Resolve pending commit links in MIL-004 review records

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.gitea/workflows/ci.yml

@@ -0,0 +1,26 @@
+name: CI
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  checks:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+      - name: Install
+        run: |
+          python -m pip install --upgrade pip
+          python -m pip install -e ".[dev]"
+      - name: Tests
+        run: python -m pytest
+      - name: Lint
+        run: python -m ruff check src tests
+      - name: Format check
+        run: python -m ruff format --check src tests
+      - name: Types
+        run: python -m mypy src tests

README.md

@@ -79,6 +79,16 @@ python -m ruff format --check src tests
 python -m mypy src tests
 ```
 
+## Continuous integration
+
+On every push and pull request, `.gitea/workflows/ci.yml` installs the project on
+Python 3.13 and runs the same checks as above: `pytest`, `ruff check`,
+`ruff format --check` and `mypy`. To run all of them locally:
+
+```bash
+python -m pytest && python -m ruff check src tests && python -m ruff format --check src tests && python -m mypy src tests
+```
+
 ## Build the source documentation
 
 The source uses Doxygen comments. The HTML output goes to `docs/doxygen/html`.
@@ -96,6 +106,7 @@ doxygen Doxyfile
 | `docs/` | Planning and review documents (business case, plan, milestones) |
 | `pyproject.toml` | Project configuration |
 | `Doxyfile` | Doxygen configuration |
+| `.gitea/workflows/` | CI workflow |
 
 ## License
 

docs/artifact-registry.md

@@ -14,7 +14,9 @@ document of a type. `Primary File` may contain a glob (e.g.
 | BC | Business Case | docs/business-case.md | 002 |
 | SA | Stakeholder Analysis | docs/stakeholder-analysis.md | 002 |
 | PP | Project Plan | docs/project-plan.md | 002 |
-| MIL | Milestone / Gateway | docs/milestones/*.md | 004 |
+| MIL | Milestone / Gateway | docs/milestones/*.md | 005 |
+| RC | SQA Review Record | docs/sqa/reviews/rc-*.md | 008 |
+| TM | Traceability Matrix | docs/sqa/traceability-matrix.md | 002 |
 
 ## Languages
 

docs/business-case.md

@@ -9,7 +9,8 @@
 ## Version History
 | Date | Status | Author | Reviewer | Change | Commit |
 | --- | --- | --- | --- | --- | --- |
-| 2026-10-05 | Accepted | Jens Tirsvad Nielsen | S01 | Initial version | [c0c3940] |
+| 2026-10-06 | Accepted | Jens Tirsvad Nielsen | S01 | Added duration constraint (RC-001 action) | [8ef00aa] |
+| 2026-10-06 | Proposed | Jens Tirsvad Nielsen | S01 | Added objective 6 and scope for code review and CI | [8ef00aa] |
 
 ---
 
@@ -45,6 +46,7 @@ participants and for viewers browsing the repository.
 3. Cover the behaviour with automated pytest tests.
 4. Document how to set up a local `.venv` and run the program and tests.
 5. Publish the repository with a description, topics and README.
+6. Review the source code against the Python quality checklist and run the tests and code checks automatically on every push.
 
 ## Scope
 
@@ -55,6 +57,7 @@ participants and for viewers browsing the repository.
 - `pyproject.toml`, Python `.gitignore`, `Doxyfile`, `README.md`.
 - Project documents under `docs/`.
 - Repository description and topics on the git host.
+- A review record for the source code and a CI workflow (MIL-004).
 
 ### Out of Scope
 
@@ -109,6 +112,7 @@ professional project hygiene, and the goal of sharing readable solutions.
 - Constants live in `constants.py`.
 - Source files use Doxygen comments.
 - Nothing is committed or pushed unless the user asks.
+- Duration: one week, 2026-10-05 to 2026-10-12.
 
 ## Cost–Benefit Assessment
 
@@ -131,4 +135,4 @@ Proceed — the scope is small, well specified and delivers a reusable example.
 ---
 
 [SA-001]: ./stakeholder-analysis.md
-[c0c3940]: https://git.tirsystem.com/Tirsvad-Udemy-100_days_of_code/015-coffee_machine/commit/c0c3940551db0d7d96492cc734976d0436051ff9
+[8ef00aa]: https://git.tirsystem.com/Tirsvad-Udemy-100_days_of_code/015-coffee_machine/commit/8ef00aafaaa193ea565f1a45238d31e963a5e05d

docs/milestones/mil-004-code-review-and-ci.md

@@ -0,0 +1,70 @@
+# MIL-004 Code Review and CI
+
+## Metadata
+| Key | Value |
+| --- | --- |
+| ID | MIL-004 |
+| CrossReference | [BC-001] |
+
+## Version History
+| Date | Status | Author | Reviewer | Change | Commit |
+| --- | --- | --- | --- | --- | --- |
+| 2026-10-06 | Accepted | Jens Tirsvad Nielsen | S01 | Initial version | [8ef00aa] |
+
+---
+
+## Purpose
+
+Decide whether the source code has been reviewed against the Python quality checklist and is checked automatically on every push.
