A Lab- and Supplier-Aware Method for Constructing Confidence-Graded Cannabis Strain Terpene Fingerprints from Certificate-of-Analysis Data

Abstract

Aggregating cannabis Certificate-of-Analysis (COA) records into per-strain terpene "fingerprints" is attractive because it promises a data-driven chemotype for each named cultivar. However, naïve aggregation produces a within-strain consistency score that is confounded: a strain whose samples all originate from a single testing laboratory, or a single cultivator, will appear highly consistent simply because it reflects one laboratory's analytical calibration or one grower's single phenotype — not a reproducible property of the strain. We describe a method that (i) extracts terpene profiles from ~808k COA records using a dual-source strategy, (ii) canonicalises fragmented product-SKU strain labels into strain identities, and (iii) grades every resulting fingerprint on two independent replication axes — laboratory diversity (controlling analytical/methodological bias) and supplier diversity (controlling single-grow/genetic bias). Beginning from 489,702 flower-type records, we derived 107,531 usable terpene profiles spanning 26 laboratories and 243 suppliers. Canonicalisation reduced 17,118 raw strain strings to 7,877 strain identities and reclassified 43% of apparently single-laboratory fingerprints as genuinely multi-laboratory. We formalise a four-level trust tier (Gold/Silver/Bronze/Caution) in which the lowest-confidence class is precisely the single-supplier-and-single-laboratory case, and the highest requires independent agreement across both laboratories and suppliers. Applied to 2,915 strains with ≥5 samples, the method labels 584 (20.0%) Gold, 1,005 (34.5%) Silver, 81 (2.8%) Bronze, and 1,245 (42.7%) Caution. Merges are validated by cross-source terpene agreement (median cosine 0.986) and by the recovery of known chemotypes (e.g. Durban Poison → terpinolene-dominant) in the Gold tier.

1. Background and Motivation

A terpene fingerprint for a cannabis strain is the mean relative abundance of individual terpenes across many independent laboratory tests of that strain. The intuitive quality metric for such a fingerprint is within-strain consistency: if repeated samples of a strain yield the same relative terpene profile, the fingerprint is presumed reliable.

This metric has a critical failure mode. Consistency is high whenever the sources of variation are suppressed, regardless of why they are suppressed. Two distinct confounds can each suppress variation artefactually:

1. Analytical (laboratory) bias. If every sample of a strain is tested by one laboratory, systematic features of that laboratory's method — integration windows, reference standards, calibration — are shared by all samples. The observed consistency then measures the laboratory's repeatability, not the strain.
2. Single-grow (supplier) bias. If every sample originates from one cultivator, the samples may share a single phenotype, growing environment, or even a single harvest re-tested repeatedly. Consistency then measures that grow, not the strain as a genotype.

The two confounds are independent and require independent controls. Laboratory diversity controls (1). Supplier diversity controls (2). The genuinely low-confidence case is the conjunction — one supplier sending one strain to one laboratory — because neither confound is broken. Conversely, agreement among multiple independent suppliers, even at a single laboratory, is strong positive evidence about the strain's chemotype, because independent grows converging on the same profile cannot be explained by a shared phenotype.

This paper describes a reproducible pipeline that separates these axes and emits a confidence grade for each fingerprint accordingly.

2. Data Sources

Two exports of the same underlying COA corpus were used, both streamed with DuckDB to avoid loading in full:

• COA-archive.csv** (≈2.53 GB; 808,407 rows; 300+ columns) — the complete export, retaining laboratory and supplier identity fields (lab, lab_license_number, producer, producer_license_number`).
• COA-archive copy.TRIMMED.csv** (≈1.97 GB; 69 columns) — a column-reduced export that preserved parsed terpene columns and the results` JSON blob but dropped all laboratory and supplier identity. This file was sufficient for the initial (confounded) fingerprint build but not for the confidence analysis, which required re-reading identity fields from the full export.

