FlyPackCAMO Software
ML.A.305 · Records · Audit trail

Documents, records and the audit trail

Records are only evidence if they can be shown to be unchanged. Every stored file carries a fingerprint that is checked again later; the records of an aircraft can be handed over as one file; and the audit trail shows what changed, who changed it and when — with no way to tidy it.

  • Documents filed by kind, with reference, revision and revision date.
  • Each stored file is fingerprinted and re-verified; a file that has changed or gone missing is reported, not hidden.
  • The records transfer package: status, programme, directives, components and release history, in one export.
  • The audit trail, newest first, filtered by kind of record, person, action, aircraft and date range.
camo.flypack.net — Documents & audit

Documents filed against YR-BUC.

Documents, and the records as a file

From the FlyPack CAMO manual

Documents on an aircraft

Aircraft → the aircraft → Documents.

Add document asks for:

FieldNotes
KindFrom the register — see below. The list changes with where you are filing
Title
Reference
RevisionRev 7
Revision date
Next revision check dueThe register flags it when the check falls due
FilePDF, image or office document, up to 25 MB. Optional — the entry can be recorded now and the paper scanned later

The kinds it knows

Filed against the organisation: exposition (CAME/CAO), procedure, management contract.

Filed against an aircraft: maintenance manual, illustrated parts catalogue, aircraft flight manual, structural repair manual, component maintenance manual, weight and balance report, supplier invoice, certificate of conformity or analysis, airworthiness release (EASA Form 1 / FAA 8130-3), and other.

The dialog offers only the ones that fit where you are: an exposition cannot be filed against an aeroplane, and a flight manual cannot be filed against the organisation.

Verify files checks that every document on record is still present in storage — a reference in the database pointing at a file that is gone is the failure this catches, and it is silent until somebody looks.

A document can be superseded by a new revision rather than replaced. The old revision stays; "That revision has already been superseded" is what you see if two people supersede the same one at once.

PDF opens a document in the viewer, tall on purpose — a bulletin is read, not glanced at. Open in a tab if you would rather have it full size.

The records as a file

Organisation info → the records as a file.

ButtonWhat it produces
Download a backupEverything this organisation holds, as one archive
One aircraftOne aircraft's records, for a transfer
Save to Google DriveThe same archive, to a connected Drive
Restore from a filePuts an archive back, into a new organisation

A backup downloads as flypack-camo-backup-…zip, one aircraft's records as flypack-camo-records-…zip. Save to Google Drive puts it in a folder called FlyPack CAMO backups; a folder made before the rename, AirSight backups, is renamed to that on the next save rather than left beside a new one, so a year of backups stays in one place.

An export is the answer to an obligation that is yours whatever you have paid us, which is why it keeps working on a read-only organisation whose trial has ended.

Restore always creates a new organisation. It never writes into an existing one, so a restore cannot overwrite anything, and a restored organisation is marked as one — with the date the backup was taken — so nobody mistakes a copy for the original. Discard it removes a restored copy; it is the only thing in the application that may be discarded.

What a stored file is, and how it can change

A file is stored once, under its own id, with its size and a hash of its bytes, and nothing that points at it ever has to be told where it went. Every read checks the file is still the file the record describes, and a mismatch is flagged rather than hidden.

One thing may change a stored file after the fact: the pages kept of a delivery's paperwork, chosen on the receive form. The file is cut down in place — same id, same name, new size and hash — so the lot that points at it goes on pointing at the right thing. Nothing else rewrites a file.

When an aircraft leaves

End management on the aircraft, which asks when it ended, why, and where the records went. It refuses a date in the future, and it refuses a blank reason:

"Say why management ended — it is the first thing asked at the next audit."

The aircraft is archived rather than deleted. Its records are retained and stay findable, and Resume management brings it back if it was archived by mistake.

Build on the records-transfer card produces the pack of records to hand over.

Audit trail

From the FlyPack CAMO manual

The audit trail. Nothing in it can be edited or removed, by anybody.

Every change the organisation has recorded, newest first: what changed, who changed it, and when. Nothing in it can be edited or removed, by anybody — a trail that can be tidied is not evidence of anything.

Who can see it

Administrators, the accountable manager, and whoever holds compliance. Not certifying staff or pilots: they produce the records, and reading back what every colleague did across the whole organisation is a separate privilege.

Somebody without one of those roles will not see the menu item, and the help panel will not read the trail on their behalf — it relays the refusal rather than answering the question from somewhere else.

The filters

Six, in two rows:

FilterWhat it narrows to
Kind of recordAircraft, defect, work pack, organisation… with a count beside each
WhoOne colleague, with their count
What happenedCreate, Update, Delete, Sign, Export
AircraftOne aeroplane's records — the question asked at a review
From / ToA date range, inclusive of the whole of the named day

When it is filtered to one aircraft the page says so, because the counters at the top go on counting the whole organisation — a page reading "89 changes" above a list of one is how somebody quotes the wrong number.

What a row shows

Folded shut: what changed, when, who, and how many fields.

Opened, an edit shows a field-by-field table — what it was, what it became. Long values are folded so one pasted note cannot hide a day of history.

A creation or deletion shows the record instead, in two blocks: what was there and what was recorded. On a deletion the first is the only description left of the thing that is gone, so it is shown in full. An earlier version showed only the second, and a deleted organisation read "Deleted: true" while saying nothing about what had been deleted.

Underneath: the kind of record and its id, and the address the change came from. A change made from the platform console rather than by somebody inside the organisation says so.

The reasons

Where the application demanded a reason, it is here: correcting an aircraft's counters, amending a flight, withdrawing a defect, ending management, changing a stock quantity. That is what those mandatory fields are for — the reason is useless at the moment of typing and is the whole answer six months later.

Paging

Show older changes appends rather than repainting. Somebody five pages into a trail scrolled there deliberately, and starting them at the top again is the fastest way to make a screen useless. When there is no more, it says "That is the whole trail."