Skip to content
LQMS
ADR-0074: PDF Export of Released Documents — Server-Side via Apache FOP over the Canonical Projection
Initializing search
nburri/lqms
LQMS
nburri/lqms
Home
Evaluate LQMS
Evaluate LQMS
LQMS Known Limits
LQMS Security Posture
Architecture
Architecture
1. Introduction and Goals
2. Architecture Constraints
3. Context and Scope
4. Solution Strategy
5. Building Block View
6. Runtime View
7. Deployment View
8. Crosscutting Concepts
9. Architecture Decisions
10. Quality Requirements
11. Risks and Technical Debt
12. Glossary
The arrival bundle format
Decisions (ADRs)
Decisions (ADRs)
ADR-0001: Content-Addressed Document Storage with PostgreSQL as Source of Truth
ADR-0002: Single Instance with Scope Hierarchy and Copy-on-Derive
ADR-0003: Fixed Life Cycle States with Configurable Review Processes
ADR-0004: Global Catalogs for Roles and Document Types with Per-Scope Activation
ADR-0005: Modular Monolith
ADR-0006: Three-Layer Search with In-Database Index and Pluggable LLM
ADR-0007: Angular Frontend with Server-Side-Only Enforcement
ADR-0008: Flyway Migrations and jOOQ Codegen from the Migrated Schema
ADR-0009: RLS Enforcement via a Session-Scoped Authorized Scope Set
ADR-0010: Self-Managed QMS via an Internal Mandator
ADR-0011: Authentication via OIDC SSO with Server-Side (BFF) Sessions
ADR-0012: Permission-Based Authorization and System Bootstrap
ADR-0013: User Identity Lifecycle
ADR-0014: Electronic Signatures (Part 11 / Annex 11-Capable)
ADR-0015: Document Effectivity, Periodic Review & Validity
ADR-0016: Data Retention, Disposal & Privacy (FADP / GDPR)
ADR-0017: Multi-Part Version Content
ADR-0018: Non-Functional Targets (Capacity, Availability, Security)
ADR-0019: Notifications & Tasks
ADR-0020: Internationalization (Content Language, Time Zones, Formatting)
ADR-0021: General Typed Document Relationships
ADR-0022: Read-Acknowledgement & Questionnaires
ADR-0023: Migration / Import — Current Released State
ADR-0024: Draft / In-Review Cancellation
ADR-0025: Disposal & Erasure Mechanics (Storage, Index, Backups)
ADR-0026: RLS Runtime Safety — Connection-Pool Scope Isolation
ADR-0027: RLS Boundary — Content-Plane vs Control-Plane
ADR-0028: Stateless Encrypted Token-State Cookie (no server-side session store)
ADR-0029: Document Content Model — Draft-Freeze, Content-Table RLS, Append-Only Audit
ADR-0030: Review & Life-Cycle Realization Model
ADR-0031: Released-base readability enforcement & copy-on-derive mechanics
ADR-0032: Frontend realization — Quinoa, Angular Material, i18n & E2E
ADR-0033: CSRF control for the BFF session — SameSite + JSON content-type
ADR-0034: Notification realization — in-process domain events + system-context fan-out
ADR-0035: Fan-out contract as shipped — gate semantics, count disclosure, audit protocol
ADR-0036: Repository layer — services carry rules, repositories carry jOOQ
ADR-0037: Task scheduler — in-process tick, advisory-lock election, SQL sweep
ADR-0038: Periodic-review realization — derived due date, policy-gated confirmation
ADR-0039: Sweep & periodic-review contract as shipped — grants, guards, addressing
ADR-0040: Disposal-due surfacing — closure-anchored retention, scope-level legal hold
ADR-0041: Email channel & notification i18n — notification-as-outbox, structured messages
ADR-0042: Disposal execution — document tombstoning, single-actor hard-gated destruction
ADR-0043: Disposal blob deletion is post-commit, GC-backstopped
ADR-0044: Search FTS baseline — event-indexed, RLS-scoped search_index
ADR-0045: Image Attachments as Content Parts (Rich-Content Slice R2)
ADR-0046: Four-Eyes — Submitter Excluded from Approval
ADR-0047: Four-Eyes — Submitter-Only Exclusion
ADR-0048: Document Organization — Folder Tree per Scope
ADR-0049: Content Model Round 2 — Type Categories, Template Instantiation, Trace Relations, Completeness Rules
ADR-0050: Live Frontend — SSE State Push, CodeMirror 6, Draft Presence
ADR-0051: In-Text Document Links (doc: Scheme)
ADR-0052: Addressees & Read-Acknowledgement (REQ-TRN Realization)
ADR-0053: Addressees Per Document + Process Owner (amends ADR-0052 K-1)
ADR-0054: Process Owner Is a Role (amends ADR-0053 P-3)
ADR-0055: WYSIWYG Editing Mode over Markdown (editor step R4)
ADR-0056: Visual-Editor Chrome via Milkdown Crepe (gated adoption)
ADR-0057: Content Record Is the ProseMirror Document Tree; Markdown Becomes a Derived Projection
ADR-0058: PM_DOC Is the Only Content Format (pre-production cut; amends ADR-0057 §5)
ADR-0059: Editor Engine Switches to TipTap (spike-gated; supersedes the Milkdown/Crepe choice)
ADR-0060: Backup & Restore — Scripted Ordered Backup with Automated Restore Rehearsal
ADR-0061: CSV — Generated Validation Package per Release
ADR-0062: SBOM — CycloneDX over the Production Layers, Validated Against the Artifact
ADR-0063: User Identity Binds on Subject Only (Issuer Becomes Provenance)
ADR-0064: Per-Document Workflow Role Bindings (Author / Reviewer / Releaser), Enforced
ADR-0065: Diagrams — Excalidraw as the Manual Layer, Mermaid Stays for Text-First/UML
ADR-0066: WITHDRAW — the Author Side May Reclaim a Version from Review
ADR-0067: Review Comments — Anchored, Immutable, Resolvable
ADR-0068: Confluence/Jira QMS Import — Staged, Read-Only, Repeatable
ADR-0069: Arbitrary File Attachments — Download-Only Confinement
ADR-0070: Training Questionnaires — Versioned, Auto-Scored, Release-Gated
ADR-0071: Training Plans — Document Obligations + External Trainings & Certifications
ADR-0072: Diagrams — Self-Hosted draw.io Replaces Excalidraw
ADR-0073: Per-Scope QMS Configuration Surface
ADR-0074: PDF Export of Released Documents — Server-Side via Apache FOP over the Canonical Projection
ADR-0074: PDF Export of Released Documents — Server-Side via Apache FOP over the Canonical Projection
Table of contents
Context
The library question (the real investigation)
The render-source question
Decision
Consequences
Clarification (2026-07-19): the distribution-control footer wording
