diff --git a/docs/artifact-registry.md b/docs/artifact-registry.md index b629482..48bdf72 100644 --- a/docs/artifact-registry.md +++ b/docs/artifact-registry.md @@ -15,7 +15,7 @@ document of a type. `Primary File` may contain a glob (e.g. | SA | Stakeholder Analysis | docs/stakeholder-analysis.md | 002 | | PP | Project Plan | docs/project-plan.md | 002 | | MIL | Milestone / Gateway | docs/milestones/*.md | 004 | -| RC | SQA Review Record | docs/sqa/reviews/rc-*.md | 006 | +| RC | SQA Review Record | docs/sqa/reviews/rc-*.md | 010 | | TM | Traceability Matrix | docs/sqa/traceability-matrix.md | 002 | | ADR | Architecture Decision Record | docs/adr/adr-NNNN-*.md | 0003 | diff --git a/docs/sqa/reviews/rc-006-adr-0001.md b/docs/sqa/reviews/rc-006-adr-0001.md new file mode 100644 index 0000000..383f304 --- /dev/null +++ b/docs/sqa/reviews/rc-006-adr-0001.md @@ -0,0 +1,54 @@ +# SQA Review Record RC-006: ADR-0001 + +## Metadata +| Key | Value | +| --- | --- | +| ID | RC-006 | +| CrossReference | [ADR-0001], [QC-ADR-001] | + +## Version History +| Date | Status | Author | Reviewer | Change | Commit | +| --- | --- | --- | --- | --- | --- | +| 2026-10-13 | Accepted | Jens Tirsvad Nielsen | AI as stand-in for S01 | Review of ADR-0001 | pending | + +--- + +## Artifact Under Review + +- Instance reviewed: [ADR-0001] +- Checklist used: [QC-ADR-001] +- Scope: full review +- Language and domain: n/a (technical type) +- Language reviewer: none +- Mode: autonomous, not independent (the reviewer is `AI as stand-in for S01`) + +## Checklist Results + +| # | Criterion | Status | Evidence/Notes | +| --- | --- | --- | --- | +| 1 | The ID (`ADR-NNNN`, 4-digit) matches the filename number and is unique and sequential | Pass | ADR-0001 matches `adr-0001-*.md` and follows the registry sequence. | +| 2 | Context states the problem, the forces (cost, risk, constraints) and the options evaluated | Pass | Context states the problem, forces and the options evaluated. | +| 3 | At least two options were considered, or the absence of alternatives is justified | Pass | Three options (ADR-0001) / three options (ADR-0002) are listed. | +| 4 | Decision is stated in one or two unhedged sentences and matches one of the evaluated options | Pass | The Decision is stated plainly and is one of the listed options. | +| 5 | Consequences list both Positive and Negative outcomes | Pass | Positive and Negative consequences are listed. | +| 6 | Quality-attribute impacts (performance, security, portability, etc.) are named where the decision affects them | Pass | Portability and security: no runtime dependency to install or patch. | +| 7 | Affected Artifacts are listed as links, and each is also in CrossReference | Pass | Affected Artifacts are links and each is in CrossReference. | +| 8 | Status changes are recorded as new Version History rows with a Change summary and Commit link; retained rows are never rewritten | Pass | One Version History row; no retained row was rewritten. | +| 9 | A superseded or deprecated ADR names its successor, and the successor links back | N-A | No ADR is superseded or deprecated. | +| 10 | Written in business or technical language of the domain, with no unexplained abbreviations | Pass | Plain technical language; abbreviations such as CSV are spelled out in the Business Case. | +| 11 | Status is one of `Proposed`, `Accepted`, `Rejected`, `Deprecated` or `Superseded by ADR-NNNN`, and every Version History row uses only these | Pass | The status is `Accepted`, an allowed value. | + +## Overall Verdict + +Go — every Mandatory criterion of QC-ADR-001 passes. + +## Action Items + +| Action | Owner | Due | +| --- | --- | --- | +| None | S01 | n/a | + +--- + +[ADR-0001]: ../../adr/adr-0001-read-nato-data-with-csv-module.md +[QC-ADR-001]: ../../../framework/qc/artifacts/qc-adr.md diff --git a/docs/sqa/reviews/rc-007-adr-0002.md b/docs/sqa/reviews/rc-007-adr-0002.md new file mode 100644 index 0000000..f71e853 --- /dev/null +++ b/docs/sqa/reviews/rc-007-adr-0002.md @@ -0,0 +1,54 @@ +# SQA Review Record RC-007: ADR-0002 + +## Metadata +| Key | Value | +| --- | --- | +| ID | RC-007 | +| CrossReference | [ADR-0002], [QC-ADR-001] | + +## Version History +| Date | Status | Author | Reviewer | Change | Commit | +| --- | --- | --- | --- | --- | --- | +| 2026-10-13 | Accepted | Jens Tirsvad Nielsen | AI as stand-in for S01 | Review of ADR-0002 | pending | + +--- + +## Artifact Under Review + +- Instance reviewed: [ADR-0002] +- Checklist used: [QC-ADR-001] +- Scope: full review +- Language and domain: n/a (technical type) +- Language reviewer: none +- Mode: autonomous, not independent (the reviewer is `AI as stand-in for S01`) + +## Checklist Results + +| # | Criterion | Status | Evidence/Notes | +| --- | --- | --- | --- | +| 1 | The ID (`ADR-NNNN`, 4-digit) matches the filename number and is unique and sequential | Pass | ADR-0002 matches `adr-0002-*.md` and follows the registry sequence. | +| 2 | Context states the problem, the forces (cost, risk, constraints) and the options evaluated | Pass | Context states the problem, forces and the options evaluated. | +| 3 | At least two options were considered, or the absence of alternatives is justified | Pass | Three options (ADR-0001) / three options (ADR-0002) are listed. | +| 4 | Decision is stated in one or two unhedged sentences and matches one of the evaluated options | Pass | The Decision is stated plainly and is one of the listed options. | +| 5 | Consequences list both Positive and Negative outcomes | Pass | Positive and Negative consequences are listed. | +| 6 | Quality-attribute impacts (performance, security, portability, etc.) are named where the decision affects them | Pass | Maintainability: fewer documents to keep consistent. | +| 7 | Affected Artifacts are listed as links, and each is also in CrossReference | Pass | Affected Artifacts are links and each is in CrossReference. | +| 8 | Status changes are recorded as new Version History rows with a Change summary and Commit link; retained rows are never rewritten | Pass | One Version History row; no retained row was rewritten. | +| 9 | A superseded or deprecated ADR names its successor, and the successor links back | N-A | No ADR is superseded or deprecated. | +| 10 | Written in business or technical language of the domain, with no unexplained abbreviations | Pass | Plain technical language; abbreviations such as CSV are spelled out in the Business Case. | +| 11 | Status is one of `Proposed`, `Accepted`, `Rejected`, `Deprecated` or `Superseded by ADR-NNNN`, and every Version History row uses only these | Pass | The status is `Accepted`, an allowed value. | + +## Overall Verdict + +Go — every Mandatory criterion of QC-ADR-001 passes. + +## Action Items + +| Action | Owner | Due | +| --- | --- | --- | +| None | S01 | n/a | + +--- + +[ADR-0002]: ../../adr/adr-0002-skip-analysis-artifacts.md +[QC-ADR-001]: ../../../framework/qc/artifacts/qc-adr.md diff --git a/docs/sqa/reviews/rc-008-ci-workflow.md b/docs/sqa/reviews/rc-008-ci-workflow.md new file mode 100644 index 0000000..dc5832c --- /dev/null +++ b/docs/sqa/reviews/rc-008-ci-workflow.md @@ -0,0 +1,88 @@ +# SQA Review Record RC-008: WF-001 + +## Metadata +| Key | Value | +| --- | --- | +| ID | RC-008 | +| CrossReference | [WF-001], [QC-WF-001], [QC-YML-001] | + +## Version History +| Date | Status | Author | Reviewer | Change | Commit | +| --- | --- | --- | --- | --- | --- | +| 2026-10-13 | Accepted | Jens Tirsvad Nielsen | AI as stand-in for S01 | Review of WF-001 | pending | + +--- + +## Artifact Under Review + +- Instance reviewed: [WF-001] +- Checklist used: [QC-WF-001] and [QC-YML-001] +- Scope: full review +- Language and domain: n/a (technical type) +- Language reviewer: none +- Mode: autonomous, not independent (the reviewer is `AI as stand-in for S01`) + +## Checklist Results + +| # | Criterion | Status | Evidence/Notes | +| --- | --- | --- | --- | +| 1 | The file meets the YAML checklist ([QC-YML-001]) | Pass | See the QC-YML-001 table below; every Mandatory row passes. | +| 2 | The file is in `.gitea/workflows/` or `.github/workflows/` with the extension `.yml` or `.yaml`, and the same workflow does not exist in both directories | Pass | `.gitea/workflows/ci.yml`; no workflow in `.github/workflows/`. Gitea 1.27.3 ran it (run 2 on branch `mil-001-repository-foundation`). | +| 3 | The file declares `name`, `on` and `jobs`; `on` lists explicit events and, where it matters, `branches` or `paths` | Pass | `name`, `on` (push with `branches` and `paths`, pull_request with `paths`) and `jobs` are declared. | +| 4 | A header comment states the purpose, the triggers, the inputs, the secrets it needs, what it changes outside the repository, and the decision or milestone it implements | Pass | The header states purpose, triggers, inputs, secrets, changes outside the repository and the decision. | +| 5 | Every job and step has a descriptive `name`, unique within its job | Pass | Every step has a unique descriptive `name`. | +| 6 | The file passes `actionlint` (or the project's workflow validation test) and the tool version is stated | Pass | actionlint 1.7.12 reports no finding; yamllint 1.38.0 as well. | +| 7 | Every job declares `permissions` explicitly with the least access that works (`contents: read` or none by default); write access only on the job that needs it | Pass | The job declares `permissions: contents: read`. | +| 8 | Every action used is pinned to a full commit SHA or an exact release tag, never to a branch; a moving major tag (`@v1`) is accepted only for an action published by the same organisation under a stated release policy | Pass | `actions/checkout@v4.2.2` and `actions/setup-python@v5.6.0` are exact release tags. | +| 9 | No secret is written in the file; a secret is read as `secrets.NAME`, passed to a step through `env:`, never placed on a command line or echoed | Pass | No secret is used or written. | +| 10 | Untrusted text (`inputs.*`, event fields such as a title, branch name or label, step outputs derived from them) is never interpolated into a `run:` script; it is passed through `env:` and used as a quoted variable | Pass | No event field is interpolated into a `run:` block; `github.ref` is used only in the concurrency group. | +| 11 | A trigger that gives a run secrets or a write token on code from a fork or an untrusted branch (`pull_request_target`, `workflow_run`) does not check out or execute that code | Pass | No `pull_request_target` or `workflow_run` trigger. | +| 12 | A workflow that changes state outside the repository (release, tag, publish, sync, deploy) is started by hand or by a protected branch, and a manual run defaults to a dry run with an explicit input to apply | N-A | The workflow changes nothing outside the repository. | +| 13 | The token the workflow uses has only the scope the job needs, and where the host's built-in token is enough it is used instead of a personal token | N-A | No token is used. | +| 14 | Every job sets `runs-on` to an explicit label and `timeout-minutes` | Pass | `runs-on: ubuntu-latest` and `timeout-minutes: 10`. | +| 15 | `concurrency` is set where two runs would conflict: a check cancels the older run (`cancel-in-progress: true`); a publishing job queues (`cancel-in-progress: false`) | Pass | `concurrency` with `cancel-in-progress: true` for a check. | +| 16 | Triggers are filtered (`branches`, `paths`, `types`) so the workflow runs only for the changes it concerns | Pass | Branch and path filters limit the runs to code and configuration changes. | +| 17 | Tools and dependencies are installed at pinned versions; a version is a workflow input with a default or a value in one place | Pass | Python version is the one value `PYTHON_VERSION`; development tools are pinned with `==` in `pyproject.toml`. | +| 18 | A dependency cache is used where the install is slow enough to matter | N-A | The install takes about 15 seconds; a cache would not matter. | +| 19 | A failing step names the tool, the file and the reason in its log (annotation or `::error::` line) | N-A | Each step is a single tool command whose own log names the file and reason. | +| 20 | A `run:` block is within the limit on embedded program text of criterion 7 of [QC-YML-001]; a longer script is a file (`tools/`, or a shared repository fetched