KrinosAI — Project Plan

Template ID: TPL-04-07 | Stage: 04-Planning | Version: 0.3
Record: KAI-VORAL-PLN-001 — retrospective draft for Visionary Oral. Not approved.

Purpose: Bring scope, schedule, milestones, people, budget and governance into one approved plan baseline.

Required inputs: Charter; SRS/RTM; design records; WBS; estimates; RACI; risk register.

Document control

Field	Required entry
Document ID	KAI-VORAL-PLN-001
Template used	TPL-04-07 Project Plan v0.3
Product / project / software version or commit SHA	VORAL (Visionary Oral) / PRJ-001 / a6b4429e3165 (branch app_dev of AI-Dental-Project/Visionary_Oral)
Record status and version	Draft v0.1
Author / technical reviewer / quality reviewer	Claude Code (drafted with Claude Code for KrinosAI) / Tech Lead (name to be assigned) / Security & Privacy Officer (name to be assigned)
Created / updated / approved dates	2026-10-27 / 2026-10-27 / Pending
Applicable SOP and revision	SOP-LC-04 v0.3
Related issue, commit, requirement and evidence links	KAI-VORAL-WBS-001; KAI-VORAL-CHR-001 §7
Approver and decision record	Pending

Applicability and evidence baseline

Product / system boundary: Web app and API (dentalapp/), doctor/admin mobile app (mobile/), PDF Lambda (dentalapp/pdf-lambda/) at a6b4429e3165, and the external services they call. Related approved requirements, risks and change records: None approved. Related drafts are listed in document control. Retrospective record? Yes — follows the Retrospective Documentation Protocol (KrinosAI lifecycle pack, 05-References/). Items are labelled Observed (code or Git at a6b4429), Measured (dated run), Stated (named person, dated) or Not recorded. Planning records are forward-looking: they plan the corrective work found in stages 01–03. No past project plan, estimates or sprints were recorded (OPEN-042); effort, cost and dates are left to their owners (OPEN-020, OPEN-025). Acceptable evidence: an implementation reference (file:line at a commit SHA), a dated test record, a signed decision, a vendor agreement, or another independently verifiable artifact. Never invent approvals, clinical results, measurements or performance data.

1. Work breakdown and dependencies

WP ID	Work package	Depends on
WP-01 (work)	Rotate committed credentials and purge secrets and backups from Git history	—
WP-02 (work)	Authenticate the 20 unprotected routes; remove deprecated admin signup/auth; fail closed without JWT_SECRET	—
WP-03 (work)	Upgrade vulnerable dependencies (next, Clerk, expo, puppeteer …)	—
WP-04 (work)	Add rate limiting	WP-02
WP-05 (work)	DPIA, consent, retention schedule, vendor DPAs and regions	WP-01
WP-06 (work)	Regulatory determination and intended use	—
WP-07 (work)	CI pipeline, branch protection, PR reviews	WP-03
WP-08 (work)	Web automated tests and API contract tests	WP-07
WP-09 (work)	Clinical validation of detectors, score and AI text	WP-06
WP-10 (work)	One release branch; production hosting and deployed version recorded	—
WP-11 (work)	Monitoring, logging, backups and runbooks	WP-10
WP-12 (work)	Complete and approve lifecycle records	All

2. Milestones with measurable exit criteria

Milestone	Date	Exit criterion
M1 — Secrets and backups purged	2026-10-31 (proposed)	OPEN-007, OPEN-008 closed
M2 — Critical routes protected	2026-10-31 (proposed)	OPEN-026, OPEN-033 closed; inventory re-run clean
M3 — Dependencies patched	2026-11-15 (proposed)	npm audit: 0 critical, 0 high
M4 — DPIA approved	2026-11-30 (proposed)	OPEN-009 closed
M5 — CI live	2026-11-30 (proposed)	Every PR runs build, lint, tests, audit

Figure 1 — Proposed milestone timeline (dates are proposals until the Sponsor approves the plan — OPEN-025).

gantt
    title Visionary Oral — proposed remediation milestones
    dateFormat YYYY-MM-DD
    axisFormat %d %b
    section Security
    M1 Secrets and backups purged      :m1, 2026-10-28, 2026-10-31
    M2 Critical routes protected       :m2, 2026-10-28, 2026-10-31
    M3 Dependencies patched            :m3, 2026-11-01, 2026-11-15
    section Privacy and quality
    M4 DPIA approved                   :m4, 2026-11-01, 2026-11-30
    M5 CI live                         :m5, 2026-11-01, 2026-11-30

