The setup wizard: the lanes, and what it writes¶
Audience: a quality manager creating a new project or configuring an existing one.
Project setup (Admin → Project setup) walks a project's configuration in four steps: Project → Lane → Configuration → Apply & verify. Its subtitle states the deal plainly — "the house-validated configuration, editable before it is written." Nothing is written until the last step, and every proposal on the way is editable.
1. The lane is the one choice that shapes everything¶
Step 2 asks which kind of scope this is. There are three, and they differ in kind, not in degree:
| Lane | What it is |
|---|---|
| Supplier lane (IEC 62304) | Software supplier: requirements, design, tests and the risk file — verification against the customer's requirements. No validation or GSPR axis. |
| Manufacturer lane (ISO 13485) | Legal manufacturer: everything the supplier lane carries plus stakeholder needs, the validation axis and the GSPR applicability matrix. |
| QMS / process scope (ISO 13485) | The organisation's own QMS: SOPs, work instructions, templates and records — no product traceability. |
Which one to pick¶
Ask what the scope documents, not what your company is:
- Supplier lane — the scope is a software project you build, and your duty is verification: requirements, design, tests, the risk file, evidence that what was built matches what was asked for. This is the IEC 62304 side of the house.
- Manufacturer lane — the scope is a device the organisation puts its name on, and it carries the legal manufacturer's duties: stakeholder needs, validation (does it meet the user's actual need, not just the specification), and regulatory applicability. This is the ISO 13485 product side.
- QMS / process lane — the scope is one of the organisation's own process areas, and its documents are procedures rather than product artefacts. Note that this is not only for engineering processes: a marketing or sales process area with its own SOPs and records is a QMS scope exactly like document control or supplier management is.
When in doubt between the two product lanes, take the manufacturer lane. It is the superset — it carries everything the supplier lane carries plus the validation and regulatory axes — so a project that turns out to need only verification simply has axes it does not use, whereas a supplier-lane project that turns out to carry the manufacturer's duty needs types, special elements and folders added by hand later. A project that both supplies the software and holds the manufacturer's validation duty is the manufacturer case, not a hybrid.
None of this is a classification you are stuck with: the lane is a starting proposal. Every type, grant, prefix and folder it puts on the configuration step is editable before Apply, and nothing is written until then.
The lane decides three things: which document types are proposed, which special elements the project declares (and under which key prefixes), and which folder skeleton is created.
- Supplier: SOP, SWREQ, SWDSN, SWTEST, RA, VERREP, REC, INFRA. Special elements requirement
REQ-, design elementDE-, riskRISK-, risk controlRC-. Folders Procedures / Requirements / Design / Verification / Records. - Manufacturer: the supplier list plus SR (stakeholder requirements), VALP (validation plan),
GSPR (applicability matrix), TPL and VALREP. Special elements add user need
UN-, validation caseVAL-, regulatory referenceGSPR-. Folders add Stakeholder needs / Validation / Regulatory. - QMS / process: QM, SOP, WI, DOC, TPL, REC. Folders are the ISO 13485 chapter tree (4 Quality management system … 8 Measurement, analysis and improvement).
A lane can no longer propose an incoherent vocabulary. The product's element catalog records what each kind depends on — risk and risk control are a mutual pair, a validation case needs a user need, which needs a system requirement, and a stakeholder requirement needs one too — and a lane's selection is checked against it. That is why the supplier lane's four come as system requirement, design element, risk, risk control and never as "risk controls, no risks": see special elements.
The QMS lane has no trace axis at all¶
This is structural, not a gap. A QMS scope documents the organisation's processes; it does not trace a product, so no type may define trace items and no element kind is declared. Where the product lanes arrive with four or eight rows ticked, the QMS lane arrives with none — and says why: "This lane traces no product, so it proposes no special elements — a process scope documents the organisation." The rows are still listed and still tickable, because a process scope that DOES key something must not be argued out of it by its lane.
What the QMS lane carries instead:
- Periodic-review cadences — Quality Manual and SOP every 365 days, Work Instruction every 730, QMS Document every 1095. A template carries none (a template is instantiated, not reviewed).
- Read-acknowledgement proposals on the read-and-understand types (QM, SOP, WI), addressed to the author and reviewer roles. Templates and records propose none — nobody is trained on a blank checklist.
