The case in brief

Months after an analysis, the people who ran it often cannot say exactly what was done — which script, which threshold, which model version produced a given result. Nothing kept a faithful record of the actions taken. And the audit trails that do exist in digital pathology are self-declared timestamps sitting in the same database an internal administrator can edit FACT.

The base: qTrace tracks what was done, so it can be remembered later. As a pathologist works in QuPath, qTrace records each workflow step they take — in real time, in the background — into a .qtrace file. That file is the history of the analysis: an ordered record of each step and its parameters, detailed enough that anyone can come back later, know what was done, and replay it step by step on another machine (steps from interactive-only tools and some extensions need manual preparation) FACT.

The compliance layer: once that history is reliably recorded, qTrace attests who produced it. On top of the .qtrace record, a compliance layer lets the validator sign the session off: the stamp is cryptographically signed and bound to a KYC-verified identity, and once the case is pushed to the Cloud Workspace, the certificate is anchored on Bitcoin via OpenTimestamps — turning a faithful record of what was done into tamper-evident proof of who signed it off and when, which anyone can verify without relying on qTrace's servers FACT.

Why it matters now: regulatory enforcement of electronic-record integrity is tightening exactly as AI-assisted diagnostic platforms add more automation — without adding provable custody of the analytical method itself. Because provenance has to be recorded at the moment an analysis happens, it cannot be reconstructed afterward — which is what makes capturing it a distinct technical problem. An AI copilot built on a growing corpus of certified sessions is the long-horizon capability this data makes possible.

The Problem

Digital pathology analysis has two distinct, compounding reliability problems: the method itself is inconsistent between experts, and no one can prove after the fact which method was actually used.

1.1 What qTrace's own target users actually experience

Across qTrace's own persona research — PhD students, postdocs, PIs, core-facility bioimage analysts, and image analysts in pharma/biotech and CRO settings — the same underlying pain surfaces again and again, regardless of setting. First, remembering the parameters: months later, no one can say with confidence which script, which threshold, which model version — let alone the full set of settings fed to QuPath's internal AI steps (pixel classifier, cell detection, InstanSeg or StarDist) — actually produced a given result. Then the documentation: when it exists at all, it is kept by hand, drifts away from the real code with the very first update, and staying on top of it is a chore no one owns. Then reproducibility that breaks without warning — a QuPath update, a new scanner, the departure of the one person who "knew" — forcing the whole analysis to be redone from scratch. And finally the audit trail that has to be rebuilt by hand, after the fact: for reviewers, QA, or a regulator, but increasingly to satisfy the journals themselves (Nature, PLOS, Elsevier), which now require not just the images but the exact scripts and proof of method in a "Data and Code Availability" section INFERENCE.

A related, adjacent problem: inter-observer disagreement

Beyond what qTrace's own users report about their own reproducibility, published literature documents a distinct but related issue: disagreement between different readers scoring the same case, across the biomarkers most commonly quantified in QuPath FACT:

• HER2 IHC — κ = 0.38 (GEFPICS ring study, 2006); Fleiss κ = 0.344 across a wider panel (Wu et al., ESMO Open, 2024); a 205-case study found 0.2 ≤ κ ≤ 0.6.
• PD-L1 CPS — only "fair agreement", ICC 0.45–0.55 (Robert et al., Modern Pathology, 2023).
• NSCLC TPS — concordance 0.558 at a low cutoff vs. 0.873 at the ≥50% cutoff.
• Ki-67 — ICC 0.955 automated vs. κ 0.2–0.4 manual routine scoring.
• Gleason grading — κ 0.31–0.68; concordance 71.4% / 56.4% across cohorts.

A methods paper from QuPath's own development group makes the underlying point explicit: the analytical method, not just the reading expert's eye, is itself a hidden variable (Bankhead group, 2022) FACT.

1.2 No verifiable chain of custody

Audit trails today are self-declared timestamps inside the same database an internal administrator can modify. 21 CFR Part 11, ICH E6(R3), and GLP all require verifiable electronic records — but "verifiable" in practice means "trust us, we kept logs" FACT. This gap is now formally documented by the Digital Pathology Association, the 8th ESTP International Workshop (2022), and a 2023 Memorial Sloan Kettering study of clinical digital pathology operations FACT.

1.3 Why now — three converging forces

1.4 The QuPath substrate

QuPath is the most widely used open-source platform for digital pathology image analysis, adopted across academic, pharma/biotech, and CRO labs worldwide — which is why the reproducibility and chain-of-custody gaps above are not edge cases but the everyday reality of a large population of analysts FACT.