+
+## Deliverable
+
+`RC-006` review record for the source code, fixes for its findings, a CI workflow running the tests and code checks, and a README section describing it.
+
+## Go / No-Go Criteria
+
+| # | Criterion (objectively checkable) | Go | No-Go |
+| --- | --- | --- | --- |
+| 1 | `docs/sqa/reviews/` has an RC record for the source against `QC-PY-001` | Present with a verdict | Missing |
+| 2 | Every Fail in that record has a closed action item or a recorded deviation | All handled | Open Fail |
+| 3 | The CI workflow runs pytest, ruff check, ruff format --check and mypy on push and pull request | All four run | Any missing |
+| 4 | The latest CI run on `main` is green | Green | Red or none |
+| 5 | README describes the CI and the matching local commands | Present | Missing |
+
+## Dependencies
+
+| Depends on | Reason |
+| --- | --- |
+| MIL-003 | Tests and metadata must exist before they are reviewed and automated |
+
+## Traceability
+
+| Business Case objective / KPI / user story | Reference |
+| --- | --- |
+| Objective 6 (review and CI), Objective 4 | [BC-001] |
+
+## Ownership
+
+| Role | Stakeholder ID (SA) |
+| --- | --- |
+| Owner | S01 |
+| Approving reviewer | S01 |
+
+## Target Date
+
+2026-10-12 — inside the duration constraint in [BC-001].
+
+## Tasks
+
+| # | Task | Summary | Needs its own Use Case/User Story? | Reference |
+| --- | --- | --- | --- | --- |
+| 1 | Review source code against QC-PY-001 | Create RC-006 with `new-artifact.sh RC` for `src/` and `tests/` against `framework/qc/qc-programming-python.md`. Criterion 10 (Design Class Diagram) is N-A because no DCD exists. Every Fail becomes an action item. | No | Objective 6 |
+| 2 | Fix code review findings | Fix each Fail from RC-006 under `src/` and `tests/`, or record a justified deviation in the record. If the review has no Fail, close this task without a code change. | No | Objective 6 |
+| 3 | Add CI workflow | Add `.gitea/workflows/ci.yml` that sets up Python 3.13, installs `.[dev]`, and runs `pytest`, `ruff check`, `ruff format --check` and `mypy` on push and pull request. Check first that the git host has an Actions runner. | No | Objective 6 |
+| 4 | Document CI in README | Add a short section to README.md saying what the CI runs and how to run the same checks locally. | No | Objective 4 |
+| 5 | Update traceability matrix | Add the RC-006 review to `docs/sqa/traceability-matrix.md` and close the milestone's row there. | No | Objective 6 |
+
+---
+
+[BC-001]: ../business-case.md
+[8ef00aa]: https://git.tirsystem.com/Tirsvad-Udemy-100_days_of_code/015-coffee_machine/commit/8ef00aafaaa193ea565f1a45238d31e963a5e05d

docs/project-plan.md

@@ -4,12 +4,13 @@
 | Key | Value |
 | --- | --- |
 | ID | PP-001 |
-| CrossReference | [BC-001], [SA-001], [MIL-001], [MIL-002], [MIL-003] |
+| CrossReference | [BC-001], [SA-001], [MIL-001], [MIL-002], [MIL-003], [MIL-004] |
 
 ## Version History
 | Date | Status | Author | Reviewer | Change | Commit |
 | --- | --- | --- | --- | --- | --- |
 | 2026-10-05 | Accepted | Jens Tirsvad Nielsen | S01 | Initial version | [c0c3940] |
+| 2026-10-06 | Proposed | Jens Tirsvad Nielsen | S01 | Added MIL-004 Code Review and CI | [8ef00aa] |
 
 ---
 
@@ -31,6 +32,7 @@ published project, within the short assignment timeline in [BC-001].
