ecoPrimals — Compliance, Regulatory, and Institutional Review Reference

FDA/ISO/HIPAA/GDPR mapping for institutional review

From: ecoPrimal — human + synthetic intelligence
Organization: ecoPrimals Date: March 17, 2026 License: scyBorg triple — AGPL-3.0-or-later (code), ORC (game mechanics), CC-BY-SA 4.0 (docs). See scyBorg Licensing. Repositories: github.com/ecoPrimals


Purpose

This document addresses requirements from regulatory bodies, institutional review boards, legal counsel, grant agencies, quality assurance auditors, and compliance officers. It maps ecoPrimals capabilities to specific standards, identifies what is implemented, what is architecturally ready but unaudited, and what is not yet addressed.

This is not marketing. Where we have gaps, they are stated explicitly.


1. Software Safety and Determinism

Language Safety Guarantees

PropertyMechanismVerification
No undefined behaviorRust ownership + borrow checkerCompile-time enforced
No null pointer dereferenceOption<T> type systemCompile-time enforced
No buffer overflowBounds checking + slicesCompile-time + runtime
No use-after-freeOwnership transfer semanticsCompile-time enforced
No data racesSend/Sync trait systemCompile-time enforced
No unsafe code#![forbid(unsafe_code)] in all spring lib cratesCompile-time enforced

Relevance to IEC 62304: Ferrocene (Rust compiler qualification) achieved IEC 62304 Class C qualification in January 2025. Rust’s compiler eliminates ~90% of traditional safety analysis requirements that apply to C/C++/Fortran codebases.

Deterministic Reproducibility

PropertyMechanismVerification
Same input → same outputNo global mutable state, no random seeds without explicit parametersAll 27,000+ tests pass deterministically
Bit-exact GPU resultsf64 WGSL shaders with explicit roundingCPU↔GPU parity checks across all springs
No Jupyter state corruptionNo notebooks — compiled binaries onlyStructural guarantee
No Python version driftNo Python dependency in production codeCargo.lock pins all dependencies
No conda/pip conflictsSingle cargo build commandStructural guarantee

Static Analysis

ToolConfigurationResult
cargo clippypedantic + nursery lints enabledZero warnings across all springs
cargo denyLicense allowlist, advisory DB, ban listAll dependencies pass
cargo fmtStandard Rust formattingAll code formatted
#[expect(reason)]Every suppressed lint has a documented reasonAuditable justifications

2. FDA 21 CFR Part 11 — Electronic Records and Signatures

Part 11 requires that electronic records used in FDA-regulated activities have controls for access, audit trails, and electronic signatures.

Mapping to ecoPrimals Architecture

Part 11 Requirement§ ReferenceecoPrimals ImplementationStatus
Validation§11.10(a)27,000+ automated tests; 15,334+ validation checks; 306 validation binaries ( wetSpring alone)Implemented
Audit trail (who, what, when)§11.10(e)rhizoCrypt DAG: every computation is a vertex with timestamp, operator DID, and input hashImplemented (architecture); Unaudited
Record retention§11.10(c)NestGate content-addressed storage (BLAKE3 hash); ZFS checksummed cold storageImplemented (architecture)
Access controls§11.10(d)loamSpine certificates with scoped permissions; BearDog Ed25519 identityImplemented (architecture)
Electronic signatures§11.50, §11.70BearDog Ed25519 signatures on all results; signature linked to individual DIDImplemented (architecture); Unaudited
Signature/record binding§11.70Signature covers content hash + metadata; cannot be separatedImplemented
Authority checks§11.10(g)loamSpine certificate scoping; operator DID must match authorized personnelImplemented (architecture)
Device checks§11.10(h)SoloKey FIDO2 hardware authentication for NUCLEUS nodesImplemented (4 HSMs)
Open system controls§11.30End-to-end encryption (chacha20poly1305); BearDog X25519 key agreementImplemented

What Is NOT Addressed

RequirementGapPath Forward
Formal Part 11 compliance auditNo auditor has reviewed the systemRequires institutional partner with QA
CTD/eCTD submission formattingNo regulatory submission output formatFormatting layer on top of existing data
Procedural controls (SOPs)Technical controls only — no SOP templatesSOPs are lab-specific; framework supports them
Training documentation per §11.10(i)No formal training recordsK-Nome methodology documented; formal training pending

3. ISO 17025:2017 — Testing and Calibration Laboratories

Paper 21 (Sovereign Sample Provenance) maps the provenance trio to ISO 17025.

