The delivery is weighed and written down. The farmer and the collection point each keep a copy.
That evening
A summary of the day’s records is sent to two people outside the collection point.
In Europe, later
Anyone can check that the records still match that summary.
Figure 1. The method being tested.
It can show that a record wasn’t changed. It can’t show the weight was right, or where the farm is. Those need other evidence.
Our mission
To make the first moment of every supply chain provable: held by the people who grow, trusted by the people who buy.
In service of communities. Producers own the records, and help shape the rules.
Open by default. Methods are published. Records never are.
Honest about limits. Every finding says what it can’t show.
The problem beneath the problems
Buyers are asked to prove many things. Trace each one back, and it arrives at the same place.
Due diligence under EU deforestation rules
Backing up the claim on the label
Answering an auditor or a customer
Paying premiums to the right farms
Spotting volume that couldn’t have grown there
Trusting documents AI can now fake
What happened at the scale?
The moment every claim depends on, and the one the paperwork never sees.
Certificates, maps and invoices describe farms and paperwork. None of them was at the scale.
Meanwhile, EU rules on deforestation-free products make importers of coffee and cacao answer for where each lot was grown, and claims on packaging face tougher rules in both the EU and the UK.
One question, four lines of inquiry
To answer the question, the research tests four smaller ones. Here is where each stands.
1
Can the farmer hold the proof?
Done: Designed
Done: Tested in simulation
Not yet: Tested in the field, 2027
Not yet: Findings published
So farChecking farmers at random misses a single altered slip most of the time. In simulation, checking 8 of 39 farmers missed it about four times in five. So each farmer’s own copy is what protects each delivery.
2
Can a record survive the people who keep it?
Done: Designed
Done: Tested in simulation
Not yet: Tested in the field, 2027
Not yet: Findings published
So farIn simulation, the day’s summary caught every rewrite we tried. We also found a hiding place: swapping in another farmer when slips go missing. So a chosen farmer is never swapped.
3
Does it work where there’s no signal?
Done: Designed
Not yet: Tested in simulation
Not yet: Tested in the field, 2027
Not yet: Findings published
So farDesigned for one text message a day from a basic phone. Planned next: simulating lost and late messages, then the field.
A short verdict for each lot: specific, signed and honest about its gaps. A buyer can keep it with their own records, and a producer can see exactly what was claimed.
Lot QL-0001
Coffee, parchment, 1,350.0 kg from three deliveries
Sample
ProvenBoth copies of every delivery receipt match.
ProvenThe collection book still gives every day’s summary that the co-op office and the board member received.
ProvenThe deliveries add up to the lot: 1,350.0 kg.
Not ProvenWhere the farms are. No field visit is on record yet.
Not ProvenThat the land is legally held. No land papers have been reviewed.
Not covered by this sample: the scale’s daily test weight, whether each farm could grow what it delivered, deforestation, payments and quality.
A summary shows a record hasn’t changed since the day it was made. It can’t show the record was true when it was made, which is why the copies and the kilos are checked too.
It works alongside what buyers already have: farm maps show where farms are, certificates show how they’re run, and delivery records show which farms’ deliveries made a lot.
In service of communities
This research is done with producer communities, not on them. Six principles guide it.
Producers own the records.
Every farmer keeps a copy of every receipt. Records stay with the producers and their co-op.
Consent is a process, not a signature.
Nothing is shared without written consent, and consent can be withdrawn at any time.
Findings go to communities first.
Everyone who takes part reads the findings first, and producers read them in Spanish.
Producers never pay to be recorded.
And no one’s records are ever sold.
Every word is tested with the people it describes.
Before a term reaches producers, we check how it sounds to them.
A person signs.
Software helps check the evidence. A named person is accountable for every verdict.
These principles draw on the CARE principles for Indigenous data governance, as set out in David Bentley’s Framework Protocol (2025).
Qori Labs is research, not a finished product. Here is the plan, and where we are in it.
Now
October to December 2026
Talking to buyers about how they prove origin today, visiting co-ops near Cusco, and testing the method in simulation.
A first pilot
Early 2027
Agreeing one free pilot with one co-op and one buyer that already works with it.
Findings
March 2027
A short research summary. Everyone who takes part reads it first.
First field season
2027 harvest
The first deliveries recorded at the source, both copies kept, sealed every evening.
