Skip to content
LQMS
Requirements Gap Analysis
Initializing search
nburri/lqms
LQMS
nburri/lqms
Home
Evaluate LQMS
Evaluate LQMS
LQMS Known Limits
LQMS Security Posture
Architecture
Architecture
1. Introduction and Goals
2. Architecture Constraints
3. Context and Scope
4. Solution Strategy
5. Building Block View
6. Runtime View
7. Deployment View
8. Crosscutting Concepts
9. Architecture Decisions
10. Quality Requirements
11. Risks and Technical Debt
12. Glossary
The arrival bundle format
Decisions (ADRs)
Decisions (ADRs)
ADR-0001: Content-Addressed Document Storage with PostgreSQL as Source of Truth
ADR-0002: Single Instance with Scope Hierarchy and Copy-on-Derive
ADR-0003: Fixed Life Cycle States with Configurable Review Processes
ADR-0004: Global Catalogs for Roles and Document Types with Per-Scope Activation
ADR-0005: Modular Monolith
ADR-0006: Three-Layer Search with In-Database Index and Pluggable LLM
ADR-0007: Angular Frontend with Server-Side-Only Enforcement
ADR-0008: Flyway Migrations and jOOQ Codegen from the Migrated Schema
ADR-0009: RLS Enforcement via a Session-Scoped Authorized Scope Set
ADR-0010: Self-Managed QMS via an Internal Mandator
ADR-0011: Authentication via OIDC SSO with Server-Side (BFF) Sessions
ADR-0012: Permission-Based Authorization and System Bootstrap
ADR-0013: User Identity Lifecycle
ADR-0014: Electronic Signatures (Part 11 / Annex 11-Capable)
ADR-0015: Document Effectivity, Periodic Review & Validity
ADR-0016: Data Retention, Disposal & Privacy (FADP / GDPR)
ADR-0017: Multi-Part Version Content
ADR-0018: Non-Functional Targets (Capacity, Availability, Security)
ADR-0019: Notifications & Tasks
ADR-0020: Internationalization (Content Language, Time Zones, Formatting)
ADR-0021: General Typed Document Relationships
ADR-0022: Read-Acknowledgement & Questionnaires
ADR-0023: Migration / Import — Current Released State
ADR-0024: Draft / In-Review Cancellation
ADR-0025: Disposal & Erasure Mechanics (Storage, Index, Backups)
ADR-0026: RLS Runtime Safety — Connection-Pool Scope Isolation
ADR-0027: RLS Boundary — Content-Plane vs Control-Plane
ADR-0028: Stateless Encrypted Token-State Cookie (no server-side session store)
ADR-0029: Document Content Model — Draft-Freeze, Content-Table RLS, Append-Only Audit
ADR-0030: Review & Life-Cycle Realization Model
ADR-0031: Released-base readability enforcement & copy-on-derive mechanics
ADR-0032: Frontend realization — Quinoa, Angular Material, i18n & E2E
ADR-0033: CSRF control for the BFF session — SameSite + JSON content-type
ADR-0034: Notification realization — in-process domain events + system-context fan-out
ADR-0035: Fan-out contract as shipped — gate semantics, count disclosure, audit protocol
ADR-0036: Repository layer — services carry rules, repositories carry jOOQ
ADR-0037: Task scheduler — in-process tick, advisory-lock election, SQL sweep
ADR-0038: Periodic-review realization — derived due date, policy-gated confirmation
ADR-0039: Sweep & periodic-review contract as shipped — grants, guards, addressing
ADR-0040: Disposal-due surfacing — closure-anchored retention, scope-level legal hold
ADR-0041: Email channel & notification i18n — notification-as-outbox, structured messages
ADR-0042: Disposal execution — document tombstoning, single-actor hard-gated destruction
ADR-0043: Disposal blob deletion is post-commit, GC-backstopped
ADR-0044: Search FTS baseline — event-indexed, RLS-scoped search_index
ADR-0045: Image Attachments as Content Parts (Rich-Content Slice R2)
ADR-0046: Four-Eyes — Submitter Excluded from Approval
ADR-0047: Four-Eyes — Submitter-Only Exclusion
ADR-0048: Document Organization — Folder Tree per Scope
ADR-0049: Content Model Round 2 — Type Categories, Template Instantiation, Trace Relations, Completeness Rules
ADR-0050: Live Frontend — SSE State Push, CodeMirror 6, Draft Presence
ADR-0051: In-Text Document Links (doc: Scheme)
ADR-0052: Addressees & Read-Acknowledgement (REQ-TRN Realization)
ADR-0053: Addressees Per Document + Process Owner (amends ADR-0052 K-1)
ADR-0054: Process Owner Is a Role (amends ADR-0053 P-3)
ADR-0055: WYSIWYG Editing Mode over Markdown (editor step R4)
ADR-0056: Visual-Editor Chrome via Milkdown Crepe (gated adoption)
ADR-0057: Content Record Is the ProseMirror Document Tree; Markdown Becomes a Derived Projection
ADR-0058: PM_DOC Is the Only Content Format (pre-production cut; amends ADR-0057 §5)
ADR-0059: Editor Engine Switches to TipTap (spike-gated; supersedes the Milkdown/Crepe choice)
ADR-0060: Backup & Restore — Scripted Ordered Backup with Automated Restore Rehearsal
ADR-0061: CSV — Generated Validation Package per Release
ADR-0062: SBOM — CycloneDX over the Production Layers, Validated Against the Artifact
ADR-0063: User Identity Binds on Subject Only (Issuer Becomes Provenance)
ADR-0064: Per-Document Workflow Role Bindings (Author / Reviewer / Releaser), Enforced
ADR-0065: Diagrams — Excalidraw as the Manual Layer, Mermaid Stays for Text-First/UML
ADR-0066: WITHDRAW — the Author Side May Reclaim a Version from Review
ADR-0067: Review Comments — Anchored, Immutable, Resolvable
ADR-0068: Confluence/Jira QMS Import — Staged, Read-Only, Repeatable
ADR-0069: Arbitrary File Attachments — Download-Only Confinement
ADR-0070: Training Questionnaires — Versioned, Auto-Scored, Release-Gated
ADR-0071: Training Plans — Document Obligations + External Trainings & Certifications
ADR-0072: Diagrams — Self-Hosted draw.io Replaces Excalidraw
ADR-0073: Per-Scope QMS Configuration Surface
ADR-0074: PDF Export of Released Documents — Server-Side via Apache FOP over the Canonical Projection
ADR-0075: Source History Import — Continuity Without Forged Audit
ADR-0076: Periodic-review status visibility (completing MVP gap #2)
ADR-0077: Requirement Items — Keyed Blocks Inside Controlled Documents
ADR-0078: Generalized Trace Items (Traceability Model — Stage A)
ADR-0079: Risk & Risk-Control Items (Traceability Model — Stage B)
ADR-0080: Traceability Workspace — Hub, Sub-Pages, and Role-Gated Views
ADR-0081: Draft-Only Trace-Structure Changes, Server-Enforced
ADR-0082: Table-Shaped Risk Authoring over Risk Blocks
ADR-0083: The TD Dossier — a Versioned, Cross-Scope, Regulatory-Structured Deliverable
ADR-0084: Validation & Regulatory Axes (Traceability Model — Stage C)
ADR-0085: Relation-Layer Consolidation — One Trace Vocabulary, One Surface
ADR-0086: Requirement Traceability Chains — End-to-End Path View + Flat Path Export
