Skip to content
LQMS
Tool-Risk Assessment — LQMS as a QMS Tool (TEMPLATE)
Initializing search
nburri/lqms
LQMS
nburri/lqms
Home
Evaluate LQMS
Evaluate LQMS
LQMS Known Limits
LQMS Security Posture
Architecture
Architecture
1. Introduction and Goals
2. Architecture Constraints
3. Context and Scope
4. Solution Strategy
5. Building Block View
6. Runtime View
7. Deployment View
8. Crosscutting Concepts
9. Architecture Decisions
10. Quality Requirements
11. Risks and Technical Debt
12. Glossary
The arrival bundle format
Decisions (ADRs)
Decisions (ADRs)
ADR-0001: Content-Addressed Document Storage with PostgreSQL as Source of Truth
ADR-0002: Single Instance with Scope Hierarchy and Copy-on-Derive
ADR-0003: Fixed Life Cycle States with Configurable Review Processes
ADR-0004: Global Catalogs for Roles and Document Types with Per-Scope Activation
ADR-0005: Modular Monolith
ADR-0006: Three-Layer Search with In-Database Index and Pluggable LLM
ADR-0007: Angular Frontend with Server-Side-Only Enforcement
ADR-0008: Flyway Migrations and jOOQ Codegen from the Migrated Schema
ADR-0009: RLS Enforcement via a Session-Scoped Authorized Scope Set
ADR-0010: Self-Managed QMS via an Internal Mandator
ADR-0011: Authentication via OIDC SSO with Server-Side (BFF) Sessions
ADR-0012: Permission-Based Authorization and System Bootstrap
ADR-0013: User Identity Lifecycle
ADR-0014: Electronic Signatures (Part 11 / Annex 11-Capable)
ADR-0015: Document Effectivity, Periodic Review & Validity
ADR-0016: Data Retention, Disposal & Privacy (FADP / GDPR)
ADR-0017: Multi-Part Version Content
ADR-0018: Non-Functional Targets (Capacity, Availability, Security)
ADR-0019: Notifications & Tasks
ADR-0020: Internationalization (Content Language, Time Zones, Formatting)
ADR-0021: General Typed Document Relationships
ADR-0022: Read-Acknowledgement & Questionnaires
ADR-0023: Migration / Import — Current Released State
ADR-0024: Draft / In-Review Cancellation
ADR-0025: Disposal & Erasure Mechanics (Storage, Index, Backups)
ADR-0026: RLS Runtime Safety — Connection-Pool Scope Isolation
ADR-0027: RLS Boundary — Content-Plane vs Control-Plane
ADR-0028: Stateless Encrypted Token-State Cookie (no server-side session store)
ADR-0029: Document Content Model — Draft-Freeze, Content-Table RLS, Append-Only Audit
ADR-0030: Review & Life-Cycle Realization Model
ADR-0031: Released-base readability enforcement & copy-on-derive mechanics
ADR-0032: Frontend realization — Quinoa, Angular Material, i18n & E2E
ADR-0033: CSRF control for the BFF session — SameSite + JSON content-type
ADR-0034: Notification realization — in-process domain events + system-context fan-out
ADR-0035: Fan-out contract as shipped — gate semantics, count disclosure, audit protocol
ADR-0036: Repository layer — services carry rules, repositories carry jOOQ
ADR-0037: Task scheduler — in-process tick, advisory-lock election, SQL sweep
ADR-0038: Periodic-review realization — derived due date, policy-gated confirmation
ADR-0039: Sweep & periodic-review contract as shipped — grants, guards, addressing
ADR-0040: Disposal-due surfacing — closure-anchored retention, scope-level legal hold
ADR-0041: Email channel & notification i18n — notification-as-outbox, structured messages
ADR-0042: Disposal execution — document tombstoning, single-actor hard-gated destruction
ADR-0043: Disposal blob deletion is post-commit, GC-backstopped
ADR-0044: Search FTS baseline — event-indexed, RLS-scoped search_index
ADR-0045: Image Attachments as Content Parts (Rich-Content Slice R2)
ADR-0046: Four-Eyes — Submitter Excluded from Approval
ADR-0047: Four-Eyes — Submitter-Only Exclusion
ADR-0048: Document Organization — Folder Tree per Scope
ADR-0049: Content Model Round 2 — Type Categories, Template Instantiation, Trace Relations, Completeness Rules
ADR-0050: Live Frontend — SSE State Push, CodeMirror 6, Draft Presence
ADR-0051: In-Text Document Links (doc: Scheme)
ADR-0052: Addressees & Read-Acknowledgement (REQ-TRN Realization)
ADR-0053: Addressees Per Document + Process Owner (amends ADR-0052 K-1)
ADR-0054: Process Owner Is a Role (amends ADR-0053 P-3)
ADR-0055: WYSIWYG Editing Mode over Markdown (editor step R4)
ADR-0056: Visual-Editor Chrome via Milkdown Crepe (gated adoption)
ADR-0057: Content Record Is the ProseMirror Document Tree; Markdown Becomes a Derived Projection
ADR-0058: PM_DOC Is the Only Content Format (pre-production cut; amends ADR-0057 §5)
ADR-0059: Editor Engine Switches to TipTap (spike-gated; supersedes the Milkdown/Crepe choice)
ADR-0060: Backup & Restore — Scripted Ordered Backup with Automated Restore Rehearsal
ADR-0061: CSV — Generated Validation Package per Release
ADR-0062: SBOM — CycloneDX over the Production Layers, Validated Against the Artifact
ADR-0063: User Identity Binds on Subject Only (Issuer Becomes Provenance)
ADR-0064: Per-Document Workflow Role Bindings (Author / Reviewer / Releaser), Enforced
ADR-0065: Diagrams — Excalidraw as the Manual Layer, Mermaid Stays for Text-First/UML
ADR-0066: WITHDRAW — the Author Side May Reclaim a Version from Review
ADR-0067: Review Comments — Anchored, Immutable, Resolvable
ADR-0068: Confluence/Jira QMS Import — Staged, Read-Only, Repeatable
ADR-0069: Arbitrary File Attachments — Download-Only Confinement
ADR-0070: Training Questionnaires — Versioned, Auto-Scored, Release-Gated
ADR-0071: Training Plans — Document Obligations + External Trainings & Certifications
ADR-0072: Diagrams — Self-Hosted draw.io Replaces Excalidraw
ADR-0073: Per-Scope QMS Configuration Surface
ADR-0074: PDF Export of Released Documents — Server-Side via Apache FOP over the Canonical Projection
ADR-0075: Source History Import — Continuity Without Forged Audit
ADR-0076: Periodic-review status visibility (completing MVP gap #2)
ADR-0077: Requirement Items — Keyed Blocks Inside Controlled Documents
ADR-0078: Generalized Trace Items (Traceability Model — Stage A)
ADR-0079: Risk & Risk-Control Items (Traceability Model — Stage B)
ADR-0080: Traceability Workspace — Hub, Sub-Pages, and Role-Gated Views
ADR-0081: Draft-Only Trace-Structure Changes, Server-Enforced
ADR-0082: Table-Shaped Risk Authoring over Risk Blocks
ADR-0083: The TD Dossier — a Versioned, Cross-Scope, Regulatory-Structured Deliverable
ADR-0084: Validation & Regulatory Axes (Traceability Model — Stage C)
ADR-0085: Relation-Layer Consolidation — One Trace Vocabulary, One Surface
ADR-0086: Requirement Traceability Chains — End-to-End Path View + Flat Path Export
ADR-0087: The Scope Traceability Report — One Derived Overview Artifact, Never a Controlled Document
ADR-0088: Verification Evidence Classes — Planned vs. Verified, Derived at the Read Layer
ADR-0089: Recurring Obligations — Periodic Tasks With Record Evidence, Not Calendar Series
ADR-0090: Release & Versioning Policy — Deliberate Releases, One Auditor-Facing Number
ADR-0091: Release Modes — Single-Person Record Release With a Structural Four-Eyes Floor
ADR-0092: Orphan-Blob Garbage Collection With a Quarantine Bin
ADR-0093: One Scope Context — the Toolbar Switcher Is the Only Scope Selector
ADR-0094: Calendar-Anchored Obligation Schedules (Clamped, Never Too Late)
ADR-0095: Key-Rule Governance — Free Until First Use, Then Frozen
ADR-0096: Transition Permissions — Always Visible, Deny Unless Granted
ADR-0097: A Governed Provisioning Surface — MANAGE_SCOPES
ADR-0098: Org Chart × Role System — Marriage at the Evidence Level, Never in Authorization
ADR-0099: The User Manual is an In-App Topic Reference, Not a Document
ADR-0100: LQMS Is the Living Quality Management System
ADR-0101: The Executable Validation Journey (PQ Evidence That Cannot Drift)
ADR-0102: Typed Template Variables (text | date | number — and Deliberately No Enum)