Addendum (2026-07-19): PDF navigation (in-doc, cross-file, merged) — contexts of the one renderer
Clarification (2026-07-20): the derived-traceability annex on risk-defining exports
ADR-0075: Source History Import — Continuity Without Forged Audit
ADR-0076: Periodic-review status visibility (completing MVP gap #2)
ADR-0077: Requirement Items — Keyed Blocks Inside Controlled Documents
ADR-0078: Generalized Trace Items (Traceability Model — Stage A)
ADR-0079: Risk & Risk-Control Items (Traceability Model — Stage B)
ADR-0080: Traceability Workspace — Hub, Sub-Pages, and Role-Gated Views
ADR-0081: Draft-Only Trace-Structure Changes, Server-Enforced
ADR-0082: Table-Shaped Risk Authoring over Risk Blocks
ADR-0083: The TD Dossier — a Versioned, Cross-Scope, Regulatory-Structured Deliverable
ADR-0084: Validation & Regulatory Axes (Traceability Model — Stage C)
ADR-0085: Relation-Layer Consolidation — One Trace Vocabulary, One Surface
ADR-0086: Requirement Traceability Chains — End-to-End Path View + Flat Path Export
ADR-0087: The Scope Traceability Report — One Derived Overview Artifact, Never a Controlled Document
ADR-0088: Verification Evidence Classes — Planned vs. Verified, Derived at the Read Layer
ADR-0089: Recurring Obligations — Periodic Tasks With Record Evidence, Not Calendar Series
ADR-0090: Release & Versioning Policy — Deliberate Releases, One Auditor-Facing Number
ADR-0091: Release Modes — Single-Person Record Release With a Structural Four-Eyes Floor
ADR-0092: Orphan-Blob Garbage Collection With a Quarantine Bin
ADR-0093: One Scope Context — the Toolbar Switcher Is the Only Scope Selector
ADR-0094: Calendar-Anchored Obligation Schedules (Clamped, Never Too Late)
ADR-0095: Key-Rule Governance — Free Until First Use, Then Frozen
ADR-0096: Transition Permissions — Always Visible, Deny Unless Granted
ADR-0097: A Governed Provisioning Surface — MANAGE_SCOPES
ADR-0098: Org Chart × Role System — Marriage at the Evidence Level, Never in Authorization
ADR-0099: The User Manual is an In-App Topic Reference, Not a Document
ADR-0100: LQMS Is the Living Quality Management System
ADR-0101: The Executable Validation Journey (PQ Evidence That Cannot Drift)
ADR-0102: Typed Template Variables (text | date | number — and Deliberately No Enum)
ADR-0103: npm audit Joins the Verification Gate as a Second Standing Input
ADR-0104: The Issued Dossier Is a Persisted Artifact of Record — and Clones to a New Draft
ADR-0105: Navigation Information Architecture — Group by Moment-of-Use
ADR-0106: The Client Reflection Follows Assignments, Not Only Content Reach
ADR-0107: The Audit Append Gate Follows Assignment Reach, Not Content Reach
ADR-0108: Mandator Membership — Invite-Accept, with Pre-Assigned Responsibilities
ADR-0109: Organization Founding Is Its Own Process
ADR-0110: The Audit Trail Is Not a Read Model
ADR-0111: The Imported-Person Model, and Project Portability's First Doctrines
ADR-0112: The Element-Kind Catalog — Semantics in the Model, Not Only in the Code
ADR-0113: Project Arrival Import — Records Arrive as They Are, People Arrive as They Were
ADR-0114: The Operating Model Arrives — Roles as Functions, Names as Words, People as This Instance's Decision
ADR-0115: Collaborative Draft Editing — Two Carets, One Truth, Honest Credit
ADR-0116: The System Maintenance Surface — the App Backs Itself Up, the Host Keeps One Dumb Job
ADR-0117: Role Documentation — a Link, a Finding, Per-Source Recognizers; Substitution Rejected
ADR-0118: The Offline QMS Copy — the Repo Carries the Audit Pack, Not a Second Renderer
ADR-0119: Module-Internal Package Structure — Capabilities First, Layers Second, the Root Is the Surface
ADR-0120: The Shared Kernel — the Domain-Exception Vocabulary Leaves the Authorization Module
ADR-0121: The Project Administrator Role — Per-Scope Administration With Read Access, Seeded in the Base Catalog
ADR-0122: Organization-Level Administration — the Cascade Stays, Becomes Visible, and Founds Projects
ADR-0123: Draft Save-Points — Every Save Restorable, Kept for the Life of the Version
ADR-0124: The Birth Path Completes Without Borrowing Content Clothes
ADR-0125: The Export Twin — Export Emits an Arrival Bundle
ADR-0126: Project Dissolution — the Un-Birth of an Unused Scope
ADR-0127: The Base-QMS Layers — One Library, Derived Adaptations, Local Records
ADR-0128: The GLOBAL Cascade Carries Administration, Never Content
ADR-0129: Role Identity from a GLOBAL Assignment Acts in GLOBAL Alone
ADR-0130: Break-Glass — the Project Administrator's Escalation Is a First-Class, Witnessed, Self-Expiring Act
ADR-0131: Role Substitution as Declared Adoption Edges — Emergency Cover Is Governed, Own-Name, Timed Staffing
ADR-0132: Dual-Hat Reviewer Satisfaction Is a Declared Policy Choice — the Strict Floor Stays the Default
ADR-NNNN:
</span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_5" > <div class="md-nav__link md-nav__container"> <a href="../../requirements/" class="md-nav__link "> <span class="md-ellipsis"> Requirements </span> </a> <label class="md-nav__link " for="__nav_5" id="__nav_5_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_5_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_5"> <span class="md-nav__icon md-icon"></span> Requirements </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../requirements/stakeholder_requirements/" class="md-nav__link"> <span class="md-ellipsis"> Stakeholder Requirements </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/gap-analysis/" class="md-nav__link"> <span class="md-ellipsis"> Requirements Gap Analysis </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_admin/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Administration, Permissions & Onboarding </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_api_ui/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: API & User Interface </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_audit_reporting/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Audit