does not close the OOS or release a batch. See OOS Records and Investigate an OOS result.
• Equipment register: register equipment with calibration and preventive-maintenance intervals, record signed calibration and PM events with evidence, and see when each is next due. A failed calibration takes the asset out of service, and a QA signer returns it to service once calibration is current again. See Equipment Register and Record a calibration.
• Internal audits: schedule audits for a programme year, record graded findings, issue a signed report, take each finding through a response and a correction or linked CAPA, and close the audit with a signature once every finding is closed.
• Employee certificates and licences: record external certificates such as WHMIS or a forklift licence with evidence, and have them verified, rejected or revoked with a signature. See Training Management.
• Change-control attachments: add evidence files to a change control until it is finished. See Attach evidence.
• Impacted documents: list the documents a change control affects, with the action each needs, and see whether each one has been updated. The list is advisory.
• CAPA risk score (RPN): record initial and residual severity, occurrence and detectability scores. Scores are append-only, with a reason and full history. See CAPAs.
• Scheduled CAPA effectiveness checks: set a later effectiveness-check date when a CAPA is done, filter CAPAs awaiting a check, and show check dates on the Quality Calendar. See CAPAs.
• Recurring quality tasks: create a daily, weekly or monthly series of up to 52 quality tasks in one step. Owners can get in-app due-date reminders. See Quality Work Items.
• Document approval: document approval is single-step for every organization. Where enabled, an Approval status pane shows each approval task and its decision. See Documents.

​

Invariant: guided five Whys, deviation timeline, SOP coverage and review decisions (26 October 2026)

• Guided five Whys, where enabled per organization: a 5-Whys RCA asks one “why” at a time, needs three to five answers, and ends with a reviewed root-cause conclusion. See Raise a deviation.
• Deviation timeline, where enabled: the deviation page shows linked CAPAs, actions, change controls and tasks with their due dates, and flags work that runs past a due date. A Deviation Timelines page lists deviations with overrunning work. See Deviations.
• SOP training coverage, where enabled: find effective SOPs with no training program in a published curriculum, and see who is trained, due or overdue on each SOP. See Training Management.
• Training due dates on the Quality Calendar, where enabled: Show training due dates adds unfinished assignments. Operators see their own. See Quality Calendar.
• Change-control review: an independent Administrator or QA Manager can sign Return to author to send a change control under review back to draft, or Reject to close it permanently. Finished change controls no longer offer SLA extension requests. See Change Controls.
• Report date ranges: report downloads include the full selected end day, and the summary and audit exports read the range in your organization’s time zone. See Reports.
• Imports: the CSV row count shown before validation follows the same quote rules as the server.
• Links in emails: invitation and password-reset links open invariant.elevatedsignals.ai.

​

Invariant: stricter CAPA, deviation and training checks (25 October 2026)

• CAPA actions: every new action needs an owner and a due date. Use Edit owner / due date to fix an existing action; on a completed action only missing values can be filled. Completing an action requires a short evidence note, and a completed action with no evidence shows an option to add one.
• CAPAs: a linked CAPA cannot be created from a closed deviation.
• CAPA effectiveness: the signed effectiveness step can now record Not effective as well as verified, so a CAPA can be returned without recording a false effectiveness result.
• Change-control training targets: before implementation, the detail page lists any training targets that are no longer available. Those targets are skipped, training goes to everyone else still available, and the skipped list is included in the implementation signature.
• CAPA retraining: only an administrator, QA manager or reviewer can add or complete a retraining action.
• Deviations: new deviations are created as Unplanned. QA classifies a deviation as Planned with a signature while it is still open. Deviations with no classification show as Unclassified and can be filtered. Once an RCA is completed, its root cause stays the one shown on the deviation.
• Change controls: SLA extension requests are refused once a change control is finished.
• Training: eligible training assignments that are not CAPA retraining can now be completed with a signature. Publishing and retiring curriculum versions works again for administrators and QA managers.
• Quality tasks: a task marked Done cannot be edited or reassigned.
• Access: private quality tickets are no longer shown on the calendar or in audit views to people who cannot open them, and attachment downloads apply the same access check everywhere.
• Imports: CSV import refuses stray quote characters, and text fields refuse values longer than the field allows instead of failing later.

