The case in brief

Months after an analysis, the people who ran it often cannot say exactly what was done — which script, which threshold, which model version produced a given result. Nothing kept a faithful record of the actions taken. And the audit trails that do exist in digital pathology are self-declared timestamps sitting in the same database an internal administrator can edit FACT.

The base: qTrace tracks what was done, so it can be remembered later. As a pathologist works in QuPath, qTrace records every action they take — in real time, in the background — into a .qtrace file. That file is the history of the analysis: an ordered record of every decision, complete enough that anyone can come back later, know precisely what was done, and replay it step by step on another machine FACT.

The compliance layer: once that history is reliably recorded, qTrace attests who produced it. On top of the .qtrace record, a compliance layer cryptographically signs the session and binds it to a KYC-verified identity, then anchors it to a blockchain via OpenTimestamps — turning a faithful record of what was done into tamper-evident, externally verifiable proof of who did it and when, independent of any vendor's servers FACT.

Why it matters now: regulatory enforcement of electronic-record integrity is tightening exactly as AI-assisted diagnostic platforms add more automation — without adding provable custody of the analytical method itself. Because provenance can only be certified at the moment an analysis happens, it cannot be reconstructed afterward — which is what makes capturing it a distinct technical problem. An AI copilot built on a growing corpus of certified sessions is the long-horizon capability this data makes possible.

The Problem

Digital pathology analysis has two distinct, compounding reliability problems: the method itself is inconsistent between experts, and no one can prove after the fact which method was actually used.

1.1 What qTrace's own target users actually experience

Across qTrace's own persona research — PhD students, postdocs, PIs, core-facility bioimage analysts, and image analysts in pharma/biotech and CRO settings — the same underlying pain surfaces again and again, regardless of setting. First, remembering the parameters: months later, no one can say with confidence which script, which threshold, which model version — let alone the full set of settings fed to QuPath's internal AI steps (pixel classifier, cell detection, InstanSeg or StarDist) — actually produced a given result. Then the documentation: when it exists at all, it is kept by hand, drifts away from the real code with the very first update, and staying on top of it is a chore no one owns. Then reproducibility that breaks without warning — a QuPath update, a new scanner, the departure of the one person who "knew" — forcing the whole analysis to be redone from scratch. And finally the audit trail that has to be rebuilt by hand, after the fact: for reviewers, QA, or a regulator, but increasingly to satisfy the journals themselves (Nature, PLOS, Elsevier), which now require not just the images but the exact scripts and proof of method in a "Data and Code Availability" section INFERENCE.

A related, adjacent problem: inter-observer disagreement

Beyond what qTrace's own users report about their own reproducibility, published literature documents a distinct but related issue: disagreement between different readers scoring the same case, across the biomarkers most commonly quantified in QuPath FACT:

• HER2 IHC — κ = 0.38 (GEFPICS ring study, 2006); Fleiss κ = 0.344 across a wider panel (Wu et al., ESMO Open, 2024); a 205-case study found 0.2 ≤ κ ≤ 0.6.
• PD-L1 CPS — only "fair agreement", ICC 0.45–0.55 (Robert et al., Modern Pathology, 2023).
• NSCLC TPS — concordance 0.558 at a low cutoff vs. 0.873 at the ≥50% cutoff.
• Ki-67 — ICC 0.955 automated vs. κ 0.2–0.4 manual routine scoring.
• Gleason grading — κ 0.31–0.68; concordance 71.4% / 56.4% across cohorts.

A methods paper from QuPath's own development group makes the underlying point explicit: the analytical method, not just the reading expert's eye, is itself a hidden variable (Bankhead group, 2022) FACT.

1.2 No verifiable chain of custody

Audit trails today are self-declared timestamps inside the same database an internal administrator can modify. 21 CFR Part 11, ICH E6(R3), and GLP all require verifiable electronic records — but "verifiable" in practice means "trust us, we kept logs" FACT. This gap is now formally documented by the Digital Pathology Association, the 8th ESTP International Workshop (2022), and a 2023 Memorial Sloan Kettering study of clinical digital pathology operations FACT.