Clause-by-Clause Mapping

ISO 17025 ClauseRequirementecoPrimals MappingStatus
4.1ImpartialityAGPL-3.0 source code; all algorithms publicly auditableStructural
5.3Facilities and environmental conditionsNot applicable (software, not physical lab)N/A
6.2Personnel competenceloamSpine certificates link operator DID to qualificationsArchitectural
6.4EquipmenttoadStool hardware discovery; probe.rs inventories GPU/CPU/NPU capabilitiesImplemented
7.1Review of requestsNot applicable (computational pipeline, not service lab)N/A
7.2Method selection/validation27,000+ tests; 70+ published papers reproduced; 15,334+ validation checksImplemented
7.3Sampling / sample receiptrhizoCrypt DAG: collection vertex with timestamp, GPS, operator, conditionsImplemented (Paper 21 exp062)
7.4Sample identificationloamSpine certificate: unique sample ID, type, condition, accessionImplemented (Paper 21 exp062)
7.5Technical recordsEvery computation produces a DAG vertex with input hashes, parameters, output hashesImplemented
7.6Measurement uncertaintygroundSpring: error propagation, uncertainty quantification, spectral methods (102 barraCuda delegations)Implemented
7.7.1Quality assurance / contaminationFraud detector: ContaminationGap — flags sequential processing without QC stepImplemented (Paper 21 exp062)
7.8ReportingValidation binaries produce structured PASS/FAIL output with tolerancesImplemented
7.11Data controlImmutable DAG vertices; BearDog Ed25519 signatures; content-addressed storageImplemented
8.5Actions to address risksRetryPolicy + CircuitBreaker for IPC fault tolerance; IpcError classificationImplemented
8.7Internal auditcargo test, cargo clippy, cargo deny run on every changeImplemented (automated)

Fraud Detection (6 Types, ISO-Mapped)

Fraud TypeDetectionISO Clause
PhantomSampleAnalysis results with no collection vertex7.3
DuplicateAccessionTwo samples claim same accession7.4
BrokenColdChainFrozen → Fresh without documented reason15189:5.4.4
UnauthorizedAccessProcessing by DID not in custody chain6.2
MislabeledSpecimenCert metadata vs collection vertex mismatch15189:5.4.2
ContaminationGapSequential processing without QC step7.7.1

4. ISO 15189:2022 — Medical Laboratories

Paper 22 (Zero-Knowledge Medical Provenance) extends the provenance model to clinical laboratories with patient consent management.

Additional Clauses Addressed

ISO 15189 ClauseRequirementecoPrimals Mapping
5.4.2Specimen labellingloamSpine certificate metadata: patient DID, sample type, collection conditions
5.4.4Transport and storagerhizoCrypt DAG tracks custody transfers with timestamps and conditions
5.7Post-examinationResult signed by BearDog; immutable in DAG; patient access via consent certificate
6.5.2Information system securityBearDog Ed25519 + X25519 encryption; loamSpine access scoping

5. HIPAA — Health Insurance Portability and Accountability Act

Paper 22 defines a consent-gated access model for patient-owned medical records.

Privacy Rule (45 CFR §164)

HIPAA Requirement§ ReferenceecoPrimals MappingStatus
Individual access rights§164.524Patient owns record via loamSpine certificate; self-sovereign DIDArchitectural
Minimum necessary§164.502(b)Consent certificate scopes access to specific record typesArchitectural
Covered entity obligations§164.502Provider DID identified in consent loan; access loggedArchitectural
Right to revoke§164.508(b)(6)revoke_consent() is irreversible; future access blockedArchitectural
Consent validity§164.508Consent certificate has expiry field; expired access is fraudArchitectural

Security Rule (45 CFR §164.312)

Requirement§ ReferenceecoPrimals Mapping
Access control§164.312(a)(1)loamSpine certificate + consent scoping; BearDog identity
Audit controls§164.312(b)Every access is a DAG vertex; BearDog signs AccessProof
Integrity§164.312(c)(1)Content-addressed storage (BLAKE3); Ed25519 signatures
Transmission security§164.312(e)(1)chacha20poly1305 encryption; X25519 key agreement

HIPAA Fraud Detection (5 Types)

Fraud TypeDetectionHIPAA Impact
UnauthorizedAccessAccess with no valid consent at timestamp§164.312(b)
ExpiredConsentAccess after consent expiry§164.508(b)(6)
ScopeViolationAccess to record type not in consent§164.502(b)
PhantomAccessRecord modified but no access vertex§164.312(b)
ConsentForgeryConsent cert not signed by patient DID§164.312(a)(1)

6. GDPR — General Data Protection Regulation

sweetGrass (SCYBORG provenance trio) implements GDPR-inspired data subject rights.