​

New website and clearer Users & Roles table

• The public homepage now shows real product screens in a redesigned layout.
• New Security and Validation pages explain the product’s controls and current boundaries.
• The demo request form keeps its existing fields and privacy wording.
• The Users & Roles table gives invitation status, role labels and action buttons more room.

​

Invariant: effective document versions and the Invariant sender name (30 September 2026)

• Controlled documents now open on their effective version: the version currently in force, rather than simply the newest version number. Every existing document was checked before the release and shows the same version as before. This is groundwork for revising an effective document while the current version stays in force, which is still in development and not yet available to any organization.
• Emails from Invariant (invitations, password resets and notifications) now show Invariant as the sender name instead of QualityCore. The sending address is unchanged.

​

Roadmap refreshed with requests from quality teams

• Training: learner content with reading material, video and quizzes; training-only access for staff who do not need the full quality system; SOP-to-training coverage.
• Documents and change control: editing in Word, Microsoft 365 or Google Docs with Invariant as the controlled version; check-out and edit locks; a configurable impact-assessment checklist.
• Complaints and quality events: linking many complaints to one investigation, a recorded triage decision, units affected against units released, and recall, loss and theft, and continuous-improvement record types.
• Workflow and reporting: approval steps each organization configures, tasks assigned to other departments and verified by QA, a per-person calendar with training due dates, and a print-ready auditor packet.
• Assistance and integration: a document check against a cited regulation, a certificate of analysis from lab results reviewed by QA, digital logbooks, label verification, and a French interface.

​

Invariant: more reliable complaint audit records (23 September 2026)

• Complaints: when two people save changes to the same complaint at the same moment, each save now waits for the other, so the “before” values written to the tamper-evident audit trail are always the values that were actually replaced.
• Deviations: the audit entry written when a deviation is created now also records which closure-target cycle was applied.
• Groundwork for future corrections of deviation severity and SLA targets ships switched off; it is not available to any organization.

​

Invariant: correct an unsubmitted change control (22 September 2026)

• Record corrections, where enabled per organization: the Correct record control now also appears on change controls that have not yet been submitted for review. Administrators and QA Managers can correct the content fields (title, description, change type, impact assessment, action plan, requires-training and GMP-impact flags, planning due date, training targets and attachment references) with a reason for change; the previous and corrected values, the reason and the actor are written to the tamper-evident audit trail. Submitted, approved and implemented change controls are not correctable. A save that collides with someone else’s edit or comment is refused and the draft is kept. A corrector counts as an author for the independence check on approval and implementation. See Correct a record.

​

Invariant: correct a record with a reason (21 September 2026)

• Record corrections, where enabled per organization: Administrators and QA Managers get a Correct record control on open complaints, deviations and CAPAs to fix recording errors (title, description, lot/batch, dates, taxonomy, recorded detector, priority and similar fields). Every save requires a reason for change and writes the previous and corrected values, the reason and the actor to the tamper-evident audit trail. Existing signatures are untouched; closed, completed or signed records must be reopened first. Deviation severity and classification, SLA deadlines and approved extensions are deliberately excluded. See Correct a record.
• Reason for change is now required on seven more existing-value actions, including the four complaint actions that already asked for one in the interface.

​

Invariant: complaint trends by type and subtype (20 September 2026)

• Complaints, where enabled per organization: the Type / subtype breakdown groups subtypes under their type and adds an Unclassified row for complaints of a type that have no valid subtype, so every complaint in the metrics window is counted. Select a row to filter the list to exactly those complaints; the search, status and site filters reset and a metrics-window chip keeps the count and the list aligned. CSV and PDF exports include the same rollup. See Complaints.

​

Invariant: accurate pre-submit CSV row count (14 September 2026)

• Imports, where enabled: the row count shown before you validate a CSV import now counts nonblank records, not physical lines, and leaves out the header row. A file with blank lines no longer over-reports. If a quoted field is unfinished the count waits until you close the quote. The server’s validation result remains the authoritative count, and its row numbers still refer to the file’s physical lines. See the validation and import procedure.