Trail & Regulatory Reporting </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_auth/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Authentication & Session </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_backup/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Backup & Restore </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_catalogs/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Catalogs, Roles & Users </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_data_protection/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Data Protection, Retention & Disposal </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_documents/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Documents, Versions & Storage </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_dossiers/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Technical Documentation Dossiers </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_effectivity/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Effectivity, Periodic Review & Validity </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_gspr/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Regulatory Conformity (GSPR / Essential Principles) </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_i18n/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Internationalization </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_lifecycle/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Life Cycle & Reviews </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_memberships/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Mandator Membership & Invitations </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_migration/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Migration & Import </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_nfr/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Non-Functional </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_notifications/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Notifications & Tasks </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_obligations/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Recurring Obligations </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_relationships/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Document Relationships </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_risk/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Risk Management (ISO 14971 Hazards & Controls) </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_sbom/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Software Bill of Materials & Supply-Chain Assurance </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_search/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Search </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_separation/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Scopes, Mandators & Separation </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_signatures/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Electronic Signatures </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_training/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Read-Acknowledgement & Questionnaires </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_users/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: User Identity & Lifecycle </span> </a> </li> <li class="md-nav__item"> <a href="../../requirements/req_validation/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Design Validation & the Validation Traceability Axis </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_6" > <div class="md-nav__link md-nav__container"> <a href="../../process/" class="md-nav__link "> <span class="md-ellipsis"> Process (IEC 62304) </span> </a> <label class="md-nav__link " for="__nav_6" id="__nav_6_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_6_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_6"> <span class="md-nav__icon md-icon"></span> Process (IEC 62304) </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../process/configuration_management_plan/" class="md-nav__link"> <span class="md-ellipsis"> Configuration Management Plan </span> </a> </li> <li class="md-nav__item"> <a href="../../process/problem_resolution/" class="md-nav__link"> <span class="md-ellipsis"> Problem Resolution Process </span> </a> </li> <li class="md-nav__item"> <a href="../../process/risk_management/" class="md-nav__link"> <span class="md-ellipsis"> Risk Management </span> </a> </li> <li class="md-nav__item"> <a href="../../process/software_development_plan/" class="md-nav__link"> <span class="md-ellipsis"> Software Development Plan </span> </a> </li> <li class="md-nav__item"> <a href="../../process/verification_plan/" class="md-nav__link"> <span class="md-ellipsis"> Verification Plan </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_7" > <label class="md-nav__link" for="__nav_7" id="__nav_7_label" tabindex="0"> <span class="md-ellipsis"> Operations </span> <span class="md-nav__icon md-icon"></span> </label> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_7_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_7"> <span class="md-nav__icon md-icon"></span> Operations </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../operations/genesis-installation/" class="md-nav__link"> <span class="md-ellipsis"> Genesis: Birthing an LQMS Installation with a Base Library </span> </a> </li> <li class="md-nav__item"> <a href="../../operations/deployment/" class="md-nav__link"> <span class="md-ellipsis"> LQMS Deployment Guide </span> </a> </li> <li class="md-nav__item"> <a href="../../operations/server-deployment/" class="md-nav__link"> <span class="md-ellipsis"> LQMS Server Deployment (single Linux host, public HTTPS) </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_8" > <div class="md-nav__link md-nav__container"> <a