at a pinned ref) that the step calls with one command, and the workflow passes its settings through `env:` | Pass | The longest `run:` block has two lines. | +| 21 | Logic used by more than one workflow or repository is a reusable workflow (`workflow_call`) or a composite action; each input has a `description`, a `type` and a `default` where one is sensible | N-A | One workflow; no logic is shared. | +| 22 | Every workflow feature used is verified on the instance that runs it, and the host and version are recorded; a feature the target hosts differ on is noted in the header | Pass | Verified on Gitea 1.27.3 (`/api/v1/version`): the run completed with conclusion success on runner label ubuntu-latest. | +| 23 | A reusable workflow states, in its header, how a caller pins it and the script it fetches, so the workflow and its script are the same release | N-A | Not a reusable workflow. | +| 24 | A static test of the repository's workflows exists and runs on every pull request: valid YAML, required keys, explicit permissions and runner, no inline script above the limit | N-A | Optional; the workflow is linted by actionlint and yamllint in this review, no repeated static test exists for a single file. | + +## Referenced Checklist Results (QC-YML-001) + +| # | Criterion | Status | Evidence/Notes | +| --- | --- | --- | --- | +| 1 | The file parses with a safe YAML loader and has no duplicate keys in any mapping | Pass | Loaded with PyYAML `safe_load`; no duplicate keys (yamllint `key-duplicates`). | +| 2 | Indentation is 2 spaces everywhere, never tabs; lines end with LF; the file ends with one newline and has no trailing spaces | Pass | 2-space indentation, LF, final newline, no trailing spaces (yamllint default rules). | +| 3 | Passes `yamllint` (or the project's YAML linter) with its configuration committed next to the code and no unexplained `disable` comments | Pass | yamllint 1.38.0 with `.yamllint.yml` committed; no `disable` comments. | +| 4 | A scalar that YAML would coerce to another type is quoted: `yes`, `no`, `on`, `off`, `null`, `~`, numbers with a leading zero, versions such as `1.10`, and values that contain `: ` or ` #` | Pass | `"3.13"` is quoted; no coercible scalar remains. | +| 5 | Only safe, plain types are used: no language-specific tags (`!!python/object`, `!ruby/object`) and no `!include`-style extension unless the consuming tool documents it | Pass | No tags or extensions. | +| 6 | No secret is written in the file: no password, token, key or private connection string; a secret is referenced by name and supplied by the consuming tool | Pass | No secret. | +| 7 | Embedded program text (shell, Python, SQL, `jq`, and so on) in a value is at most five lines; a longer one is moved to a file of its own, in its own language, and the YAML calls it | Pass | Longest embedded script is two lines. | +| 8 | A block of keys or values repeated in the file or across files is defined once (an anchor, a template, an include or a reusable unit the consumer supports) | Pass | Nothing repeats beyond the three-line path list used by two triggers; the paths are a different trigger each, accepted because the host has no anchor support in `on:`. | +| 9 | Anchors, aliases and merge keys (`&`, `*`, `<<`) are used only where the consuming tool is known to support them | Pass | No anchors or aliases. | +| 10 | The file validates against the schema of the consuming tool where one exists, and the schema or tool version is stated | N-A | Optional: no schema file is available offline; actionlint validates the structure. | +| 11 | A header comment states what the file is for, which tool reads it, and where its decision or design is recorded | Pass | The header says what the file is for, which tool reads it and the decision. | +| 12 | Key names follow the convention of the consuming tool; one case style is used within the file (kebab-case or snake_case, never mixed) | Pass | kebab-case for keys such as `runs-on`, `timeout-minutes`; no mixed style. | +| 13 | Multi-line strings use a block scalar (`\|` or `>`) and state the chomping indicator (`\|-`, `\|+`) where the trailing newline matters | Pass | `run: |` is used for the two-line block with the default clip chomping, which suits a script. | +| 14 | The file name is lowercase kebab-case with one extension style (`.yml` or `.yaml`) used throughout the repository | Pass | `ci.yml`, lowercase, `.yml` throughout. | +| 15 | A change is exercised by a check that runs without the real target: a parse and schema test, or a dry run of the consuming tool | Pass | Exercised by actionlint, yamllint and a real run. | + +## Overall Verdict + +Go — every Mandatory criterion of QC-WF-001 and QC-YML-001 passes; the workflow ran green on Gitea 1.27.3. The `Doxyfile` output folder is `build/` (not `build/doxygen/` as the MIL-001 task summary says) because Doxygen creates only one directory level; the Go/No-Go criteria are not affected. + +## Action Items + +| Action | Owner | Due | +| --- | --- | --- | +| None | S01 | n/a | + +--- + +[WF-001]: ../../../.gitea/workflows/ci.yml +[QC-WF-001]: ../../../framework/qc/code/qc-workflow.md +[QC-YML-001]: ../../../framework/qc/code/qc-yaml.md diff --git a/docs/sqa/reviews/rc-009-python-skeleton.md b/docs/sqa/reviews/rc-009-python-skeleton.md new file mode 100644 index 0000000..2dd69a4 --- /dev/null +++ b/docs/sqa/reviews/rc-009-python-skeleton.md @@ -0,0 +1,59 @@ +# SQA Review Record RC-009: PY-001 + +## Metadata +| Key | Value | +| --- | --- | +| ID | RC-009 | +| CrossReference | [PY-001], [QC-PY-001] | + +## Version History +| Date | Status | Author | Reviewer | Change | Commit | +| --- | --- | --- | --- | --- | --- | +| 2026-10-13 | Accepted | Jens Tirsvad Nielsen | AI as stand-in for S01 | Review of PY-001 | pending | + +--- + +## Artifact Under Review + +- Instance reviewed: [PY-001] +- Checklist used: [QC-PY-001] +- Scope: full review +- Language and domain: n/a (technical type) +- Language reviewer: none +- Mode: autonomous, not independent (the reviewer is `AI as stand-in for S01`) + +## Checklist Results + +| # | Criterion | Status | Evidence/Notes | +| --- | --- | --- | --- | +| 1 | Packages, modules, functions, variables, classes and constants follow PEP 8 casing (`snake_case`, `PascalCase`, `UPPER_SNAKE`) | Pass | snake_case modules, UPPER_SNAKE constants; ruff rule set N passes. | +| 2 | Names state purpose in the domain's language; no unexplained abbreviations, no single-letter names outside tiny scopes | Pass | Names state purpose: `DATA_FILE_NAME`, `LETTER_COLUMN`, `INVALID_INPUT_TEXT`. | +| 3 | Code is produced by the project's formatter and passes its linter with no unexplained suppressions | Pass | `ruff check` and `ruff format --check` pass; no suppressions. | +| 4 | Every function and method signature is type-annotated, including `-> None` | Pass | Test functions are annotated `-> None`; constants are annotated. | +| 5 | No bare `except:`, no swallowed exceptions; specific exceptions are raised and the cause is kept (`raise ... from`) | N-A | No exception handling exists in the skeleton. | +| 6 | No mutable default arguments and no shadowed builtins | Pass | No mutable defaults; no builtin shadowed. | +| 7 | Files, locks and connections are managed with context managers | Pass | No file handles are opened; `Traversable.read_text` closes its own. | +| 8 | Public modules, classes and functions have docstrings that say what, not how | Pass | The module and package have docstrings with `@brief`. | +| 9 | Logging uses `logging`, not `print`; no secrets or personal data in log output | N-A | No output is produced in the skeleton. | +| 10 | Classes and operations trace to the Design Class Diagram they implement; deviations are recorded | N-A | No design class diagram exists for this phase; the skeleton has no classes. | +| 11 | Tests exist for new behaviour, are named for the behaviour, and do not depend on order or the network | Pass | Two tests named for the behaviour test the data file. | +| 12 | Type checker runs in strict mode without errors; `Any` is justified in a comment | Pass | `mypy --strict` reports no issue in 3 files. | +| 13 | Dependencies are declared and pinned in the