ADR-0087: The Scope Traceability Report — One Derived Overview Artifact, Never a Controlled Document
ADR-0088: Verification Evidence Classes — Planned vs. Verified, Derived at the Read Layer
ADR-0089: Recurring Obligations — Periodic Tasks With Record Evidence, Not Calendar Series
ADR-0090: Release & Versioning Policy — Deliberate Releases, One Auditor-Facing Number
ADR-0091: Release Modes — Single-Person Record Release With a Structural Four-Eyes Floor
ADR-0092: Orphan-Blob Garbage Collection With a Quarantine Bin
ADR-0093: One Scope Context — the Toolbar Switcher Is the Only Scope Selector
ADR-0094: Calendar-Anchored Obligation Schedules (Clamped, Never Too Late)
ADR-0095: Key-Rule Governance — Free Until First Use, Then Frozen
ADR-0096: Transition Permissions — Always Visible, Deny Unless Granted
ADR-0097: A Governed Provisioning Surface — MANAGE_SCOPES
ADR-0098: Org Chart × Role System — Marriage at the Evidence Level, Never in Authorization
ADR-0099: The User Manual is an In-App Topic Reference, Not a Document
ADR-0100: LQMS Is the Living Quality Management System
ADR-0101: The Executable Validation Journey (PQ Evidence That Cannot Drift)
ADR-0102: Typed Template Variables (text | date | number — and Deliberately No Enum)
ADR-0103: npm audit Joins the Verification Gate as a Second Standing Input
ADR-0104: The Issued Dossier Is a Persisted Artifact of Record — and Clones to a New Draft
ADR-0105: Navigation Information Architecture — Group by Moment-of-Use
ADR-0106: The Client Reflection Follows Assignments, Not Only Content Reach
ADR-0107: The Audit Append Gate Follows Assignment Reach, Not Content Reach
ADR-0108: Mandator Membership — Invite-Accept, with Pre-Assigned Responsibilities
ADR-0109: Organization Founding Is Its Own Process
ADR-0110: The Audit Trail Is Not a Read Model
ADR-0111: The Imported-Person Model, and Project Portability's First Doctrines
ADR-0112: The Element-Kind Catalog — Semantics in the Model, Not Only in the Code
ADR-0113: Project Arrival Import — Records Arrive as They Are, People Arrive as They Were
ADR-0114: The Operating Model Arrives — Roles as Functions, Names as Words, People as This Instance's Decision
ADR-0115: Collaborative Draft Editing — Two Carets, One Truth, Honest Credit
ADR-0116: The System Maintenance Surface — the App Backs Itself Up, the Host Keeps One Dumb Job
ADR-0117: Role Documentation — a Link, a Finding, Per-Source Recognizers; Substitution Rejected
ADR-0118: The Offline QMS Copy — the Repo Carries the Audit Pack, Not a Second Renderer
ADR-0119: Module-Internal Package Structure — Capabilities First, Layers Second, the Root Is the Surface
ADR-0120: The Shared Kernel — the Domain-Exception Vocabulary Leaves the Authorization Module
ADR-0121: The Project Administrator Role — Per-Scope Administration With Read Access, Seeded in the Base Catalog
ADR-0122: Organization-Level Administration — the Cascade Stays, Becomes Visible, and Founds Projects
ADR-0123: Draft Save-Points — Every Save Restorable, Kept for the Life of the Version
ADR-0124: The Birth Path Completes Without Borrowing Content Clothes
ADR-0125: The Export Twin — Export Emits an Arrival Bundle
ADR-0126: Project Dissolution — the Un-Birth of an Unused Scope
ADR-0127: The Base-QMS Layers — One Library, Derived Adaptations, Local Records
ADR-0128: The GLOBAL Cascade Carries Administration, Never Content
ADR-0129: Role Identity from a GLOBAL Assignment Acts in GLOBAL Alone
ADR-0130: Break-Glass — the Project Administrator's Escalation Is a First-Class, Witnessed, Self-Expiring Act
ADR-0131: Role Substitution as Declared Adoption Edges — Emergency Cover Is Governed, Own-Name, Timed Staffing
ADR-0132: Dual-Hat Reviewer Satisfaction Is a Declared Policy Choice — the Strict Floor Stays the Default
ADR-NNNN:
</span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_5" checked> <div class="md-nav__link md-nav__container"> <a href="../" class="md-nav__link "> <span class="md-ellipsis"> Requirements </span> </a> <label class="md-nav__link " for="__nav_5" id="__nav_5_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_5_label" aria-expanded="true"> <label class="md-nav__title" for="__nav_5"> <span class="md-nav__icon md-icon"></span> Requirements </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../stakeholder_requirements/" class="md-nav__link"> <span class="md-ellipsis"> Stakeholder Requirements </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type="checkbox" id="__toc"> <label class="md-nav__link md-nav__link--active" for="__toc"> <span class="md-ellipsis"> Requirements Gap Analysis </span> <span class="md-nav__icon md-icon"></span> </label> <a href="./" class="md-nav__link md-nav__link--active"> <span class="md-ellipsis"> Requirements Gap Analysis </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class="md-nav__title" for="__toc"> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class="md-nav__list" data-md-component="toc" data-md-scrollfix> <li class="md-nav__item"> <a href="#what-is-already-well-covered-for-context" class="md-nav__link"> <span class="md-ellipsis"> What is already well covered (for context) </span> </a> </li> <li class="md-nav__item"> <a href="#tier-1--shapes-the-core-data-model--security-resolve-before-building-much-further" class="md-nav__link"> <span class="md-ellipsis"> Tier 1 — shapes the core data model & security; resolve before building much further </span> </a> </li> <li class="md-nav__item"> <a href="#tier-2--needed-soon-shape-features-not-the-foundation" class="md-nav__link"> <span class="md-ellipsis"> Tier 2 — needed soon; shape features, not the foundation </span> </a> </li> <li class="md-nav__item"> <a href="#tier-3--record-the-decision-lower-urgency" class="md-nav__link"> <span class="md-ellipsis"> Tier 3 — record the decision; lower urgency </span> </a> </li> <li class="md-nav__item"> <a href="#triage-log" class="md-nav__link"> <span class="md-ellipsis"> Triage log </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item"> <a href="../req_admin/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Administration, Permissions & Onboarding </span> </a> </li> <li class="md-nav__item"> <a href="../req_api_ui/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: API & User Interface </span> </a> </li> <li class="md-nav__item"> <a href="../req_audit_reporting/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Audit Trail & Regulatory Reporting </span> </a> </li> <li class="md-nav__item"> <a href="../req_auth/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Authentication & Session </span> </a> </li> <li class="md-nav__item"> <a href="../req_backup/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Backup & Restore </span> </a> </li> <li class="md-nav__item"> <a href="../req_catalogs/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Catalogs, Roles & Users </span> </a> </li> <li class="md-nav__item"> <a href="../req_data_protection/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Data Protection, Retention & Disposal </span> </a> </li> <li class="md-nav__item"> <a href="../req_documents/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Documents, Versions & Storage </span> </a> </li> <li class="md-nav__item"> <a href="../req_dossiers/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Technical Documentation Dossiers </span> </a> </li> <li class="md-nav__item"> <a href="../req_effectivity/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Effectivity, Periodic Review & Validity </span> </a> </li> <li class="md-nav__item"> <a href="../req_gspr/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Regulatory Conformity (GSPR / Essential Principles) </span> </a> </li> <li class="md-nav__item"> <a href="../req_i18n/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Internationalization </span> </a> </li> <li class="md-nav__item"> <a href="../req_lifecycle/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Life Cycle & Reviews </span> </a> </li> <li class="md-nav__item"> <a href="../req_memberships/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Mandator Membership & Invitations </span> </a> </li> <li class="md-nav__item"> <a href="../req_migration/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Migration & Import </span> </a> </li> <li class="md-nav__item"> <a href="../req_nfr/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Non-Functional </span> </a> </li> <li class="md-nav__item"> <a href="../req_notifications/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Notifications & Tasks </span> </a> </li> <li class="md-nav__item"> <a href="../req_obligations/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Recurring Obligations </span> </a> </li> <li class="md-nav__item"> <a href="../req_relationships/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Document Relationships </span> </a> </li> <li class="md-nav__item"> <a href="../req_risk/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Risk Management (ISO 14971 Hazards & Controls) </span> </a> </li> <li class="md-nav__item"> <a href="../req_sbom/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Software Bill of Materials & Supply-Chain Assurance </span> </a> </li> <li class="md-nav__item"> <a href="../req_search/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Search </span> </a> </li> <li class="md-nav__item"> <a href="../req_separation/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Scopes, Mandators & Separation </span> </a> </li> <li class="md-nav__item"> <a href="../req_signatures/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Electronic Signatures </span> </a> </li> <li class="md-nav__item"> <a href="../req_training/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Read-Acknowledgement & Questionnaires </span> </a> </li> <li class="md-nav__item"> <a href="../req_users/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: User Identity & Lifecycle </span> </a> </li> <li class="md-nav__item"> <a href="../req_validation/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Design Validation & the Validation Traceability Axis </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_6" > <div class="md-nav__link md-nav__container"> <a href="../../process/" class="md-nav__link "> <span class="md-ellipsis"> Process (IEC 62304) </span> </a> <label class="md-nav__link " for="__nav_6" id="__nav_6_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_6_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_6"> <span class="md-nav__icon md-icon"></span> Process (IEC 62304) </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../process/configuration_management_plan/" class="md-nav__link"> <span class="md-ellipsis"> Configuration Management Plan </span> </a> </li> <li class="md-nav__item"> <a href="../../process/problem_resolution/" class="md-nav__link"> <span class="md-ellipsis"> Problem Resolution Process </span> </a> </li> <li class="md-nav__item"> <a href="../../process/risk_management/" class="md-nav__link"> <span class="md-ellipsis"> Risk Management </span> </a> </li> <li class="md-nav__item"> <a href="../../process/software_development_plan/" class="md-nav__link"> <span class="md-ellipsis"> Software Development Plan </span> </a> </li> <li class="md-nav__item"> <a href="../../process/verification_plan/" class="md-nav__link"> <span class="md-ellipsis"> Verification Plan </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_7" > <label class="md-nav__link" for="__nav_7" id="__nav_7_label" tabindex="0"> <span class="md-ellipsis"> Operations </span> <span class="md-nav__icon md-icon"></span> </label> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_7_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_7"> <span class="md-nav__icon md-icon"></span> Operations </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../operations/genesis-installation/" class="md-nav__link"> <span class="md-ellipsis"> Genesis: Birthing an LQMS Installation with a Base Library </span> </a> </li> <li class="md-nav__item"> <a href="../../operations/deployment/" class="md-nav__link"> <span class="md-ellipsis"> LQMS Deployment Guide </span> </a> </li> <li class="md-nav__item"> <a href="../../operations/server-deployment/" class="md-nav__link"> <span class="md-ellipsis"> LQMS Server Deployment (single Linux host, public HTTPS) </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_8" > <div class="md-nav__link md-nav__container"> <a href="../../traceability/" class="md-nav__link "> <span class="md-ellipsis"> Traceability </span> </a> <label class="md-nav__link " for="__nav_8" id="__nav_8_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_8_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_8"> <span class="md-nav__icon md-icon"></span> Traceability </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../traceability/matrix/" class="md-nav__link"> <span