 | Project Setup | [MIL-001] | 2026-10-05 to 2026-10-07 | 2026-10-07 | S01 | none | Skeleton, tooling, README | [Milestone 40] |
 | Coffee Machine Core | [MIL-002] | 2026-10-08 to 2026-10-10 | 2026-10-10 | S01 | none | Working program | [Milestone 41] |
 | Quality and Publication | [MIL-003] | 2026-10-11 to 2026-10-12 | 2026-10-12 | S01 | none | Tests, Doxygen, published repo | [Milestone 42] |
+| Code Review and CI | [MIL-004] | 2026-10-07 to 2026-10-12 | 2026-10-12 | S01 | none | Source review record, CI workflow | [Milestone 48] |
 
 ```plantuml
 @startgantt
@@ -41,6 +43,8 @@ Project starts 2026-10-05
 [MIL-001 Go/No-Go] happens 2026-10-07
 [MIL-002 Go/No-Go] happens 2026-10-10
 [MIL-003 Go/No-Go] happens 2026-10-12
+[Code Review and CI] starts 2026-10-07 and ends 2026-10-12
+[MIL-004 Go/No-Go] happens 2026-10-12
 @endgantt
 ```
 
@@ -53,11 +57,12 @@ Project starts 2026-10-05
 | `pyproject.toml`, `.gitignore`, `Doxyfile`, README | [MIL-001] |
 | Project documents | Planning, before [MIL-001] |
 | Repository description and topics | [MIL-003] |
+| Source code review record and CI workflow | [MIL-004] |
 
 ## Dependencies
 
 ```
-MIL-001 -> MIL-002 -> MIL-003
+MIL-001 -> MIL-002 -> MIL-003 -> MIL-004
 ```
 
 A No-Go moves all later dates by the same amount.
@@ -66,6 +71,7 @@ A No-Go moves all later dates by the same amount.
 
 | Risk | Impact | Mitigation |
 | --- | --- | --- |
+| The git host has no Actions runner | CI cannot run | Check the host first; if none, keep the workflow file and document the local commands |
 | README template not supplied | README task blocked | Ask S01 for the template before the task |
 | Doxygen not installed locally | Cannot verify docs | Document the install step in README |
 
@@ -82,7 +88,10 @@ A No-Go moves all later dates by the same amount.
 [MIL-001]: ./milestones/mil-001-project-setup.md
 [MIL-002]: ./milestones/mil-002-coffee-machine-core.md
 [MIL-003]: ./milestones/mil-003-quality-and-publication.md
+[MIL-004]: ./milestones/mil-004-code-review-and-ci.md
 [Milestone 40]: https://git.tirsystem.com/Tirsvad-Udemy-100_days_of_code/015-coffee_machine/milestone/40
 [Milestone 41]: https://git.tirsystem.com/Tirsvad-Udemy-100_days_of_code/015-coffee_machine/milestone/41
 [Milestone 42]: https://git.tirsystem.com/Tirsvad-Udemy-100_days_of_code/015-coffee_machine/milestone/42
 [c0c3940]: https://git.tirsystem.com/Tirsvad-Udemy-100_days_of_code/015-coffee_machine/commit/c0c3940551db0d7d96492cc734976d0436051ff9
+[8ef00aa]: https://git.tirsystem.com/Tirsvad-Udemy-100_days_of_code/015-coffee_machine/commit/8ef00aafaaa193ea565f1a45238d31e963a5e05d
+[Milestone 48]: https://git.tirsystem.com/Tirsvad-Udemy-100_days_of_code/015-coffee_machine/milestone/48

docs/sqa/reviews/rc-001-business-case.md

@@ -0,0 +1,49 @@
+# RC-001 Business Case Review
+
+## Metadata
+| Key | Value |
+| --- | --- |
+| ID | RC-001 |
+| CrossReference | [BC-001], [QC-BC-001] |
+
+## Version History
+| Date | Status | Author | Reviewer | Change | Commit |
+| --- | --- | --- | --- | --- | --- |
+| 2026-10-06 | Proposed | Jens Tirsvad Nielsen | S01 | Initial version | [8ef00aa] |
+
+---
+
+## Artifact Under Review
+
+- Instance reviewed: [BC-001] (docs/business-case.md)
+- Checklist used: [QC-BC-001] (`QC-BC-001`)
+- Independence: S01 is the only stakeholder and is also the recorded author, so the reviewer-is-not-author rule cannot be met. The documents were drafted by Claude on S01's behalf; S01 reviews and signs. This is a known limit of a one-person project, not a clean independent review.
+
+## Checklist Results
+
+| # | Criterion | Status | Evidence/Notes |
+| --- | --- | --- | --- |
+| 1 | ROI/Cost-Benefit analysis is quantitative, or where qualitative, is explicitly justified | Pass | Cost-Benefit table is explicitly qualitative and says why (no money involved). |
+| 2 | Risks are identified with documented impact and mitigation | Pass | Three risks, each with impact and mitigation. |
+| 3 | Success criteria are measurable, stating explicit targets rather than vague aspirations | Pass | Five criteria with targets and a measure each. |
+| 4 | Scope explicitly separates In Scope vs Out of Scope | Pass | `### In Scope` and `### Out of Scope` are separate. |
+| 5 | Stakeholders are cross-referenced to Stakeholder Analysis IDs rather than re-described inline | Pass | Stakeholders table cites S01 to S03 only; no roles are re-described. |
+| 6 | Methodology and quality-standard foundation are stated explicitly (e.g. ISO/IEC 25010, Larman) | Pass | Methodology section names the framework, ISO/IEC 25010:2023 and the coding conventions. |
+| 7 | Assumptions and constraints are explicit and clearly distinguished from one another | Pass | Fixed in v2: the first draft had no duration, although MIL-001 to MIL-003 and PP-001 cite one. Constraints now state 2026-10-05 to 2026-10-12. |
+| 8 | Document supports executive decision-making with a clear, unambiguous recommendation | Pass | Recommendation is a single "Proceed" with a reason. |
+
+## Overall Verdict
+
+Go — all mandatory criteria pass. Criterion 7 first failed (missing duration constraint) and was fixed in the same change as BC-001 v2.
