RequiemOS Chain of Custody · Overview 2026-05-27
Concept

Chain of Custody

What the platform tracks, why it is append-only, and what it refuses to let happen.

Chain of custody is the platform’s primary regulatory differentiator. The architecture sits on three data structures — custody_events, assets, and implanted_devices — and a small set of locked workflow modules that drive them. This page describes the surface in roughly the order a case touches it.

Custody is not one chain. It is three.

Lane 01

The remains

Custody of the deceased from removal at the place of death to final disposition. Remains-level events recorded on custody_events with scan-driven event sources where the QR infrastructure is live and operator-attested entries where it is not.

Event types include
pickup_scan · receiving_verification · coc_scan_disposition · cremated_remains_received
Lane 02

Personal effects

Every item other than the remains that arrives with the deceased — wedding ring, glasses, wallet, clothing, religious items. One row per item on assets, with a tracking ID and bag ID, photographed on intake and decided per item during arrangement.

Asset status
receivedin_custodyreturned / with_remains / released
Lane 03

Implanted devices

Pacemakers, ICDs, certain orthopedic and radiotherapy implants. One row per device on implanted_devices, examined in preparation and resolved before disposition. Removed devices become asset rows in their own right; cleared devices remain with the deceased.

Device status
reportedremoved / cleared_for_cremation / not_found

What a representative case writes.

Mon · 04:12
pickup_scan
Vancouver General Hospital morgue. David scans on departure.
Mon · 05:08
receiving_verification
Identity confirmed at funeral home receiving. Storage location assigned.
Mon · 05:14
asset_received
Wedding ring inventoried, photographed, bagged. One row per inventoried item.
Tue · 09:30
medical_device_removed
Pacemaker explanted by licensed embalmer. Becomes an asset with category medical_device.
Wed · 11:05
asset_placed_with_remains
Wedding ring placed with the remains per family decision.
Wed · 14:30
coc_scan_disposition
Final QR scan at crematorium hand-off. Possession transfers to crematory operator.
Fri · 10:20
cremated_remains_received
Cremated remains arrive at funeral home. Scanned in. Director notified.
Mon · 13:00
asset_released
Family receives the urn and the items intended for return. Property release signed.

What each row captures

event_type
vocabulary term
case_id
the case this binds to
actor_id
who scanned or attested
location_badge
where it happened
event_source
qr_scan / manual_entry
occurred_at
actual event time
recorded_at
write time
description
free-text narrative

Asset-level events reference the asset in description rather than via a polymorphic column. Polymorphic targeting is flagged in ADR-022 Future Work for when asset-level event querying earns the schema change.

No row is ever deleted. Not by directors, not by admins, not by platform staff.

Append-only

Every state change appends a new row. The table grows; it does not change.

#1041
pickup_scan · Mon 04:12 · David
#1042
receiving_verification · Mon 05:08 · Linda
#1043
asset_received · Mon 05:14 · Linda
#1044
medical_device_removed · Tue 09:30 · Rob
#1045
coc_scan_disposition · Wed 14:30 · David

Supersession

A correction is a new row that references the prior row with a captured reason. The original stays visible.

#1042
receiving_verification · Mon 05:08 · Linda · Storage: Cooler A
#1067
receiving_verification · Mon 05:08 · Linda · Storage: Cooler B supersedes_event_id: #1042 “Storage location entered in error; remains transferred to Cooler B at receiving.”
#1068
asset_received · Mon 05:14 · Linda
Immutability is the entire point. Layer 1 of the four-layer audit architecture (ADR-014) exists for compliance, regulators, and courts — consumers who need to know what was recorded at the time, not what someone wishes had been recorded. Corrections happen, but they happen on top of the record, never inside it. A custody event also writes a mirror entry into Layer 3 for the Case Timeline UI, referencing the authoritative record rather than duplicating it.

Every asset must reach a terminal state.

Family intent is captured during arrangement on intended_disposition; the operational status resolves at execution. The case cannot close while any asset sits between them.

Decided at arrangement

  • return_to_family
  • with_remains
  • donate
  • dispose
  • medical_disposal
M-B decision M-D execution

Terminal status

  • returned
  • with_remains
  • released
asset_terminal_check gates case closure on three conditions: every asset in returned, with_remains, or released; no asset in received or in_custody; no asset still at pending_decision. The third condition catches assets where a disposition decision was somehow skipped despite the locked execution module — belt and braces against silent loss of family intent.

No cremation case advances with a reported device unresolved.

The medical_device_check module runs in preparation, after remains_id_verify and before any disposition module. For cremation, aquamation, and green-burial-involving-cremation cases, it is a hard gate: every implanted_devices row for the deceased must resolve to one of three outcomes before the workflow proceeds.

Outcome 01

Removed

Device is physically explanted. An assets row is created with category medical_device and intended disposition medical_disposal. A custody event records the removal.

Outcome 02

Cleared for cremation

Surgical screws, fixed dental implants, certain orthopedic hardware present no cremation hazard. The device row records the clearing reason and remains with the deceased.

Outcome 03

Not found

Examination did not find the previously reported device. Rare; possible. The row records the discrepancy.

The hazard. A pacemaker or implantable cardioverter-defibrillator in a cremation retort can explode due to the lithium battery, damaging the chamber, injuring the operator, and violating the funeral home’s contract with the crematory. ICDs are worse than pacemakers; certain radiotherapy implants worse still. This is the most safety-critical module in the catalog.

The Comprehensive Chain of Custody Report.

At case close, the platform generates a PDF report containing the full custody record for the case. The report is persisted as a case_document with a SHA-256 hash recorded on the row for tamper evidence. The same report can be regenerated on demand at any point in the case’s life as a derived view.

One universal format at MVP, designed to exceed the requirements of every Canadian province currently in scope plus the Illinois Integrity in Death Care Act. Per-jurisdiction variants are deferred to Phase 2 once specific gaps emerge.

Open discovery items — six questions remain on report consumers, tamper-evidence mechanism, on-demand vs case-close triggers, and the BC CIFSA-specific format check. Owners: Ryan and Zareef. Resolution expected week of 2026-06-01.

What the report contains

  • Every custody_events row in chronological order
  • Asset-level chain per tracked asset
  • Medical device events & outcomes
  • Property release form references
  • Signing party identity, timestamp, method
  • Identity verification events
  • Supersession events with their reasons

Scope of this overview

This is the conceptual surface. The PRD that owns this aggregate is a stub today — see PRD/chain-of-custody-prd.md — pending the full rewrite when the chain-of-custody implementation arc surfaces. The workflow orchestration that drives the lanes lives in ADR-022. The four-layer audit architecture — including the supersession pattern and the Layer 3 mirror-entry mechanism — lives in ADR-014. The aggregate boundaries are set in ADR-016.

Out of scope here: the persona-specific UI surfaces (Rob’s scan flow, the daily prep board, David’s at-removal capture), the per-province regulatory mapping, and the post-MVP family-facing export. Those land when the PRD is rewritten.