class="md-ellipsis"> Requirements Traceability Matrix </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_9" > <div class="md-nav__link md-nav__container"> <a href="../../validation/" class="md-nav__link "> <span class="md-ellipsis"> Validation (tool lane) </span> </a> <label class="md-nav__link " for="__nav_9" id="__nav_9_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_9_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_9"> <span class="md-nav__icon md-icon"></span> Validation (tool lane) </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../validation/templates/ai-authorship-posture/" class="md-nav__link"> <span class="md-ellipsis"> AI-Authorship Posture — How LQMS Is Built, and Why the Validation Evidence Does Not Rest on It (TEMPLATE) </span> </a> </li> <li class="md-nav__item"> <a href="../../validation/templates/intended-use/" class="md-nav__link"> <span class="md-ellipsis"> Intended-Use Specification — LQMS as a QMS / Document-Control Tool (TEMPLATE) </span> </a> </li> <li class="md-nav__item"> <a href="../../validation/templates/tool-risk-assessment/" class="md-nav__link"> <span class="md-ellipsis"> Tool-Risk Assessment — LQMS as a QMS Tool (TEMPLATE) </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_10" > <label class="md-nav__link" for="__nav_10" id="__nav_10_label" tabindex="0"> <span class="md-ellipsis"> Regulatory </span> <span class="md-nav__icon md-icon"></span> </label> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_10_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_10"> <span class="md-nav__icon md-icon"></span> Regulatory </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../regulatory/mdr-annex-i-skeleton/" class="md-nav__link"> <span class="md-ellipsis"> MDR Annex I — GSPR authoring skeleton (paraphrased) </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_11" > <div class="md-nav__link md-nav__container"> <a href="../../user-guide/" class="md-nav__link "> <span class="md-ellipsis"> User guide </span> </a> <label class="md-nav__link " for="__nav_11" id="__nav_11_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_11_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_11"> <span class="md-nav__icon md-icon"></span> User guide </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../user-guide/tutorial/" class="md-nav__link"> <span class="md-ellipsis"> Tutorial — from zero to a released document </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/administration/" class="md-nav__link"> <span class="md-ellipsis"> Administering an LQMS Installation </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/diagrams/" class="md-nav__link"> <span class="md-ellipsis"> Diagrams </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/documents-lifecycle/" class="md-nav__link"> <span class="md-ellipsis"> Documents & the Lifecycle </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/exports/" class="md-nav__link"> <span class="md-ellipsis"> PDF Exports & the Audit Pack </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/obligations/" class="md-nav__link"> <span class="md-ellipsis"> Recurring Obligations </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/project-context/" class="md-nav__link"> <span class="md-ellipsis"> The Project Context & App Version </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/review-comments/" class="md-nav__link"> <span class="md-ellipsis"> Review Comments </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/activity-trail/" class="md-nav__link"> <span class="md-ellipsis"> Who did what, when — reading a project's activity </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/admin-scopes/" class="md-nav__link"> <span class="md-ellipsis"> Renaming a project, and what can never change </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/authority-view/" class="md-nav__link"> <span class="md-ellipsis"> Who holds each function here, and what may it do </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/break-glass/" class="md-nav__link"> <span class="md-ellipsis"> The permission I need is held by a role I do not hold — what now? </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/coverage-and-chains/" class="md-nav__link"> <span class="md-ellipsis"> Coverage or chains? — which requirement view answers your question </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/credentials/" class="md-nav__link"> <span class="md-ellipsis"> Your password: changing it, resetting it — and why LQMS never sees it </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/emergency-cover/" class="md-nav__link"> <span class="md-ellipsis"> Who may cover for whom here — declaring emergency cover, and reading where the glass was broken </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/key-rules/" class="md-nav__link"> <span class="md-ellipsis"> Special elements: what a project declares, and when its names freeze </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/memberships/" class="md-nav__link"> <span class="md-ellipsis"> Belonging to an organization: invitations, acceptance, and what they change </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/provisioning-birth-path/" class="md-nav__link"> <span class="md-ellipsis"> How a new organization and project are born </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/review-policies/" class="md-nav__link"> <span class="md-ellipsis"> What a review policy controls, and what an empty grant means </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/setup-wizard-lanes/" class="md-nav__link"> <span class="md-ellipsis"> The setup wizard: the lanes, and what it writes </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/staffing-and-assignments/" class="md-nav__link"> <span class="md-ellipsis"> Staffing people into roles, and the accountable holder </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/topics/technical-dossier/" class="md-nav__link"> <span class="md-ellipsis"> How do I assemble a technical dossier? </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/trace-items/" class="md-nav__link"> <span class="md-ellipsis"> Trace Items — Requirements, Risks & Risk Controls </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/trace-links/" class="md-nav__link"> <span class="md-ellipsis"> Trace Links & the Suspect Cycle </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/traceability-workspace/" class="md-nav__link"> <span