Who’s behind it
Qori Labs is run by David Bentley, a British systems engineer who lives in Peru’s Sacred Valley, near Cusco. He builds offline tools for places without signal, has field-tested them in a highland community at about 4,300 metres, and has published eight papers and draft standards on offline evidence and community data governance. When you write, you reach David.
Tell us how you prove where your coffee or cacao came from today. If you work with producer communities, we’d like to hear from you too. A reply by email or a 20-minute call is enough.
Everyone who takes part reads the findings first. The first phase is free, and ‘no thanks’ is a perfectly good answer. First field season: the 2027 harvest.
The method being tested
Can someone in Europe verify a delivery made in Peru? This is the method we’re testing to find out: in simulation now, and in the field from the 2027 harvest. It’s described as it stands, including what it can’t do.
Why paperwork can’t answer it
The certificate says the farm meets the standard.It doesn’t say a lot came from it.
The map shows where the farms are.It doesn’t show whose coffee is in the sack.
The invoice says 18,000 kg.Nobody asked whether those farms could grow that much.
The documents arrived signed and stamped.They may have been written by a machine in a few seconds.
What each delivery records
Six facts, written down at the scale, in front of the farmer.
Fact
Why it’s there
Receipt number
Printed before the harvest, so no receipt can be added later.
Farm
By its member code, not the farmer’s name.
Collection point
Where the delivery was weighed.
Date
The day it was weighed.
Product
For example, parchment coffee.
Weight
Read from the scale, with a photo of its display.
On the day: two copies, kept apart
The farmer keeps one copy of the receipt. The other stays in the collection book, which belongs to the co-op. If either copy is changed later, it no longer matches the other.
Receipt numbers are fixed before the harvest starts. When a book is finished, every number in it is accounted for: used, voided the same day with a reason, or returned blank.
That evening: a summary of the day
At the end of each collection day, one text message goes to the co-op office and to a member of the co-op’s board: two people outside the collection point. It carries the day’s count of receipts, the kilos, and a short code calculated from every record in the collection book since the season began.
The same records always give the same code. Changing anything, even one digit, gives a different one, and nobody can choose the code they want. It’s calculated with SHA-256, a public method anyone can run. The message holds no names and no payments, and works on a basic phone with no internet.
Later: the check
A reviewer, or anyone else, can recalculate each day’s summary from the collection book. If it still matches the message sent that evening, the book hasn’t been changed since. The full check for a lot has six parts, published before it’s used:
Every receipt number is on the list fixed before the harvest, and is used, voided or returned exactly once.
The collection book still gives every day’s summary that was sent.
For farmers chosen at random, their copies match the collection book.
The deliveries add up to the lot, allowing for drying and sorting.
No farm delivered more than its land could plausibly grow.
The scale read a test weight correctly at the start and end of each day.
If any part fails, the answer is Not Proven, with the reason and the evidence that would change it.
Check it yourself
One delivery, three records, two checks. Change a record and see which check fails.
Figure 2. The day’s summary is calculated in your browser, the same way the method calculates it.
Farmers are chosen at random, and a chosen farmer is never swapped for another.
If a chosen farmer’s receipts are missing, other evidence of the same deliveries is sought: a photo taken at delivery, or the farmer’s confirmation in person, recorded by the reviewer. An explanation is not evidence.
When gaps cluster on one day, at one collection point or with one collector, the check widens to every delivery in that group. A wider check is not an accusation.
These rules are drawn from ISA 530, the international auditing standard on audit sampling.
Mistakes are designed out, and fixed in the open
Receipt numbers and member cards are scanned, not typed. The phone shows the weight in large numbers, so the farmer can check it.
A wrong receipt is voided the same day, with its reason. A void recorded later counts as a problem.
A correction is added as a new record. The original stays in view, and nothing is erased.
Tested before the field
Before it meets a farmer, the method runs in simulation: a fictional season, separate record holders, and scenarios built to fool each check, including a rewritten receipt, an invented one, a missing day and a hidden change. Every check must catch what it should, and stay quiet when nothing is wrong. The scenarios it can’t catch are kept too, and written down as limits.
A person signs
Software helps gather and check the evidence. A named person reviews it, signs the verdict and is accountable for it.
What the method can’t do
The day’s summary shows a record hasn’t changed since that day. It can’t show the record was right when it was made. That’s why the copies, the kilos and the scale are checked too.