ADR-0103: npm audit Joins the Verification Gate as a Second Standing Input
ADR-0104: The Issued Dossier Is a Persisted Artifact of Record — and Clones to a New Draft
ADR-0105: Navigation Information Architecture — Group by Moment-of-Use
ADR-0106: The Client Reflection Follows Assignments, Not Only Content Reach
ADR-0107: The Audit Append Gate Follows Assignment Reach, Not Content Reach
ADR-0108: Mandator Membership — Invite-Accept, with Pre-Assigned Responsibilities
ADR-0109: Organization Founding Is Its Own Process
ADR-0110: The Audit Trail Is Not a Read Model
ADR-0111: The Imported-Person Model, and Project Portability's First Doctrines
ADR-0112: The Element-Kind Catalog — Semantics in the Model, Not Only in the Code
ADR-0113: Project Arrival Import — Records Arrive as They Are, People Arrive as They Were
ADR-0114: The Operating Model Arrives — Roles as Functions, Names as Words, People as This Instance's Decision
ADR-0115: Collaborative Draft Editing — Two Carets, One Truth, Honest Credit
ADR-0116: The System Maintenance Surface — the App Backs Itself Up, the Host Keeps One Dumb Job
ADR-0117: Role Documentation — a Link, a Finding, Per-Source Recognizers; Substitution Rejected
ADR-0118: The Offline QMS Copy — the Repo Carries the Audit Pack, Not a Second Renderer
ADR-0119: Module-Internal Package Structure — Capabilities First, Layers Second, the Root Is the Surface
ADR-0120: The Shared Kernel — the Domain-Exception Vocabulary Leaves the Authorization Module
ADR-0121: The Project Administrator Role — Per-Scope Administration With Read Access, Seeded in the Base Catalog
ADR-0122: Organization-Level Administration — the Cascade Stays, Becomes Visible, and Founds Projects
ADR-0123: Draft Save-Points — Every Save Restorable, Kept for the Life of the Version
ADR-0124: The Birth Path Completes Without Borrowing Content Clothes
ADR-0125: The Export Twin — Export Emits an Arrival Bundle
ADR-0126: Project Dissolution — the Un-Birth of an Unused Scope
ADR-0127: The Base-QMS Layers — One Library, Derived Adaptations, Local Records
ADR-0128: The GLOBAL Cascade Carries Administration, Never Content
ADR-0129: Role Identity from a GLOBAL Assignment Acts in GLOBAL Alone
ADR-0130: Break-Glass — the Project Administrator's Escalation Is a First-Class, Witnessed, Self-Expiring Act
ADR-0131: Role Substitution as Declared Adoption Edges — Emergency Cover Is Governed, Own-Name, Timed Staffing
ADR-0132: Dual-Hat Reviewer Satisfaction Is a Declared Policy Choice — the Strict Floor Stays the Default
ADR-NNNN:
</span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_5" > <div class="md-nav__link md-nav__container"> <a href="../../../requirements/" class="md-nav__link "> <span class="md-ellipsis"> Requirements </span> </a> <label class="md-nav__link " for="__nav_5" id="__nav_5_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_5_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_5"> <span class="md-nav__icon md-icon"></span> Requirements </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../../requirements/stakeholder_requirements/" class="md-nav__link"> <span class="md-ellipsis"> Stakeholder Requirements </span> </a> </li> <li class="md-nav__item"> <a href="../../../requirements/gap-analysis/" class="md-nav__link"> <span class="md-ellipsis"> Requirements Gap Analysis </span> </a> </li> <li class="md-nav__item"> <a href="../../../requirements/req_admin/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Administration, Permissions & Onboarding </span> </a> </li> <li class="md-nav__item"> <a href="../../../requirements/req_api_ui/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: API & User Interface </span> </a> </li> <li class="md-nav__item"> <a href="../../../requirements/req_audit_reporting/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Audit Trail & Regulatory Reporting </span> </a> </li> <li class="md-nav__item"> <a href="../../../requirements/req_auth/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Authentication & Session </span> </a> </li> <li class="md-nav__item"> <a href="../../../requirements/req_backup/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Backup & Restore </span> </a> </li> <li class="md-nav__item"> <a href="../../../requirements/req_catalogs/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Catalogs, Roles & Users </span> </a> </li> <li class="md-nav__item"> <a href="../../../requirements/req_data_protection/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Data Protection, Retention & Disposal </span> </a> </li> <li class="md-nav__item"> <a href="../../../requirements/req_documents/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Documents, Versions & Storage </span> </a> </li> <li class="md-nav__item"> <a href="../../../requirements/req_dossiers/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Technical Documentation Dossiers </span> </a> </li> <li class="md-nav__item"> <a href="../../../requirements/req_effectivity/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Effectivity, Periodic Review & Validity </span> </a> </li> <li class="md-nav__item"> <a href="../../../requirements/req_gspr/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Regulatory Conformity (GSPR / Essential Principles) </span> </a> </li> <li class="md-nav__item"> <a href="../../../requirements/req_i18n/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Internationalization </span> </a> </li> <li class="md-nav__item"> <a href="../../../requirements/req_lifecycle/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Life Cycle & Reviews </span> </a> </li> <li class="md-nav__item"> <a href="../../../requirements/req_memberships/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Mandator Membership & Invitations </span> </a> </li> <li class="md-nav__item"> <a href="../../../requirements/req_migration/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Migration & Import </span> </a> </li> <li class="md-nav__item"> <a href="../../../requirements/req_nfr/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Non-Functional </span> </a> </li> <li class="md-nav__item"> <a href="../../../requirements/req_notifications/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Notifications & Tasks </span> </a> </li> <li class="md-nav__item"> <a href="../../../requirements/req_obligations/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Recurring Obligations </span> </a> </li> <li class="md-nav__item"> <a href="../../../requirements/req_relationships/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Document Relationships </span> </a> </li> <li class="md-nav__item"> <a href="../../../requirements/req_risk/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Risk Management (ISO 14971 Hazards & Controls) </span> </a> </li> <li class="md-nav__item"> <a href="../../../requirements/req_sbom/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Software Bill of Materials & Supply-Chain Assurance </span> </a> </li> <li class="md-nav__item"> <a href="../../../requirements/req_search/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Search </span> </a> </li> <li class="md-nav__item"> <a href="../../../requirements/req_separation/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Scopes, Mandators & Separation </span> </a> </li> <li class="md-nav__item"> <a href="../../../requirements/req_signatures/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Electronic Signatures </span> </a> </li> <li class="md-nav__item"> <a href="../../../requirements/req_training/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Read-Acknowledgement & Questionnaires </span> </a> </li> <li