1.3 Why now — three converging forces

1.4 The QuPath substrate

QuPath is the most widely used open-source platform for digital pathology image analysis, adopted across academic, pharma/biotech, and CRO labs worldwide — which is why the reproducibility and chain-of-custody gaps above are not edge cases but the everyday reality of a large population of analysts FACT.

Ref.: Bankhead P. et al., Scientific Reports (2017) — QuPath: Open source software for digital pathology image analysis.

Limits of Existing Approaches

The industry is not short of tools that log activity. It is short of tools whose logs cannot be quietly edited. Three generations of tooling illustrate where existing approaches stop short of a verifiable record INFERENCE:

The step from Gen 2 to Gen 3 is not incremental: certified identity and external cryptographic anchoring have to be captured while the analysis is happening. They cannot be added to a historical, anonymous audit log after the fact — which is why the point of capture, not later storage, is where the problem has to be solved INFERENCE.

The Solution and Central Thesis

qTrace is a compliance layer purpose-built for QuPath. It captures pixel classifier training, manual annotations, ROI definitions, and spatial transforms as they happen, and writes that record into a cryptographically signed .qtrace certificate anchored to a blockchain via OpenTimestamps.

Key properties

• Zero-friction adoption — installs as a QuPath extension; no workflow change.
• Cryptographic proof — blockchain timestamp; no trusted third party required.
• Replay fidelity — the meta-script re-runs the entire analysis autonomously.
• Certified identity — KYC-verified validator (Stripe Identity); RS256 JWT anchors identity to the stamp.

Why this is also an AI foundation, not just a compliance tool

An image-only AI model — even a very good one — only ever learns from what a slide showed and what the final call was. It never sees how a verified expert got there: which regions were flagged, which classifier was retrained, which threshold was adjusted, and why. That "how" is exactly what qTrace's corpus of certified sessions captures, and no other dataset in digital pathology does — because no other tool binds a verified identity to each analytical step at the moment it happens INFERENCE.

Three AI capabilities the certified record makes possible

The same corpus supports three capabilities of increasing ambition, each requiring a different amount of certified data before it works well INFERENCE:

1. Drift detection — near-term: flag when an analysis deviates from a lab's own validated method, before it impacts the result. Works from day one on a single lab's own certified history.
2. Best-practice retrieval — mid-term: surface the most relevant certified method for a given tissue/stain. Needs certified sessions contributed across multiple labs on the same protocol to be useful.
3. Analysis copilot — longer-term: suggest next steps based on what certified peers actually do. The most ambitious of the three, and the one requiring the broadest corpus per protocol before it works well SPECULATION.

How It Works

Capture → certify → anchor → verify/replay

The Groovy replay script is a derived artifact, generated from the .qtrace record on demand at replay time — not produced live during capture:

• Capture — a WorkflowListener and classifier watcher (ActionLogger) run inside QuPath, accumulating every decision as structured JSON as it happens. No script exists at this stage.
• Certify — on stamp/export, QTraceExporter writes that JSON into the .qtrace sidecar and commits it to an embedded Git repository (JGit), giving the session a commit in the image's version graph. Under Compliance, it's additionally signed into a .qtcert: KYC-verified identity bound via Ed25519 + RS256 JWT, ULID + SHA-256 Merkle root over the steps.
• Anchor — the certificate's timestamp is anchored to a blockchain via OpenTimestamps.
• Verify / Replay — qtrace-verify independently checks any certificate. Separately, QTraceReplayEngine reads the .qtrace JSON and generates a self-contained Groovy replay script from it on demand, then re-runs the analysis in QuPath.

AI copilot — mechanism sketch

This future copilot would analyze patterns from already-certified sessions to suggest a pathologist's next step — without ever letting lab data leave the premises, by sending the model to the data instead of the reverse.

Evidence and Validation

Independent literature validation

Regulatory context

21 CFR Part 11, ICH E6(R3), and GLP already require verifiable electronic records; the FDA's first De Novo authorization for an AI digital pathology tool (ArteraAI, Aug 2025) signals intensifying enforcement FACT.

Vision and Implications

What changes for a pathologist's day-to-day work as more certified data becomes available INFERENCE:

Conclusion

Why this, why now