​

Clearer quality follow-up, training, and import results

• Audit links: open supported affected records from their audit events. Unavailable records and event types without detail pages remain text. See Audit Trail.
• Complaints: select existing deviations and CAPAs by number and title. Action-specific errors and pending-request controls make investigation and disposition actions clearer.
• Quality Calendar: unfinished tasks with due dates appear as Task entries where the calendar and task workflow are enabled. This is not recurring scheduling or live document-routing history.
• Training: combine group, role, and program matrix filters; create draft curriculum versions or retire published versions with a reason, within the existing role boundaries. Version-specific document assignments require approved revisions. New change-control audiences retain explicit group, user, or role identities; legacy labels are not automatically converted.
• Aging reports: separate 91–180 days from 180+, meaning older than 180 days.
• Imports, where enabled: a valid CSV can report invalid rows while importing the valid subset. Validate only now saves an audited validation report without creating the predicted records, invitations, or email jobs. Malformed files are still refused. See the validation and import procedure.
• Administration: clearer outstanding-invitation handling and first-time site/licence creation. Existing-record changes retain their reason requirements.
• Optional categories and materials: category controls remain feature-gated; material history respects the existing multi-site boundary. No live inventory integration is implied.

​

A clearer starting point for quality teams and partners

• The introduction now links the complaint, task, document, training, and evidence workflows.
• New evaluation guidance helps teams scope a first site and a guided SOP-based walkthrough.
• Availability notes distinguish beta workflows from planned AI complaint intake, live production integrations, and broader multi-site work. The audit-history explanation states verification limits.

​

QualityCore is now Elevated Signals Invariant

• The product has a new name. Same product, same team, same roadmap. The name refers to the audit history: your records change throughout their lifecycle, as they must, but the recorded history of those changes is hash-chained, so any alteration to it is detectable.
• Existing documentation links keep working. Every /qualitycore/... page now redirects to its /invariant/... equivalent, so previously shared links do not break.
• Entries below this one were written under the previous name and are left as they were recorded.

​

Export your audit trail and verify it yourself

• Audit trail exports are now independently verifiable. An export previously left out the fields you would need to check its integrity without us. Every export now carries the full hash chain, so you — or your auditor — can confirm that no row has been altered or removed, using nothing but the file. You do not have to take our word for it, which is the entire point of a tamper-evident record.
• Every audit trail download is itself recorded. We logged the request for an export but not the export that actually left the system. Now the download is recorded with the number of rows it contained, so “who took this organization’s audit trail out of the system, and when?” has a complete answer. If that recording ever fails, the download fails with it — you will never receive a copy that was not logged.
• Reports are restricted to QA managers and administrators. This now applies to the report list as well as the downloads themselves. Previously any member could see that a report had been generated, when, and by whom — the index was open even though the file was not.

​

SLA extensions: clearer rules, honest dates

• The rules are stated before you click, not after. Requesting a due-date extension told you what was wrong only once you had tried. The justification minimum and the constraints on the new date are now shown up front. (Found by Amar hitting exactly this wall on a live deviation.)
• The date you see is the date that is checked. A CAPA could reject a due date that was visibly later than the one on screen, because the display and the validator were resolving different dates. They now agree.
• One pending extension per record, enforced by the database rather than by convention. Stacked requests could previously be approved out of order and produce a due-date history that depended on the order of approval.
• Extended records are marked in list views without pushing the row to double height.

​

Bulk import refuses bad files loudly

• Malformed CSV is now rejected with a clear reason instead of being partially processed, and imports are bounded so an oversized file cannot run away.

​

Smaller things

• Creating or triaging a quality ticket no longer asks for a reason-for-change. Both are first-time actions, so there was no prior state to explain; the prompt still appears on later status changes, where it is meaningful.
• Dashboard KPI widgets now explain what they measure.
• Marketing and in-product claims about SLA, retraining and notification features now state their availability boundaries next to the claim itself, rather than relying on a note elsewhere on the page.

​

Under the hood

​

Bulk user import no longer overwrites existing people

• Importing a spreadsheet that contains someone who already has an account now leaves that account alone by default. Previously a re-import could quietly change an existing person’s role. If you genuinely intend to modify existing users from a spreadsheet, tick update existing users — the import then tells you plainly which rows it skipped and why, rather than failing the whole file.
• You cannot change your own account through an import. A safeguard against an administrator removing their own access mid-file.
• Invitations to an email that already has an account in your organization now return the same clear refusal as every other invitation conflict, instead of a raw database error.