class="md-nav__item"> <a href="../../../requirements/req_users/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: User Identity & Lifecycle </span> </a> </li> <li class="md-nav__item"> <a href="../../../requirements/req_validation/" class="md-nav__link"> <span class="md-ellipsis"> Software Requirements: Design Validation & the Validation Traceability Axis </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_6" > <div class="md-nav__link md-nav__container"> <a href="../../../process/" class="md-nav__link "> <span class="md-ellipsis"> Process (IEC 62304) </span> </a> <label class="md-nav__link " for="__nav_6" id="__nav_6_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_6_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_6"> <span class="md-nav__icon md-icon"></span> Process (IEC 62304) </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../../process/configuration_management_plan/" class="md-nav__link"> <span class="md-ellipsis"> Configuration Management Plan </span> </a> </li> <li class="md-nav__item"> <a href="../../../process/problem_resolution/" class="md-nav__link"> <span class="md-ellipsis"> Problem Resolution Process </span> </a> </li> <li class="md-nav__item"> <a href="../../../process/risk_management/" class="md-nav__link"> <span class="md-ellipsis"> Risk Management </span> </a> </li> <li class="md-nav__item"> <a href="../../../process/software_development_plan/" class="md-nav__link"> <span class="md-ellipsis"> Software Development Plan </span> </a> </li> <li class="md-nav__item"> <a href="../../../process/verification_plan/" class="md-nav__link"> <span class="md-ellipsis"> Verification Plan </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_7" > <label class="md-nav__link" for="__nav_7" id="__nav_7_label" tabindex="0"> <span class="md-ellipsis"> Operations </span> <span class="md-nav__icon md-icon"></span> </label> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_7_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_7"> <span class="md-nav__icon md-icon"></span> Operations </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../../operations/genesis-installation/" class="md-nav__link"> <span class="md-ellipsis"> Genesis: Birthing an LQMS Installation with a Base Library </span> </a> </li> <li class="md-nav__item"> <a href="../../../operations/deployment/" class="md-nav__link"> <span class="md-ellipsis"> LQMS Deployment Guide </span> </a> </li> <li class="md-nav__item"> <a href="../../../operations/server-deployment/" class="md-nav__link"> <span class="md-ellipsis"> LQMS Server Deployment (single Linux host, public HTTPS) </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_8" > <div class="md-nav__link md-nav__container"> <a href="../../../traceability/" class="md-nav__link "> <span class="md-ellipsis"> Traceability </span> </a> <label class="md-nav__link " for="__nav_8" id="__nav_8_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_8_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_8"> <span class="md-nav__icon md-icon"></span> Traceability </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../../traceability/matrix/" class="md-nav__link"> <span class="md-ellipsis"> Requirements Traceability Matrix </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--active md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_9" checked> <div class="md-nav__link md-nav__container"> <a href="../../" class="md-nav__link "> <span class="md-ellipsis"> Validation (tool lane) </span> </a> <label class="md-nav__link " for="__nav_9" id="__nav_9_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_9_label" aria-expanded="true"> <label class="md-nav__title" for="__nav_9"> <span class="md-nav__icon md-icon"></span> Validation (tool lane) </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../ai-authorship-posture/" class="md-nav__link"> <span class="md-ellipsis"> AI-Authorship Posture — How LQMS Is Built, and Why the Validation Evidence Does Not Rest on It (TEMPLATE) </span> </a> </li> <li class="md-nav__item"> <a href="../intended-use/" class="md-nav__link"> <span class="md-ellipsis"> Intended-Use Specification — LQMS as a QMS / Document-Control Tool (TEMPLATE) </span> </a> </li> <li class="md-nav__item md-nav__item--active"> <input class="md-nav__toggle md-toggle" type="checkbox" id="__toc"> <label class="md-nav__link md-nav__link--active" for="__toc"> <span class="md-ellipsis"> Tool-Risk Assessment — LQMS as a QMS Tool (TEMPLATE) </span> <span class="md-nav__icon md-icon"></span> </label> <a href="./" class="md-nav__link md-nav__link--active"> <span class="md-ellipsis"> Tool-Risk Assessment — LQMS as a QMS Tool (TEMPLATE) </span> </a> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class="md-nav__title" for="__toc"> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class="md-nav__list" data-md-component="toc" data-md-scrollfix> <li class="md-nav__item"> <a href="#1-purpose-and-method" class="md-nav__link"> <span class="md-ellipsis"> 1. Purpose and method </span> </a> </li> <li class="md-nav__item"> <a href="#2-instantiation-fields" class="md-nav__link"> <span class="md-ellipsis"> 2. Instantiation fields </span> </a> </li> <li class="md-nav__item"> <a href="#3-risk-table" class="md-nav__link"> <span class="md-ellipsis"> 3. Risk table </span> </a> <nav class="md-nav" aria-label="3. Risk table"> <ul class="md-nav__list"> <li class="md-nav__item"> <a href="#tr-001--wrong-document-served-stale-superseded-or-not-yet-effective-version" class="md-nav__link"> <span class="md-ellipsis"> TR-001 — Wrong document served (stale, superseded, or not-yet-effective version) </span> </a> </li> <li class="md-nav__item"> <a href="#tr-002--access-leak-across-mandators--projects" class="md-nav__link"> <span class="md-ellipsis"> TR-002 — Access leak across mandators / projects </span> </a> </li> <li class="md-nav__item"> <a href="#tr-003--data-loss-content-records-or-configuration" class="md-nav__link"> <span class="md-ellipsis"> TR-003 — Data loss (content, records, or configuration) </span> </a> </li> <li class="md-nav__item"> <a href="#tr-004--stale-or-false-traceability-claims" class="md-nav__link"> <span class="md-ellipsis"> TR-004 — Stale or false traceability claims </span> </a> </li> <li class="md-nav__item"> <a href="#tr-005--export--audit-pack-integrity-tampered-or-incomplete-evidence-bundle" class="md-nav__link"> <span class="md-ellipsis"> TR-005 — Export / audit-pack integrity (tampered or incomplete evidence bundle) </span> </a> </li> <li class="md-nav__item"> <a href="#tr-006--unauthorized-or-self-approved-release-four-eyes-bypass" class="md-nav__link"> <span class="md-ellipsis"> TR-006 — Unauthorized or self-approved release (four-eyes bypass) </span> </a> </li> <li class="md-nav__item"> <a href="#tr-007--released-evidence-eroded-by-in-place-edit" class="md-nav__link"> <span class="md-ellipsis"> TR-007 — Released evidence eroded by in-place edit </span> </a> </li> <li class="md-nav__item"> <a href="#tr-008--acknowledgement-gap-an-addressee-misses-a-required-document" class="md-nav__link"> <span class="md-ellipsis"> TR-008 — Acknowledgement gap (an addressee misses a required document) </span> </a> </li> <li class="md-nav__item"> <a href="#tr-009--audit-trail-integrity--forged-history" class="md-nav__link"> <span class="md-ellipsis"> TR-009 — Audit-trail integrity / forged history </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item"> <a href="#4-residual-risks-inherent-to-the-tool" class="md-nav__link"> <span class="md-ellipsis"> 4. Residual risks inherent to the tool </span> </a> </li> <li class="md-nav__item"> <a href="#5-open-points-for-the-red-pen-round-template-level" class="md-nav__link"> <span