How a lot is checked
The method is being tested, in simulation now and in the field from the 2027 harvest. This page describes it as it stands, including what it can’t do.
In short, it works like a shop till: two receipts, a text at closing time, and a total that must add up.
The four moments, in short
- At the scale. A farmer delivers. Both people see the weight, and the scale is checked with a test weight at the start and end of each day.
- Two copies, one record. One receipt, two copies: the farmer’s copy and the collector’s copy, which stays in the co-op’s receipt book. The same receipt goes into the phone, which is designed to work without internet.
- That evening. The phone seals the day into one code and texts it to the co-op office and a board member.
- Months later. A reviewer checks the book against the codes, compares the copies of farmers chosen at random, and checks that the kilos add up. The buyer gets a signed verdict on the lot, Proven or Not Proven, with its limits, and can recheck the codes.
The sections below explain each part in detail.
One record, two copies
At each delivery, the farmer and the collector each keep a copy of the same receipt: the receipt number, the date, the farm, the collection point and the kilos. Each copy carries a seal, a short fingerprint of the record. If anything in the record changes, the fingerprint changes.
Receipt numbers are fixed before the harvest starts, and the list is sealed, so a receipt can’t be invented later. When a book is finished, every number in it is accounted for: used, voided the same day with a reason, or returned blank.
Witnessed every evening
At the end of each collection day, the collector’s phone sends one text message to the co-op office and to a member of the co-op’s board. It carries the day’s count of receipts, the kilos, and a fingerprint of the whole collection book since the season began. It holds no names and no payments.
If any receipt is changed later, even one from weeks before, the book no longer produces the fingerprints the office received. It’s designed for a basic phone with no internet. The office can also stamp one fingerprint a week publicly, so that not even the office could rewrite history unnoticed.
Mistakes are designed out, and fixed in the open
- Receipt numbers and member cards are scanned, not typed. The phone photographs the scale’s display and shows the weight in large numbers, so the farmer can check it. Reading it aloud is an option we’ll test with members, not a promise.
- A wrong receipt is voided the same day, with its reason. A void recorded later counts as a problem.
- A correction is added as a new record. The original stays in view, and nothing is erased.
A published rule of evidence
Each kind of claim gets a short written rule, published before it’s used. The first rule answers one question: did this lot come from the deliveries it lists? It checks six things:
- Every receipt number is on the list fixed before the harvest, and is used, voided or returned exactly once.
- The collection book reproduces every fingerprint sent to the co-op office.
- For a random sample of farmers, their copies match the collector’s.
- The deliveries add up to the lot, allowing for drying and sorting.
- No farm delivered more than its land could plausibly grow.
- The scale read a test weight correctly at the start and end of each day.
If any check fails, the answer is Not Proven, with the reason and the evidence that would change it.
Sampling, done like an audit
- Farmers are chosen at random, and a chosen farmer is never swapped for another.
- If a chosen farmer’s receipts are missing, other evidence of the same deliveries is sought: the office’s carbon copy, a photo taken at delivery, or the farmer’s confirmation in person, recorded by the verifier. An explanation is not evidence.
- When gaps cluster on one day, at one collection point or with one collector, the check widens to every delivery in that group. A wider check is not an accusation.
These rules are drawn from ISA 530, the international auditing standard on audit sampling.
Tested before the field
Before it meets a farmer, the method runs in simulation: a fictional season, separate record holders, and scenarios built to fool each check. These include a rewritten receipt, an invented one, a missing day and a hidden change. Every check must catch what it should, and stay quiet when nothing is wrong. The scenarios it can’t catch are kept too, and written down as limits.
A person signs
Software helps gather and check the evidence. A named person reviews it, signs the verdict and is accountable for it.
What the method can’t do
- A seal shows a record hasn’t changed since it was sealed. It can’t show the record was right when it was made. That’s why the copies, the kilos and the scale are checked too.
- If a farmer and a collector agree to write false kilos on both copies, the receipts can’t show it. Scale checks, yields and kilos in and out narrow that gap.
- The evening fingerprint only protects if it’s held by someone the collector doesn’t control.
- Without a public timestamp, a seal can’t show when a record was made.
- This first rule doesn’t cover deforestation, land rights, payments or quality.
Works with what you already have
Farm maps show where farms are, and certificates show how they’re run. Delivery receipts show which farms’ deliveries made a lot, and that nobody changed them afterwards. Qori Labs adds that third piece. It doesn’t replace the other two.
How data is handled
Records belong to the producers and stay with them and their co-op. Qori Labs keeps only seals, counts and verdicts, never members’ personal details or what they were paid. Nothing is shared without written consent, and consent can be withdrawn.
What this research is not
- Not a certification or a label.
- Not a data platform: we don’t own or sell anyone’s records.
- Not part of UNSAAC or LAAD.
- Not finished. The method changes as the field teaches us.
Built on published work
The method builds on two of David Bentley’s papers. The Sovereign Khipu Protocol (PKS) is an open standard for records that can be checked offline, in which missing evidence means Not Proven. The Tinkuy Node Pair (PNT) describes two separate custodians jointly recording a shared event.
doi:10.5281/zenodo.18645310 and doi:10.5281/zenodo.19228636
Read the publications