Governance / ARB Workflow

Metadata

Key	Value
ID	GOV-001
CrossReference	BC-001, SA-001, TM-001
Language	en
Domain	it

Version History

Date	Status	Author	Reviewer	Change	Commit
2026-10-28	Accepted	Jens Tirsvad Nielsen	AI as stand-in for S01	Initial version	01e016e

Purpose

Defines how this project applies Quality Criteria (QC) checklists to its artifact instances, producing SQA Review Records and Go/No-Go decisions. It serves the Business Case (BC-001) objective O5 (documentation) and success criterion 6, and the stakeholder concern CN-002 of SA-001 that nothing unreviewed or secret reaches the repository.

ARB Review Workflow

Submission — the artifact owner (S01) submits an instance for review, identifying its type's QC checklist (framework/qc/*/qc-*.md).
QC Checklist Review — the Responsible reviewer (S01, or the AI as stand-in for S01 in autonomous mode) applies the checklist criterion by criterion.
Review Record — the Responsible reviewer documents the outcome as an SQA Review Record (RC-* under docs/sqa/reviews/).
Go/No-Go Decision — the Accountable role for the artifact category (S01) decides; contested or cross-cutting cases escalate to the ARB Chair (S01).
Sign-off — S01 signs off. On Go, the artifact's ## Version History gets an Accepted row (the previous row becomes Deprecated). On Go-with-conditions, status stays Proposed until the Action Items are closed. On No-Go, the artifact returns to its owner (S01). A blocking finding (a Fail on a Mandatory criterion, or an open security finding rated High or Critical) always gives No-Go, unless a valid risk exception covers it.
Traceability Update — S01 (or the stand-in) updates the Traceability Matrix (TM-001) with the instance and its RC-* reference.

A criterion that only a person can confirm stays Pending until S01 confirms it by name and date; the author's or a stand-in's own assessment never closes it, and Pending allows Go-with-conditions at most. A risk exception names the finding, an owner, an approver who is neither the author nor the owner, an expiry date and the compensating controls; an expired exception blocks again. This project has one person, so a risk exception is approved by S01 in chat only, never by the stand-in.

RACI by Artifact Category

Artifact Category	Responsible (runs the review)	Accountable (Go/No-Go owner)	Consulted	Informed
Strategic (Stakeholder Analysis, Business Case)	S01	S01	S02	S03
Process/Business (Project Plan, Milestones/Gateways)	S01	S01	S02	S03
Governance and traceability (Governance, Traceability Matrix)	S01	S01	S02	S03
Source code and tests	S01	S01	S02	S03

Cross-cutting escalations and disputed verdicts are Accountable to the ARB Chair (S01), overriding the category-level Accountable role. Requirements and modeling artifacts (use cases, domain model and similar) are not in scope: all tasks are technical tasks (see BC-001, Scope).

Escalation Rules

A No-Go verdict, or any disagreement between the Responsible reviewer and the category's Accountable owner, escalates to the ARB Chair (S01).
A reviewer may not review an instance they authored. The one exception is autonomous mode: the AI may act as stand-in for a reviewer or an Accountable role, recorded as AI as stand-in for S01 and Mode: autonomous, not independent; S01's acceptance of the plan is the authorisation for it. The named alternate for a review that S01 authored is S01 reading it again in the run summary.
Repeated No-Go verdicts (2 or more) on the same artifact type trigger a review of the corresponding QC-* checklist itself.

Cadence

Reviews are triggered per artifact instance as it is produced or revised.
QC checklists are reviewed annually (framework level, outside this project).

Process artifacts relied on: TM-001 (traceability) and framework/process/review-checklist-process.md (review procedure).

4.3 KiB Raw Permalink Blame History