If a farmer and a collector agree to write false kilos on both copies, the receipts can’t show it. Scale checks, yields and kilos in and out narrow that gap.
The summary only protects if it’s held by people the collection point doesn’t control.
Without a public timestamp, a summary can’t show to outsiders exactly when it was made.
This first rule doesn’t cover deforestation, land rights, payments or quality.
Works with what buyers already have
Farm maps show where farms are, and certificates show how they’re run. Delivery records show which farms’ deliveries made a lot, and that nobody changed them afterwards. Qori Labs researches that third piece. It doesn’t replace the other two.
How data is handled
Records belong to the producers and stay with them and their co-op. Qori Labs keeps only summaries, counts and verdicts, never members’ personal details or what they were paid. Nothing is shared without written consent, and consent can be withdrawn.
What this research is not
Not a certification or a label.
Not a data platform: we don’t own or sell anyone’s records.
Not part of UNSAAC or LAAD.
Not finished. The method changes as the field teaches us.
Built on published work
The method builds on two of David Bentley’s papers. The Sovereign Khipu Protocol (PKS) is an open standard for records that can be checked offline, in which missing evidence means Not Proven. The Tinkuy Node Pair (PNT) describes two separate custodians jointly recording a shared event.
doi:10.5281/zenodo.18645310 and doi:10.5281/zenodo.19228636
Sample data. The co-op, farms, buyer and numbers on this page are fictional.
This is a sample evidence pack, built the way the Sovereign Khipu Protocol (PKS) describes. Each claim reads Proven or Not Proven, and you can check the seal yourself.
The lot
Lot
QL-0001
Product
Coffee, parchment
Origin
A sample district in the Cusco region. No farm locations are shown.
Harvest
2026-07
Weight
1,350.0 kg
The claims
Claim
Status
Why
Checking the seal…
Check it yourself
Below is the exact record this pack was sealed from. Your browser calculates its fingerprint and compares it with the seal. Change any character, even a space, and check again.
Seal
This record now
calculating…
Checking the seal…
The evidence behind the claims
Where it came from
Three deliveries, each recorded at entry and sealed. Farms are shown by code, not by name.
Delivery
Farm
Date
Kilos
Photo check
D-101
F-014
2026-07-08
412.5
Clear
D-102
F-027
2026-07-10
380.0
Blurred, retaken
D-103
F-031
2026-07-14
557.5
Clear
Checks at entry
Checks flag problems rather than block a record. Each fix is a new entry, and the original stays.
Missing fields: none.
Impossible dates: none.
Duplicates: one. D-102 was entered twice; the second entry was voided by correction E-009.
Blurred photos: one. The photo for D-102 was retaken.
Kilos in, kilos out
Calculating…
What this page does not prove
Besides every claim marked Not Proven above, two limits apply to any sealed record:
It can’t show that nobody entered a false record before it was sealed. Entry checks, a second copy and field visits reduce that risk; they don’t remove it.
It can’t show when each record was made. Phones in the field don’t always keep reliable time, so the seal proves order and integrity, not the hour.
Who owns this record
The (fictional) co-op owns it. It has agreed in writing that one (fictional) importer may see it, under consent record C-2026-007, and it can withdraw that consent.
For one of your real lots
The free first phase builds this same page for one real lot, from a co-op you already buy from, with the co-op’s written consent.
Help answer one question: can someone in Europe verify a delivery made in Peru? We’re talking to importers, roasters and chocolate makers who buy from producers in the Andes. There are two ways to take part.
A conversation
A reply by email or a 20-minute call, whichever suits you. We ask how you prove origin today and what it costs you. You get the research summary before anyone else.
The free first phase
We build a checkable evidence pack for one real lot, from a co-op you already buy from, with the co-op’s written consent. It costs you nothing.
After the first phase
If it proves useful, we’ll offer a paid second phase, agreed in writing before it starts. If not, ‘no thanks’ is a perfectly good answer. Taking part never obliges you to buy anything.
The question we start with
When an auditor or a customer asks you to prove where a lot came from, what do you show them, and what does it cost you?
And the one that matters most to this research:
If a co-op gave you a short evidence pack like this for one lot, would you rely on it when someone asks you to prove where that lot came from?
Get in touch
No call needed to start. This form doesn’t send anything by itself. It writes an email for you to send, so nothing is stored on this site. We don’t add anyone to a mailing list.