A technical note relevant to reproducibility: DuckDB uses the RE2 regular-expression engine and does not support the PostgreSQL case-insensitive match operator (~*) or \y word boundaries; predicates were written with regexp_matches(col, pattern, 'i') and \b.

3. Methods

3.1 Sample selection (flower-type filter)

Fingerprints are meaningful only for intact plant material, whose terpene profile reflects the flower rather than added or processed material. Product types were classified by regular-expression predicates: an inclusion set matched intact material (flower, pre-roll, popcorn, shake, smalls, buds, nugs, ground, trim, whole, etc.) and an exclusion set removed processed or infused products (concentrate, vape, edible, distillate, rosin, hash, infused, oil, wax, etc.). Word-boundary matching prevented false positives (e.g. "buds" as a whole word, not a substring). This selected 43 product types and 489,702 records for extraction.

3.2 Terpene quantification (dual-source extraction)

Terpene values in the corpus are represented in two mutually exclusive ways across records: (a) dedicated per-analyte columns (alpha_pinene, beta_caryophyllene, …) and (b) a results JSON array of {key, value} objects using lab-varying analyte names. We extracted from both sources per record and merged them, with the typed columns taking priority. Lab-varying synonyms were unified to a canonical analyte set (~44 terpenes) — for example myrcene/beta_myrcene, limonene/d_limonene, and the caryophyllene isomers (e_/trans_/beta_caryophyllene) map to single canonical keys.

Values were parsed defensively: non-detects and below-limit flags (ND, <LLOQ, <LOD, N/A, blank) were coerced to 0.0, and negatives clamped to 0. A record was retained only if it carried at least 3 distinct detected terpenes (MIN_TERPENES = 3), yielding 107,531 usable profiles. Empirically, the column and JSON sources were mutually exclusive at the record level (no record met the threshold in both simultaneously), confirming that the dual-source strategy strictly increased coverage rather than duplicating it (99,642 profiles from columns; 7,977 from JSON).

3.3 Fingerprint representation

For sample i, the detected terpene vector tᵢ was normalised to a proportional profile pᵢ = tᵢ / Σtᵢ, so that a fingerprint describes the relative composition of the terpene bouquet and is invariant to overall potency. All downstream geometry operates on these proportion vectors.

3.4 Strain identity resolution and canonicalisation

Two problems degrade strain labels. First, the strain_name field is frequently blank; where absent, a strain was recovered from product_name by stripping weight, packaging, and product-type suffixes. Second — and more consequential — strain labels are heavily fragmented by product-SKU decoration, so that one strain appears under many surface strings (mac & cheese flower, mac & cheese small buds, mac & cheese trim, buds - mac & cheese #23219). Left unaddressed, this fragmentation manufactures single-source fingerprints, because each SKU variant tends to originate from one producer testing at one laboratory.

We therefore canonicalised strain strings by whole-token removal of three noise classes, preserving all remaining tokens (including pheno-distinguishing numbers such as gg4, mac 1, chem 91):

• Product form (flower, bud(s), smalls, popcorn, shake, trim, preroll, …);
• Packaging / process / QA (bulk, sample, test(ing), lot, batch, fresh, frozen, …);
• Batch / lot / SKU codes (e.g. #23219, six-digit date-batch codes 090823b141, internal SKUs absjf01), removed by pattern.

Short parenthetical grade/cultivator codes ((k), (h), (trim)) and residual generic names (pure-numeric strings; hybrid/indica/sativa) were also removed or dropped. This constitutes Tier A canonicalisation and is safe by construction: nothing it removes is strain identity.

An optional Tier B additionally strips a curated allowlist of producer/facility codes (trb, tcvg, tcs, curaleaf, fth, sst, fo). Automatic brand detection was deliberately rejected: because some markets funnel nearly all testing to one laboratory, any leading token — including genuine strain words (hawaiian, triangle, mochi) — appears ≥85% concentrated in one laboratory, so a concentration-based detector conflates market concentration with brand concentration and would over-merge distinct strains. Only human-verified codey tokens are stripped; all ambiguous candidates are left intact and reported for review. The published asset keys on Tier A.

