FFD // MethodPilot · Boyacá · March 2026Signatures roadmap
01 · Capture by vector

Four vectors, four sources

Each vector answers a different question and comes from a different party, so faking a coherent story means capturing all of them at once. For each one: what it is designed to capture, and what the pilot captured for lot 7ZxK9mQ4Pd2nR8.

A Agronomic

Captured
Answers
What conditions did the fruit grow in, and where?
By design

The operator of the field sensors writes soil moisture and temperature at several depths, soil conductivity, air temperature and humidity, radiation, rain and wind. The harvest entry adds origin, cultivar and the first mass.

SenML · FoodOn · SAREF4AGRI
In the pilot

Four soil sensors and one weather station from the IoT partner, over about seven weeks. The field operator typed the harvest into Tracer: basket, row, block, weight and variety.

For basket CAN-009, the soil series on the record was logged from 2 to 10 April, after the harvest.

Sensors measured3 kg declared

L Logistic

Captured
Answers
What happened between the field and the plant?
By design

Whoever holds the lot writes each transport leg: origin, destination, departure and arrival, cold-chain temperature, and the mass at every handover, read from a connected scale.

EPCIS 2.0 ObjectEvent · SenML
In the pilot

At the plant, the operator scanned the basket's QR label in Tracer, read the scale and typed the weight and the condition of the fruit. There was no carrier record, no cold-chain sensor and no GPS track.

CAN-009: 3.48 kg at intake. Transit time is arrival minus harvest, 6 h 06 min. Distance is the straight line between the two points, 149 km.

Scale measuredTyped by hand

R Recipe

Not captured
Answers
What did the plant commit to do?
By design

Before the cycle starts, the plant operator commits the programme: temperature steps, target pressure, freezing protocol and tray load. Only its hash needs to be public; the content can stay with verifiers under NDA. Comparing R with P shows whether the plant did what it said.

In the pilot

Not captured. The cycle ran without a recipe on the record, so whether it followed its programme cannot be checked for this lot.

Not captured

P Process

Captured
Answers
What did the transformation actually do?
By design

The plant control system writes the cycle as it runs: shelf and product temperature, chamber pressure, mass loss and cumulative energy. No person sits between the sensor and the record.

EPCIS 2.0 TransformationEvent · SenML
In the pilot

The lyophilizer's control system logged one cycle of 43 h 29 min in seven stages: chamber pressure and temperature, nine heater temperatures, power and cumulative energy, with a reading about every minute.

The cycle was shared by the 15 baskets of the campaign, so its 87.6 kWh is not allocated per basket. It started 24 days after the harvest, on 12 April; storage in between was not instrumented.

Measured

E External attestation

Not captured
Answers
Does an independent laboratory confirm origin or identity?
By design

An accredited laboratory, under ISO 17025, issues a signed credential attached to the lot. It supports tier T4. It is an envelope any party can use, not a fifth vector.

W3C VC 2.0
In the pilot

None. No laboratory analysis was run.

Not captured
02 · Integrity

How a record stays honest

Capturing a vector is not enough: the record has to stay the same after it is written.

  1. Canonical formEach payload is serialised as canonical JSON, RFC 8785. Same data, same bytes.In review
  2. Hashhash = keccak256(canonical(payload)). Large telemetry is stored apart and hashed by reference.In review
  3. ChainEach event embeds the hash of the previous one. The field name is not fixed yet.In review
  4. StorePayloads go to Swarm by content address, one feed per lot. Lot 7ZxK9mQ4Pd2nR8 has three references; feeds are planned.Partial
  5. AnchorOne call per sealed event on Ethereum mainnet: lot id, phase, Swarm reference, event hash.Planned
  6. Append onlyA sealed record is never edited. Corrections are new versions.In review
  7. Repeatable readsAny Bee node returns the same bytes; any Ethereum RPC returns the same anchors. A phone that scans a package recomputes and compares.Planned
  8. LabelsMeasured, declared or illustrative, on every value. Illustrative data is watermarked.In review
Figure 1. Record pipeline The notary, FFD's sealing service, state planned, reads events from the plant system, which exists, through a read-only account, state proposed. The notary, state planned, writes payloads to Swarm, state partial, and anchors event hashes on Ethereum, state planned. A phone that scans a package, state planned, reads the lot record from Swarm and the anchors from Ethereum. 1 2 3 4 5 EXISTSPlant systemread access: proposed PLANNEDNotaryhashes · chains PARTIALSwarmstores by content PLANNEDEthereumanchors event hashes PLANNEDPhonereads · recomputes Figure 1. Record pipeline The notary, FFD's sealing service, state planned, reads events from the plant system, which exists, through a read-only account, state proposed. The notary, state planned, writes payloads to Swarm, state partial, and anchors event hashes on Ethereum, state planned. A phone that scans a package, state planned, reads the lot record from Swarm and the anchors from Ethereum. 1 2 3 4 5 EXISTSPlant systemread access: proposed PLANNEDNotaryhashes · chains PARTIALSwarmstores by content PLANNEDEthereumanchors hashes PLANNEDPhonereads · recomputes
  1. 1 FFD's notary service reads plant events through a read-only account.
  2. 2 Payloads go to Swarm, one feed per lot.
  3. 3 Event hash and Swarm reference are anchored on Ethereum.
  4. 4 A phone that scans a package reads the lot record from any Bee node.
  5. 5 The phone reads the anchors from any Ethereum RPC and recomputes the hashes.