class="md-ellipsis"> 5. Open points for the red-pen round (template-level) </span> </a> </li> </ul> </nav> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_10" > <label class="md-nav__link" for="__nav_10" id="__nav_10_label" tabindex="0"> <span class="md-ellipsis"> Regulatory </span> <span class="md-nav__icon md-icon"></span> </label> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_10_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_10"> <span class="md-nav__icon md-icon"></span> Regulatory </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../../regulatory/mdr-annex-i-skeleton/" class="md-nav__link"> <span class="md-ellipsis"> MDR Annex I — GSPR authoring skeleton (paraphrased) </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item md-nav__item--nested"> <input class="md-nav__toggle md-toggle " type="checkbox" id="__nav_11" > <div class="md-nav__link md-nav__container"> <a href="../../../user-guide/" class="md-nav__link "> <span class="md-ellipsis"> User guide </span> </a> <label class="md-nav__link " for="__nav_11" id="__nav_11_label" tabindex="0"> <span class="md-nav__icon md-icon"></span> </label> </div> <nav class="md-nav" data-md-level="1" aria-labelledby="__nav_11_label" aria-expanded="false"> <label class="md-nav__title" for="__nav_11"> <span class="md-nav__icon md-icon"></span> User guide </label> <ul class="md-nav__list" data-md-scrollfix> <li class="md-nav__item"> <a href="../../../user-guide/tutorial/" class="md-nav__link"> <span class="md-ellipsis"> Tutorial — from zero to a released document </span> </a> </li> <li class="md-nav__item"> <a href="../../../user-guide/administration/" class="md-nav__link"> <span class="md-ellipsis"> Administering an LQMS Installation </span> </a> </li> <li class="md-nav__item"> <a href="../../../user-guide/diagrams/" class="md-nav__link"> <span class="md-ellipsis"> Diagrams </span> </a> </li> <li class="md-nav__item"> <a href="../../../user-guide/documents-lifecycle/" class="md-nav__link"> <span class="md-ellipsis"> Documents & the Lifecycle </span> </a> </li> <li class="md-nav__item"> <a href="../../../user-guide/exports/" class="md-nav__link"> <span class="md-ellipsis"> PDF Exports & the Audit Pack </span> </a> </li> <li class="md-nav__item"> <a href="../../../user-guide/obligations/" class="md-nav__link"> <span class="md-ellipsis"> Recurring Obligations </span> </a> </li> <li class="md-nav__item"> <a href="../../../user-guide/project-context/" class="md-nav__link"> <span class="md-ellipsis"> The Project Context & App Version </span> </a> </li> <li class="md-nav__item"> <a href="../../../user-guide/review-comments/" class="md-nav__link"> <span class="md-ellipsis"> Review Comments </span> </a> </li> <li class="md-nav__item"> <a href="../../../user-guide/topics/activity-trail/" class="md-nav__link"> <span class="md-ellipsis"> Who did what, when — reading a project's activity </span> </a> </li> <li class="md-nav__item"> <a href="../../../user-guide/topics/admin-scopes/" class="md-nav__link"> <span class="md-ellipsis"> Renaming a project, and what can never change </span> </a> </li> <li class="md-nav__item"> <a href="../../../user-guide/topics/authority-view/" class="md-nav__link"> <span class="md-ellipsis"> Who holds each function here, and what may it do </span> </a> </li> <li class="md-nav__item"> <a href="../../../user-guide/topics/break-glass/" class="md-nav__link"> <span class="md-ellipsis"> The permission I need is held by a role I do not hold — what now? </span> </a> </li> <li class="md-nav__item"> <a href="../../../user-guide/topics/coverage-and-chains/" class="md-nav__link"> <span class="md-ellipsis"> Coverage or chains? — which requirement view answers your question </span> </a> </li> <li class="md-nav__item"> <a href="../../../user-guide/topics/credentials/" class="md-nav__link"> <span class="md-ellipsis"> Your password: changing it, resetting it — and why LQMS never sees it </span> </a> </li> <li class="md-nav__item"> <a href="../../../user-guide/topics/emergency-cover/" class="md-nav__link"> <span class="md-ellipsis"> Who may cover for whom here — declaring emergency cover, and reading where the glass was broken </span> </a> </li> <li class="md-nav__item"> <a href="../../../user-guide/topics/key-rules/" class="md-nav__link"> <span class="md-ellipsis"> Special elements: what a project declares, and when its names freeze </span> </a> </li> <li class="md-nav__item"> <a href="../../../user-guide/topics/memberships/" class="md-nav__link"> <span class="md-ellipsis"> Belonging to an organization: invitations, acceptance, and what they change </span> </a> </li> <li class="md-nav__item"> <a href="../../../user-guide/topics/provisioning-birth-path/" class="md-nav__link"> <span class="md-ellipsis"> How a new organization and project are born </span> </a> </li> <li class="md-nav__item"> <a href="../../../user-guide/topics/review-policies/" class="md-nav__link"> <span class="md-ellipsis"> What a review policy controls, and what an empty grant means </span> </a> </li> <li class="md-nav__item"> <a href="../../../user-guide/topics/setup-wizard-lanes/" class="md-nav__link"> <span class="md-ellipsis"> The setup wizard: the lanes, and what it writes </span> </a> </li> <li class="md-nav__item"> <a href="../../../user-guide/topics/staffing-and-assignments/" class="md-nav__link"> <span class="md-ellipsis"> Staffing people into roles, and the accountable holder </span> </a> </li> <li class="md-nav__item"> <a href="../../../user-guide/topics/technical-dossier/" class="md-nav__link"> <span class="md-ellipsis"> How do I assemble a technical dossier? </span> </a> </li> <li class="md-nav__item"> <a href="../../../user-guide/trace-items/" class="md-nav__link"> <span class="md-ellipsis"> Trace Items — Requirements, Risks & Risk Controls </span> </a> </li> <li class="md-nav__item"> <a href="../../../user-guide/trace-links/" class="md-nav__link"> <span class="md-ellipsis"> Trace Links & the Suspect Cycle </span> </a> </li> <li class="md-nav__item"> <a href="../../../user-guide/traceability-workspace/" class="md-nav__link"> <span class="md-ellipsis"> The Traceability Workspace </span> </a> </li> <li class="md-nav__item"> <a href="../../../user-guide/training/" class="md-nav__link"> <span class="md-ellipsis"> Training & Acknowledgements </span> </a> </li> </ul> </nav> </li> </ul> </nav> </div> </div> </div> <div class="md-sidebar md-sidebar--secondary" data-md-component="sidebar" data-md-type="toc" > <div class="md-sidebar__scrollwrap"> <div class="md-sidebar__inner"> <nav class="md-nav md-nav--secondary" aria-label="Table of contents"> <label class="md-nav__title" for="__toc"> <span class="md-nav__icon md-icon"></span> Table of contents </label> <ul class="md-nav__list" data-md-component="toc" data-md-scrollfix> <li class="md-nav__item"> <a href="#1-purpose-and-method" class="md-nav__link"> <span class="md-ellipsis"> 1. Purpose and method </span> </a> </li> <li class="md-nav__item"> <a href="#2-instantiation-fields" class="md-nav__link"> <span class="md-ellipsis"> 2. Instantiation fields </span> </a> </li> <li class="md-nav__item"> <a href="#3-risk-table" class="md-nav__link"> <span class="md-ellipsis"> 3. Risk table </span> </a> <nav class="md-nav" aria-label="3. Risk table"> <ul class="md-nav__list"> <li class="md-nav__item"> <a href="#tr-001--wrong-document-served-stale-superseded-or-not-yet-effective-version" class="md-nav__link"> <span class="md-ellipsis"> TR-001 — Wrong document served (stale, superseded, or not-yet-effective version) </span> </a> </li> <li class="md-nav__item"> <a href="#tr-002--access-leak-across-mandators--projects" class="md-nav__link"> <span