Qori Labs builds on eight papers by David Bentley, published on Zenodo between December 2025 and August 2026.
They are written in Spanish; the English titles and summaries here are our own translations. They are reports, draft standards and a field report, published by Higher Self Forge Ltd, and they have not been peer-reviewed.
Written by David Bentley, with AI tools used for research, drafting and translation. All sources are public and cited, and the author is responsible for the content.
The method
Framework Protocol for Decentralised Infrastructure: a field method for sovereign governance in Indigenous territories
Protocolo Marco para Infraestructura Descentralizada: Metodología de Campo para Gobernanza Soberana en Territorios Indígenas
The root of the series: a co-design method for bringing technology to places where connectivity is weak. It treats free, prior and informed consent as an ongoing process rather than a one-off signature, follows the CARE principles for Indigenous data governance, and sets a rule of “no false safety”: never promise protection a system can’t deliver.
A deliberately conservative draft standard for governing AI and decision-support systems where connectivity is fragile and power is unequal. Its central idea is that community authority must be an enforceable technical constraint, shown through controls and records, not a consultation. It certifies nothing and claims no safety results.
IR Standard v1.0: public overview
Estándar IR v1.0 - Panorama Público / Resumen Ejecutivo
A non-technical summary of the IR standard for funders and policy readers: computing and decisions that stay in the territory, so services can work without the cloud in places with no signal.
IR Standard v1.0: normative technical specification
Estándar IR v1.0 — Especificación Técnica Normativa: Infraestructura Soberana e Inteligencia Distribuida
The full technical specification: an offline-first reference architecture, conformance requirements, kill-switch protocols, and forensic audit using hash-chained records.
Why it’s restricted: data sovereignty (ILO Convention 169), dual-use concerns and operational security. The full text is available on request to institutional reviewers, technical evaluators and licensed partners. To ask, write to research@q-ori.pe.
The evidence layer
Sovereign Khipu Protocol (PKS) v1.0: offline decision integrity
(PKS v1.0) — Protocolo Khipu Soberano: Perfil de Implementación IR para Integridad Decisional Offline
Puts the IR standard into practice as an offline evidence standard. Each claim maps to a protocol that produces an evidence pack, which can be checked without a connection.
Sovereign Khipu Protocol (PKS) v1.1: decision integrity in the age of synthetic abundance
PKS v1.1 — Protocolo Khipu Soberano: Integridad Decisional en la Era de la Abundancia Sintética
The fuller specification, for evidence that holds up when images and documents can be faked at no cost. It defines the Digital Khipu, an append-only, hash-linked record; portable evidence packs; and the rule that any missing evidence means “Not Proven”. It is the basis of the worked example on this site.
Applied
Tinkuy Node Pair (PNT): an early public note on architecture, custody and scope
PNT (Par Nodo Tinkuy) — Nota pública temprana sobre arquitectura, custodia y alcance
A research architecture in which two separate custodians, working offline, jointly record a shared event. It starts from a 2026 rainfall emergency in which five days of inter-agency work still left the district recorded as “emergency not registered”. It is a research note, not an operational validation.
In the field
Between Specification and Deployment: a public field report
Entre la Especificación y el Despliegue — un informe público de campo
The public report on the first stage of El Hilo que Persiste, an applied research programme of LAAD (UNSAAC) with Higher Self Forge Ltd: a field test of an offline communication prototype in a highland community in Cusco, at about 4,300 m. Two points could talk. It is plain about what it didn’t establish: no coverage figure, no proof that a full network would hold, and unreliable timestamps on the node.
About
David Bentley is a British systems engineer who lives in the Sacred Valley, Cusco. He has 17 years’ experience building systems, and builds offline tools for places without signal. He has published eight papers and draft standards on offline evidence and community data governance.
The name and the mark
Qori means gold in Quechua. The mark is a Q drawn in two halves, one for each copy of a record, with a small gap between them: neither half is the whole record alone. The gold tail is the person who signs.
Who runs it
Qori Labs is run by Higher Self Forge Ltd, registered in England and Wales (no. 14045104). Research and field work are based in Cusco, Peru. Qori Labs is small: when you write, you reach David.
Qori Labs is not part of UNSAAC or LAAD. David collaborates with LAAD’s El Hilo que Persiste programme, whose field report is listed under Publications.
