A tap attests. It does not pretend to prove.
A modern beverage plant is automated end to end — but recalls still start at the handful of gates where a human makes a release decision the automation can't verify for itself: line clearance at a product changeover, a code and packaging check, a CIP sign-off. Today that decision is a claim in a logbook. This study reads those gates as a thin verification layer: one tap attests that a role released a step, sealed and tamper-evident. It doesn't prove the step was physically correct — it makes the human attestation binding and provable.
The plant runs on SCADA and MES. Value appears only where a person still makes a release the automation does not verify. The pilot takes exactly one such gate: tap → release → tamper-evident entry (hash chain) → live dashboard. Standalone, no integration, buildable and auditable in days. Three states, and only three: open · released · blocked.
No physical or software installation. Value in hours, not months. Works with no power at the gate.
The tap opens a web page — no app, no terminal, no login. Training built into the page itself.
The page adapts per gate and language. NFC nodes extend to further gates whenever the plant is ready.
Three candidate gates, three nodes, one tap each — chosen for where a claimed release most often precedes a recall.
| Node | Gate | The release |
|---|---|---|
| CIP-A | CIP station | Clean-in-place complete, line clear of residue |
| FILL-2 | Filling line | Product changeover — line cleared, correct product |
| PACK-1 | Packaging | Code & packaging match the product |
The operator taps the node at the gate. The page confirms a release or raises a block. The interface serves; the dashboard (V) shows.
Separate from the operator's view: the line's live state and its history. Each release writes the chain forward — value grows, documented risk falls. Illustrative data.
Mockup · illustrative data over 12 months.
Real recalls begin exactly here — at rushed changeovers, missing line clearance, and code or packaging mix-ups. A witnessed, tamper-evident release makes the check binding and provable. It doesn't replace the check; it evidences it.
In 2025, sugared drinks were filled into packaging marked "sugar-free," and a spirit seltzer into an energy-drink can — documented recalls from packaging and changeover errors.
Around a third of US food recalls in 2024 traced to undeclared allergens — frequently cross-contamination at changeovers without an evidenced release.
Illustrative, from public recall summaries; verify at source before external use.
The record proves that a role released a step, at a time — role-based by default, named only where a plant deliberately assigns QA accountability. No camera, no presence-tracking, no profile of the operator's day. The record serves the line and its accountability, never leverage over the person keeping it. Ten unamendable prohibitions, published to the public domain.
These close the pilot's open points — process, roles, evidence, data-protection role, language, boundary. Select or type, then assemble and send.