+
+## Action Items
+
+| Action | Owner | Due |
+| --- | --- | --- |
+| Add the duration constraint to BC-001 (done in v2) | S01 | 2026-10-06 |
+
+---
+
+[BC-001]: ../../business-case.md
+[QC-BC-001]: ../../../framework/qc/qc-business-case.md
+[8ef00aa]: https://git.tirsystem.com/Tirsvad-Udemy-100_days_of_code/015-coffee_machine/commit/8ef00aafaaa193ea565f1a45238d31e963a5e05d

docs/sqa/reviews/rc-002-stakeholder-analysis.md

@@ -0,0 +1,49 @@
+# RC-002 Stakeholder Analysis Review
+
+## Metadata
+| Key | Value |
+| --- | --- |
+| ID | RC-002 |
+| CrossReference | [SA-001], [QC-SA-001] |
+
+## Version History
+| Date | Status | Author | Reviewer | Change | Commit |
+| --- | --- | --- | --- | --- | --- |
+| 2026-10-06 | Proposed | Jens Tirsvad Nielsen | S01 | Initial version | [8ef00aa] |
+
+---
+
+## Artifact Under Review
+
+- Instance reviewed: [SA-001] (docs/stakeholder-analysis.md)
+- Checklist used: [QC-SA-001] (`QC-SA-001`)
+- Independence: S01 is the only stakeholder and is also the recorded author, so the reviewer-is-not-author rule cannot be met. The documents were drafted by Claude on S01's behalf; S01 reviews and signs. This is a known limit of a one-person project, not a clean independent review.
+
+## Checklist Results
+
+| # | Criterion | Status | Evidence/Notes |
+| --- | --- | --- | --- |
+| 1 | Power/Interest grid is filled for every stakeholder, with no gaps or unclassified entries | Pass | S01 to S03 each have power, interest and quadrant. |
+| 2 | Each stakeholder is assigned a unique, stable ID (e.g. S01-S11 style) reusable for RACI assignments in other artifacts | Pass | IDs S01 to S03 are used by every other document. |
+| 3 | Roles and organizational context are defined with explicit Power and Interest levels, not just narrative description | Pass | Levels are stated as High/Low in the table, with organisation and role. |
+| 4 | Communication needs (channel, frequency, deliverable type) are mapped to project phases or milestones | Pass | Communication table maps each stakeholder to MIL-001 to MIL-003. |
+| 5 | Conflicting stakeholder interests are identified with documented mitigation or resolution strategies | Pass | One conflict (assignment names vs testable structure) with a mitigation. |
+| 6 | Stakeholder concerns are explicitly traced to Business Case objectives | Pass | Traceability table maps each stakeholder to [BC-001] objectives. |
+| 7 | Primary concerns are expressed in both business language and a recognized quality-attribute mapping (e.g. FURPS+) | Pass | Each concern has a FURPS+ attribute. |
+| 8 | Document is understandable and navigable by non-technical stakeholders reviewing their own entry | Pass | Plain language, short; each stakeholder can find their own row. |
+
+## Overall Verdict
+
+Go — all criteria pass. The Sign-Off row said `Pending review` and was updated to the Go in SA-001 v2.
+
+## Action Items
+
+| Action | Owner | Due |
+| --- | --- | --- |
+| Record the sign-off in SA-001 (done in v2) | S01 | 2026-10-06 |
+
+---
+
+[SA-001]: ../../stakeholder-analysis.md
+[QC-SA-001]: ../../../framework/qc/qc-stakeholder-analysis.md
+[8ef00aa]: https://git.tirsystem.com/Tirsvad-Udemy-100_days_of_code/015-coffee_machine/commit/8ef00aafaaa193ea565f1a45238d31e963a5e05d

docs/sqa/reviews/rc-003-mil-001.md

@@ -0,0 +1,47 @@
+# RC-003 MIL-001 Review
+
+## Metadata
+| Key | Value |
+| --- | --- |
+| ID | RC-003 |
+| CrossReference | [MIL-001], [QC-MIL-001] |
+
+## Version History
+| Date | Status | Author | Reviewer | Change | Commit |
+| --- | --- | --- | --- | --- | --- |
+| 2026-10-06 | Proposed | Jens Tirsvad Nielsen | S01 | Initial version | [8ef00aa] |
+
+---
+
+## Artifact Under Review
+
+- Instance reviewed: [MIL-001] (docs/milestones/mil-001-project-setup.md)
+- Checklist used: [QC-MIL-001] (`QC-MIL-001`)
+- Independence: S01 is the only stakeholder and is also the recorded author, so the reviewer-is-not-author rule cannot be met. The documents were drafted by Claude on S01's behalf; S01 reviews and signs. This is a known limit of a one-person project, not a clean independent review.