Principles
Producers own their records, decide who sees them, and can take all of them with them in open formats.
Consent is written, revisited and revocable. Nothing is shared without it.
Methods are open by default, and code written for producers is open source. Anything restricted says why, and how to ask for it.
No lock-in: records and their seals can be checked with free, standard tools, with or without us.
No false safety: every claim says what it cannot prove, and missing evidence means “Not Proven”.
Field first: claims rest on what is checked on the ground.
A person signs: software helps check the evidence, and a named human is accountable for every verdict.
Tested before it’s used: every rule is tried in simulation against the ways it could be fooled, before it meets a farmer.
Several come from David’s published work: ongoing consent and the CARE principles from the Framework Protocol (2025), and “no false safety” and “Not Proven” from the IR and PKS standards.
How research and paid work stay apart
The first phase is free, and its findings are published. Paid work comes later, only if the research shows it’s useful, and it is agreed in writing before it starts. We don’t use a participant’s data or name without written permission.
Qori Labs investiga cómo los compradores pueden comprobar de dónde vienen el café, el cacao y otros productos andinos, con registros que pertenecen a los productores.
Cómo funciona, en seis pasos
Funciona como la caja de una tienda: dos recibos, un mensaje al cierre del día y un total que tiene que cuadrar.
1
Usted entrega su café.
El acopiador pesa el saco y los dos ven el número. Cada mañana, la balanza se revisa con una pesa conocida.
2
Un recibo de entrega, dos copias.
Una copia es para usted y la otra para el acopio. Los números de los recibos se imprimen antes de la cosecha.
3
El mismo recibo entra al teléfono.
El acopiador escanea el recibo y anota los kilos. El teléfono muestra el peso en números grandes para que usted lo revise. Funciona sin internet.
4
En la tarde, el teléfono cierra el día.
Todos los recibos del talonario se convierten en un código corto. Si cambia un solo número, el código cambia por completo. Un mensaje de texto lleva el código a la oficina de la cooperativa y a un miembro de la directiva. No lleva nombres ni pagos.
5
Meses después, alguien revisa.
El talonario tiene que dar los mismos códigos que guardó la oficina. Se eligen socios al azar para comparar sus copias. Los errores se corrigen agregando una corrección, nunca borrando.
6
El resultado: «Probado» o «No probado».
Siempre con sus límites, y sin nombrar a ningún socio. Para los productores no tiene costo.
Si algo se cambia después, se nota: la copia del acopio ya no coincide con la suya, o el talonario ya no da el código que guardó la oficina.
Nuestros compromisos
Los registros son de ustedes: ustedes deciden quién los ve.
Cada productor guarda su propia copia de cada recibo.
Nada se comparte sin su autorización por escrito, y pueden retirarla cuando quieran.
Para los productores no tiene costo.
Lo que no se puede probar, lo decimos: si falta evidencia, la respuesta es «No probado».
Cómo empezaríamos
Primero conversamos con la cooperativa, en persona. Si les interesa, registramos un lote de prueba con su autorización por escrito, y ustedes reciben una copia de todo.
Quiénes somos
Qori Labs es una iniciativa de investigación de Higher Self Forge Ltd, empresa registrada en Inglaterra y Gales (n.º 14045104), con trabajo de campo en Cusco. No forma parte de la UNSAAC ni del LAAD.
Higher Self Forge Ltd (company no. 14045104), trading as Qori Labs, is responsible for the personal data described here. Contact: research@q-ori.pe.
What this website collects
Nothing by itself. It sets no cookies, uses no analytics and loads nothing from other websites. The form on the Take part page writes an email in your own email app; we receive only what you choose to send.
What we do with what you send
We reply to you, and arrange conversations you ask for. We do this because it’s in our legitimate interest to answer enquiries.
If you take part in the research, we use what you share as your consent form describes. You can withdraw that consent at any time.
How long we keep it
Enquiries that lead nowhere are deleted after 12 months. Research records are kept as your consent form says, and deleted when you ask.
Where it’s held
On our email provider’s servers, and on David Bentley’s devices in Peru.
Producers’ records
Records made with producers belong to them. They are covered by separate written consent, in Spanish.
Your rights
You can ask to see, correct or delete your data, object to how we use it, or withdraw consent. If you’re unhappy with how we handle it, you can complain to the Information Commissioner’s Office at ico.org.uk.