WorkflowListener · Git · JSON sidecar
"annotations": 47,
✓ "validation": "T. McKee · HIGH"
Sound familiar?
The reproducibility crisis
hits every lab doing spatial biology
Lost context. Missing classifiers. Impossible-to-recreate analyses. qTrace captures everything QuPath does — so you never lose the thread.
"Who trained this classifier — and when?"
Every classifier carries a SHA-256 hash and Git commit. Immutable, forever.
"I spent four hours recreating last month's analysis."
One-click Replay reconstructs the full pipeline from any .qtrace file.
"The reviewer wants the complete protocol."
Compliance certificate. PDF. One click. Every operation, every analyst, every version.
qTrace is the audit trail QuPath was missing.
Designed for compliance
21 CFR Part 11 — What qTrace covers
- ✓§11.10(e) — Secure, computer-generated, time-stamped audit trails (append-only git)
- ✓§11.10(b) — Accurate & complete copies: human-readable JSON + batch export
- ✓§11.10(c) — Record protection & ready retrieval (git + off-site backup)
- ✓§11.10(g) — Authority checks: JWT + PIN required before every signing
- ✓§11.50(a) — Signature shows name, date-time, and meaning (review/approval)
- ✓§11.70 — Stamp embedded in record; git hash prevents excision or transfer
- ✓§11.100(a–b) — Unique KYC-verified signature; identity verified before issuance
- ✓§11.200(a)(1)(ii) — Both components (license + PIN) required at every signing
Scoped to the QuPath analysis record lifecycle (closed system). System IQ/OQ/PQ, OS access controls, written policies, and §11.100(c) FDA certification remain with the laboratory.
GLP / ALCOA+ — What qTrace covers
- ✓Attributable — operator identity locked per session, validator KYC-verified and cryptographically bound
- ✓Legible — plain-text JSON, readable without qTrace; integrity via git hash
- ✓Contemporaneous — ActionLogger records each QuPath act in real time via WorkflowListener
- ✓Original — git append-only; first recording always recoverable; copies flagged as such
- ✓Accurate — direct QuPath API capture, no manual transcription; corrections appended separately
- ✓Complete (+) — full session, all parameters, all corrections, full git history
- ✓Consistent (+) — versioned JSON schema, ISO 8601 timestamps, chronological order guaranteed
- ✓Enduring (+) — open format, co-located with WSI, off-site Supabase backup
- ✓Available (+) — Dashboard search, batch ZIP export, plain-text readable by auditors
Scoped to digital pathology analysis records in QuPath. Wet lab instruments, SOPs, training records, raw scanner data, and Computer System Validation (GAMP 5) remain with the laboratory.
ISO 15189:2022 — What qTrace covers
- ✓§7.3.1d — Operator identity locked per session
- ✓§7.3.6 — Auto-generated examination procedure (MetaScript)
- ✓§7.3.2 — Method reproducibility via one-click Replay
- ✓§7.4.1.8 — Amendment tracing via cryptographic git versioning
- ✓§7.5 — Manual correction records (Dashboard Card 7)
- ✓§7.6.3 — Tamper-evident data integrity (SHA-1 + JWT RS256)
- ✓§8.4.1 — Real-time record creation at the moment of each act
- ✓§8.4.2–3 — Immutable audit trail with off-site backup
- ✓§8.8 — Quality indicators dashboard for management review
Scoped to the digital pathology examination process in QuPath. Pre-analytical phases, equipment calibration, and IQC programs remain with the laboratory's LIS/QMS.
IVDR 2017/746 — What qTrace covers
- ✓Art. 5(5)(b–c) — Health institution exemption requires ISO 15189 + QMS: qTrace is the enabling audit trail
- ✓Art. 10(4) — Technical documentation: software version, classifier hash, parameters, git history
- ✓Art. 10(7) — Record retention ≥ 10 years: open JSON + git + Supabase, no expiry
- ✓Art. 10(8) — QMS data layer: performance evaluation, PMS, and corrective action records
- ✓Art. 68(3) — Performance study data: real-time, accurate, verifiable, operator-locked
- ✓Art. 73(5) — Performance study report: batch export + MetaScript document analysis methods
- ✓Art. 78 — Post-market surveillance: accumulated .qtrace sessions feed PMS reports
Scoped to the QuPath analysis workflow. CE marking, Eudamed registration, clinical evidence generation, notified body assessment, and informed consent management remain with the manufacturer or sponsor.