+
+## Checklist Results
+
+| # | Criterion | Status | Evidence/Notes |
+| --- | --- | --- | --- |
+| 1 | A concrete deliverable is defined for every gate | Pass | Deliverable section names the concrete output. |
+| 2 | Explicit Go/No-Go criteria are stated for each gate | Pass | Go/No-Go table with one checkable criterion per row. |
+| 3 | Dependencies on other milestones are explicitly mapped | Pass | Dependencies table present. |
+| 4 | Each milestone is traceable to a Business Case objective or KPI | Pass | Traceability cites the Business Case objectives. |
+| 5 | Milestone owner and approving reviewer are identified | Pass | Ownership names S01 as owner and approving reviewer (same person; see independence note). |
+| 6 | Milestone has a defined target date consistent with project constraints | Pass | Target date lies inside the duration constraint added to BC-001 in RC-001's action (2026-10-05 to 2026-10-12). Before that fix this was a Fail. |
+
+## Overall Verdict
+
+Go — all criteria pass. Delivery matches: issues #1 to #5 closed, PRs 19 and 20 merged.
+
+## Action Items
+
+| Action | Owner | Due |
+| --- | --- | --- |
+| None | S01 | - |
+
+---
+
+[MIL-001]: ../../milestones/mil-001-project-setup.md
+[QC-MIL-001]: ../../../framework/qc/qc-milestones-gateways.md
+[8ef00aa]: https://git.tirsystem.com/Tirsvad-Udemy-100_days_of_code/015-coffee_machine/commit/8ef00aafaaa193ea565f1a45238d31e963a5e05d

docs/sqa/reviews/rc-004-mil-002.md

@@ -0,0 +1,47 @@
+# RC-004 MIL-002 Review
+
+## Metadata
+| Key | Value |
+| --- | --- |
+| ID | RC-004 |
+| CrossReference | [MIL-002], [QC-MIL-001] |
+
+## Version History
+| Date | Status | Author | Reviewer | Change | Commit |
+| --- | --- | --- | --- | --- | --- |
+| 2026-10-06 | Proposed | Jens Tirsvad Nielsen | S01 | Initial version | [8ef00aa] |
+
+---
+
+## Artifact Under Review
+
+- Instance reviewed: [MIL-002] (docs/milestones/mil-002-coffee-machine-core.md)
+- Checklist used: [QC-MIL-001] (`QC-MIL-001`)
+- Independence: S01 is the only stakeholder and is also the recorded author, so the reviewer-is-not-author rule cannot be met. The documents were drafted by Claude on S01's behalf; S01 reviews and signs. This is a known limit of a one-person project, not a clean independent review.
+
+## Checklist Results
+
+| # | Criterion | Status | Evidence/Notes |
+| --- | --- | --- | --- |
+| 1 | A concrete deliverable is defined for every gate | Pass | Deliverable section names the concrete output. |
+| 2 | Explicit Go/No-Go criteria are stated for each gate | Pass | Go/No-Go table with one checkable criterion per row. |
+| 3 | Dependencies on other milestones are explicitly mapped | Pass | Dependencies table present. |
+| 4 | Each milestone is traceable to a Business Case objective or KPI | Pass | Traceability cites the Business Case objectives. |
+| 5 | Milestone owner and approving reviewer are identified | Pass | Ownership names S01 as owner and approving reviewer (same person; see independence note). |
+| 6 | Milestone has a defined target date consistent with project constraints | Pass | Target date lies inside the duration constraint added to BC-001 in RC-001's action (2026-10-05 to 2026-10-12). Before that fix this was a Fail. |
+
+## Overall Verdict
+
+Go — all criteria pass. Delivery matches: issues #6 to #12 closed, PR 21 merged. Note: Go/No-Go rows refer to the assignment's behaviour; the exact texts are asserted in tests/.