​

Under the hood

• Several automated checks were found to be passing without actually testing anything — comparing an empty dataset against an empty dataset, or scanning for problems in a place the problem could never appear. Each has been rebuilt and then deliberately broken to confirm it now fails when it should. A check that has never been observed failing is not evidence.
• Signing in across multiple facilities is being reworked so one person can hold a single set of credentials rather than one per site. The design passed independent review; it is not yet released, and nothing about how you sign in has changed. It will appear here when it ships.

​

Multi-site foundation, and audited bulk user import

• Multi-site foundation (Phase A). Organizations can define sites as first-class entities, ahead of per-site scoping of records and permissions. Behind the multi-site flag, off by default; existing single-site behaviour is unchanged until you opt in.
• Bulk user import is now fully audited — behind the bulk-user-import flag. Every provisioned or modified account appends an audit entry, so an import is reconstructable after the fact rather than being an unattributed bulk write.
• Archive and unlink on the sites screen no longer fail silently. A rejected action (too short a reason, a constraint violation, a network error) previously produced no row change, no error and no spinner — leaving an administrator unable to tell whether an audited action had been recorded or refused. Found in review before the feature was enabled for anyone.
• Transactional outbox for system email, so a message is committed exactly once with the work that triggered it — no “sent” claim for mail that never left, and no duplicate on retry.

​

Sign-in dead-ends fixed, and honest compliance language

• An expired or already-used invitation or reset link no longer dead-ends the login page. You now get a real explanation and a route forward instead of a screen that cannot proceed.
• Invitation links are presented as account setup, not as a login — the previous wording asked people to sign in to an account they had not created yet.
• Overdue and on-time are now graded against the same due date. They could previously disagree, so a record could read as both.
• Unqualified compliance claims removed from our public site, and the full list of what we do and do not claim is now enumerated internally and checked automatically. We describe QualityCore as built to support Part 11 and Annex 11 expectations — never as certified or validated on your behalf.
• The deviation screen no longer displays a production-telemetry panel that was not backed by real data. It is gated off pending a genuine data source.

​

SLA extensions, due-date accuracy and dashboard honesty

• Extensions are refused on closed records, and an extended due date is now labelled as such rather than silently replacing the original.
• An approved extension applies inside the signed transaction, so the approval and the new date land together or not at all.
• Due dates render in UTC consistently, closing gaps where a record could fall into the wrong aging bucket depending on the reader’s timezone.
• A dashboard with no closures yet reads as “pending” rather than 0%. An empty program was previously indistinguishable from a failing one.
• Unsupported dashboard figures removed, and activity entries whose actor could not be verified are no longer attributed to a name.
• Training evidence and role gates enforced — completion requires the evidence the assignment asks for, and the roles permitted to record it are checked server-side.
• The Quality Tickets page shows its own help content, and its breadcrumb no longer reads “Quality-tasks”.

​

Training completion reporting corrected

• Training compliance now measures completion, not absence of lateness. The headline was previously (total − overdue) / total, which reported 100% whenever nothing was past due — including assignments nobody had started, and assignments with no due date, which can never be overdue. It is now completed / total. If your training figure drops after this release, this is why — the new number is the accurate one. Our reference tenant moved from 100% to 86%, matching the record table beneath it.
• The KPI is renamed “Training Completion” (from “Overall Compliance”) and states its own denominator — e.g. 25 of 29 assignments complete.
• The Training page and the exportable Training Compliance report now share one contract (qualitycore.training-compliance.v1). They could previously disagree: the export already used completion while the screen used absence-of-lateness, so the same tenant could show 86% in a PDF and 100% in the app.
• A date range now scopes only the detail rows, not the headline. A bounded range previously reported 0% against 86% on screen.
• Completion and on-time are now distinct measures. The completion figure no longer reuses the on-time field or the “On-Time Rate” label; CSV exports carry completion_rate. On-time rate keeps its closed-within-SLA meaning everywhere else.
• Exports disclose their cohort rule and metric contract version on the artifact itself.
• 100% is reserved for an exact result. A non-empty incomplete cohort caps at 99%, so 199 of 200 no longer renders as “100%”, and an empty cohort reports 0% rather than 100%.
• Training matrix cells resolve due soon through the shared contract, so the cells and the “Due Within 30 Days” KPI can no longer diverge.
• Ticket category labels render SOP/CAPA/QA/SLA acronyms correctly (sop_revision previously rendered “Sop Revision”).