Figure 1. Record pipeline as designed. Amber dashed lines mark the anchor path, which is planned. No part runs end to end yet.

Measured

Read from an instrument. Cycle telemetry, calibrated scales, sensor series.

Declared

Entered by a person or a plant system. Reception, harvest entries, recipe.

Illustrative

Shows a shape, not a fact. Watermarked wherever it appears.

03 · Connect a plant

How a plant gets a record

The plant keeps its own system and writes what happens in it. FFD reads from it and writes the proof. This is a proposal to plants, not an agreement yet.

Proposed

Read-only access

FFD reads the plant system through a read-only account, every 10 minutes. FFD never writes into it.

In review

Three sealed moments

Each lot is sealed at reception, at the cycle and at packing. The plant contract calls the third one delivery.

Proposed

What FFD reads

Reception, consumption in an order, machine load, cycle, close and weighing, sack and final lot, dispatch. Times in UTC; units kg, °C, Pa, kWh.

Proposed

Custody

The plant writes the data. FFD writes the proof. A sealed version is never edited; a change becomes a new version that points to the old one.

Live

Lot page

One page per lot, with its vectors, charts and storage references. Lot 7ZxK9mQ4Pd2nR8 is the only one today.

Planned

Explorer

A page per lot with the event tree, the anchors, and a check that runs in the browser.

Open lot 7ZxK9mQ4Pd2nR8 →Run it at your plant
04 · For developers

Writing to BDF from another system

This part is for engineers: what another system will need to write a BDF record or check one. None of it is published yet. Each item says what it is, in one sentence, and where it stands.

Specification

Planned

The rules in one document. Today they live in the record design and in the four papers.

Event format

Planned

The exact shape of each event a system sends: reception, cycle and packing, with times in UTC and units in kg, °C, Pa and kWh. No schema file exists yet.

Show the illustrative shape
Illustrative
{
  "bdt_id": "urn:bdf:lot:…",
  "schema": "bdf/lot/1.0",
  "events": [
    { "phase": "genesis", "at": "…", "payload": { … },
      "hash": "0x…", "anchor": { "chain": 1, "tx": "0x…", "block": … } },
    { "phase": "cycle", … },
    { "phase": "packing", … }
  ]
}

Anchor contract

Planned

The Ethereum contract that will record the fingerprint of each sealed event. It will be tested on Sepolia and then deployed on Ethereum mainnet. It has no address yet. The Sepolia prototypes of April 2026 are not this contract.

Contract interface

Planned

The functions other programs will call on that contract. Its details are not fixed yet.

Show the interface
Solidity
interface IBDTLot {
  function anchor(bytes32 bdtId, uint8 phase, bytes32 swarmRef, bytes32 eventHash) external; // ATTESTER
  function anchors(bytes32 bdtId) external view returns (Anchor[] memory);
  event Anchored(bytes32 indexed bdtId, uint8 phase, bytes32 swarmRef, bytes32 eventHash, uint64 at);
}

Independent check

Planned

A check inside the lot page: fetch the record from Swarm, read the anchors from Ethereum, recompute every hash and compare. A standalone script is not scheduled.