+
+## Action Items
+
+| Action | Owner | Due |
+| --- | --- | --- |
+| None | S01 | - |
+
+---
+
+[MIL-002]: ../../milestones/mil-002-coffee-machine-core.md
+[QC-MIL-001]: ../../../framework/qc/qc-milestones-gateways.md
+[8ef00aa]: https://git.tirsystem.com/Tirsvad-Udemy-100_days_of_code/015-coffee_machine/commit/8ef00aafaaa193ea565f1a45238d31e963a5e05d

docs/sqa/reviews/rc-005-mil-003.md

@@ -0,0 +1,47 @@
+# RC-005 MIL-003 Review
+
+## Metadata
+| Key | Value |
+| --- | --- |
+| ID | RC-005 |
+| CrossReference | [MIL-003], [QC-MIL-001] |
+
+## Version History
+| Date | Status | Author | Reviewer | Change | Commit |
+| --- | --- | --- | --- | --- | --- |
+| 2026-10-06 | Proposed | Jens Tirsvad Nielsen | S01 | Initial version | [8ef00aa] |
+
+---
+
+## Artifact Under Review
+
+- Instance reviewed: [MIL-003] (docs/milestones/mil-003-quality-and-publication.md)
+- Checklist used: [QC-MIL-001] (`QC-MIL-001`)
+- Independence: S01 is the only stakeholder and is also the recorded author, so the reviewer-is-not-author rule cannot be met. The documents were drafted by Claude on S01's behalf; S01 reviews and signs. This is a known limit of a one-person project, not a clean independent review.
+
+## Checklist Results
+
+| # | Criterion | Status | Evidence/Notes |
+| --- | --- | --- | --- |
+| 1 | A concrete deliverable is defined for every gate | Pass | Deliverable section names the concrete output. |
+| 2 | Explicit Go/No-Go criteria are stated for each gate | Pass | Go/No-Go table with one checkable criterion per row. |
+| 3 | Dependencies on other milestones are explicitly mapped | Pass | Dependencies table present. |
+| 4 | Each milestone is traceable to a Business Case objective or KPI | Pass | Traceability cites the Business Case objectives. |
+| 5 | Milestone owner and approving reviewer are identified | Pass | Ownership names S01 as owner and approving reviewer (same person; see independence note). |
+| 6 | Milestone has a defined target date consistent with project constraints | Pass | Target date lies inside the duration constraint added to BC-001 in RC-001's action (2026-10-05 to 2026-10-12). Before that fix this was a Fail. |
+
+## Overall Verdict
+
+Go — all criteria pass. Delivery matches: issues #13 to #17 closed, PR 22 merged.
+
+## Action Items
+
+| Action | Owner | Due |
+| --- | --- | --- |
+| None | S01 | - |
+
+---
+
+[MIL-003]: ../../milestones/mil-003-quality-and-publication.md
+[QC-MIL-001]: ../../../framework/qc/qc-milestones-gateways.md
+[8ef00aa]: https://git.tirsystem.com/Tirsvad-Udemy-100_days_of_code/015-coffee_machine/commit/8ef00aafaaa193ea565f1a45238d31e963a5e05d

docs/sqa/reviews/rc-006-source-code.md

@@ -0,0 +1,54 @@
+# RC-006 Source Code Review
+
+## Metadata
+| Key | Value |
+| --- | --- |
+| ID | RC-006 |
+| CrossReference | [MIL-004], [QC-PY-001] |
+
+## Version History
+| Date | Status | Author | Reviewer | Change | Commit |
+| --- | --- | --- | --- | --- | --- |
+| 2026-10-06 | Proposed | Jens Tirsvad Nielsen | S01 | Initial version | [00d47e2] |
+
+---
+
+## Artifact Under Review
+
+- Instance reviewed: `src/coffee_machine/` and `tests/` at the state of MIL-003 (`main` after PR 22)
+- Checklist used: [QC-PY-001] (`QC-PY-001`)
+- Independence: S01 is the only stakeholder and is also the recorded author, so the reviewer-is-not-author rule cannot be met. The code and documents were written by Claude on S01's behalf; S01 reviews and signs. This is a known limit of a one-person project, not a clean independent review.
+
+## Checklist Results
+
+| # | Criterion | Status | Evidence/Notes |
+| --- | --- | --- | --- |
+| 1 | Packages, modules, functions, variables, classes and constants follow PEP 8 casing (`snake_case`, `PascalCase`, `UPPER_SNAKE`) | Pass | Modules, functions and variables are `snake_case`, constants `UPPER_SNAKE`, `Drink` is `PascalCase`. |
+| 2 | Names state purpose in the domain's language; no unexplained abbreviations, no single-letter names outside tiny scopes | Pass | Names state purpose (`is_resource_sufficient`, `process_coins`); the only short names are loop variables. |
+| 3 | Code is produced by the project's formatter and passes its linter with no unexplained suppressions | Pass | `ruff check` and `ruff format --check` pass; no suppression comments. |
+| 4 | Every function and method signature is type-annotated, including `-> None` | Pass | Every function, including tests and the nested `feed`, is annotated. |
+| 5 | No bare `except:`, no swallowed exceptions; specific exceptions are raised and the cause is kept (`raise ... from`) | Pass | No bare `except`. `_ask_coin_count` catches only `ValueError` and answers it by asking again, so nothing is swallowed. |
+| 6 | No mutable default arguments and no shadowed builtins | Pass | No mutable defaults; no builtin is shadowed. |
+| 7 | Files, locks and connections are managed with context managers | N-A | The program opens no files, locks or connections. |
+| 8 | Public modules, classes and functions have docstrings that say what, not how | Pass | All modules, public functions and tests have Doxygen docstrings that say what the code does. |
+| 9 | Logging uses `logging`, not `print`; no secrets or personal data in log output | N-A | No logging exists. `print` is the program's own console output, not diagnostics. |
+| 10 | Classes and operations trace to the Design Class Diagram they implement; deviations are recorded | N-A | No Design Class Diagram exists; the plan treats the work as plain technical tasks. |
+| 11 | Tests exist for new behaviour, are named for the behaviour, and do not depend on order or the network | Pass | 19 tests named for behaviour, independent of order, no network. |
+| 12 | Type checker runs in strict mode without errors; `Any` is justified in a comment | Pass | `mypy --strict` runs clean and `Any` is not used. |
+| 13 | Dependencies are declared and pinned in the project's dependency file, none unused | Fail | Runtime dependencies: none. The dev tools had no lower bounds for ruff and mypy; fixed by action item 1, which sets `pytest>=9`, `ruff>=0.16`, `mypy>=2.4` (the tested versions). |
+
+## Overall Verdict
+
+Go — every mandatory criterion passes or is N-A. The one Fail (13) is optional and is fixed in the same change by issue #25.