class="md-ellipsis"> The Traceability Workspace </span> </a> </li> <li class="md-nav__item"> <a href="../../user-guide/training/" class="md-nav__link"> <span class="md-ellipsis"> Training & Acknowledgements </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component="sidebar" data-md-type="toc" > <div class="md-sidebar__scrollwrap"> <div class="md-sidebar__inner"> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class="md-nav__title" for="__toc"> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class="md-nav__list" data-md-component="toc" data-md-scrollfix> <li class="md-nav__item"> <a href="#what-is-already-well-covered-for-context" class="md-nav__link"> <span class="md-ellipsis"> What is already well covered (for context) </span> </a> </li> <li class="md-nav__item"> <a href="#tier-1--shapes-the-core-data-model--security-resolve-before-building-much-further" class="md-nav__link"> <span class="md-ellipsis"> Tier 1 — shapes the core data model & security; resolve before building much further </span> </a> </li> <li class="md-nav__item"> <a href="#tier-2--needed-soon-shape-features-not-the-foundation" class="md-nav__link"> <span class="md-ellipsis"> Tier 2 — needed soon; shape features, not the foundation </span> </a> </li> <li class="md-nav__item"> <a href="#tier-3--record-the-decision-lower-urgency" class="md-nav__link"> <span class="md-ellipsis"> Tier 3 — record the decision; lower urgency </span> </a> </li> <li class="md-nav__item"> <a href="#triage-log" class="md-nav__link"> <span class="md-ellipsis"> Triage log </span> </a> </li> </ul> </nav> </div> </div> </div> <div class="md-content" data-md-component="content"> <article class="md-content__inner md-typeset"> <a href="https://github.com/nburri/lqms/edit/main/docs/requirements/gap-analysis.md" title="Edit this page" class="md-content__button md-icon"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <h1 id="requirements-gap-analysis">Requirements Gap Analysis<a class="headerlink" href="#requirements-gap-analysis" title="Permanent link">¶</a></h1> <ul> <li><strong>Status:</strong> working document (not part of the released requirements baseline).</li> <li><strong>Created:</strong> 2026-06-17, against baseline <code>requirements-v1.0</code>.</li> </ul> <p>This document captures areas the current requirements baseline does not yet cover or specifies ambiguously. It is the <strong>input to change-control rounds</strong>, not a requirement itself: an accepted gap is resolved by adding/amending STR/REQ documents (and ADRs where a decision is architecturally significant), re-reviewing, and cutting a new baseline (<code>requirements-v1.1</code>, …) per the <a href="../../process/configuration_management_plan/#document-baselines-and-change-control">configuration management plan</a>.</p> <p>Each gap has a stable ID for tracking. The <strong>Status</strong> column records triage outcome: <code>open</code> → <code>accepted</code> (will become requirements) / <code>rejected</code> (with rationale) / <code>resolved</code> (requirements added, names the baseline).</p> <h2 id="what-is-already-well-covered-for-context">What is already well covered (for context)<a class="headerlink" href="#what-is-already-well-covered-for-context" title="Permanent link">¶</a></h2> <p>Mandator/scope separation (RLS), the document life-cycle and review model, audit reproducibility of released versions, and content/blob storage are specified and internally consistent. The gaps below are mostly <em>whole areas not yet addressed</em>, not defects in the above.</p> <h2 id="tier-1--shapes-the-core-data-model--security-resolve-before-building-much-further">Tier 1 — shapes the core data model & security; resolve before building much further<a class="headerlink" href="#tier-1--shapes-the-core-data-model--security-resolve-before-building-much-further" title="Permanent link">¶</a></h2> <table> <thead> <tr> <th>ID</th> <th>Gap</th> <th>Why it matters</th> <th>Likely artifact</th> <th>Status</th> </tr> </thead> <tbody> <tr> <td>GAP-01</td> <td><strong>Authentication & session management.</strong> REQ-API-002 assumes authenticated requests but nothing defines login, SSO/OIDC, session lifetime, or logout.</td> <td>Cross-cutting; also unblocks RISK-002 (runtime can only connect as <code>lqms_app</code> with a real per-user scope set once identity exists).</td> <td>ADR-0011 + STR-016, REQ-AUTH-001..011</td> <td>resolved (v1.1)</td> </tr> <tr> <td>GAP-02</td> <td><strong>User account lifecycle.</strong> Creating users, deactivating leavers, and preserving a deactivated user's historical approvals/attribution.</td> <td><code>User</code> is referenced by every approval and audit event but never specified.</td> <td>ADR-0013 + STR-018, REQ-USR-001..011</td> <td>resolved (v1.1)</td> </tr> <tr> <td>GAP-03</td> <td><strong>Administration & onboarding.</strong> Who creates mandators/scopes/projects, bootstraps the first admin, and maintains catalogs; project setup flow (activate roles → staff → choose policies).</td> <td>Core daily/admin work; REQ-CAT-001's "authorized users" has no defined admin authorization model.</td> <td>ADR-0012 + STR-017, REQ-ADM-001..009</td> <td>resolved (v1.1)</td> </tr> <tr> <td>GAP-04</td> <td><strong>Electronic signatures.</strong> Signing intent/meaning, re-authentication at signing, signature manifestation on the document.</td> <td>Regulated QMS expectation (ISO 13485; 21 CFR Part 11 / EU Annex 11 if ever in scope). Approvals (REQ-LC-008) record user/role/time but not signature semantics.</td> <td>ADR-0014 + STR-019, REQ-SIG-001..009</td> <td>resolved (v1.1)</td> </tr> <tr> <td>GAP-05</td> <td><strong>Periodic review, effective date & validity.</strong> Scheduled re-review (e.g. every N years), effective date distinct from release date, validity/expiry.</td> <td>ISO 13485 §4.2.4. The life cycle currently has no time-based review or effectivity concept.</td> <td>ADR-0015 + STR-020, REQ-EFF-001..008</td> <td>resolved (v1.1)</td> </tr> <tr> <td>GAP-06</td> <td><strong>Retention & deletion, incl. GDPR.</strong> Defined record retention periods; whether anything can ever be deleted; legal hold; right-to-erasure vs. the immutable audit trail.</td> <td>ISO 13485 §4.2.5 + explicit CH/EU data-protection context. A genuine design tension needing a documented stance (e.g. pseudonymization).