Ref.: Bankhead P. et al., Scientific Reports (2017) — QuPath: Open source software for digital pathology image analysis.

Limits of Existing Approaches

The industry is not short of tools that log activity. It is short of tools whose logs cannot be quietly edited. Three generations of tooling illustrate where existing approaches stop short of a verifiable record INFERENCE:

The step from Gen 2 to Gen 3 is not incremental: the method has to be recorded while the analysis is happening, then bound to a certified identity when the expert signs it off. Neither can be added to a historical, anonymous audit log after the fact — which is why the point of capture, not later storage, is where the problem has to be solved INFERENCE.

The Solution and Central Thesis

qTrace is a compliance layer purpose-built for QuPath. It captures pixel classifier training, manual annotations, ROI definitions, and spatial transforms as they happen, and writes that record into a .qtrace file. With a Compliance licence, the validator's sign-off produces a cryptographically signed .qtcert certificate, anchored on Bitcoin via OpenTimestamps once the case is pushed to the Cloud Workspace.

Key properties

• Zero-friction adoption — installs as a QuPath extension; no workflow change.
• Cryptographic proof — Ed25519-signed certificate plus Bitcoin timestamp after Cloud Push; verification requires no trusted third party.
• Replay — the generated script re-runs the recorded analysis; steps from interactive-only tools (e.g. SAM) and some extensions need manual preparation.
• Certified identity — KYC-verified validator (Stripe Identity); the validator's Ed25519 key, anchored on Polygon, signs each stamp.

Why this is also an AI foundation, not just a compliance tool

An image-only AI model — even a very good one — only ever learns from what a slide showed and what the final call was. It never sees how a verified expert got there: which regions were flagged, which classifier was retrained, which threshold was adjusted, and why. That "how" is exactly what qTrace's corpus of certified sessions captures, and no other dataset in digital pathology does — because no other tool records each analytical step as it happens and binds the whole record to a verified identity at sign-off INFERENCE.

Three AI capabilities the certified record makes possible

The same corpus supports three capabilities of increasing ambition, each requiring a different amount of certified data before it works well INFERENCE:

1. Drift detection — near-term: flag when an analysis deviates from a lab's own validated method, before it impacts the result. Works from day one on a single lab's own certified history.
2. Best-practice retrieval — mid-term: surface the most relevant certified method for a given tissue/stain. Needs certified sessions contributed across multiple labs on the same protocol to be useful.
3. Analysis copilot — longer-term: suggest next steps based on what certified peers actually do. The most ambitious of the three, and the one requiring the broadest corpus per protocol before it works well SPECULATION.

How It Works

Capture → certify → anchor → verify/replay

The Groovy replay script is a derived artifact, generated from the .qtrace record on demand at replay time — not produced live during capture:

• Capture — a WorkflowListener and classifier watcher (ActionLogger) run inside QuPath, accumulating every decision as structured JSON as it happens. No script exists at this stage.
• Certify — QTraceExporter writes that JSON into the .qtrace sidecar, where each session becomes a node in the image's version graph (classifier files are also versioned in an embedded Git repository, JGit). Under Compliance, the validator's stamp produces a .qtcert: Ed25519 signature by the KYC-verified validator's key, ULID + SHA-256 Merkle root over the steps, hash-chained into the case's custody log.
• Anchor — when the case is pushed to the Cloud Workspace, the certificate hash is anchored on Bitcoin via OpenTimestamps. Until then, timestamps come from the workstation clock.
• Verify / Replay — qtrace-verify independently checks any certificate. Separately, QTraceReplayEngine reads the .qtrace JSON and generates a self-contained Groovy replay script from it on demand, then re-runs the analysis in QuPath.

AI copilot — mechanism sketch

This future copilot would analyze patterns from already-certified sessions to suggest a pathologist's next step — without ever letting lab data leave the premises, by sending the model to the data instead of the reverse.

Evidence and Validation

Independent literature validation

Regulatory context

21 CFR Part 11, ICH E6(R3), and GLP already require verifiable electronic records; the FDA's first De Novo authorization for an AI digital pathology tool (ArteraAI, Aug 2025) signals intensifying enforcement FACT.

Vision and Implications

What changes for a pathologist's day-to-day work as more certified data becomes available INFERENCE:

Conclusion

Why this, why now