href="../../traceability/" class="md-nav__link "> <span class="md-ellipsis"> Traceability </span> </a> <label class="md-nav__link " for="__nav_8" id="__nav_8_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_8_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_8"> <span class="md-nav__icon md-icon"></span> Traceability </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../traceability/matrix/" class="md-nav__link"> <span class="md-ellipsis"> Requirements Traceability Matrix </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_9" > <div class="md-nav__link md-nav__container"> <a href="../../validation/" class="md-nav__link "> <span class="md-ellipsis"> Validation (tool lane) </span> </a> <label class="md-nav__link " for="__nav_9" id="__nav_9_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_9_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_9"> <span class="md-nav__icon md-icon"></span> Validation (tool lane) </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../validation/templates/ai-authorship-posture/" class="md-nav__link"> <span class="md-ellipsis"> AI-Authorship Posture — How LQMS Is Built, and Why the Validation Evidence Does Not Rest on It (TEMPLATE) </span> </a> </li> <li class="md-nav__item"> <a href="../../validation/templates/intended-use/" class="md-nav__link"> <span class="md-ellipsis"> Intended-Use Specification — LQMS as a QMS / Document-Control Tool (TEMPLATE) </span> </a> </li> <li class="md-nav__item"> <a href="../../validation/templates/tool-risk-assessment/" class="md-nav__link"> <span class="md-ellipsis"> Tool-Risk Assessment — LQMS as a QMS Tool (TEMPLATE) </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_10" > <label class="md-nav__link" for="__nav_10" id="__nav_10_label" tabindex="0"> <span class="md-ellipsis"> Regulatory </span> <span class="md-nav__icon md-icon"></span> </label> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_10_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_10"> <span class="md-nav__icon md-icon"></span> Regulatory </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../regulatory/mdr-annex-i-skeleton/" class="md-nav__link"> <span class="md-ellipsis"> MDR Annex I — GSPR authoring skeleton (paraphrased) </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_11" > <div class="md-nav__link md-nav__container"> <a href="../../user-guide/" class="md-nav__link "> <span class="md-ellipsis"> User guide </span> </a> <label class="md-nav__link " for="__nav_11" id="__nav_11_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_11_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_11"> <span class="md-nav__icon md-icon"></span> User guide </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../user-guide/tutorial/" class="md-nav__link"> <span class="md-ellipsis"> Tutorial — from zero to a released document </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/administration/" class="md-nav__link"> <span class="md-ellipsis"> Administering an LQMS Installation </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/diagrams/" class="md-nav__link"> <span class="md-ellipsis"> Diagrams </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/documents-lifecycle/" class="md-nav__link"> <span class="md-ellipsis"> Documents & the Lifecycle </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/exports/" class="md-nav__link"> <span class="md-ellipsis"> PDF Exports & the Audit Pack </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/obligations/" class="md-nav__link"> <span class="md-ellipsis"> Recurring Obligations </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/project-context/" class="md-nav__link"> <span class="md-ellipsis"> The Project Context & App Version </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/review-comments/" class="md-nav__link"> <span class="md-ellipsis"> Review Comments </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/activity-trail/" class="md-nav__link"> <span class="md-ellipsis"> Who did what, when — reading a project's activity </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/admin-scopes/" class="md-nav__link"> <span class="md-ellipsis"> Renaming a project, and what can never change </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/authority-view/" class="md-nav__link"> <span class="md-ellipsis"> Who holds each function here, and what may it do </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/break-glass/" class="md-nav__link"> <span class="md-ellipsis"> The permission I need is held by a role I do not hold — what now? </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/coverage-and-chains/" class="md-nav__link"> <span class="md-ellipsis"> Coverage or chains? — which requirement view answers your question </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/credentials/" class="md-nav__link"> <span class="md-ellipsis"> Your password: changing it, resetting it — and why LQMS never sees it </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/emergency-cover/" class="md-nav__link"> <span class="md-ellipsis"> Who may cover for whom here — declaring emergency cover, and reading where the glass was broken </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/key-rules/" class="md-nav__link"> <span class="md-ellipsis"> Special elements: what a project declares, and when its names freeze </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/memberships/" class="md-nav__link"> <span class="md-ellipsis"> Belonging to an organization: invitations, acceptance, and what they change </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/provisioning-birth-path/" class="md-nav__link"> <span class="md-ellipsis"> How a new organization and project are born </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/review-policies/" class="md-nav__link"> <span class="md-ellipsis"> What a review policy controls, and what an empty grant means </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/setup-wizard-lanes/" class="md-nav__link"> <span