class="md-ellipsis"> TR-002 — Access leak across mandators / projects </span> </a> </li> <li class="md-nav__item"> <a href="#tr-003--data-loss-content-records-or-configuration" class="md-nav__link"> <span class="md-ellipsis"> TR-003 — Data loss (content, records, or configuration) </span> </a> </li> <li class="md-nav__item"> <a href="#tr-004--stale-or-false-traceability-claims" class="md-nav__link"> <span class="md-ellipsis"> TR-004 — Stale or false traceability claims </span> </a> </li> <li class="md-nav__item"> <a href="#tr-005--export--audit-pack-integrity-tampered-or-incomplete-evidence-bundle" class="md-nav__link"> <span class="md-ellipsis"> TR-005 — Export / audit-pack integrity (tampered or incomplete evidence bundle) </span> </a> </li> <li class="md-nav__item"> <a href="#tr-006--unauthorized-or-self-approved-release-four-eyes-bypass" class="md-nav__link"> <span class="md-ellipsis"> TR-006 — Unauthorized or self-approved release (four-eyes bypass) </span> </a> </li> <li class="md-nav__item"> <a href="#tr-007--released-evidence-eroded-by-in-place-edit" class="md-nav__link"> <span class="md-ellipsis"> TR-007 — Released evidence eroded by in-place edit </span> </a> </li> <li class="md-nav__item"> <a href="#tr-008--acknowledgement-gap-an-addressee-misses-a-required-document" class="md-nav__link"> <span class="md-ellipsis"> TR-008 — Acknowledgement gap (an addressee misses a required document) </span> </a> </li> <li class="md-nav__item"> <a href="#tr-009--audit-trail-integrity--forged-history" class="md-nav__link"> <span class="md-ellipsis"> TR-009 — Audit-trail integrity / forged history </span> </a> </li> </ul> </nav> </li> <li class="md-nav__item"> <a href="#4-residual-risks-inherent-to-the-tool" class="md-nav__link"> <span class="md-ellipsis"> 4. Residual risks inherent to the tool </span> </a> </li> <li class="md-nav__item"> <a href="#5-open-points-for-the-red-pen-round-template-level" class="md-nav__link"> <span class="md-ellipsis"> 5. Open points for the red-pen round (template-level) </span> </a> </li> </ul> </nav> </div> </div> </div> <div class="md-content" data-md-component="content"> <article class="md-content__inner md-typeset"> <a href="https://github.com/nburri/lqms/edit/main/docs/validation/templates/tool-risk-assessment.md" title="Edit this page" class="md-content__button md-icon"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M10 20H6V4h7v5h5v3.1l2-2V8l-6-6H6c-1.1 0-2 .9-2 2v16c0 1.1.9 2 2 2h4zm10.2-7c.1 0 .3.1.4.2l1.3 1.3c.2.2.2.6 0 .8l-1 1-2.1-2.1 1-1c.1-.1.2-.2.4-.2m0 3.9L14.1 23H12v-2.1l6.1-6.1z"/></svg> </a> <!-- REVIEWED — red-pen round CLOSED 2026-07-26. --> <blockquote> <p><strong>Review (2026-07-26):</strong> approved as the tool-lane template by <strong>Nicolas Burri</strong> (C-V2 red-pen round; QMS/engineering domain-expert review, no legal-counsel claim — legal review deferred to before any commercial distribution).</p> </blockquote> <h1 id="tool-risk-assessment--lqms-as-a-qms-tool-template">Tool-Risk Assessment — LQMS as a QMS Tool (TEMPLATE)<a class="headerlink" href="#tool-risk-assessment--lqms-as-a-qms-tool-template" title="Permanent link">¶</a></h1> <blockquote> <p><strong>Tool-lane TEMPLATE, free of any organisation's specifics.</strong> Per <a href="../../../decisions/adr-0061-csv-validation-package/">ADR-0061</a> §2 the tool-risk assessment ships as a <strong>seeded template document in LQMS itself</strong> (C-V2a); each organisation that uses LQMS in its quality management system instantiates it for its own use. Everything below is true of <strong>any</strong> LQMS installation; organisation-specific values are declared template fields (§2) and nothing else. <strong>This document references no instance document</strong> — see the <a href="../../#the-rule">lane rule</a>.</p> <p><strong>Status:</strong> working draft for review, not yet a controlled document.</p> <p><strong>Norm handling:</strong> standards are paraphrased with clause citations only (conventions.md; ADR-0061 D-5). This assessment borrows ISO 14971 / GAMP-5 vocabulary; it assesses <strong>tool</strong> risk, not the risk of any device.</p> </blockquote> <h2 id="1-purpose-and-method">1. Purpose and method<a class="headerlink" href="#1-purpose-and-method" title="Permanent link">¶</a></h2> <p>This is the risk input required by ISO 13485 <strong>§4.1.6</strong> ("proportionate to risk"): what could go wrong when an organisation — here <strong>{{organisation}}</strong> — <em>uses</em> LQMS as its QMS / document-control tool, and what already mitigates it. It pairs with the organisation's intended-use specification ({{intendedUseRef}}); together they scope which PQ steps are mandatory in the CSV package.</p> <p><strong>Recorded, not computed (ADR-0079 doctrine, applied to the tool's own table).</strong> LQMS's own design rule is that the tool <em>records</em> a risk judgment and never computes or endorses a score — the scoring scale and how a level is reached live in content, not in the tool (<a href="../../../decisions/adr-0079-risk-items/">ADR-0079</a>). The same discipline applies here: the Severity / Likelihood / residual entries below are <strong>recorded judgments</strong>, entered by the assessor and confirmed by the reviewer, not values this document calculated. They are written as neutral tokens (<code>Severity · Likelihood — Residual</code>), never as a formula (no <code>S × L = level</code>), consistent with the presentation-honesty rule in conventions.md. The scale itself belongs to the instantiating organisation's risk policy ({{riskPolicy}}) — this template ships <strong>no</strong> suggested scores, precisely so it cannot appear to compute one.</p> <p>Each entry cites the <strong>real mechanism</strong> and its ADR / requirement / test, so the mitigation is objective evidence, not assertion.</p> <h2 id="2-instantiation-fields">2. Instantiation fields<a class="headerlink" href="#2-instantiation-fields" title="Permanent link">¶</a></h2> <p>Every value that differs between installations is a declared field; the body carries nothing else organisation-specific. Mechanics (<code>template-vars</code> declarations + brace placeholders, camelCase keys): <a href="../../../decisions/adr-0049-content-model-round2/">ADR-0049</a> §2 and the <a href="../../#how-template-fields-work">field guide</a>.</p> <div class="highlight"><pre><span></span><code><a id="__codelineno-0-1" name="__codelineno-0-1" href="#__codelineno-0-1"></a>organisation | Organisation validating its use of LQMS | yes | <a id="__codelineno-0-2" name="__codelineno-0-2" href="#__codelineno-0-2"></a>instanceName | Deployment / instance identifier | yes | <a id="__codelineno-0-3" name="__codelineno-0-3" href="#__codelineno-0-3"></a>lqmsRelease | LQMS release under assessment (tag + git SHA) | yes | <a id="__codelineno-0-4" name="__codelineno-0-4" href="#__codelineno-0-4"></a>assessor | Assessor recording the judgments | yes | <a id="__codelineno-0-5" name="__codelineno-0-5" href="#__codelineno-0-5"></a>assessmentDate | Assessment date | yes | <a id="__codelineno-0-6" name="__codelineno-0-6" href="#__codelineno-0-6"></a>riskPolicy | Organisation's risk-scoring scale / policy (reference) | yes | <a id="__codelineno-0-7" name="__codelineno-0-7" href="#__codelineno-0-7"></a>intendedUseRef | Companion intended-use specification (document id) | yes | <a id="__codelineno-0-8" name="__codelineno-0-8" href="#__codelineno-0-8"></a>backupCadence | Backup + restore-rehearsal cadence on this deployment (automated / manual) | yes | <a id="__codelineno-0-9" name="__codelineno-0-9" href="#__codelineno-0-9"></a>hardeningStatus | Deployment hardening per the operations