# Traceability Coverage and Gap Analysis

## Purpose

Assess how completely the current repository supports requirements-to-design traceability and identify gaps that need stakeholder validation, additional documentation, or tests.

## Inputs

- Trace catalog in `traceability/requirements-design-traceability.md`.
- Design map in `traceability/design-decision-map.md`.
- Repository documentation, source code, and tests listed in the trace catalog.

## BA Activities

- Manage requirements lifecycle.
- Analyze requirements and define design options.
- Evaluate solution.
- Elicit and collaborate.

## Techniques Applied

- Gap analysis: compared requirement statements, design elements, evidence, and tests.
- Risk analysis: identified where unvalidated policy or weak evidence could affect operations.
- Acceptance criteria: noted where tests exist or where acceptance evidence is missing.

## Coverage Summary

| Area | Trace Coverage | Evidence Strength | Notes |
| --- | --- | --- | --- |
| Automated reconciliation | High | Strong | Requirements trace to workflow code, audit controls, README, and focused tests. |
| Matching profiles | High | Strong | Code and tests cover transforms, target fields, email usernames, crosswalks, and validation. |
| Candidate review | High | Strong | Candidate services and viewer behavior have detailed test coverage. |
| Manual reconciliation audit | High | Strong | Edit classifications and invalid amount blocking are tested. |
| InitialBalances transfer | High | Strong | Preflight, blocking, aggregation, audit, manifest, and atomic publication are tested. |
| Managed desktop runs | High | Strong | Staging, manifests, and privacy behavior are tested. |
| GUI workflow state | Moderate to high | Strong for controller state, moderate for rendered GUI behavior | Controller tests exist; full visual/operator usability validation is outside this trace round. |
| Sandbox generator | High | Strong | Determinism and production workflow verification are tested. |
| Windows packaging | Moderate | Moderate | Repository tests inspect installer/script properties; clean-machine install evidence is not in repo. |
| Business approval | Low | Unknown | Implementation is observable, but formal stakeholder approval is not captured in repo artifacts. |

## Traceability Gaps

| Gap ID | Gap Statement | Impact | Evidence Quality | Related Requirements | Suggested Action | Validation Owner |
| --- | --- | --- | --- | --- | --- | --- |
| GAP-001 | Requirements are implementation-derived and not marked as approved business requirements. | Traceability could be mistaken for formal signoff. | Observed repository behavior, approval unknown | All | Add status fields for Draft, Validated, Approved, Deferred, Rejected. | Product owner |
| GAP-002 | Business rationale for excluding `no Lunchtab match` from manual-review exceptions is not separately approved. | Staff may miss a class of exceptions if policy changes. | Observed code/docs, business rationale inferred | REQ-003, REQ-008 | Confirm exception triage policy. | Operations lead |
| GAP-003 | Candidate score weights and confidence thresholds are implemented but not tied to stakeholder-approved criteria. | Candidate rankings may not reflect staff trust model. | Observed code, intent inferred | REQ-008, REQ-009 | Run validation workshop using real anonymized cases or approved synthetic cases. | Reconciliation staff lead |
| GAP-004 | All-or-nothing InitialBalances blocking is implemented but not recorded as an approved policy decision. | Partial-safe import expectations could conflict with operational needs. | Observed code/docs, approval unknown | REQ-013 | Record policy decision and exception handling procedure. | Finance/operations approver |
| GAP-005 | Manifest privacy controls are documented and tested, but no explicit data-handling policy reference is captured. | Audit/privacy claims may be incomplete for governance review. | Observed, policy unknown | REQ-015 | Validate manifest content against internal data policy. | Data owner |
| GAP-006 | GUI rendered behavior and operator comprehension are not fully traceable to usability acceptance evidence. | Controller correctness may not fully prove operator readiness. | Observed tests, validation unknown | REQ-016 | Add operator acceptance checklist or GUI walkthrough record. | Operations lead |
| GAP-007 | Packaging trace lacks clean Windows 10/11 install, upgrade, uninstall, and no-Python acceptance evidence in repository artifacts. | Release readiness depends on manual validation outside tests. | README states checklist, evidence unknown | REQ-019 | Store release validation record per release. | Release owner |
| GAP-008 | Profile ownership and approval workflow are not defined in code artifacts. | Venue profile changes could alter matching behavior without governance. | Inferred from profile capability | REQ-004 | Define profile change-control requirement. | Product owner and operations lead |

## Acceptance Coverage Notes

- Strong automated acceptance coverage exists where business rules are encoded in tests.
- Human acceptance coverage is still needed for operator-facing policies, candidate ranking trust, profile governance, and release deployment.
- No future-state recommendation is treated as approved in this artifact; gaps are validation needs until stakeholders confirm desired outcomes.

## Traceability

- GAP-001 applies to every requirement because all requirements in this round are derived from implementation and documentation evidence.
- GAP-002 and GAP-003 attach to manual review and candidate design decisions DEC-002, DEC-006, and DEC-007.
- GAP-004 attaches to InitialBalances design decision DEC-010.
- GAP-005 attaches to manifest design decision DEC-012.
- GAP-007 attaches to packaging design decision DEC-015.

## Validation Needs

The next BA step should be stakeholder validation, not additional code inspection. The recommended validation sequence is:

1. Confirm requirement statuses and owners.
2. Confirm operational exception policies.
3. Confirm profile governance.
4. Confirm audit/privacy obligations.
5. Confirm release acceptance evidence expectations.