</td> <td>ADR-0016 + STR-021, REQ-DPR-001..010</td> <td>resolved (v1.1)</td> </tr> <tr> <td>GAP-23</td> <td><strong>Model the organization's own QMS operations as a first-class internal scope/"product".</strong> Represent the operating company as an internal mandator and "QMS Operations" as a scope under it, deriving masters from the global base like any product project — so one process master (e.g. one feedback SOP) serves both product and QMS operations instead of parallel SOP trees.</td> <td>Removes a major real-world pain (duplicated QMS-vs-product processes); leverages ADR-0002 with little/no schema change (perhaps an <code>internal</code> scope marker). Interacts with GAP-03 (onboarding bootstraps this scope) and GAP-01 (identity). Caveat: regulation may still force conditional handling within a unified process.</td> <td>ADR-0010 + STR-015, REQ-SEP-008/009, REQ-REP-004</td> <td>resolved (v1.1)</td> </tr> </tbody> </table> <h2 id="tier-2--needed-soon-shape-features-not-the-foundation">Tier 2 — needed soon; shape features, not the foundation<a class="headerlink" href="#tier-2--needed-soon-shape-features-not-the-foundation" title="Permanent link">¶</a></h2> <table> <thead> <tr> <th>ID</th> <th>Gap</th> <th>Why it matters</th> <th>Likely artifact</th> <th>Status</th> </tr> </thead> <tbody> <tr> <td>GAP-07</td> <td><strong>Notifications & tasks.</strong> Review/approval requests, reminders, escalation.</td> <td>STR-007 (intuitive daily work) depends on it; only base-update notification (REQ-DOC-012) exists.</td> <td>ADR-0019 + STR-023, REQ-NOT-001..009</td> <td>resolved (v1.2)</td> </tr> <tr> <td>GAP-08</td> <td><strong>Performance & capacity targets.</strong> Expected #documents/#users/#concurrent, search latency, response times.</td> <td>Needed to validate architecture (e.g. pgvector scale) and as testable NFRs; arc42 §10 scenarios still TBD.</td> <td>ADR-0018 + STR-022, REQ-NFR-001/002</td> <td>resolved (v1.2)</td> </tr> <tr> <td>GAP-09</td> <td><strong>Availability, backup scheduling, RPO/RTO.</strong> REQ-BAK specifies backup <em>capability</em> only — no schedule, frequency, retention, or recovery objectives.</td> <td>Operational fitness; restore is part of CSV evidence.</td> <td>ADR-0018 + REQ-NFR-003..006</td> <td>resolved (v1.2)</td> </tr> <tr> <td>GAP-10</td> <td><strong>Security NFRs.</strong> TLS, encryption at rest (blobs/DB), session timeout, brute-force lockout, secrets management, dependency vulnerability scanning. (Crypto-shredding / per-scope keys from GAP-06 considered here: kept as a documented future option; transparent at-rest encryption adopted instead.)</td> <td>None specified; security is a stated quality goal.</td> <td>ADR-0018 + REQ-NFR-007..013</td> <td>resolved (v1.2)</td> </tr> <tr> <td>GAP-11</td> <td><strong>i18n completeness.</strong> Time zones (audit timestamps across regions), date/number formats, multi-language <em>document content</em> (REQ-UI-002 covers only UI text).</td> <td>Multi-region CH/EU use.</td> <td>ADR-0020 + STR-024, REQ-I18N-001..005</td> <td>resolved (v1.2)</td> </tr> <tr> <td>GAP-12</td> <td><strong>Ambiguity — REQ-SEP-005 base readability.</strong> "Readable for derivation according to configuration" — what governs it (all authenticated users? opt-in scopes?).</td> <td>Authorization-model gap affecting RLS policy design.</td> <td>REQ-SEP-010 + REQ-SEP-005 refinement (permission-gated)</td> <td>resolved (v1.2)</td> </tr> <tr> <td>GAP-13</td> <td><strong>Revoke semantics.</strong> Reinstatement of a revoked version? Effect on existing derivations? Does revoke need its own approval?</td> <td>REQ-LC-002 defines the transition but not its consequences.</td> <td>REQ-LC-012/013/014 (terminal; notifies derivations; gated/auditable)</td> <td>resolved (v1.2)</td> </tr> <tr> <td>GAP-14</td> <td><strong>Attachment cardinality.</strong> One content blob per version (REQ-DOC-005 implies) vs. records bundling several files.</td> <td>Affects the version/content data model.</td> <td>ADR-0017 + REQ-DOC-014/015 + REQ-DOC-005 refinement (multi-part)</td> <td>resolved (v1.2)</td> </tr> </tbody> </table> <h2 id="tier-3--record-the-decision-lower-urgency">Tier 3 — record the decision; lower urgency<a class="headerlink" href="#tier-3--record-the-decision-lower-urgency" title="Permanent link">¶</a></h2> <table> <thead> <tr> <th>ID</th> <th>Gap</th> <th>Why it matters</th> <th>Likely artifact</th> <th>Status</th> </tr> </thead> <tbody> <tr> <td>GAP-15</td> <td><strong>Migration/import</strong> from the current Confluence/Jira QMS.</td> <td>Adoption blocker eventually; not foundational.</td> <td>ADR-0023 + STR-026, REQ-MIG-001..003</td> <td>resolved (v1.2)</td> </tr> <tr> <td>GAP-16</td> <td><strong>Training / read-acknowledgement</strong> of controlled documents.</td> <td>Common QMS capability; may be ruled out of scope.</td> <td>ADR-0022 + STR-025, REQ-TRN-001..006 (read/ack/questionnaire + role training requirement)</td> <td>resolved (v1.2)</td> </tr> <tr> <td>GAP-17</td> <td><strong>Document relationships & supersession</strong> beyond derive-provenance (WI references SOP; "replaces DOC-X").</td> <td>Navigability and audit context.</td> <td>ADR-0021 + REQ-REL-001..004</td> <td>resolved (v1.2)</td> </tr> <tr> <td>GAP-18</td> <td><strong>Search quality acceptance criteria.</strong> Measurable bar for search/RAG relevance.</td> <td>"Good search" is otherwise untestable.</td> <td>REQ-SRCH-010 (curated benchmark set)</td> <td>resolved (v1.2)</td> </tr> <tr> <td>GAP-19</td> <td><strong>Accessibility & browser support matrix.</strong> WCAG target, supported browsers.</td> <td>Possible EU obligation; scope clarity.</td> <td>REQ-UI-005/006 (WCAG 2.2 AA; evergreen)</td> <td>resolved (v1.2)</td> </tr> <tr> <td>GAP-20</td> <td><strong>Concurrent draft editing/locking.</strong> Two users editing one draft: locking vs. optimistic vs. last-write-wins.</td> <td>Data-loss avoidance.</td> <td>REQ-DOC-016 (optimistic locking)</td> <td>resolved (v1.2)</td> </tr> <tr> <td>GAP-21</td> <td><strong>Requirement prioritization (MoSCoW).</strong> No priority field; the overview itself defers some scope.</td> <td>Sequencing a long build / MVP definition.</td> <td>MoSCoW adopted (README convention); classification at implementation planning</td> <td>resolved (process)</td> </tr> <tr> <td>GAP-22</td> <td><strong>Validate REQ-REP-001 report content.</strong> Its content was AI-drafted, not validated against what auditors actually expect.