guide (applied / pending) | yes | <a id="__codelineno-0-10" name="__codelineno-0-10" href="#__codelineno-0-10"></a>esignatureStatus | Electronic-signature capability in this deployment (configured / not configured) | no | not configured <a id="__codelineno-0-11" name="__codelineno-0-11" href="#__codelineno-0-11"></a>emailDelivery | Email / notification delivery in this deployment (enabled / disabled) | no | disabled <a id="__codelineno-0-12" name="__codelineno-0-12" href="#__codelineno-0-12"></a>tr001 | Recorded judgment TR-001 wrong document served (Severity · Likelihood — Residual) | yes | <a id="__codelineno-0-13" name="__codelineno-0-13" href="#__codelineno-0-13"></a>tr002 | Recorded judgment TR-002 access leak across mandators / projects | yes | <a id="__codelineno-0-14" name="__codelineno-0-14" href="#__codelineno-0-14"></a>tr003 | Recorded judgment TR-003 data loss | yes | <a id="__codelineno-0-15" name="__codelineno-0-15" href="#__codelineno-0-15"></a>tr004 | Recorded judgment TR-004 stale or false traceability claims | yes | <a id="__codelineno-0-16" name="__codelineno-0-16" href="#__codelineno-0-16"></a>tr005 | Recorded judgment TR-005 export / audit-pack integrity | yes | <a id="__codelineno-0-17" name="__codelineno-0-17" href="#__codelineno-0-17"></a>tr006 | Recorded judgment TR-006 unauthorized or self-approved release | yes | <a id="__codelineno-0-18" name="__codelineno-0-18" href="#__codelineno-0-18"></a>tr007 | Recorded judgment TR-007 released evidence eroded by in-place edit | yes | <a id="__codelineno-0-19" name="__codelineno-0-19" href="#__codelineno-0-19"></a>tr008 | Recorded judgment TR-008 acknowledgement gap | yes | <a id="__codelineno-0-20" name="__codelineno-0-20" href="#__codelineno-0-20"></a>tr009 | Recorded judgment TR-009 audit-trail integrity / forged history | yes </code></pre></div> <p><strong>Assessment identity:</strong> {{organisation}} · instance {{instanceName}} · LQMS {{lqmsRelease}} · assessed by {{assessor}} on {{assessmentDate}} · risk scale: {{riskPolicy}}.</p> <h2 id="3-risk-table">3. Risk table<a class="headerlink" href="#3-risk-table" title="Permanent link">¶</a></h2> <h3 id="tr-001--wrong-document-served-stale-superseded-or-not-yet-effective-version">TR-001 — Wrong document served (stale, superseded, or not-yet-effective version)<a class="headerlink" href="#tr-001--wrong-document-served-stale-superseded-or-not-yet-effective-version" title="Permanent link">¶</a></h3> <ul> <li><strong>Failure mode / effect:</strong> a user acts on a version that is not the one in force → work performed against an outdated or premature procedure.</li> <li><strong>Recorded judgment:</strong> {{tr001}} <em>(recorded, for review)</em>.</li> <li><strong>Mitigation in place:</strong> the <em>currently effective</em> version is <strong>derived, never stored</strong> — the released, non-revoked version with the latest effective date not after now; the prior version stays in force until the new version's effective date, then is superseded (REQ-EFF-002; <a href="../../../decisions/adr-0015-effectivity-periodic-review/">ADR-0015</a>, "computed, not stored states"). Released content is frozen; the only vehicle for change is a new version (<a href="../../../decisions/adr-0057-tree-as-record/">ADR-0057</a>). Overdue/periodic review is flagged and escalated — the tool never silently revokes a governing document (REQ-EFF-007). <strong>Evidence:</strong> effectivity/periodic-review tests; the full-stack browser smoke drives the release/revision loop.</li> </ul> <h3 id="tr-002--access-leak-across-mandators--projects">TR-002 — Access leak across mandators / projects<a class="headerlink" href="#tr-002--access-leak-across-mandators--projects" title="Permanent link">¶</a></h3> <ul> <li><strong>Failure mode / effect:</strong> a user sees or changes another mandator's or project's content → breach of the top data-separation quality goal.</li> <li><strong>Recorded judgment:</strong> {{tr002}} <em>(recorded, for review)</em>.</li> <li><strong>Mitigation in place:</strong> row-level security enforced in the database, <strong>independent of application code</strong> — a per-session authorized-scope set (<code>lqms.authorized_scope_ids</code>), the runtime connecting as a non-<code>BYPASSRLS</code> role, request-bounded <code>SET LOCAL ROLE lqms_app</code> + scope GUCs via the <code>runAs</code> context, SECURITY INVOKER resolution functions, and a content-plane / control-plane boundary (<a href="../../../decisions/adr-0009-rls-session-scope-context/">ADR-0009</a>/ <a href="../../../decisions/adr-0026-rls-connection-pool-safety/">ADR-0026</a>/ <a href="../../../decisions/adr-0027-rls-content-vs-control-plane/">ADR-0027</a>). <strong>Evidence:</strong> the automated <strong>separation suite</strong> — <code>RlsSeparationTest</code> (cross-scope data invisible even to an unfiltered query) and <code>RlsConnectionReuseTest</code> (pooled-connection isolation), <strong>negative-tested</strong> (weakening a policy makes the suite fail) and run in CI on every change (REQ-SEP-004 / -007 / -011 / -012).</li> <li><strong>Instance precondition:</strong> this backstop depends on the runtime <strong>not</strong> connecting as a BYPASSRLS role — see the hardening precondition in §4.</li> </ul> <h3 id="tr-003--data-loss-content-records-or-configuration">TR-003 — Data loss (content, records, or configuration)<a class="headerlink" href="#tr-003--data-loss-content-records-or-configuration" title="Permanent link">¶</a></h3> <ul> <li><strong>Failure mode / effect:</strong> hardware/volume loss or corruption destroys controlled documents and records → §4.2.4 g) loss-prevention and §4.2.5 retrieval duties fail.</li> <li><strong>Recorded judgment:</strong> {{tr003}} <em>(recorded, for review — see the cadence note below before recording Low)</em>.</li> <li><strong>Mitigation in place (as designed):</strong> scripted ordered backup — <code>deploy/backup.sh</code>, <strong>blobs first, database second</strong> (self-consistent archive), blob re-hash on copy (bit-rot detection), <code>pg_dump -Fc</code>, Keycloak realm export, a manifest, off-box copy, bounded retention (default 35 days), and a dead-man success ping — with an automated <strong>weekly restore rehearsal</strong> <code>deploy/verify-backup.sh</code> that restores into a scratch project and checks migrations current, health + manifest-SHA match, blob re-hash clean, and referential closure, writing a <strong>dated verification record</strong> into <code>deploy/backup-verification.log</code> (<a href="../../../decisions/adr-0060-backup-restore-mechanism/">ADR-0060</a>; RPO ≤ 24 h / RTO ≤ 1 business day per <a href="../../../decisions/adr-0018-nonfunctional-targets/">ADR-0018</a>). Those verification records are the cited IQ/CSV evidence (ADR-0061).</li> <li><strong>Cadence is an instance fact — recorded here as {{backupCadence}}.</strong> The mechanism is implemented in the tool, but whether a <em>schedule</em> runs on a given deployment (backup cron, rehearsal cadence, dead-man ping) is per-installation. Where the cadence is <strong>manual</strong>, continued execution depends on operator discipline: the residual must not be recorded as Low on that ground alone, and the instantiation states the gap plainly and names the closing act — automating the cadence, a natural first <a href="../../../decisions/adr-0089-recurring-obligations/">ADR-0089</a> recurring obligation — before the organisation relies on LQMS for retained §4.2.5 records at scale.