+
+## Action Items
+
+| Action | Owner | Due |
+| --- | --- | --- |
+| Set lower bounds for the dev dependencies in pyproject.toml (done) | S01 | 2026-10-06 |
+
+---
+
+[MIL-004]: ../../milestones/mil-004-code-review-and-ci.md
+[QC-PY-001]: ../../../framework/qc/qc-programming-python.md
+[00d47e2]: https://git.tirsystem.com/Tirsvad-Udemy-100_days_of_code/015-coffee_machine/commit/00d47e244c82007bbc55e18312649189b175ec10

docs/sqa/reviews/rc-007-mil-004.md

@@ -0,0 +1,47 @@
+# RC-007 MIL-004 Review
+
+## Metadata
+| Key | Value |
+| --- | --- |
+| ID | RC-007 |
+| CrossReference | [MIL-004], [QC-MIL-001] |
+
+## Version History
+| Date | Status | Author | Reviewer | Change | Commit |
+| --- | --- | --- | --- | --- | --- |
+| 2026-10-06 | Proposed | Jens Tirsvad Nielsen | S01 | Initial version | [00d47e2] |
+
+---
+
+## Artifact Under Review
+
+- Instance reviewed: [MIL-004] (docs/milestones/mil-004-code-review-and-ci.md)
+- Checklist used: [QC-MIL-001] (`QC-MIL-001`)
+- Independence: S01 is the only stakeholder and is also the recorded author, so the reviewer-is-not-author rule cannot be met. The code and documents were written by Claude on S01's behalf; S01 reviews and signs. This is a known limit of a one-person project, not a clean independent review.
+
+## Checklist Results
+
+| # | Criterion | Status | Evidence/Notes |
+| --- | --- | --- | --- |
+| 1 | A concrete deliverable is defined for every gate | Pass | Deliverable names the RC record, the fixes, the CI workflow and the README section. |
+| 2 | Explicit Go/No-Go criteria are stated for each gate | Pass | Five Go/No-Go rows, each checkable (a record exists, a workflow runs four commands, a run is green). |
+| 3 | Dependencies on other milestones are explicitly mapped | Pass | Depends on MIL-003 with a reason. |
+| 4 | Each milestone is traceable to a Business Case objective or KPI | Pass | Traceability cites Business Case objective 6 and 4. |
+| 5 | Milestone owner and approving reviewer are identified | Pass | Owner and approving reviewer are S01 (same person; see independence note). |
+| 6 | Milestone has a defined target date consistent with project constraints | Pass | Target date 2026-10-12 lies inside the duration constraint in the Business Case. |
+
+## Overall Verdict
+
+Go — all criteria pass.
+
+## Action Items
+
+| Action | Owner | Due |
+| --- | --- | --- |
+| None | S01 | - |
+
+---
+
+[MIL-004]: ../../milestones/mil-004-code-review-and-ci.md
+[QC-MIL-001]: ../../../framework/qc/qc-milestones-gateways.md
+[00d47e2]: https://git.tirsystem.com/Tirsvad-Udemy-100_days_of_code/015-coffee_machine/commit/00d47e244c82007bbc55e18312649189b175ec10

docs/sqa/traceability-matrix.md

@@ -0,0 +1,59 @@
+# Traceability Matrix
+
+## Metadata
+| Key | Value |
+| --- | --- |
+| ID | TM-001 |
+| CrossReference | [BC-001] |
+
+## Version History
+| Date | Status | Author | Reviewer | Change | Commit |
+| --- | --- | --- | --- | --- | --- |
+| 2026-10-06 | Proposed | Jens Tirsvad Nielsen | S01 | Added MIL-004 | [8ef00aa] |
+| 2026-10-06 | Proposed | Jens Tirsvad Nielsen | S01 | Added RC-006, RC-007 and the source code row | [00d47e2] |
+
+---
+
+## Purpose
+
+Tracks backward/forward links between artifact instances so that the Business Case's
+cross-artifact traceability can be measured. A row is added or updated whenever an
+artifact instance is created or reviewed.