ICH E6(R3) GCP — What qTrace covers
- ✓Principles 9.2–9.5 — Fit-for-purpose systems, computerised system integrity, record traceability, and secure retention
- ✓§3.16.1(e) — Data integrity for the full data life cycle: ActionLogger → git → Supabase
- ✓§3.16.1(i–j) — Changes documented; corrections attributed, justified, supported by source records (Card 7)
- ✓§3.16.1(l) — No exclusive control: git distributed + Bitcoin Proof of Prior Existence
- ✓§3.16.3–4 — Retention without expiry + direct access for monitoring, audits, regulatory inspection
- ✓§4.2.2 — Audit trail: user logs, changes documented, workflow actions recorded; not disableable; UTC timestamps
- ✓§4.2.4 — Data corrections attributed to correcting operator, appended (original preserved)
- ✓§4.2.7 — Data and metadata archived, retrievable, protected from alteration throughout retention
Scoped to the QuPath image analysis workflow in clinical trial settings. Clinical participant source records, informed consent, safety reporting (SUSARs), statistical analysis, and full system validation (IQ/OQ/PQ) remain with the investigator/sponsor.
Each validation stamp is KYC-signed, then embedded in the world's largest proof-of-work consensus chain — cryptographic Proof of Prior Existence, backdating-proof, verifiable by anyone, forever, with no dependency on qTrace.
The problem
Three gaps spatial biology
cannot afford
A single QuPath analysis may involve 50+ sequential operations across multiple analysts and machines. Yet no native mechanism exists to certify what was done, in what order, by whom — or whether results remain reproducible.
No tamper evidence
A single modified annotation or retrained classifier goes undetected. Regulators and reviewers have no mechanism to verify the analysis was not altered after sign-off.
.qpdata is not bound to results
The QuPath project file is mutable and unpinned. Nothing links the raw image to the classifier version, annotation set, and quantification parameters that produced the reported numbers.
No trusted timestamp
There is no cryptographic proof of when an analysis was performed. Reproducibility claims cannot be independently verified — a fatal gap for clinical translation and inter-lab trust.
Use case
Glioma Multi-Omics · Workflow
Provenance Map
Each arrow shows the QuPath action captured by qTrace. ⏺ REC = step recorded in .qtrace passport. H&E is the spatial coordinate reference.
(stRNA-Seq)
(IMC)
(MSI)
FFPE · TMA core
174K cells
Clustering
cell states
Cell Typing
MES/AC/NPC/OPC
Segmentation
CD163 · Ki-67
proliferation index
Pixels
20µm · metabolites
Overlay
spatial metabolomics
Multi-Omics View
RCTD · Ki-67 · Metabolites
H&E coordinate space
Features
Everything your workflow needs
to be certifiable
Automatic Provenance
Hooks directly into the QuPath API — no manual logging. Every WorkflowStep, pixel classifier change, and annotation edit is captured in real time via the histogram listener.
Expert Validation Stamp
A named validator signs off on scope, confidence, and classifier fidelity. The stamp is embedded in the .qtrace — not stored separately — and cannot be separated from the analysis record.
Cohort Dashboard
Real-time QA status across all images in a project. Filterable by contributor, annotation class, tissue region, or validation state. Identify outliers before submission.
Batch Export
Generate .qtrace passports for every image in a project with a single operation. Stamp, export, and append to the master CSV log without opening each image manually.
Chain of Custody
Ed25519 signature binds the .qtrace to the raw .qpdata at validation time. OpenTimestamps then anchors the certificate hash to the proof-of-work consensus chain — Proof of Prior Existence that predates any dispute, verifiable without trusting qTrace.
Replay Engine
From a .qtrace passport, reconstruct and execute the exact analysis on a new image — classifier models embedded, annotation coordinates preserved. Analytical fidelity confirmed.