3. RACI owners and substitutes

Milestone	Accountable	Substitute
M1, M4	Security & Privacy Officer	Proposed (Claude Code, for confirmation): Tech Lead reviews security and privacy work; Security & Privacy Officer reviews engineering work (names to be assigned)
M2, M3, M5	Tech Lead	Proposed (Claude Code, for confirmation): Tech Lead reviews security and privacy work; Security & Privacy Officer reviews engineering work (names to be assigned)

4. Critical path and contingency

Item	Entry
Critical path	WP-01 → WP-05 (DPIA); WP-02 → WP-04; WP-03 → WP-07 → WP-08
Contingency	Proposed (Claude Code, for confirmation): 20 % of the likely estimate

5. Resource availability and capacity

Period	Capacity (person-days)	Planned
Nov 2026	Proposed (Claude Code, for confirmation): 3 developers × 8 person-days per 2-week sprint	WP-01 to WP-05

6. Regulatory and validation planning

Activity	When	Owner
Regulatory determination	Before next public release	Qualified regulatory reviewer
Clinical validation	Stage 07	Clinical advisor

7. Budget forecasts and change triggers

Item	Value
Budget forecast	Proposed (Claude Code, for confirmation): 139 person-days likely over Nov 2026 – Jan 2027
Change trigger	Any milestone > 2 weeks late, or new critical finding

8. Tracking and reporting cadence

Report	Audience	Frequency	Owner
Status summary	Sponsor	Fortnightly (proposed)	Product Owner
Security status	Sponsor	Weekly until M2 (proposed)	Security & Privacy Officer