+
+## Traceability Table
+
+| Artifact Instance | Type | Upstream (Backward Link) | Downstream (Forward Link) | Last Reviewed (RC-ID) |
+| --- | --- | --- | --- | --- |
+| [SA-001] | Stakeholder Analysis | - | [BC-001] | [RC-002] |
+| [BC-001] | Business Case | [SA-001] | [PP-001], [MIL-001], [MIL-002], [MIL-003], [MIL-004] | [RC-001] |
+| [PP-001] | Project Plan | [BC-001], [SA-001] | [MIL-001], [MIL-002], [MIL-003], [MIL-004] | - |
+| [MIL-001] | Milestone | [BC-001], [PP-001] | - | [RC-003] |
+| [MIL-002] | Milestone | [BC-001], [PP-001] | - | [RC-004] |
+| [MIL-003] | Milestone | [BC-001], [PP-001] | - | [RC-005] |
+| [MIL-004] | Milestone | [BC-001], [PP-001] | - | [RC-007] |
+| Source code (`src/`, `tests/`) | Source code | [MIL-002], [MIL-003], [MIL-004] | - | [RC-006] |
+
+## Coverage Notes
+
+- `-` in Upstream means foundational; in Downstream, nothing is built on it yet; in Last Reviewed, no `RC-*` exists yet.
+- [PP-001] has no QC checklist in the framework, so it has no `RC-*`.
+- No use case, domain model, design or data artifacts exist; the plan treats all tasks as plain technical tasks. The source code is reviewed in [RC-006].
+
+---
+
+[SA-001]: ../stakeholder-analysis.md
+[BC-001]: ../business-case.md
+[PP-001]: ../project-plan.md
+[MIL-001]: ../milestones/mil-001-project-setup.md
+[MIL-002]: ../milestones/mil-002-coffee-machine-core.md
+[MIL-003]: ../milestones/mil-003-quality-and-publication.md
+[MIL-004]: ../milestones/mil-004-code-review-and-ci.md
+[RC-001]: ./reviews/rc-001-business-case.md
+[RC-002]: ./reviews/rc-002-stakeholder-analysis.md
+[RC-003]: ./reviews/rc-003-mil-001.md
+[RC-004]: ./reviews/rc-004-mil-002.md
+[RC-005]: ./reviews/rc-005-mil-003.md
+[RC-006]: ./reviews/rc-006-source-code.md
+[RC-007]: ./reviews/rc-007-mil-004.md
+[8ef00aa]: https://git.tirsystem.com/Tirsvad-Udemy-100_days_of_code/015-coffee_machine/commit/8ef00aafaaa193ea565f1a45238d31e963a5e05d
+[00d47e2]: https://git.tirsystem.com/Tirsvad-Udemy-100_days_of_code/015-coffee_machine/commit/00d47e244c82007bbc55e18312649189b175ec10

docs/stakeholder-analysis.md

@@ -9,7 +9,8 @@
 ## Version History
 | Date | Status | Author | Reviewer | Change | Commit |
 | --- | --- | --- | --- | --- | --- |
-| 2026-10-05 | Accepted | Jens Tirsvad Nielsen | S01 | Initial version | [c0c3940] |
+| 2026-10-05 | Deprecated | Jens Tirsvad Nielsen | S01 | Initial version | [c0c3940] |
+| 2026-10-06 | Accepted | Jens Tirsvad Nielsen | S01 | Recorded S01 sign-off after RC-002 | [8ef00aa] |
 
 ---
 
@@ -70,9 +71,10 @@ Monitor).
 
 | Stakeholder | Decision | Date |
 | --- | --- | --- |
-| S01 | Pending review | |
+| S01 | Go (RC-002) | 2026-10-06 |
 
 ---
 
 [BC-001]: ./business-case.md
 [c0c3940]: https://git.tirsystem.com/Tirsvad-Udemy-100_days_of_code/015-coffee_machine/commit/c0c3940551db0d7d96492cc734976d0436051ff9
+[8ef00aa]: https://git.tirsystem.com/Tirsvad-Udemy-100_days_of_code/015-coffee_machine/commit/8ef00aafaaa193ea565f1a45238d31e963a5e05d

pyproject.toml

@@ -12,7 +12,7 @@ license = { file = "LICENSE" }
 dependencies = []
 
 [project.optional-dependencies]
-dev = ["pytest>=8", "ruff", "mypy"]
+dev = ["pytest>=9", "ruff>=0.16", "mypy>=2.4"]
 
 [project.scripts]
 coffee-machine = "coffee_machine.main:main"