Appliance
Industrial enclosure in the quality or IT closet. Local inference hardware, physical air-gap key, append-only log store. Looks like an instrument. Is not a workstation.
Product spec
An appliance, connectors, a local model, and a signature.
Written for a VP Quality. If a sentence would make an auditor nervous, it does not belong here.
Architecture
On-prem, by default
1
Systems you already run
- eQMS (read)
- ERP item master (read)
- File SOPs
2
Harness QMS appliance
- Living requirements graph
- Local model drafts
- Part 11 signatures
- Append-only audit log
3
Official record
- Human sign-off
- Authorized export only
- DHF stays in the eQMS
Connectors
Read-first adapters to MasterControl, Greenlight Guru, QT9, Veeva, and SharePoint for SOPs and DHF objects; NetSuite and SAP for item master and standard cost. Writes only as authorized export of a signed record.
Local model
Weights reside on the box. Used to propose traces, flag gaps, and draft controlled language from your SOPs. Customer procedures are not used to train a foundation model off-box.
Core object
The living requirements graph
Every commercial SKU hangs off the same graph as the user need that justified it. When wall thickness moves, residual risk and standard cost move with it — or Harness QMS refuses to let the residual be signed. That refusal is the product.
- User needs, including hospital economics, as design-control objects — not slides.
- Design inputs with numbers, standards, and owners.
- Verification and validation protocols with evidence pointers.
- ISO 14971 residual risk that cannot close on superseded geometry.
Audit log
Append-only, on the box
Model drafts, human signatures, returns, failed authentications, and authorized exports are written with time, actor, record ID, and meaning of signature. The log is part of the IQ/OQ story. It is not a product-analytics stream.
Validation
IQ / OQ / PQ-lite ships in the crate
Harness QMS is quality-system software, not a medical device, and we do not claim FDA clearance for it. It is still software used around 21 CFR 820 and Part 11. A VP Quality should be able to show the pack without inventing a protocol the week before an audit.
IQ
Identity, hashes, connectors, time source, air-gap key. Vendor-executed on install.
OQ
Signature challenge, lockout, log immutability, blocked unsupervised write. Vendor-scripted.
PQ-lite
Site SOP mapping and signer roles. Customer evidence of intended use.
What we will not do
Hard noes
- No unsupervised writes to the official DHF or eQMS.
- No claim to replace MasterControl, Greenlight Guru, QT9, Veeva, or SharePoint.
- No required cloud inference. Air-gap remains a first-class mode.
- No training of foundation models on customer SOPs off the box.
- No invented FDA clearances, customer logos, or implied 510(k) for Harness QMS itself.