Product
Requirements Traceability Matrix
Owner: Product + QALast reviewed:
Status values: implemented · implemented-blocked-on-vendor · partial · planned
| # | Requirement (prompt §) | Where | Status |
|---|---|---|---|
| R1 | Monorepo structure (§4) | repo root | implemented |
| R2 | Design system, tokens, radii, typography (§6) | packages/design-tokens, packages/ui | implemented |
| R3 | Hugeicons semantic registry (§6) | packages/ui/src/icons | implemented |
| R4 | Floating-label field suite (§6) | packages/ui/src/fields | implemented |
| R5 | ContextIsland state machine + states (§7) | packages/ui/src/context-island | implemented |
| R6 | Recorder: permissions, devices, pause/resume, timer, consent (§8) | apps/clinic-web/features/recording | implemented |
| R7 | Real waveform (AudioWorklet, RMS, reduced motion) (§8) | packages/ui/src/waveform | implemented |
| R8 | Chunked, resumable, checksummed, idempotent upload (§8) | core-api recordings + web uploader | implemented |
| R9 | Diarized final transcription + live interim (§9) | ai-gateway + worker + realtime | implemented (OpenAI credentials gated) |
| R10 | Transcript editor: speakers, merge/split, redact, versions (§9) | clinic-web + core-api transcripts | implemented |
| R11 | Prompt-injection defense (§9, §26) | ai-gateway prompts + evals | implemented |
| R12 | Clinical note templates + sections + evidence (§10) | packages/template-definitions, core-api clinicalnotes | implemented |
| R13 | Patient-friendly summary EN/FR (§11) | ai-gateway purpose patient_summary | implemented |
| R14 | Versioned procedure-code catalog + licensed import (§12) | core-api procedurecodes + import tool | implemented |
| R15 | Treatment plans, options, stages, estimates, statuses (§13) | core-api treatmentplans | implemented |
| R16 | Option comparison from approved content (§14) | core-api + clinic-web compare | implemented |
| R17 | Consent templates, versions, signing evidence (§15) | core-api consents | implemented |
| R18 | Pre/post-op instruction templates + delivery tracking (§16) | core-api instructions | implemented |
| R19 | Review workspace: section approve/reject/regenerate, hashes, step-up (§17) | core-api approvals, clinic-web review | implemented |
| R20 | Patient communication package + secure delivery (§18) | core-api communications, worker | implemented |
| R21 | Patient portal incl. acceptance capture (§19) | apps/patient-portal + portal APIs | implemented |
| R22 | Insurance estimates (manual + adapter, versioned) (§20) | core-api insurance | implemented (live adapters vendor-blocked) |
| R23 | Referrals, prescriptions, clearance, lab prescriptions (§21) | core-api clinicaldocs | implemented |
| R24 | Role-limited reporting (§22) | core-api reporting | implemented |
| R25 | Integration framework + ABELDent boundary (§23) | services/integration-service | implemented-blocked-on-vendor |
| R26 | Full schema, RLS, UUIDv7, audit partitions (§24) | database/migrations | implemented |
| R27 | REST API + OpenAPI 3.1 + problem details + idempotency (§25) | api/openapi, core-api | implemented |
| R28 | Realtime channels + AsyncAPI (§25) | realtime-gateway, api/asyncapi | implemented |
| R29 | AI gateway, AI_PHI_MODE, routing, structured outputs, evals (§26) | services/ai-gateway | implemented (PHI mode gated on contract) |
| R30 | Keycloak OIDC, passkeys, MFA, sessions, step-up (§27) | infra keycloak + core-api auth | implemented |
| R31 | RBAC + contextual authorization + matrix (§27) | packages/permissions, core-api | implemented |
| R32 | Privacy artifacts: PIA, classification, retention, IR (§28) | security/ | implemented (docs) |
| R33 | Field-level envelope encryption (§28) | core-api crypto | implemented |
| R34 | Hash-chained audit (§28) | core-api audit | implemented |
| R35 | Canadian infra: RKE2, CNPG, MinIO, backups, DR (§29) | infrastructure/ | implemented (manifests; hardware client-side) |
| R36 | Observability: metrics/logs/traces/dashboards/alerts (§30) | packages/observability, infra | implemented |
| R37 | Test strategy incl. cross-tenant + resilience (§31) | tests/, service tests | implemented |
| R38 | CI/CD + GitOps + supply chain (§32) | .github/workflows, infrastructure/argocd | implemented |
| R39 | Documentation suite + docs app (§33) | docs/, apps/docs | implemented |
| R40 | Compliance language + legal-review register (§34) | docs/security/legal-review-required.md | implemented |