</li> </ul> <h3 id="tr-004--stale-or-false-traceability-claims">TR-004 — Stale or false traceability claims<a class="headerlink" href="#tr-004--stale-or-false-traceability-claims" title="Permanent link">¶</a></h3> <ul> <li><strong>Failure mode / effect:</strong> a coverage or trace claim shown to an auditor is no longer true (an upstream item changed) but still reads as satisfied → false assurance.</li> <li><strong>Recorded judgment:</strong> {{tr004}} <em>(recorded, for review)</em>.</li> <li><strong>Mitigation in place:</strong> all traceability status is <strong>derived live, never stored — the house doctrine</strong> (<a href="../../../decisions/adr-0086-requirement-trace-chains/">ADR-0086</a>; <a href="../../../decisions/adr-0078-generalized-trace-items/">ADR-0078</a>), so there is no stored status that can silently drift. When an upstream item moves, the dependent link is flagged <strong>suspect per hop</strong> (re-score a risk → its controls' <code>mitigates</code> links go suspect; change a requirement → the <code>implemented-by</code> link goes suspect — <a href="../../../decisions/adr-0079-risk-items/">ADR-0079</a>); chain roll-up flags (<em>not satisfied</em> / <em>satisfied-but-unverified</em> / <em>suspect on the path</em>) are honest and <strong>non-suppressible</strong>, and access rules bound every hop's read. <strong>Evidence:</strong> the trace-item generalization / chain tests; risk-traceability tests exercising each suspect and gap path.</li> </ul> <h3 id="tr-005--export--audit-pack-integrity-tampered-or-incomplete-evidence-bundle">TR-005 — Export / audit-pack integrity (tampered or incomplete evidence bundle)<a class="headerlink" href="#tr-005--export--audit-pack-integrity-tampered-or-incomplete-evidence-bundle" title="Permanent link">¶</a></h3> <ul> <li><strong>Failure mode / effect:</strong> an exported audit pack is altered or silently truncated, or omits a cited document → the evidence given to an auditor is not trustworthy or not complete.</li> <li><strong>Recorded judgment:</strong> {{tr005}} <em>(recorded, for review)</em>.</li> <li><strong>Mitigation in place:</strong> the scope audit pack / traceability report is a zip of the effective- released PDF of every visible document <strong>plus <code>manifest.json</code> and <code>manifest.txt</code> carrying a SHA-256 of every PDF</strong> — the evidence-grade layer a verifier re-hashes (REQ-DOC-037; <a href="../../../decisions/adr-0083-td-dossier/">ADR-0083</a>). <code>manifest.txt</code> streams <strong>last</strong> as the completeness marker (a truncated pack is detectably incomplete and raises no audit event); the single <code>EXPORTED</code> event commits only <strong>after</strong> the whole pack is written. Transitive citation closure pulls every cited document at its effective-released version, <strong>bounded absolutely by access rules</strong> (an invisible cited document is silently absent — no name/count/existence leak). Each PDF carries a §4.2.4-style identity header and an honest "Uncontrolled copy — issued via LQMS to \<user> on \<date>; validity must be verified against the live system" footer (<a href="../../../decisions/adr-0074-pdf-export/">ADR-0074</a>). <strong>Evidence:</strong> <code>PdfExportServiceTest</code> (streamed zip, sha256 manifest, citation closure, completeness marker), <code>audit-pack.spec.ts</code>.</li> </ul> <h3 id="tr-006--unauthorized-or-self-approved-release-four-eyes-bypass">TR-006 — Unauthorized or self-approved release (four-eyes bypass)<a class="headerlink" href="#tr-006--unauthorized-or-self-approved-release-four-eyes-bypass" title="Permanent link">¶</a></h3> <ul> <li><strong>Failure mode / effect:</strong> a document is released without independent review, or by its own author → §4.2.4 review-and-approval duty defeated.</li> <li><strong>Recorded judgment:</strong> {{tr006}} <em>(recorded, for review)</em>.</li> <li><strong>Mitigation in place:</strong> release is gated by a per-(scope,type) review policy; the default and the floor for prescriptive types is <strong>four-eyes</strong> — the releaser is structurally not the author — and every approval/release is permission-gated and recorded in the audit trail (ADR-0003/0030/0046-0047 review-policy machinery).</li> <li><strong>Caveat (bounds this row) — e-signature capability in this deployment: {{esignatureStatus}}.</strong> Where signing is <strong>not configured</strong>, releases are <strong>plain approvals, not asserted Part 11 electronic signatures</strong>: the capability (<a href="../../../decisions/adr-0014-electronic-signatures/">ADR-0014</a>) is designed but left unconfigured, and an LQMS approval must <strong>not</strong> be represented as a compliant e-signature. The companion intended-use specification carries the matching exclusion. Where signing <em>is</em> configured, that configuration is itself validated and claimed before this caveat is dropped.</li> </ul> <h3 id="tr-007--released-evidence-eroded-by-in-place-edit">TR-007 — Released evidence eroded by in-place edit<a class="headerlink" href="#tr-007--released-evidence-eroded-by-in-place-edit" title="Permanent link">¶</a></h3> <ul> <li><strong>Failure mode / effect:</strong> a released document's trace links or relations are changed in place, so a coverage rule satisfied at release becomes silently unsatisfiable → evidence erosion.</li> <li><strong>Recorded judgment:</strong> {{tr007}} <em>(recorded, for review)</em>.</li> <li><strong>Mitigation in place:</strong> released content is frozen (<a href="../../../decisions/adr-0057-tree-as-record/">ADR-0057</a>); trace-structure changes (links, relations) are <strong>draft-only and server-enforced</strong> — the authority rejects a structure change whose source document has no draft version (409), so the proper vehicle for fixing released trace is a revision, not an in-place edit (<a href="../../../decisions/adr-0081-draft-only-structure-changes/">ADR-0081</a>). Re-attestation (clearing a suspect flag) is deliberately state-independent and always audited. <strong>Evidence:</strong> <code>RelationServiceTest</code> / <code>RequirementLinkServiceTest</code> draft-gating tests.</li> </ul> <h3 id="tr-008--acknowledgement-gap-an-addressee-misses-a-required-document">TR-008 — Acknowledgement gap (an addressee misses a required document)<a class="headerlink" href="#tr-008--acknowledgement-gap-an-addressee-misses-a-required-document" title="Permanent link">¶</a></h3> <ul> <li><strong>Failure mode / effect:</strong> a person who must read a released document never does, or a late-added role holder is missed → training/awareness obligation unmet.</li> <li><strong>Recorded judgment:</strong> {{tr008}} <em>(recorded, for review)</em>.</li> <li><strong>Mitigation in place:</strong> on release of a document that requires acknowledgement, one obligation is fanned out <strong>per addressed person</strong>; the acknowledgement is a controlled, <strong>version-precise</strong> record (acknowledging v2 never satisfies v3); a periodic sweep resolves newly-assigned role holders into open obligations (late joiners); status is reportable per document / role / scope, <strong>gaps first</strong> (<a href="../../../decisions/adr-0052-addressees-acknowledgement/">ADR-0052</a>/ <a href="../../../decisions/adr-0053-addressees-per-document/">ADR-0053</a>).</li> <li><strong>Caveat — email / notification delivery in this deployment: {{emailDelivery}}.</strong> Where delivery is <strong>disabled</strong> (<a href="../../../decisions/adr-0041-email-channel-and-notification-i18n/">ADR-0041</a>), obligations surface <strong>in-tool only</strong> — the deployment does not push external reminders.