class="md-ellipsis"> The setup wizard: the lanes, and what it writes </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/staffing-and-assignments/" class="md-nav__link"> <span class="md-ellipsis"> Staffing people into roles, and the accountable holder </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/technical-dossier/" class="md-nav__link"> <span class="md-ellipsis"> How do I assemble a technical dossier? </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/trace-items/" class="md-nav__link"> <span class="md-ellipsis"> Trace Items — Requirements, Risks & Risk Controls </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/trace-links/" class="md-nav__link"> <span class="md-ellipsis"> Trace Links & the Suspect Cycle </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/traceability-workspace/" class="md-nav__link"> <span class="md-ellipsis"> The Traceability Workspace </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/training/" class="md-nav__link"> <span class="md-ellipsis"> Training & Acknowledgements </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component="sidebar" data-md-type="toc" > <div class="md-sidebar__scrollwrap"> <div class="md-sidebar__inner"> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class="md-nav__title" for="__toc"> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class="md-nav__list" data-md-component="toc" data-md-scrollfix> <li class="md-nav__item"> <a href="#context" class="md-nav__link"> <span class="md-ellipsis"> Context </span> </a> <nav class="md-nav" aria-label="Context"> <ul class="md-nav__list"> <li class="md-nav__item"> <a href="#the-library-question-the-real-investigation" class="md-nav__link"> <span class="md-ellipsis"> The library question (the real investigation) </span> </a> </li> <li class="md-nav__item"> <a href="#the-render-source-question" class="md-nav__link"> <span class="md-ellipsis"> The render-source question </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item"> <a href="#decision" class="md-nav__link"> <span class="md-ellipsis"> Decision </span> </a> </li> <li class="md-nav__item"> <a href="#consequences" class="md-nav__link"> <span class="md-ellipsis"> Consequences </span> </a> </li> <li class="md-nav__item"> <a href="#clarification-2026-07-19-the-distribution-control-footer-wording" class="md-nav__link"> <span class="md-ellipsis"> Clarification (2026-07-19): the distribution-control footer wording </span> </a> </li> <li class="md-nav__item"> <a href="#addendum-2026-07-19-pdf-navigation-in-doc-cross-file-merged--contexts-of-the-one-renderer" class="md-nav__link"> <span class="md-ellipsis"> Addendum (2026-07-19): PDF navigation (in-doc, cross-file, merged) — contexts of the one renderer </span> </a> </li> <li class="md-nav__item"> <a href="#clarification-2026-07-20-the-derived-traceability-annex-on-risk-defining-exports" class="md-nav__link"> <span class="md-ellipsis"> Clarification (2026-07-20): the derived-traceability annex on risk-defining exports </span> </a> </li> </ul> </nav> </div> </div> </div> <div class="md-content" data-md-component="content"> <article class="md-content__inner md-typeset"> <a href="https://github.com/nburri/lqms/edit/main/docs/decisions/adr-0074-pdf-export.md" title="Edit this page" class="md-content__button md-icon"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id="adr-0074-pdf-export-of-released-documents--server-side-via-apache-fop-over-the-canonical-projection">ADR-0074: PDF Export of Released Documents — Server-Side via Apache FOP over the Canonical Projection<a class="headerlink" href="#adr-0074-pdf-export-of-released-documents--server-side-via-apache-fop-over-the-canonical-projection" title="Permanent link">¶</a></h1> <ul> <li><strong>Status:</strong> accepted (Nicolas 2026-07-15: approved MVP gap #1 together with the gap-analysis A3 amendment — the uncontrolled-copy distribution-control layer folds into this export)</li> <li><strong>Date:</strong> 2026-07-15</li> <li><strong>Deciders:</strong> Nicolas Burri (scope pair), design by Claude.</li> <li><strong>Relates to:</strong> ADR-0057/0058 (tree as record, markdown as the canonical projection — the render source), ADR-0062 (SBOM/license posture — the constraint that decided the library), ADR-0045 (attachment scheme / rendering policy), ADR-0072 (draw.io xmlsvg diagrams), ADR-0029 (audit).</li> </ul> <h2 id="context">Context<a class="headerlink" href="#context" title="Permanent link">¶</a></h2> <p>MVP gap #1 (docs/ai/mvp-definition.md): auditors and externals ask for controlled copies, and nothing renders a released version out of the system. Gap analysis A3 adds the ISO 13485 §4.2.4 distribution-control layer: every export must self-identify as an uncontrolled copy with its print/export date. Numbered controlled-copy registers are explicitly out of scope.</p> <p>The core question is WHERE the PDF is produced:</p> <ul> <li><strong>(a) Server-side rendering</strong> — deterministic, auditable (the system emits the artifact and can record WHO exported WHAT WHEN), no browser dependency, one gated endpoint. Cost: no JavaScript, so client-rendered constructs (Mermaid) cannot render; a JVM rendering stack must be chosen.</li> <li><strong>(b) Client print view</strong> (print CSS + browser print-to-PDF) — trivially renders everything the reading view renders (incl. Mermaid), but the artifact is browser-produced (not server-attested, no server-side EXPORTED audit event at the moment of artifact creation), header/footer control across browsers is weak (the §4.2.4 footer band is exactly the part browsers control worst), and it creates a second, permanently diverging render surface.</li> </ul> <p>The market expectation — and the audit expectation — is a downloadable PDF <em>from the system</em>. Option (a) is chosen; the print-CSS path is deliberately NOT built (no double surface).