</td> <td>Regulatory fitness of the re-evaluation report.</td> <td>REQ-REP-001 refinement + REQ-REP-005/006 (validated with Nicolas)</td> <td>resolved (v1.2)</td> </tr> </tbody> </table> <h2 id="triage-log">Triage log<a class="headerlink" href="#triage-log" title="Permanent link">¶</a></h2> <p><em>Decisions are appended here as gaps are triaged (date, GAP IDs, outcome, resulting STR/REQ/ADR and baseline).</em></p> <ul> <li><strong>2026-06-17 — GAP-23 added & accepted (work first).</strong> Decision to model the operating organization's own QMS operations as a first-class internal scope/"product" so that one process master serves both product and QMS operations (resolves the duplicated QMS-vs-product process pain). Detail decisions still open (internal-mandator vs. a dedicated scope type; the <code>internal</code> marker; treatment in re-evaluation report and separation). To be designed as an ADR extending ADR-0002, ahead of GAP-03 (onboarding) and informing GAP-01 (identity). Chosen Tier-1 work order: <strong>GAP-23 → GAP-01 → GAP-03 → GAP-02 → GAP-04 → GAP-05 → GAP-06</strong>.</li> <li><strong>2026-06-17 — GAP-23 resolved (design).</strong> Decided: internal-mandator model (mandator carries an <code>internal</code> classification; QMS operations are ordinary PROJECT scopes under it; one master serves product + QMS ops). Captured as ADR-0010 (extends ADR-0002) and STR-015, REQ-SEP-008/009, REQ-REP-004 (pending requirements baseline v1.1). Schema change (<code>mandator.internal</code>) deferred to mandator/admin management (GAP-03). Next: GAP-01 (authentication).</li> <li><strong>2026-06-17 — GAP-01 resolved (design).</strong> Decided: OIDC-only SSO, pluggable provider (corporate IdP or bundled Keycloak), no credentials in LQMS; server-side (BFF) sessions with opaque, revocable, httpOnly/Secure/SameSite cookies + idle/absolute timeouts + CSRF; OAuth2 bearer for machine/MCP clients; authn≠authz (JIT provisioning, deny-by-default); per-request scope resolution into the RLS context (closes RISK-002 by design). Captured as ADR-0011 and STR-016 + REQ-AUTH-001..011 (pending v1.1). Runtime DB wiring to <code>lqms_app</code> is the implementation follow-up. Next: GAP-03 (administration & onboarding).</li> <li><strong>2026-06-17 — GAP-03 resolved (design).</strong> Decided: permission-based authorization — fixed closed permission set, configurably mapped to catalog roles; permissions cascade over the scope subtree (global = system admin, mandator = delegated, project = local); admin and content permissions independent (system admin does not implicitly read content → separation preserved); review policies still own life-cycle transitions. Bootstrap: configured break-glass system-admin identity (idempotent, no lock-out); first-run auto-creates global base + internal mandator + QMS-ops scope. Captured as ADR-0012 and STR-017 + REQ-ADM-001..009 (pending v1.1). Rejected: built-in fixed admin roles. Next: GAP-02 (user lifecycle).</li> <li><strong>2026-06-17 — GAP-02 resolved (design).</strong> Decided: user identity anchored to a stable OIDC subject; pre-provisioning (invite) + JIT; states invited/active/deactivated; deactivation is a state change never deletion (attribution preserved, prior approvals not invalidated), LQMS-owned status independent of the IdP; reactivation reuses the record; no shared human accounts; pending obligations surfaced for reassignment; erasure deferred to GAP-06. Captured as ADR-0013 and STR-018 + REQ-USR-001..011 (pending v1.1). Remaining Tier 1: GAP-04 (e-signatures), GAP-05 (periodic review/effectivity), GAP-06 (retention/GDPR). Next: GAP-04.</li> <li><strong>2026-06-17 — GAP-04 resolved (design).</strong> Decided: electronic signatures as a configurable, Part 11 / Annex 11-capable capability — an approval becomes a signature when the review policy marks the step as signed, with a meaning (authored/reviewed/ approved/released); the signature captures signer + meaning + timestamp + content-hash binding + authentication proof, is immutable, and is manifested (name/date/meaning) in renderings and exports. Re-auth uses a continuous-session step-up model with a configurable window. Captured as ADR-0014 and STR-019 + REQ-SIG-001..009 (pending v1.1). Rejected: lightweight approval-as-signature (not Part 11 defensible). Remaining Tier 1: GAP-05 (periodic review/effectivity), GAP-06 (retention/GDPR). Next: GAP-05.</li> <li><strong>2026-06-17 — GAP-05 resolved (design).</strong> Decided: effective date as a derived attribute (<code>effective_from</code>, release ≠ effective; currently-effective version derived by date, no new states); per-document-type periodic-review interval with per-document override; periodic review recorded with outcome (confirmed unchanged resets the clock without a new version / revision initiated starts a draft), may require a <code>REVIEWED</code> signature; optional <code>valid_until</code>; overdue/expiry flagged & escalated, never auto-revoked. Captured as ADR-0015 and STR-020 + REQ-EFF-001..008 (refines REQ-LC-010), pending v1.1. Rejected: effectivity as a new state; automatic hard expiry as default. <strong>Last Tier-1 item: GAP-06 (retention / GDPR).</strong></li> <li><strong>2026-06-17 — GAP-06 resolved (design). Tier 1 COMPLETE.</strong> Reframed after discussion: retention-primary — for regulated records, retention obligations (MDR 10/15y etc.) override the right to erasure during retention; the common response to an erasure request is a documented refusal, not deletion. Decided: data minimization; pseudonymous attribution (PII only in user record, severable); configurable retention per type/scope</li> <li>legal hold; deliberate, authorized, audited disposal at end of retention (not automatic); narrow erasure (physical delete or user-record anonymization) for no-retention-basis / non-regulated / end-of-retention data; access + rectification; signature name captured as snapshot (refines REQ-SIG-004). Crypto-shredding / encryption-at-rest deferred to GAP-10. Captured as ADR-0016 and STR-021 + REQ-DPR-001..010 (pending v1.1). <strong>All Tier-1 gaps resolved (GAP-23, 01, 03, 02, 04, 05, 06).</strong> Next: baseline requirements v1.1 (review the accrued batch), and/or proceed to Tier 2 / implementation.</li> <li><strong>2026-06-17 — requirements baseline v1.1 released.