project's dependency file, none unused | Pass | Zero runtime dependencies; dev tools pinned exactly. | +| 14 | Each piece of knowledge (a business rule, constant, format, validation or query) is defined in one place; code is merged only where it expresses the same knowledge, not where it merely looks alike | Pass | Each literal is defined once in `constants.py`; the test reads names, not copies. | +| 15 | Imports point inward: business-rule modules import no framework, database, UI or delivery-mechanism code, and there are no import cycles | Pass | The package imports nothing; no cycles. | +| 16 | SOLID holds: a class or module has one reason to change; new behaviour is added by extension, not by editing a type test in several places; subclasses honour the contract of their base; protocols are narrow; high-level code depends on protocols or abstract types and receives its implementations | Pass | A module with only constants has one reason to change. | + +## Overall Verdict + +Go — every Mandatory criterion of QC-PY-001 passes or is not applicable to the skeleton (constants and smoke tests). + +## Action Items + +| Action | Owner | Due | +| --- | --- | --- | +| None | S01 | n/a | + +--- + +[PY-001]: ../../../src/nato_alphabet/constants.py +[QC-PY-001]: ../../../framework/qc/code/qc-programming-python.md diff --git a/docs/sqa/traceability-matrix.md b/docs/sqa/traceability-matrix.md index c44b432..85b6f04 100644 --- a/docs/sqa/traceability-matrix.md +++ b/docs/sqa/traceability-matrix.md @@ -9,7 +9,8 @@ ## Version History | Date | Status | Author | Reviewer | Change | Commit | | --- | --- | --- | --- | --- | --- | -| 2026-10-13 | Accepted | Jens Tirsvad Nielsen | AI as stand-in for S01 | Initial version | [7212302] | +| 2026-10-13 | Deprecated | Jens Tirsvad Nielsen | AI as stand-in for S01 | Initial version | [7212302] | +| 2026-10-13 | Accepted | Jens Tirsvad Nielsen | AI as stand-in for S01 | Added rows for ADR-0001, ADR-0002, the CI workflow and the Python skeleton (RC-006 to RC-009) | pending | --- @@ -30,14 +31,19 @@ Tracks backward and forward links between artifact instances so that the cross-a | [BC-001] | Business Case | en | it | - | [SA-001], [PP-001], [MIL-001], [MIL-002], [MIL-003] | [RC-001] | | [SA-001] | Stakeholder Analysis | en | it | [BC-001] | [PP-001] | [RC-002] | | [PP-001] | Project Plan | en | it | [BC-001], [SA-001] | [MIL-001], [MIL-002], [MIL-003] | - | -| [MIL-001] | Milestone | en | it | [BC-001], [PP-001] | [MIL-002] | [RC-003] | +| [MIL-001] | Milestone | en | it | [BC-001], [PP-001] | [MIL-002], [ADR-0001], [ADR-0002] | [RC-003] | | [MIL-002] | Milestone | en | it | [BC-001], [MIL-001] | [MIL-003] | [RC-004] | | [MIL-003] | Milestone | en | it | [BC-001], [MIL-002] | - | [RC-005] | +| [ADR-0001] | ADR | - | - | [BC-001], [SA-001] | [PY-001] | [RC-006] | +| [ADR-0002] | ADR | - | - | [BC-001] | - | [RC-007] | +| [WF-001] | CI workflow | - | - | [MIL-001] | - | [RC-008] | +| [PY-001] | Python source | - | - | [ADR-0001], [MIL-001] | - | [RC-009] | ## Coverage Notes - `-` in Upstream means foundational; in Downstream it means nothing is built on it yet; in Last Reviewed it means no review record exists. - PP-001 has no QC checklist yet; it is accepted by the Product Owner's stand-in. +- WF-001 and PY-001 are labels for reviewed code instances (no artifact file). - Use cases, user stories and design artifacts are added in MIL-002. --- @@ -54,3 +60,11 @@ Tracks backward and forward links between artifact instances so that the cross-a [RC-005]: ./reviews/rc-005-mil-003.md [SA-001]: ../stakeholder-analysis.md [7212302]: https://git.tirsystem.com/Tirsvad-Udemy-100-days-of-code/026-nato-alphabet/commit/7212302fb9d9fe411215d4702d56a7cfe8834f1a +[ADR-0001]: ../adr/adr-0001-read-nato-data-with-csv-module.md +[ADR-0002]: ../adr/adr-0002-skip-analysis-artifacts.md +[WF-001]: ../../.gitea/workflows/ci.yml +[PY-001]: ../../src/nato_alphabet/constants.py +[RC-006]: ./reviews/rc-006-adr-0001.md +[RC-007]: ./reviews/rc-007-adr-0002.md +[RC-008]: ./reviews/rc-008-ci-workflow.md +[RC-009]: ./reviews/rc-009-python-skeleton.md