conductor/docs/MVP_TRACEABILITY.md

Conductor v0.1.0 Requirements Traceability

Purpose

This matrix maps every release-critical requirement area in docs/REQUIREMENTS.md and every approved workflow in MVP_SCOPE.md to an owning slice and acceptance evidence. It is the governance bridge between product requirements, implementation plans, and validation. Detailed field-level behavior remains authoritative in the linked schema and topic documents.

Release-critical requirements

ID	v0.1.0 requirement area	Owning slice	Validation criterion and evidence	Status
R1	Browser-based application, React frontend, backend API, SQLite persistence, and Docker Compose deployment	Slices 1, 6, 8	Production builds, Compose startup/health/restart/persistence, backup/restore in docs/RELEASE_VALIDATION.md and TESTING.md	Accepted
R2	Canonical JSON project definition shared by Visual Editor, JSON Editor, Preview, persistence, and validation	Slices 2, 5, 6	Schema matrix, canonical round trips, cross-view synchronization, save/reload/restart tests	Accepted
R3	Single-page visual canvas with the eleven schema-supported components, selection, movement, resizing, deletion, properties, and basic styling	Slices 1, 2	Slice 1/2 component tests and accepted canvas/property/Preview manual workflows	Accepted
R4	REST actions with supported methods, URL, headers, query/path parameters, body template, description, and fixed proxy-policy timeout	Slices 2, 4	Action-editor tests, proxy integration/security suites, docs/SCHEMA.md, docs/PROXY_SECURITY.md	Accepted
R5	Button onClick and page onLoad execution; component/variable request templates; Table selection runtime binding	Slices 2, 6	Frontend event/template/runtime tests and deterministic launcher/dashboard E2E	Accepted
R6	Top-level response/component bindings to supported component properties or typed runtime variables	Slices 2, 5, 6	Binding diagnostics/runtime tests, compatibility validation, dependent-data/dashboard workflows	Accepted
R7	Anonymous, Basic, Bearer, API-key header, and API-key query authentication with opaque canonical references	Slices 3, 6	All-mode backend integration and manual authenticated-request acceptance	Accepted
R8	Encrypted server-side secret lifecycle, compatible selection, missing-reference behavior, and no browser/project exposure	Slices 3, 6	docs/SECRETS.md, lifecycle tests, restart checks, manual redaction gate	Accepted
R9	Default-deny server-side proxy with URL/header validation, SSRF/redirect/DNS controls, limits, safe errors, and explicit internal exceptions	Slices 4, 6	docs/PROXY_SECURITY.md, proxy security/integration tests, Docker manual gate	Accepted
R10	Sanitized bounded execution history with filtering, persistence, clear behavior, and no credential leakage	Slices 4, 6	Backend history/redaction tests, frontend history checks, exact marker scans	Accepted
R11	Central schema/semantic validation, atomic persistence, actionable cross-view diagnostics, and unsaved-edit preservation	Slices 5, 6	Backend rollback/version/semantic tests and Slice 5 manual failure/recovery acceptance	Accepted
R12	Preview runtime with loading, empty, success, upstream failure, mapping failure, retry/recovery, and ephemeral state	Slices 2, 5, 6	Preview suites and all six deterministic manual workflows	Accepted
R13	Save/load, portable JSON definition, backend/full-stack restart persistence, runtime reset, and SQLite backup/recovery	Slices 2, 5, 6	Canonical round-trip tests, E2E save/reload, restart and offline backup/restore evidence	Accepted
R14	Accessible, scannable Actions & Bindings authoring with progressive disclosure and preserved local drafts	Slice 6a	25 frontend suites / 520 tests and SLICE6a_MANUAL_TEST.md acceptance	Accepted

Approved acceptance workflows

Workflow	Primary requirements	Owning validation slice	Evidence
Workflow Launcher	R2–R6, R11–R13	Slice 6	SLICE6_MANUAL_TEST.md Test 1 and deterministic E2E
Dependent Data	R5, R6, R11, R12	Slice 6	SLICE6_MANUAL_TEST.md Test 2 and runtime tests
Read-Only Dashboard	R3, R5, R6, R12	Slice 6	SLICE6_MANUAL_TEST.md Test 3 and deterministic E2E
Authenticated Request	R4, R7–R10	Slice 6	SLICE6_MANUAL_TEST.md Test 5 and backend integration
JSON Editing and Persistence	R1, R2, R11, R13	Slice 6	SLICE6_MANUAL_TEST.md Tests 4 and 6
Failure Handling	R9–R12	Slice 6	SLICE6_MANUAL_TEST.md Test 4 and Slice 5 recovery evidence

Explicit post-MVP classifications

The following capabilities are not release requirements. Their presence in future-oriented requirements or architecture text does not block v0.1.0:

• Provider-neutral AI assistance, including chat, generation, explanation, documentation, and refactoring
• IBM Bob, watsonx, or any provider-specific AI dependency
• Multi-page authoring and advanced page management
• Direct Dropdown-triggered REST execution and general action chaining/orchestration
• Conditions, branches, loops, parallelism, retries, workflow graphs, and long-running task orchestration
• OAuth 2.0, IBM Cloud IAM, mTLS, and custom authentication scripts
• OpenAPI import and generated React/static/deployment-package output
• Per-action timeout and expected-response-format controls
• Binding transforms, expression languages, and configurable per-binding error policies
• Canvas zoom/pan, undo/redo, advanced JSON-editor tooling, themes, and reusable component libraries
• Tabs, modals, date pickers, file uploads, charts, progress indicators, and advanced Table capabilities
• RBAC, team collaboration, approval workflows, enterprise audit retention, and SIEM integration
• PostgreSQL/high-availability/centralized multi-user deployment

Governance rule

MVP_SCOPE.md controls the release boundary. A new capability becomes release-blocking only through an explicit product-owner scope decision followed by updates to this matrix, ROADMAP.md, the owning slice, and its validation criteria. Aspirational or compatibility-only schema text does not silently expand v0.1.0.