# Decision Log

## Decisions

| ID | Decision | Rationale | Status | Evidence quality |
| --- | --- | --- | --- | --- |
| D-001 | Source data are explicitly read only | Maintain source data integrety and facilitate tracability and operation governance | Accepted | Observed |
| D-002 | Audit artifacts are created at each process steps | Each process steps needs to be auditablae and allow tracing of user's decisions during operation | Accepted | Observed |
| D-003 | Final output folder contains both audit files and lunchtab import file | Streamline user audit and finalization sequence | Accepted | Observed |
| D-004 | Program will be developed on Python packaged for Windows 11 OS | Lunchtab and Odin Cloud does not currently have OPEN API capability or shared common ID for account reconciliation, a light-weight local program is preferred over a web based app | Accepted | Observed |

## Assumptions

| ID | Assumption | Validation need | Evidence quality |
| --- | --- | --- | --- |
| A-001 | The intended audience includes operations staff and stakeholders reviewing the automation value. | Confirm with project owner. | Inferred |
| A-002 | Future-state recommendations should be operational and governance-oriented rather than a large new software build. | Confirm appetite for further development. | Inferred |
| A-003 | The Lunchtab import itself occurs outside this application. | Validate production procedure. | Observed |
| A-004 | Generated result artifacts are considered sensitive because they can include names, identifiers, family codes, emails, and balances. | Confirm applicable policy. | Observed |

## Open Questions

1. Who approves high-risk manual reconciliation deltas before InitialBalances use?
2. Who owns matching profile changes and crosswalk maintenance?
3. Where should generated artifacts be stored, and how long should they be retained?
4. What is the expected post-import verification step in Lunchtab?
5. Should production runs be logged centrally for match rates, exception trends, and labor savings?
6. What privacy or compliance policy should be explicitly referenced in user guidance?