Canonicalisation reduced 17,118 raw strain strings to 7,877 canonical strain identities.

3.5 Consistency metric

All agreement scores use mean cosine similarity to a centroid. For a set of proportion vectors {v₁ … vₙ} with centroid c̄ = (1/n)Σvⱼ:

consistency = (1/n) Σⱼ cos(vⱼ, c̄)

This is applied at three levels:

• Within-strain consistency — {vⱼ} are the individual sample profiles pᵢ of the strain (the original, confounded metric).
• Cross-laboratory consistency (xlab) — {vⱼ} are the per-laboratory mean profiles: profiles are averaged within each laboratory first, so the score measures whether different laboratories agree.
• Cross-supplier consistency (xsup) — {vⱼ} are the per-supplier mean profiles, measuring whether different growers agree.

Cross-source scores are defined only when an axis has ≥2 sources. Averaging within a source before comparing across sources is the key step that turns a variance measurement into an independence measurement.

3.6 Source identity: laboratory and supplier

Laboratory. The correct identity grain is the normalised laboratory name (lab; 80 organisations corpus-wide, 26 in the terpene subset). The field lab_id was found to have ~20,631 distinct values — a per-sample identifier, not a laboratory — and was discarded; lab_license_number (272 values) distinguishes physical locations of the same organisation and was retained only as a fallback.

Supplier. Supplier identity is taken from the cultivator field producer, normalised by lower-casing, whitespace collapse, and removal of legal-entity suffixes (llc, inc, corp, …), with producer_license_number as a fallback. Within the flower/terpene subset, supplier identity was resolvable for 100% of usable records, yielding 243 distinct suppliers. Manual inspection confirmed these are distinct real cultivators (e.g. Tahoe-Reno Botanicals, Nevada Pure, Acres Cultivation) rather than artefacts of over-normalisation.

3.7 Two-axis confidence model and trust tiers

For each strain with ≥5 samples we compute, per axis, the number of distinct sources (n_labs, n_suppliers), the share held by the largest source (top_lab_frac, top_supplier_frac), and the cross-source consistency (xlab, xsup). An axis is deemed corroborated when it has independent replication and those replicates agree:

corroborated(axis) ⇔ (nₛₒᵤᵣ𝒸ₑₛ ≥ 2) ∧ (cross-consistency ≥ τ), with τ = 0.90.

The trust tier follows directly:

Crucially, single-laboratory status alone no longer implies low confidence: a single-laboratory strain corroborated across suppliers is Silver, and only the single-supplier-and-single-laboratory conjunction is Caution.

3.8 Validation strategy

Two adversarial checks guard against the principal failure mode of canonicalisation — over-merging distinct strains into one label:

1. Cross-source coherence of merges. If canonicalisation merged unrelated strains, the merged groups would show low cross-source terpene agreement. We therefore examine the distribution of xlab/xsup among newly multi-source strains and flag any below 0.85 as a review set.
2. External chemotype recovery. The highest-confidence (Gold) fingerprints are checked against independently known strain chemotypes; recovery of textbook profiles (e.g. terpinolene-dominant landraces) is positive evidence that merges reflect real biology.

4. Results

Pipeline yield. 489,702 flower-type records → 107,531 usable terpene profiles (≥3 terpenes and a resolvable strain) → 2,915 strains with ≥5 samples after canonicalisation.

The confound, quantified. Under raw (un-canonicalised) labels, 2,431 of 4,079 fingerprints (59.6%) were single-laboratory; only 3.6% were "lab-robust" (no laboratory holding >50% of samples). The apparently high consistency of these fingerprints was therefore not laboratory-independent.