Open issues and decisions

ID	Specific gap or decision	Responsible owner	Due date	Blocks gate?	Evidence required	Status
OPEN-001	Tracker project ID, named requester and sponsor, and named reviewers are not recorded	Product Owner	2026-11-10 (proposed)	Yes	Tracker entry; names with roles	Open
OPEN-004	Intended-use statement not confirmed (proposed wording in KAI-VORAL-IRS-001 §1)	Product Owner with Qualified regulatory reviewer	2026-11-10 (proposed)	Yes	Confirmed wording, dated	Open
OPEN-006	Medical-device applicability not assessed in any jurisdiction	Qualified regulatory reviewer	2026-11-30 (proposed)	Yes	Written regulatory determination	Open
OPEN-007	Credential files committed to Git: dentalapp/google-credentials.json, dentalapp/mongoDb_usernamePassword (contents not opened)	Security & Privacy Officer	2026-10-31 (proposed)	Yes	Credentials rotated; files removed and purged from history; confirmation	Open
OPEN-008	Database backups with personal data committed to Git: 9 files under dentalapp/backups/ (commit 92a4b77; contents not opened)	Security & Privacy Officer	2026-10-31 (proposed)	Yes	Files purged from history; breach/incident assessment recorded	Open
OPEN-009	No DPIA	Security & Privacy Officer	2026-11-30 (proposed)	Yes	DPIA	Open
OPEN-011	No clinical validation	Clinical advisor with ML Lead	2026-12-15 (proposed)	Yes	Validation study	Open
OPEN-012	No vendor DPAs	Security & Privacy Officer	2026-11-30 (proposed)	Yes	DPAs	Open
OPEN-016	Data regions and transfers	Security & Privacy Officer	2026-11-30 (proposed)	Yes	Transfer assessment	Open
OPEN-017	Admin session signing uses a hard-coded fallback secret when JWT_SECRET is unset (dentalapp/src/lib/admin/session.js:4)	Backend Lead	2026-11-10 (proposed)	Yes	Code fix; secret confirmed set	Open
OPEN-019	No named support team, support lead or on-call rota; capacity not confirmed	Tech Lead	2026-11-30 (proposed)	No	Support model accepted by a named team	Open
OPEN-020	No budget ceiling, contingency or cost estimates	Sponsor	2026-11-30 (proposed)	Yes	Explicit numbers	Open
OPEN-021	Decision rights and acceptance authorities proposed, not confirmed	Sponsor	2026-11-10 (proposed)	Yes	Sponsor confirmation	Open
OPEN-022	Production hosting (Vercel vs Render), deployed version and dated integration checks for Clerk, MongoDB, R2, AWS, OpenRouter, Groq, Cashfree and Resend not recorded	Tech Lead	2026-11-30 (proposed)	No	Environment record (stage 05) with dated checks	Open
OPEN-023	Diverging branches; release line not defined	Tech Lead	2026-11-30 (proposed)	No	Branch policy	Open
OPEN-025	Milestone dates proposed only; no resources confirmed by their managers	Sponsor	2026-11-10 (proposed)	Yes	Committed dates and people	Open
OPEN-026	Critical: 20 API routes have no authentication check, incl. /api/admin/patient-sample (patient emails) and /api/admin/api-usage (doctor names and emails), support tickets/messages, and paid AI routes (/api/detect-gemini, /api/speech-to-text, /api/validate-scan) — see docs/lifecycle/_evidence/api-inventory-a6b4429.md	Backend Lead	2026-10-31 (proposed)	Yes	Auth added to each route; re-run of the inventory shows none unprotected	Open
OPEN-027	The web app (dentalapp/) has no automated tests and no test script	Tech Lead	2026-12-15 (proposed)	Yes	Test suite and CI run for the web app	Open
OPEN-029	No retention or deletion periods for patient data, photos, reports, backups or phone caches	Security & Privacy Officer	2026-11-30 (proposed)	Yes	Retention schedule in the DPIA	Open
OPEN-031	No recorded patient consent or privacy notice for photo capture, AI processing and QR self-registration	Security & Privacy Officer	2026-11-30 (proposed)	Yes	Consent text, where it is shown, and stored consent records	Open
OPEN-032	Design (DES) and test (TC) links for requirements are added by stages 03 and 07; requirements without them stay open	Tech Lead	2026-12-15 (proposed)	No	RTM with DES and TC links	Open
OPEN-033	Critical: deprecated POST /api/admin/signup is public and creates admin profiles with a password for anyone (dentalapp/src/app/api/admin/signup/route.js:14-60); POST /api/admin/auth issues admin sessions signed with a fallback secret (OPEN-017). Full privilege path not verified	Backend Lead	2026-10-31 (proposed)	Yes	Routes removed or locked down; check that no password-based admin can sign in	Open
OPEN-034	No rate limiting on any API route (login, public registration, AI routes, uploads)	Backend Lead	2026-11-30 (proposed)	Yes	Rate limits configured and tested	Open
OPEN-035	No database schema definition, migrations or index plan in the repository (MongoDB collections created implicitly); backup and restore not recorded	Backend Lead	2026-11-30 (proposed)	No	Schema/validation rules and index list; backup and restore test	Open
OPEN-036	No OpenAPI specification and no contract tests for the 75 API route files	Backend Lead	2026-12-15 (proposed)	No	OpenAPI file and contract tests in CI	Open
OPEN-037	Known vulnerable dependencies (npm audit 2026-10-27 16:50 UTC): web 4 critical (incl. next, @clerk/nextjs), 23 high; mobile 1 critical, 4 high (incl. expo) — fixes available for all	Tech Lead	2026-11-15 (proposed)	Yes	Upgraded lock files; clean re-run of npm audit	Open
OPEN-038	No branch protection, required reviews or CODEOWNERS recorded; changes are pushed directly to shared branches (app_dev, non-compliance)	Tech Lead	2026-11-15 (proposed)	Yes	Branch protection settings; PR template; CODEOWNERS	Open
OPEN-039	No CI pipeline builds, lints, tests or scans the code; the only workflow is the ML keep-awake job	Tech Lead	2026-11-30 (proposed)	Yes	CI workflow running build, lint, tests, audit and secret scan on every PR	Open
OPEN-042	No project tracker, sprint history, PR descriptions or code-review records exist for past work	Tech Lead	2026-12-15 (proposed)	No	Tracker and PR workflow in use from now on	Open
OPEN-043	No structured logging, metrics, uptime monitoring or alerting; logs are console.* only	Tech Lead	2026-11-30 (proposed)	Yes	Monitoring and alerting in place with an on-call contact	Open

Review and approval

Review role	Named individual	Decision	Date	Signed / controlled record
Author	Claude Code (drafted with Claude Code)	Draft	2026-10-27	This file at the commit that adds it
Technical reviewer	Tech Lead (name to be assigned)	Pending	Pending	Pending
Quality / regulatory reviewer (if applicable)	Qualified regulatory reviewer (name to be assigned)	Pending	Pending	Pending
Authorized approver	Sponsor (name to be assigned)	Pending	Pending	Pending