</strong> Tier-1 batch reviewed and approved by Nicolas Burri; pending markers flipped to released, baseline-history recorded in the requirements README, annotated tag <code>requirements-v1.1</code> created. Tier ⅔ gaps (GAP-07..22) remain open for future rounds.</li> <li><strong>2026-06-18 — GAP-12/13/14 resolved (Tier-2 core clarifications, pending v1.2).</strong> GAP-12: base-content readability is permission-gated (global-scope base-read role, or implicit during an authorized DERIVE) — REQ-SEP-010 + REQ-SEP-005 refinement; not "all authenticated". GAP-13: revocation is terminal (re-establish via new version), notifies derivations without changing them, gated by transition permission and optionally approval/signature (REVOKED meaning) — REQ-LC-012/013/014, REQ-SIG-001 refinement. GAP-14: multi-part version content with a manifest hash — ADR-0017, REQ-DOC-014/015 + REQ-DOC-005 refinement. Accruing toward requirements baseline v1.2. Next Tier-2: the NFR block (GAP-08/09/10).</li> <li><strong>2026-06-18 — GAP-08/09/10 resolved (NFR block, pending v1.2).</strong> Targets chosen with Nicolas: capacity "small" tier (~100 users/~20 concurrent, ~100k versions, single-node — confirms ADR-0005); performance p95 < 1s, FTS < 1s, RAG a few s; availability ~99.5% business hours, nightly backup (RPO ≤ 24h), RTO ≤ 1 business day; security — TLS, transparent at-rest encryption (crypto-shredding kept as documented future option), secrets management, CI dependency scanning, runtime as lqms_app, security-event audit, brute-force/MFA delegated to IdP. Captured as ADR-0018 and STR-022 + REQ-NFR-001..013; quantified arc42 §10 scenarios. Remaining Tier-2: GAP-07 notifications, GAP-11 i18n.</li> <li><strong>2026-06-18 — GAP-07 resolved (notifications & tasks, pending v1.2).</strong> New event-driven <code>notification</code> module (ADR-0019, extends ADR-0005). Distinct actionable <strong>tasks</strong> (assigned by role/user, open→done, auto-resolve, reminders + optional escalation) vs. informational <strong>notifications</strong>; in-app inbox always + pluggable email channel; scope- keyed under RLS; audit trail remains the record of truth. Overdue reviews (REQ-EFF-007) and disposal-due (REQ-DPR-005) surface as tasks. STR-023 + REQ-NOT-001..009; TASK and NOTIFICATION added to arc42 §5/§8.1. Remaining Tier-2: <strong>GAP-11 i18n</strong>.</li> <li><strong>2026-06-18 — GAP-11 resolved (i18n completeness, pending v1.2). Tier 2 COMPLETE.</strong> UTC timestamps stored/displayed-localized and manifested unambiguously on signatures/ audit; locale formatting; document <strong>content language</strong> per-document with translations as separate, independently controlled documents linked via <code>translation-of</code> (one optionally authoritative); language-aware search. ADR-0020 + STR-024 + REQ-I18N-001..005; <code>language</code> attribute + <code>translation-of</code> added to arc42 §8.1. <strong>All Tier-2 gaps resolved (GAP-07/08/09/10/11/12/13/14).</strong> Next: Tier 3 (GAP-15..22), then baseline v1.2.</li> <li><strong>2026-06-18 — Tier 3 triaged (GAP-15..22), pending v1.2.</strong> GAP-17 general typed document relationships (ADR-0021, REQ-REL); GAP-16 read-acknowledgement + simple questionnaire + role-training-requirement — middle ground, not full training management (ADR-0022, STR-025, REQ-TRN-001..006); GAP-15 import current released state (ADR-0023, STR-026, REQ-MIG); GAP-18 search-quality benchmark (REQ-SRCH-010); GAP-19 WCAG 2.2 AA + evergreen browsers (REQ-UI-005/006); GAP-20 optimistic locking (REQ-DOC-016); GAP-21 MoSCoW adopted as a requirements convention (classification deferred to implementation planning). <strong>GAP-22 remains open — needs QMS-SME input</strong> on re-evaluation report content. <strong>All gaps resolved except GAP-22.</strong> Next: review & baseline requirements v1.2.</li> <li><strong>2026-06-18 — GAP-22 resolved (v1.2). ALL GAPS RESOLVED.</strong> Re-evaluation report validated with Nicolas as a management-review template: LQMS auto-fills nine sections it has data for (REQ-REP-005) and provides manual-input placeholders for inputs it doesn't hold — complaints, CAPA, audit findings, supplier/risk, decisions (REQ-REP-006); REQ-REP-001 refined accordingly. No ADR (requirement-content validation). <strong>GAP-01..23 all resolved.</strong> Next: review & baseline requirements v1.2.</li> </ul> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> <button type="button" class="md-top md-icon" data-md-component="top" hidden> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M13 20h-2V8l-5.5 5.5-1.42-1.42L12 4.16l7.92 7.92-1.42 1.42L13 8z"/></svg> Back to top </button> </main> <footer class="md-footer"> <nav class="md-footer__inner md-grid" aria-label="Footer" > <a href="../stakeholder_requirements/" class="md-footer__link md-footer__link--prev" aria-label="Previous: Stakeholder Requirements"> <div class="md-footer__button md-icon"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </div> <div class="md-footer__title"> <span class="md-footer__direction"> Previous </span> <div class="md-ellipsis"> Stakeholder Requirements </div> </div> </a> <a href="../req_admin/" class="md-footer__link md-footer__link--next" aria-label="Next: Software Requirements: Administration, Permissions & Onboarding"> <div class="md-footer__title"> <span class="md-footer__direction"> Next </span> <div class="md-ellipsis"> Software Requirements: Administration, Permissions & Onboarding </div> </div> <div class="md-footer__button md-icon"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M4 11v2h12l-5.5 5.5 1.42 1.42L19.84 12l-7.92-7.92L10.5 5.5 16 11z"/></svg> </div> </a> </nav> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class="md-copyright"> <div class="md-copyright__highlight"> Built from <code>v0.9.56-4-g06c7f811</code> (commit <code>06c7f811</code>, 2026-09-09) — the same Markdown the repository ships. </div> </div> </div> </div> </footer> </div> <div class="md-dialog" data-md-component="dialog"> <div class="md-dialog__inner md-typeset"></div> </div> <script id="__config" type="application/json">{"base": "../..", "features": ["navigation.instant", "navigation.tracking", "navigation.top", "navigation.footer", "navigation.indexes", "toc.follow", "search.suggest", "search.highlight", "content.code.copy", "content.action.edit"], "search": "../../assets/javascripts/workers/search.6ce7567c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src="../../assets/javascripts/bundle.83f73b43.min.js"></script> </body> </html>