​

SLA policy versioning & alert alignment

• Closure targets are now versioned. Each record is pinned to an immutable snapshot of the SLA policy in force when its clock started — including the working-day calendar — so tightening a target later cannot retroactively rewrite how earlier work is judged. Editing a target previously could hide work that had genuinely been overdue.
• Target changes are tighten-only, so a loosened target cannot silently clear an existing overdue item from the dashboard.
• Overdue and aging alerts now follow severity-tiered targets rather than a single org-wide number, and stale alerts are reconciled when a record’s date moves or it closes — a closed record no longer keeps an “overdue” alert indefinitely. Reassigning a record resets read state so the new owner sees an unread alert.
• Deviation close and reopen now lock and re-validate inside the transaction, so two people acting at the same moment cannot both write a transition.
• Row-level security is enabled by default on new tables, with the tenant-isolation backstop and type checking enforced on every push in CI.

​

Employee groups, curricula & quality tickets

• Employee Groups and Curricula on the Training page — define a group once, attach requirements to it, and matching assignments materialize for its members, so “has everyone been trained on what they should be trained on” is answerable without reconciling paper records. Behind the employee-groups-training flag.
• Quality tickets — a gated intake and triage workflow for issues that need routing before they become a formal quality record, with audited state changes throughout. Behind the quality-ticketing flag.
• Fixed: the Schedule Training trainee list came back empty under the production tenant-isolation role, leaving the dialog permanently unsubmittable.
• Fixed: training reference numbers restart their ordinal each year. A tenant with 150 records in 2025 previously began 2026 at TR-2026-151.
• Fixed: opening and saving Settings no longer resets your closure targets. The legacy SLA form initialized to a hardcoded 30/30 rather than loading current values, so an unrelated save could overwrite real targets — with an audit entry that made it look deliberate.

​

Deviation investigation & calendar refinements

• Assign the investigator when you start the investigation — every deviation now gets a responsible owner from the moment investigation begins (defaulting to you), and the assignment is persisted and audit-logged. Hand ownership over later with Reassign investigator, which captures a reason for change.
• Removed a redundant reason-for-change prompt from Start Investigation (starting an investigation is an inherent step, not a change to an existing controlled value); the audit trail still records the event.
• Quality calendar entries now show their context — each item is labelled with its type and whether the date is a Requested due date, Target due date (SLA-derived), or Due for review, so you can see why an item is scheduled without opening it.
• Create a quality task directly from a deviation (matching CAPAs and change controls) to delegate the work that happens between approval steps.

​

Complaints management

• Capture, classify, and close product complaints in one controlled workflow: intake with source channel, product/lot, and site.
• Controlled two-level taxonomy (type → subtype) that you manage, so complaint trends stay consistent and reportable.
• Link a complaint to a CAPA when corrective action is needed, and track severity and status through to closure.
• Every create and state change is written to the tamper-evident audit trail automatically. Behind the complaints flag.

​

File attachments & evidence (audit-bound)

• Attach evidence to documents and deviations (one shared primitive, extending to CAPAs and change controls): upload a file and it’s captured against the record.
• Tamper-evident by design — every file’s content hash is computed on the server, stored, and bound into the audit chain, so a substituted file is detectable; downloads re-verify the bytes and refuse altered content.
• Private, organization-scoped downloads only. Behind the attachments flag.
• (At this release the storage backend was local/dev storage. No WORM or durability claim is made.)

​

Document control completion

• Draft editing — edit a draft document’s content and change summary (draft status only), audit-logged with a required reason.
• Reject / rework — reviewers can send a document back with a signed rejection (independent approver, reason for change), returning it to draft while retaining the rejection evidence; the author can then edit and resubmit through to approval.
• Controlled-copy PDF — one-click controlled PDF of an approved document (title, document + version numbers, approver, approval and generated timestamps, and a CONTROLLED COPY marking).
• Behind the document-control-completion flag. Binary file upload / object storage was out of scope for this release.

