Sampleboard

Problem

Sample data is recorded where the work happens — a plant PC, often with no usable connection — and the data is confidential. The values, the limits they are checked against, and the trend they form are not for whoever happens to sit down at that machine. Spreadsheets handle neither constraint well: the file sits unencrypted, limits are checked by eye against a table somebody typed once, and the numbers sent to the group chat are retyped by hand.

What it does

Sampleboard records, checks and presents IPAL sample data on a single Windows PC, with no network dependency at any point.

• Offline in the literal sense. No CDN, no telemetry, no auto-update; requests to anything outside the local machine are blocked.
• Encrypted at rest. The database is SQLCipher. Without the admin password or the recovery code the file is unreadable — including on a lost USB stick, since the portable build uses the same encrypted store.
• Two passwords, one for each audience. The app password unlocks the local database; the save-file password is set per export and belongs to whoever receives the file. The recovery code is shown once at setup and stored nowhere.
• A judgement it will not fake. Every value is checked against a min/max limit for its sampling point and parameter. A value with no confirmed limit is marked belum ada batas and is never counted as a pass.
• Reporting that fits where it is sent. A 1080×1350 image and a ready-to-send caption for the daily WhatsApp update, rendered offscreen so the output is identical every time.
• History that is not overwritten. A correction soft-deletes the old result and links the new one to it with a reason, and limits are versioned — a result is judged by the limit in force when it was sampled. Every action lands in the audit log.

Approach

The binding constraint was the threat model, not the feature list. The data has to survive a machine other people use, so the password protects the file rather than the screen: one random master key encrypts the database and is stored wrapped twice — once by the password, once by the recovery code — so changing the password rewraps a slot instead of rewriting data. Auto-lock and the audit log cover what encryption cannot: a machine left unlocked.

The second decision was to keep the offline promise literal. Import, validation, charting and image rendering all run locally, which is what makes the app usable in the room where samples are taken — and what makes the confidentiality claim defensible.

Status

Building. Version 0.1.0 is packaged as an NSIS installer and a portable executable; entry, the limit engine, history and save files are implemented and self-tested, and import from the lab’s original export files is the outstanding piece. Distribution is deliberately narrow: there is no public download, and the installer link goes only to approved requesters.