GDPR RightArticlesweetGrass Implementation
Right of accessArt. 155-level privacy; Access level allows subject to read all attributed data
Right to erasureArt. 17Erasure level; DAG vertex marked as erased (hash retained for integrity)
Right to portabilityArt. 20Portability level; PROV-O export of full provenance chain
Purpose limitationArt. 5(1)(b)loamSpine certificate scopes purpose; exceeding scope is fraud
Data minimizationArt. 5(1)(c)Consent certificate specifies record types; minimum necessary

7. IRB — Institutional Review Board

Current State

ecoPrimals is a computational platform. All current experiments use:

  • Published, peer-reviewed data (NCBI, PhysioNet, ChEMBL)
  • Synthetic/simulated data (Monte Carlo, mathematical models)
  • Publicly available datasets (repoDB, ROBOKOP, MIT-BIH)

No human subjects data has been collected, generated, or processed.

When IRB Becomes Relevant

IRB review would be required when:

  1. Processing real patient data (e.g., MIMIC-IV with PhysioNet credential)
  2. Collecting biological samples (wet lab integration with Gonzales iPSC work)
  3. Clinical validation studies (prospective trials)

healthSpring explicitly states: “Clinical validation requires prospective studies, IRB approval, and institutional partnerships. healthSpring provides the computational foundation; clinical validation is a separate, future phase.”

What ecoPrimals Provides to IRB Processes

IRB ConcernecoPrimals Response
Data securityBearDog encryption (chacha20poly1305) + Ed25519 signatures
Access controlloamSpine consent certificates; scoped, time-limited, revocable
Audit trailrhizoCrypt DAG; every access logged as immutable vertex
De-identificationsweetGrass AnonymizedPublic privacy level; DID-based pseudonymization
Data retention/destructionContent-addressed storage with erasure capability
ReproducibilityDeterministic computation; same input → same output

8. Licensing and Intellectual Property

License Structure (scyBorg Triple Copyleft)

DomainLicenseWhat It Covers
Source codeAGPL-3.0-or-laterAll Rust code in all springs and primals
Game mechanics / IPC protocolsORC (Open RPG Creative Foundation)JSON-RPC methods, deploy graphs, game rules
Documentation / creative worksCC-BY-SA-4.0White papers, baseCamp documents, briefs

What AGPL-3.0 Means for Institutional Users

ScenarioAGPL Requirement
Clone and use internallyNo obligation beyond internal use
Modify and use internallyNo obligation (no distribution)
Distribute modified binariesMust provide source code under AGPL
Run as a network serviceMust provide source code to users of the service
Use output/resultsNo license restriction on output data
Publish papers using resultsNo license restriction on publications

For a university lab: You can clone, build, use, modify, and publish papers using ecoPrimals results with zero licensing obligation, as long as you don’t distribute modified binaries or run a public service. Internal use within a university is explicitly permitted.

Symbiotic Exception Protocol

The scyBorg exception protocol (AGPL §7 additional permissions) allows named organizations to receive broader permissions in exchange for reciprocal benefit. Exceptions are not for sale — they are granted based on symbiotic value.


9. Dependency Audit

Production Dependencies (wetSpring barracuda crate)

DependencyLicensePurposeC Code?
barracuda ( barraCuda)AGPL-3.0GPU math primitivesNo
serdeMIT/Apache-2.0SerializationNo
serde_jsonMIT/Apache-2.0JSON parsingNo
wgpu (optional)MIT/Apache-2.0WebGPU runtimeNo (Rust)
tracingMITStructured loggingNo
bytemuckMIT/Apache-2.0/ZlibSafe byte castingNo
flate2MIT/Apache-2.0Gzip decompressionNo (rust_backend feature)
chacha20poly1305 (optional)MIT/Apache-2.0AEAD encryptionNo
ed25519-dalek (optional)BSD-3Ed25519 signaturesNo
blake3 (optional)MIT/Apache-2.0Cryptographic hashingNo (pure feature)

Zero C/C++/Fortran in the application dependency chain. The flate2 crate uses rust_backend (miniz_oxide, pure Rust). blake3 uses pure feature (no assembly, no C). wgpu uses Rust for all API translation.

Audit Tools

cargo deny check         # License allowlist, advisory DB, ban list
cargo audit              # Known vulnerability scan
cargo tree               # Full dependency tree

10. Validation Evidence Summary

MetricValueHow to Verify
Total automated tests27,000+ across 7 springscargo test --workspace in each spring
Validation checks (numerical)15,334+ with explicit tolerancescargo run --release --bin validate_*
Papers reproduced70+ across physics, biology, pharmacology, chemistryEach paper has dedicated experiment(s)
Validation binaries306 ( wetSpring) + others per springls barracuda/src/bin/validate_*.rs
Clippy warnings0 (pedantic + nursery)cargo clippy --all-targets -- -D warnings
Unsafe code blocks0#![forbid(unsafe_code)] in lib.rs
TODO/FIXME in production0grep -r "TODO|FIXME" src/ --include="*.rs"
Mocks in production code0All mocks isolated to #[cfg(test)]
External C dependencies0cargo tree shows no C/C++ crates

Document History

DateChange
2026-03-17Initial compliance and institutional review reference