​

Work-item tracker, in-app help, and this docs site

• Quality Work Items — a new in-app task tracker spanning deviations, CAPAs, and change controls, with list + Kanban views, owner assignment, due-date SLAs, and overdue flags. Scoped to quality work (not a general project-management tool).
• In-app Help center — browsable documentation available directly inside the app.
• Documentation site — this site (docs.elevatedsignals.ai) went live.

​

Deviation → CAPA closure spine

• Deviations — structured 5-Whys / Fishbone root-cause capture, persisted investigator assignment, signed reopen/amendment, and a close gate that requires an RCA conclusion plus a linked disposition.
• CAPAs — enforced closure ordering (all actions complete → effectiveness verified → signed close), signed reopen/correction, and overdue flags.
• Maker-checker (an independent approver, never the author) and reason-for-change are enforced at every controlled step.

​

Unified metrics, single verifier & capability register

• One versioned metric contract (qualitycore.metrics.v1) so the dashboard, CSV export, and PDF export always report identical numbers — closure cohorts, SLA on-time rate, aging, 12-month trend, recurrence, and reopen rate — with fixture parity coverage across edge cases.
• Single audit verifier — retired the standalone verifier so qualification, CI, scheduled checks, and demos all run the same verifyOrgChain the customer’s Verify Integrity button uses.
• Capability register established as the source of truth for implemented-vs-claimed; stale PRD, Settings, help, and marketing copy reconciled; fake “connected” states replaced with disabled planned-connector cards and evidence-scoped compliance statuses.

​

Tenant isolation, maker-checker & reason-for-change

• Database row-level-security backstop across regulated tenant tables — transaction-local org context, scoped data access, and a guard that rejects raw unscoped queries.
• Independent approval/sign-off enforced across documents, CAPA effectiveness + closure, and change-control approval/implementation.
• Reason-for-change (10–1000 chars) required on routine regulated-value edits, written atomically into the hash-chained audit entry and bound into signed approval payloads.
• Adversarial cross-organization proofs added.

​

Change-control depth & training loop

• Change controls expanded — impacted teams, attachments, action plan, GMP impact, requires-training, and implementation dates — plus a pre-review comment stage before committee submission.
• Automatic training assignments triggered by document approval, CAPA/deviation closure retraining, and implemented change controls.
• Document review radar — next-review dates, dashboard review radar, and Quality Calendar review entries.

​

Audit Trail screen + Verify Integrity

• New Audit Trail dashboard: organization-scoped events, human/AI/system actor badges, and pagination.
• One-click Verify Integrity recomputes the tamper-evident chain from genesis and renders an unmistakable intact/broken result.

​

Database-enforced tamper-evident audit chain

• The audit hash chain is enforced at the database layer (insert-time trigger, per-organization advisory lock, fail-closed on a missing chain head).
• audit_logs made append-only — updates, deletes, and truncation are blocked, with an anti-fork uniqueness guard.

​

AI Investigation Assistant & quality-review hardening

• Flag-gated AI Investigation Assistant for deviation intake, producing reviewable AI-generated drafts with both human and AI audit events (early access, behind a feature flag).
• Per-organization vector substrate underpinning AI features.
• Falco Phase 1 automated end-to-end regression suite (read-only).
• UI polish — loading skeletons, table and dialog cleanup.
• First cut of the product marketing site.

​

Real data + full workflow spine

• Core quality pages backed by real demo (Apex) data.
• Create flows and lifecycle transitions wired across modules.
• Electronic-signature spine.
• Reports + audit exports.
• User administration and bulk user import.
• GMP gap analysis completed.

​

Closure-time KPI dashboard

• Average closure time, configured-SLA on-time rate, aging buckets, a 12-month closure trend, and role-gated per-owner scorecards — the metrics a GMP quality program is measured on.
• North-star product strategy set; first external cross-model review cycle run against the build.

​

Design-partner Round 1 preview

• First preview deployment for design-partner (GMP consultant) review, with QA screenshots and a review package.

​

First quality workflow surfaces

• Initial Round 1 quality workflow surfaces built for design-partner feedback.

​

Initial QualityCore build

• Original prototype: core module pages, a GMP-styled document editor with inline SOP editing and a change-reason dialog, and the first live deployment. This foundation was later rebuilt into the productized system above.