</li> </ul> <h3 id="tr-009--audit-trail-integrity--forged-history">TR-009 — Audit-trail integrity / forged history<a class="headerlink" href="#tr-009--audit-trail-integrity--forged-history" title="Permanent link">¶</a></h3> <ul> <li><strong>Failure mode / effect:</strong> the record of who did what, when, is incomplete or falsifiable → the audit trail cannot be relied on as evidence.</li> <li><strong>Recorded judgment:</strong> {{tr009}} <em>(recorded, for review)</em>.</li> <li><strong>Mitigation in place:</strong> life-cycle and export events are recorded append-only and tied to the acting authenticated identity; imported source history is represented as continuity <strong>without forging audit actors</strong> (<a href="../../../decisions/adr-0075-source-history-import/">ADR-0075</a>). <strong>Evidence:</strong> audit-trail tests; ADR-0075 import verification.</li> </ul> <h2 id="4-residual-risks-inherent-to-the-tool">4. Residual risks inherent to the tool<a class="headerlink" href="#4-residual-risks-inherent-to-the-tool" title="Permanent link">¶</a></h2> <p>These bounds hold for every installation and are <strong>not</strong> the instantiating organisation's to remove — only to accept, or to close by configuration where a field says so. The instantiation adds its own residuals and open items on top (it does not restate these).</p> <ul> <li><strong>Backup cadence must be operating, not merely available (bounds TR-003).</strong> The ADR-0060 mechanism is implemented and restore-verified; the <em>schedule</em> is a deployment act. Cadence recorded as {{backupCadence}}; where manual, automating it is the closing act (a natural first ADR-0089 recurring obligation).</li> <li><strong>No e-signature claim unless configured (bounds TR-006):</strong> with signing unconfigured, approvals are not Part 11 signatures (ADR-0014 designed, not enabled). Recorded as {{esignatureStatus}}.</li> <li><strong>Single-instance, no HA (bounds TR-003 recovery):</strong> recovery is backup-based within RTO ≤ 1 business day; not continuous-availability (ADR-0018).</li> <li><strong>Deployment hardening precondition — recorded as {{hardeningStatus}}.</strong> The reference stack ships demo credentials and a single BYPASSRLS datasource; a production instance must apply the <a href="../../../operations/deployment/"><code>docs/operations/deployment.md</code></a> hardening (credentials, TLS, two-role database) before these mitigations hold in production. The RLS backstop (TR-002) specifically depends on the runtime <strong>not</strong> connecting as a BYPASSRLS role.</li> <li><strong>In-tool surfacing only where delivery is disabled (bounds TR-008):</strong> recorded as {{emailDelivery}}.</li> </ul> <h2 id="5-open-points-for-the-red-pen-round-template-level">5. Open points for the red-pen round (template-level)<a class="headerlink" href="#5-open-points-for-the-red-pen-round-template-level" title="Permanent link">¶</a></h2> <p>These concern the <strong>template</strong>; an instantiation's own open items live in the instantiation.</p> <ul> <li><strong>Row set.</strong> The table covers the five rows named in the CSV concept (TR-001…005) plus four high-risk-function rows it called out: four-eyes (TR-006), released-content immutability (TR-007), acknowledgement (TR-008), audit-trail (TR-009). Confirm the set — add retention/disposal (ADR-0060 B-3) as its own row if it should be separated from TR-003, or drop TR-009 if it is considered in scope of TR-005/TR-007.</li> <li><strong>No suggested judgments shipped.</strong> The nine judgment tokens are fields with no default, so the template cannot appear to compute or endorse a score (ADR-0079 doctrine). If a <em>suggested baseline</em> would be more useful than the pure doctrine, say so and it becomes a set of defaults the instantiator overwrites.</li> <li><strong>Nine required fields at instantiation time</strong> is real friction: LQMS enforces required variables at instantiate, so the assessor must record all nine tokens before first reading the rows in context. The alternative is optional fields defaulting to <code>— to be recorded —</code>, filled during the draft's review. Pick one.</li> <li><strong>AI-authorship as a row here vs. its own document.</strong> The <a href="../ai-authorship-posture/">AI-authorship posture template</a> states the posture standalone; folding it in would add a <strong>TR-010</strong> row ("AI authorship introduces an undetected defect into a released control") plus a short narrative section. That choice is the same one flagged in that document.</li> <li><strong>Field granularity of the judgments.</strong> One field per row holds the whole <code>Severity · Likelihood — Residual</code> token (nine fields) rather than three fields per row (twenty-seven). Confirm the coarser form is what you want in the definition table.</li> </ul> </article> </div> <script>var target=document.getElementById(location.hash.slice(1));target&&target.name&&(target.checked=target.name.startsWith("__tabbed_"))</script> </div> <button type="button" class="md-top md-icon" data-md-component="top" hidden> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M13 20h-2V8l-5.5 5.5-1.42-1.42L12 4.16l7.92 7.92-1.42 1.42L13 8z"/></svg> Back to top </button> </main> <footer class="md-footer"> <nav class="md-footer__inner md-grid" aria-label="Footer" > <a href="../intended-use/" class="md-footer__link md-footer__link--prev" aria-label="Previous: Intended-Use Specification — LQMS as a QMS / Document-Control Tool (TEMPLATE)"> <div class="md-footer__button md-icon"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M20 11v2H8l5.5 5.5-1.42 1.42L4.16 12l7.92-7.92L13.5 5.5 8 11z"/></svg> </div> <div class="md-footer__title"> <span class="md-footer__direction"> Previous </span> <div class="md-ellipsis"> Intended-Use Specification — LQMS as a QMS / Document-Control Tool (TEMPLATE) </div> </div> </a> <a href="../../../regulatory/mdr-annex-i-skeleton/" class="md-footer__link md-footer__link--next" aria-label="Next: MDR Annex I — GSPR authoring skeleton (paraphrased)"> <div class="md-footer__title"> <span class="md-footer__direction"> Next </span> <div class="md-ellipsis"> MDR Annex I — GSPR authoring skeleton (paraphrased) </div> </div> <div class="md-footer__button md-icon"> <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path d="M4 11v2h12l-5.5 5.5 1.42 1.42L19.84 12l-7.92-7.92L10.5 5.5 16 11z"/></svg> </div> </a> </nav> <div class="md-footer-meta md-typeset"> <div class="md-footer-meta__inner md-grid"> <div class="md-copyright"> <div class="md-copyright__highlight"> Built from <code>v0.9.56-4-g06c7f811</code> (commit <code>06c7f811</code>, 2026-09-09) — the same Markdown the repository ships. </div> </div> </div> </div> </footer> </div> <div class="md-dialog" data-md-component="dialog"> <div class="md-dialog__inner md-typeset"></div> </div> <script id="__config" type="application/json">{"base": "../../..", "features": ["navigation.instant", "navigation.tracking", "navigation.top", "navigation.footer", "navigation.indexes", "toc.follow", "search.suggest", "search.highlight", "content.code.copy", "content.action.edit"], "search": "../../../assets/javascripts/workers/search.6ce7567c.min.js", "translations": {"clipboard.copied": "Copied to clipboard", "clipboard.copy": "Copy to clipboard", "search.result.more.one": "1 more on this page", "search.result.more.other": "# more on this page", "search.result.none": "No matching documents", "search.result.one": "1 matching document", "search.result.other": "# matching documents", "search.result.placeholder": "Type to start searching", "search.result.term.missing": "Missing", "select.version": "Select version"}}</script> <script src="../../../assets/javascripts/bundle.83f73b43.min.js"></script> </body> </html>