2. What the wizard writes¶
Step 3 pre-fills everything from the lane; step 4 applies it one act at a time, each reporting its own outcome (Pending / Running… / Done / Already there / Failed). A failure stops the run there and leaves it resumable — "Nothing after it ran; fix the cause and resume."
Written for any caller holding the matching permission in the project:
- the per-type review policy — the complete grant set, including all three standing permissions (see review policies);
- the per-type may-define rights (which special elements documents of that type may mint) — edited on the per-kind row of the Special elements section, and governed by catalog activation in the project, which is a different right from the installation-shaping one below;
- the per-type read-acknowledgement policy where the lane proposes one;
- the folder skeleton.
Written only for a caller holding MANAGE_SCOPES at the installation level (see the birth path):
- creating a project — inside an organization that already exists. Founding the organization itself is a separate act with a right of its own since ADR-0109 (the birth path, §1a); this wizard cannot do it;
- activating a document type in the project;
- activating a role in the project — this makes the role bindable and assignable; it staffs nobody;
- declaring the project's special elements — its element kinds, each with the project's own name for it and its key prefix, and the prerequisites the declaration pulls in with it (special elements).
3. What it honestly hands over¶
Three things stay a hand-off even with every permission, and the wizard names each rather than skipping it silently:
- A type or role this installation's catalog does not carry at all. Creating catalog entries is catalog administration (Admin → Roles, document-type defaults) — the wizard can activate what exists, not invent vocabulary.
- The periodic-review interval a lane recommends. The interval lives on the document type for the whole installation, not on your project, so the wizard displays the cadence and says where it is set.
- Staffing. People come from your identity provider and are staffed through the user administration surface (staffing & assignments).
4. Two modes on the configuration step¶
- A new project renders the lane's type list — there is nothing else to render yet.
- An existing project renders its own activated types first, pre-filled from the lane where the prefixes match, and only then the lane types it has yet to activate.
A type the lane knows nothing about — an imported vocabulary, a house type, another lane's type — gets a "not in this lane" marker, honestly empty grant rows, and starts out of the commit. Turn it on and fill the rows in yourself. The wizard will not invent a policy for a type nobody asked about.
5. The last step checks, it does not gate¶
Apply & verify re-reads the project's setup status against what was just written and lists what the system will still flag. It enforces nothing: unstaffed roles are normal on day one — invited people bind on first login — and the point is that you see what will block, and where, instead of meeting it as a surprise at the first submit.
6. The chip monitors; the wizard remediates¶
These are two different tools, and confusing them wastes time in both directions.
The setup-status chip is the monitor. Setup complete / "N setup gaps" on the project configuration is always on, always current, and it is the thing that tells you a project has drifted or was never finished. You do not need the wizard to find out whether a project is in order — that is the chip's job, and re-running the wizard as a routine health check is ceremony that tells you nothing the chip has not already said.
Wizard re-entry is the remediation tool. Pointing the wizard at an existing project (§4's second mode) does one thing the chip cannot: it compares the project against a lane and offers the whole difference as a single editable, reviewable batch. The chip reports "this type has no review policy", one finding at a time, with a fix link per finding; the wizard says "here is the lane's shape, here is yours, here is everything missing — check what you want and apply it in one pass". Nothing is written until Apply, so opening it to look costs nothing.
Reach for re-entry when:
- a project was configured by hand or arrived through an import and you want to see how far it is from a house lane;
- new document types were activated in it and they need policies, may-define flags and acknowledgement policies — the wizard fills all three from the lane rather than you visiting three tabs per type;
- you are adopting a lane's shape late — the project pre-dates the lane, or you decided its lane was the wrong one.
Re-entry is safe: acts that are already satisfied report as Already there rather than being re-applied, and re-declaring an element kind the wizard itself declared is a no-op that does not trip the freeze. A type the lane does not know starts out of the commit (§4), so re-entry never quietly reshapes a house type.
Governing decisions: ADR-0097 (the governed provisioning surface — what the wizard may create), ADR-0096 (deny-unless-granted transition permissions — why every preset grant set is complete), ADR-0112 (the element-kind catalog a lane selects from), ADR-0095 (its freeze governance), ADR-0091 (release modes — the direct record release the INFRA type uses), ADR-0052 (read-acknowledgement policies), ADR-0049 (document categories — why only prescriptive types are periodically reviewed). Regulatory frame: IEC 62304 (supplier lane), ISO 13485 §§4–8 (the QMS lane's chapter tree).