SOP-06 — Corrections, withdrawal and CAPA

Owner: Owner-operator (Document Owner and Records Owner for every SOP; no delegate exists). Version 2026-10-08 · effective 2026-10-03 · reviewed every 180 days · last reviewed 2026-10-08 · next review due 2027-04-06.

Purpose

When a receipt or held file is found to misstate its source: withdraw in public, state the cause, rebuild, and change the procedure.

Scope

Class B incidents (Incident Response Plan).

Procedure

Open a corrections ticket at /corrections with: what was wrong, how it was found, which receipts are affected (ids), the cause.
Annotate each affected registry row withdrawn{at, ticket_id, reason}. Bodies and hashes are kept; the public receipt page shows the withdrawn banner. Nothing is deleted or edited in place.
Re-queue the affected rows; new receipts carry new ids and hashes and reference the ticket.
Notify any partner whose receipts were withdrawn, by email, the same business day.
Record the procedural change (code, test, SOP text) on the ticket. Close the ticket only when the rebuild is complete and the change is deployed.
A correction request from the public or a customer is acknowledged within one business day and handled by this procedure or answered with why no change is made.

Records this procedure produces — and who keeps them current

Record	Where	Updated by	Update trigger	Retention	Public
Corrections ticket	`db.corrections (/corrections)`	owner	any Class B finding or request	indefinite	True
Withdrawal annotation	`receipt_registry.withdrawn`	owner via remediation endpoint	per ticket	indefinite	True

Evidence

/corrections · /api/trust/policies/incident-response

Change log

Date	Change
2026-10-03	Exercised: PB-CCN-307B0E, 181 receipts withdrawn and rebuilt.
2026-10-06	Written as SOP.
2026-10-08	Owner adopted Ed25519 signatures on the audit log (entity-resolution / provenance memo). Every new corrections-log entry carries a detached signature over its hash under the platform key published in the DID document (SOP-11); GET /api/corrections/verify recomputes the chain and checks every signature. Entries older than the key are reported as unsigned, never back-signed.

Quality Manual · All SOPs · Records Register