Ecosystem
Works with your full QuPath stack
qTrace is tested against 18 popular QuPath extensions. From deep-learning segmentation to multi-modal registration — every step is captured, regardless of which extension ran it.
How it works
From raw image to
certified analysis
Capture
Automatic — zero effort
Install the JAR in QuPath extensions. qTrace hooks into the QuPath API silently — every WorkflowStep, classifier change, annotation edit, and script run is recorded without any user action.
- ▸Pixel classifier versions (SHA-256 + Git hash)
- ▸Manual annotations with author attribution
- ▸Image-alignment transforms (AffineServer / Warpy)
- ▸Script runs + terminal output
Validate
One-click expert sign-off
When the analysis is complete, the expert clicks "Validate & Stamp". A dialog captures validator identity, analytical scope, confidence level, and classifier fidelity — all embedded in the .qtrace.
- ▸Named validator + institutional context
- ▸Analytical scope declaration
- ▸HIGH / MEDIUM / LOW confidence
- ▸Classifier fidelity check (modified since training?)
Certify
Compliance — cryptographic proof
The Compliance plugin generates a .qtcert binding the .qtrace to the raw .qpdata via Ed25519 signature. OpenTimestamps anchors the hash to the proof-of-work consensus chain — immutable Proof of Prior Existence, independent of any company or jurisdiction.
- ▸Ed25519 signature (BouncyCastle)
- ▸SHA-256 of .qpdata at validation moment
- ▸chain.jsonl — append-only custody log
- ▸qtrace-verify check → GREEN / RED in 1 command
The tamper-evidence moment
Open the validated .qpdata in a text editor. Modify a single byte. Save. Run qtrace-verify check --case-dir ./case/ --qpdata ./Core_01.qpdata. Result: RED "qpdata hash mismatch". That moment is the entire value proposition — irrefutable, in one command.
Anatomy
Inside a .qtrace passport
A single self-contained JSON file — one per image, accumulating sessions. No database. No external service. Drop it next to your .qpdata and it travels with the data.
Source metadata + SHA-256 integrity hash
"sha256": "a3f8d2c1e4b7…" // integrity lock at export time
"width": 4096, "height": 4096, "channels": 25
User · machine · versions Git snapshot · extensions captured
"qtrace_version": "1.0.2", "qupath_version": "0.7.0"
"git": { "commit": "c3d91f2" }, "steps_captured": 28
"extensions": [ { "name": "InstanSeg", "version": "0.1.6" },{ "name": "StarDist", "version": "0.5.0" } }]
License-locked identity · PIN-protected Fidelity · scope · confidence
"license_verified": true, "pin_required": true
"confidence": "HIGH", "classifier_fidelity": "HIGH"
"scope": "Full pipeline — annotation + classification + alignment"
Affine transform matrix Moving → reference image
"transform_type": "Affine", "matrix": [0.98, -0.02, 45.3, 0.02, 0.97, -12.1]
"scale_x": 0.981, "scale_y": 0.972
All QuPath WorkflowSteps in execution order + Groovy
"extension": "qupath-extension-instanseg", "model_name": "fluorescence_nuclei_and_cells"
"script_fragment": "InstanSeg.builder().modelPath(…).build().detectObjects()"
SHA-256 + Git hash Channels · training info · fidelity
"sha256": "7e4ab3c2…", "git_hash": "9a1f4d8" // version-locked
"channels": ["DAPI", "CD163", "Ki-67"], "fidelity": "HIGH"
ROI geometry · author attribution by_class · by_author counts
"by_class": { "Tumour Core": 18, "Edge": 29 }
"roi_type": "Polygon", "area_um2": 14820.4
Get started with
qTrace
Download the open-source Core and start capturing QuPath provenance today — every alignment, segmentation, pixel classification, and cell-typing step recorded into a self-contained .qtrace passport. Request access to qTrace Compliance for verified-identity certification and cryptographic chain of custody.
Request access
Join the qTrace network and get early access to qTrace Compliance.
You can contact us by email at tourteromain@gmail.com. Please include your Name, Institution, Country, Role, ORCID (optional), and a brief description of your use case.
Contact us by emailNo spam. We'll reply with Compliance access details.