</p> <h3 id="the-library-question-the-real-investigation">The library question (the real investigation)<a class="headerlink" href="#the-library-question-the-real-investigation" title="Permanent link">¶</a></h3> <p>The obvious HTML→PDF JVM libraries fail our non-negotiable license gate (ADR-0062: the backend runtime classpath is permissive-only, enforced by <code>scripts/check-backend-licenses.py</code> on every build): <strong>openhtmltopdf and Flying Saucer are LGPL-2.1</strong> — copyleft, not on the allow-list, and not the kind of deviation the exceptions file exists for (it holds unavoidable Jakarta EE API jars, not an avoidable rendering engine).</p> <p><strong>Apache FOP (XSL-FO → PDF) is Apache-2.0 with an all-ASF dependency tree</strong> (xmlgraphics-commons, Batik, commons-io/logging, fontbox — all Apache-2.0; even the <code>xml-apis</code> family resolves with Apache-2.0 POM metadata, so the license gate passes with zero new exceptions — verified against the real SBOM before implementation). Batik gives FOP native SVG rendering — which our content actually needs (draw.io diagrams are SVG images, ADR-0072). FOP is the ASF's reference XSL-FO formatter, maintained for two decades; "no headless browser, deterministic layout" is its exact design point.</p> <p>FOP consumes XSL-FO, not HTML — so we need a document-AST→FO serializer. That is small and closed-vocabulary here, because of the second decision:</p> <h3 id="the-render-source-question">The render-source question<a class="headerlink" href="#the-render-source-question" title="Permanent link">¶</a></h3> <p>The authoritative record is the ProseMirror tree (ADR-0057 §1); every version also stores a <strong>derived, deterministic, canonical markdown projection</strong> (ADR-0057 §2), and legacy v1 versions store markdown text directly. Rendering the PDF <strong>from the stored markdown</strong> (projection for v2, text for v1) via <strong>commonmark-java</strong> (BSD-2-Clause) + its GFM-tables extension gives:</p> <ul> <li>ONE render path for both content formats (v1 and v2) — no format dispatch in the PDF layer;</li> <li>a parsed AST for free (headings, tables, lists, quotes, code, images, links) — the FO serializer walks a small, closed CommonMark+GFM vocabulary instead of the full tree schema;</li> <li>degradation semantics that are ALREADY documented per feature (<code>fidelity/projection-notes.md</code>, the ADR-0057 known-limitations duty): alignment, column widths, text colour, highlight, underline and block-in-cell structure degrade in the projection, and the PDF inherits exactly those documented degradations — no new fidelity contract to define or drift from.</li> </ul> <p>The alternative (walking the tree JSON directly) would preserve alignment/colwidth/colour but requires a second full-vocabulary serializer that must chase every future schema node. The MVP scope line is explicit: "not a print designer". The projection is the human-readable record copy by design (ADR-0057 §2) — the PDF is that record copy, typeset.</p> <h2 id="decision">Decision<a class="headerlink" href="#decision" title="Permanent link">¶</a></h2> <ol> <li><strong>Server-side PDF generation</strong> in the <code>document</code> module: stored markdown (v2 projection / v1 text) → commonmark-java AST → XSL-FO → <strong>Apache FOP</strong> → PDF. No client print path.</li> <li><strong>Endpoint:</strong> <code>GET /api/documents/versions/{id}/export/pdf</code> — authenticated, RLS-scoped through the standard <code>runAs</code> path, <code>application/pdf</code> with a content-disposition filename derived from the human document id + version.</li> <li><strong>Exportable states: every post-working state</strong> — RELEASED (including versions whose effective standing is superseded or future-effective) and REVOKED. DRAFT, IN_REVIEW and CANCELLED return <strong>409</strong>: a draft PDF invites exactly the uncontrolled circulation §4.2.4 exists to prevent, and pre-release content has no controlled identity to stamp. Superseded and revoked versions DO export (auditors ask for historical copies) — the identity header stamps the state and, for a superseded/future-effective released version, its effective standing, so an outdated copy self-identifies twice (standing + uncontrolled banner). Disposed (tombstoned) versions have no content to render and 409 likewise.</li> <li><strong>Identity header</strong> (first page, above the body): human document id, title, version number, state, effective date, scope name — the §4.2.4 identity block.</li> <li><strong>Distribution-control footer on EVERY page</strong> (fo:static-content): <em>"UNCONTROLLED COPY — exported \<date> by \<user display name>"</em> plus <code>page N / total</code>. The footer band IS the §4.2.4 control. A diagonal watermark was considered and dropped: FOP rotates text only in 90°-steps (reference-orientation), a true diagonal needs SVG-underlay hacks that hurt readability and add fragility for zero additional control value.</li> <li><strong>Images</strong> (<code>attachment:</code> scheme, IMAGE content parts incl. draw.io xmlsvg SVGs) are resolved server-side from the frozen manifest and <strong>inlined as data URIs</strong> in <code>fo:external-graphic</code> — the PDF is self-contained, and Batik renders the SVGs.</li> <li><strong>Honest degradations (documented, not hidden):</strong></li> <li><strong>Mermaid</strong> code blocks cannot render without JS: they render as a <strong>labeled source block</strong> ("Mermaid diagram — source") in monospace. Draw.io diagrams are unaffected (SVG images).</li> <li><strong>Math</strong> renders as the literal <code>$latex$</code> / <code>$$latex$$</code> source (no KaTeX server-side).</li> <li>Projection-level degradations carry through (alignment, colwidth, colour/highlight/underline, block-in-cell flatten) — see <code>fidelity/projection-notes.md</code>.</li> <li><code>doc:</code> links render as their link text (a PDF cannot resolve an internal scheme); external http(s) links stay live PDF links; <code>attachment:</code> non-image links render as their text.