Effect of canonicalisation. Collapsing product-form, lot-code, and SKU decoration reduced the single-laboratory share to 47.9% and reclassified 1,050 of the 2,431 (43%) apparently single-laboratory fingerprints as genuinely multi-laboratory once fragmentation was removed. Strains corroborated by ≥3 laboratories rose from 380 to 542. Over-merge validation was reassuring: newly multi-laboratory strains had median cross-laboratory cosine 0.986 (10th percentile 0.930), with only 35 of 1,524 (2.3%) below 0.85 — and inspection showed these to be genuinely variable real strains (e.g. AK-47, Pineapple Express) rather than bad merges.

The supplier axis. Adding supplier identity changed classifications in both directions:

• 146 single-laboratory strains were promoted from Caution to Silver because ≥2 independent suppliers agreed on the profile (e.g. Cap Junky: 1 laboratory, 7 suppliers, xsup = 0.972).
• 839 multi-laboratory strains were found to rest on a single supplier — laboratory-robust but genetically un-replicated; this caveat is now surfaced through n_suppliers rather than hidden inside a high grade.
• 1,245 strains are single-supplier and single-laboratory — the true low-confidence set.

Final tier distribution (2,915 strains):

External validation. Gold-tier fingerprints recover known chemotypes: Durban Poison is terpinolene-dominant (47.6%), GG4 caryophyllene-dominant (41.8%), Super Lemon Haze terpinolene-dominant (37.0%). The archetypal Gold strain, Wedding Cake, is supported by 1,247 samples across 10 laboratories and 34 suppliers with xlab = 0.944 and xsup = 0.928 — a profile stable across both independent laboratories and independent growers.

5. Limitations

• Geographic skew. The terpene-reporting subset is heavily Nevada-weighted; supplier diversity is therefore largely intra-Nevada, and cross-supplier agreement is not yet a nationwide claim.
• Residual brand-as-strain labels. Strain resolution is name-based; a minority of canonical labels are brand names (e.g. Cookies, Almora Farm) rather than cultivars.
• Threshold choices. The minimum sample count (5), minimum terpene count (3), and agreement threshold (τ = 0.90) are defensible but not tuned against an external ground truth.
• Absolute calibration. Cross-supplier agreement at a single laboratory controls genetic replication but not that laboratory's absolute calibration; only the laboratory axis addresses calibration, which is why Gold requires both.
• Batch independence. Supplier diversity is a proxy for grow independence; distinct batches from one supplier are not separately credited.

6. Conclusion

Within-strain consistency is a necessary but insufficient quality signal for cannabis terpene fingerprints, because it is inflated whenever the sources of natural variation are suppressed rather than sampled. We identify two independent confounds — analytical (laboratory) bias and single-grow (supplier) bias — and show that they demand independent controls: laboratory diversity and supplier diversity. After canonicalising SKU-fragmented strain labels (which alone converts 43% of apparently laboratory-locked fingerprints into genuinely multi-laboratory ones), we grade each fingerprint on both axes and reserve the lowest confidence tier for the true degenerate case, a single supplier testing at a single laboratory. The resulting asset makes confidence explicit and filterable: consumers can restrict to Gold (independent agreement across both laboratories and growers) or Silver (one axis) and treat Caution profiles as the repeatability of a single grow-laboratory pair rather than as strain properties. The recovery of established chemotypes in the Gold tier, together with high cross-source agreement among merged strains and a small, inspectable disagreement tail, indicates that the graded fingerprints reflect reproducible strain-level chemistry rather than the fingerprint of any one laboratory or grower.

Appendix: Reproducibility

Pipeline stages, each a standalone script under scripts/, with intermediate caches to avoid re-scanning the 2.5 GB source:

Parameters: MIN_SAMPLES = 5, MIN_TERPENES = 3, agreement threshold τ = 0.90. Consistency is mean cosine similarity to the centroid at the sample, per-laboratory-mean, and per-supplier-mean levels.