</li> <li><strong>Audited:</strong> every export records an <code>EXPORTED</code> audit event (actor, document entity, version id in the changes payload) — who pulled copies is part of the distribution-control story.</li> <li><strong>License/SBOM:</strong> fop-core and its ASF tree enter the runtime classpath (Apache-2.0); commonmark-java is BSD-2-Clause (allow-listed). Verified against the gate BEFORE implementation: <code>checkBackendLicenses</code> passes with <strong>zero new exceptions</strong> (the <code>xml-apis</code> family resolves with Apache-2.0 POM metadata, so the anticipated W3C deviation never materialized). PDFBox is used <strong>test-only</strong> (PDF text extraction in the export test; pinned to the same fontbox line FOP pulls) and never enters the L1 runtime SBOM. THIRD_PARTY_NOTICES.md gains the FOP/Batik/commonmark section (attribution duty rides the standing ADR-0062 pre-distribution notices work).</li> </ol> <h2 id="consequences">Consequences<a class="headerlink" href="#consequences" title="Permanent link">¶</a></h2> <ul> <li>The controlled artifact is server-attested: state gate, RLS, audit and the §4.2.4 stamp are all enforced at one endpoint; no browser variance.</li> <li>PDF fidelity is coupled to the projection's documented canon — a deliberate, already-governed contract. Features with no markdown expression need no PDF work until they earn a projection expression (per-feature duty, ADR-0057).</li> <li>Mermaid-heavy documents export with source blocks, not diagrams. If that proves unacceptable in practice, the escalation path is pre-rendering Mermaid SVGs at SAVE time (client-side, where JS exists, stored as content parts like draw.io) — a content-model change, its own ADR.</li> <li>FOP + Batik add ~15 MB of jars to the backend image. Accepted for a JVM-only, license-clean, SVG-capable formatter.</li> </ul> <h2 id="clarification-2026-07-19-the-distribution-control-footer-wording">Clarification (2026-07-19): the distribution-control footer wording<a class="headerlink" href="#clarification-2026-07-19-the-distribution-control-footer-wording" title="Permanent link">¶</a></h2> <p>Nicolas decided the §4.2.4 footer band wording (previously "UNCONTROLLED COPY — exported \<date> by \<user>"). It now reads:</p> <blockquote> <p><strong>Uncontrolled copy</strong> — issued via LQMS to \<user display name> on \<date>; validity must be verified against the live system.</p> </blockquote> <p>Rationale: the copy stays <em>uncontrolled</em> on purpose. Calling an exported PDF a "controlled copy" would imply a recall / update-distribution obligation (numbered registers, forced re-issue on change) that LQMS deliberately does NOT provide — numbered controlled-copy registers are explicitly out of scope (see Context). The honest form is the <strong>audited issue event</strong> (the <code>EXPORTED</code> audit records who pulled which version, when) plus an <strong>explanatory uncontrolled stamp</strong> that tells the reader exactly what the artifact is and what to do (verify against the live system). This changes only the §5 band's WORDING — the band is still on every page, still carries <code>page N / total</code>, and the §4.2.4 identity elements are intact. The single-document export and every pack/merged context share the one render path, so they share the wording.</p> <h2 id="addendum-2026-07-19-pdf-navigation-in-doc-cross-file-merged--contexts-of-the-one-renderer">Addendum (2026-07-19): PDF navigation (in-doc, cross-file, merged) — contexts of the one renderer<a class="headerlink" href="#addendum-2026-07-19-pdf-navigation-in-doc-cross-file-merged--contexts-of-the-one-renderer" title="Permanent link">¶</a></h2> <p>Auditor-driven request (Nicolas): clickable navigation inside a PDF, between the audit pack's PDFs, and a single merged pack PDF. Built as CONTEXTS of the ADR-0074 renderer — not new render surfaces.</p> <ul> <li><strong>In-document navigation.</strong> Every heading gets a stable GitHub-style slug <code>id</code>; a <code>fo:bookmark-tree</code> outline is emitted from the heading hierarchy (the PDF bookmark panel), nested by heading level. In-text <code>#fragment</code> links resolve to the matching heading via <code>fo:basic-link internal-destination</code>; an unmatched fragment degrades to inert text (never a dead link). This — plus the bookmark tree — is the ONLY change to the single-document output; layout/footer are otherwise unchanged.</li> <li><strong><code>doc:</code> link resolution is context-dependent</strong> (a <code>DocLinkResolver</code> injected per render, ADR-0051):</li> <li><em>single-document</em> export — a <code>doc:</code> link renders as inert text + <code>(HUMAN-ID)</code> (the improved honest form of §7's "renders as its link text");</li> <li><em>audit-pack (zip)</em> — a target IN the pack becomes <code>fo:basic-link external-destination</code> to the relative sibling filename <code><humanId>_v<n>.pdf</code>; a target NOT in the pack degrades to text + id. Relative cross-file (GoToR) links are viewer-dependent and require the files to stay in one folder — noted in the pack <code>manifest.txt</code>.</li> <li><em>merged</em> — the same <code>doc:</code> target becomes an <code>internal-destination</code> to that document's chapter.</li> <li><strong>Merged pack PDF</strong> (<code>GET /api/scopes/{scopeId}/audit-pack?format=merged</code>): one PDF — cover (scope, generated-at/by, document count) + a clickable ToC (one entry per document) + each document as a chapter (its own bookmark subtree, its §4.2.4 identity header, continuous page numbering). Same permission gate + one scope-level <code>EXPORTED</code> event shaped <code>format: merged</code>; the zip and the merged PDF are <strong>separate artifacts</strong> (zip OR merged), never double-bundled.</li> <li><strong>Reusable for ADR-0083 dossier 3a.</strong> The merged rendering is expressed as "given an ordered list of versions + a front-matter spec → one PDF with ToC/bookmarks/internal links" (<code>PdfExportService.renderMergedVersions</code> → <code>PdfRenderer.renderMerged</code>), so the dossier's reviewer's copy (D-4) will call the SAME service seam with its skeleton sections — no audit-pack-specific coupling.</li> </ul> <h2 id="clarification-2026-07-20-the-derived-traceability-annex-on-risk-defining-exports">Clarification (2026-07-20): the derived-traceability annex on risk-defining exports<a class="headerlink" href="#clarification-2026-07-20-the-derived-traceability-annex-on-risk-defining-exports" title="Permanent link">¶</a></h2> <p>Decided by Nicolas ("b sounds like a good compromise") after his export review: a risk analysis PDF showed the risk/control CONTENT but not the controls' implementation/verification — which are EDGES (trace links, ADR-0079's deliberate cut), not document content, and therefore honestly absent from the frozen record. Three options were weighed: inline derived columns in the controls table (rejected — blends approved content with live derivation in one table), keep exports pure and rely on the traceability-workspace exports (rejected — reintroduces the cross-artifact hop), or:</p> <ol> <li><strong>A clearly-bounded derived ANNEX after the document content</strong> in the PDF export of any version whose content defines <code>risk</code>/<code>risk-control</code> items: heading "Derived traceability — as at export (not part of the controlled content)", one row per control — mitigates → risks, implemented by (requirement item OR document), verified by (document · version), current gap flags. Derived live from <code>RiskTraceabilityService</code> at export time, RLS-bounded exactly like the on-screen view.</li> <li><strong>The boundary is the point:</strong> the export is already a stamped point-in-time artifact (identity header, per-page uncontrolled-copy band), so a derivation is consistent with its nature — but it must be VISUALLY separate and labeled, so an auditor can never mistake link-derived rows for reviewed content. The annex never enters the content hash discussion: same version, different export moment, possibly different annex — by design and by label.</li> <li>Applies to all export shapes (single, zip pack entries, merged chapters). Documents defining no risk items get NO annex (no empty scaffolding).</li> <li><strong>Permission-conditional (coordinator addendum, same day):</strong> the annex derives from the same data the ADR-0080-gated traceability views show, so it is included only when the exporting caller holds <code>VIEW_TRACEABILITY</code> in the scope — otherwise the PDF renders without it (no placeholder). The annex must never become a backdoor around the per-view gating.</li> <li><strong>Risk rows join the annex (Nicolas 2026-07-20, "yes, please extend the annex"):</strong> the control-centric annex was silent on a RISK-defining document whose controls live in ANOTHER document (the split-file shape his walkthrough exposed). The annex now also carries one row per <code>risk</code> item defined in the exported document — <strong>Key | Mitigated by | Gaps</strong> — where "Mitigated by" names the control keys (with the defining document's human id when the control is defined elsewhere) and "Gaps" carries the derived risk-level flags with the ADR-0079 accepted-without-reduction semantics intact (an acceptable initial risk with no control and no residual is COMPLETE, no flag). Both sections appear when a document defines both item types, in content order (risks, then controls); the trigger, label, boundary and permission rule are unchanged.</li> </ol> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> <button type="button" class="md-top md-icon" data-md-component="top" hidden> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M13 20h-2V8l-5.5 5.5-1.42-1.42L12 4.16l7.92 7.92-1.42 1.42L13 8z"/></svg> Back to top </button> </main> <footer class="md-footer"> <nav class="md-footer__inner md-grid" aria-label="Footer" > <a href="../adr-0073-scope-configuration-surface/" class="md-footer__link md-footer__link--prev" aria-label="Previous: ADR-0073: Per-Scope QMS Configuration Surface"> <div class="md-footer__button md-icon"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </div> <div class="md-footer__title"> <span class="md-footer__direction"> Previous </span> <div class="md-ellipsis"> ADR-0073: Per-Scope QMS Configuration Surface </div> </div> </a> <a href="../adr-0075-source-history-import/" class="md-footer__link md-footer__link--next" aria-label="Next: ADR-0075: Source History Import — Continuity Without Forged Audit"> <div class="md-footer__title"> <span class="md-footer__direction"> Next </span> <div class="md-ellipsis"> ADR-0075: Source History Import — Continuity Without Forged Audit </div> </div> <div class="md-footer__button md-icon"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M4 11v2h12l-5.5 5.5 1.42 1.42L19.84 12l-7.92-7.92L10.5 5.5 16 11z"/></svg> </div> </a> </nav> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class="md-copyright"> <div class="md-copyright__highlight"> Built from <code>v0.9.56-4-g06c7f811</code> (commit <code>06c7f811</code>, 2026-09-09) — the same Markdown the repository ships. </div> </div> </div> </div> </footer> </div> <div class="md-dialog" data-md-component="dialog"> <div class="md-dialog__inner md-typeset"></div> </div> <script id="__config" type="application/json">{"base": "../..", "features": ["navigation.instant", "navigation.tracking", "navigation.top", "navigation.footer", "navigation.indexes", "toc.follow", "search.suggest", "search.highlight", "content.code.copy", "content.action.edit"], "search": "../../assets/javascripts/workers/search.6ce7567c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src="../../assets/javascripts/bundle.83f73b43.min.js"></script> </body> </html>