KrinosAI — Repository Setup
Template ID: TPL-05-01 | Stage: 05-Development-Setup | Version: 0.3
Record: KAI-VORAL-REPO-001 — retrospective draft for Visionary Oral. Not approved.
Purpose: Record how each repository is configured so code changes are reviewed, traceable and protected.
Required inputs: Project plan; HLD containers; organization Git policy.
Document control
| Field |
Required entry |
| Document ID |
KAI-VORAL-REPO-001 |
| Template used |
TPL-05-01 Repository Setup v0.3 |
| Product / project / software version or commit SHA |
VORAL (Visionary Oral) / PRJ-001 / a6b4429e3165 (branch app_dev of AI-Dental-Project/Visionary_Oral) |
| Record status and version |
Draft v0.1 |
| Author / technical reviewer / quality reviewer |
Claude Code (drafted with Claude Code for KrinosAI) / Tech Lead (name to be assigned) / Security & Privacy Officer (name to be assigned) |
| Created / updated / approved dates |
2026-10-27 / 2026-10-27 / Pending |
| Applicable SOP and revision |
SOP-LC-05 v0.3 |
| Related issue, commit, requirement and evidence links |
KAI-VORAL-DEC-001 (DEC-001, DEC-009) |
| Approver and decision record |
Pending |
Applicability and evidence baseline
Product / system boundary: Web app and API (dentalapp/), doctor/admin mobile app (mobile/), PDF Lambda (dentalapp/pdf-lambda/) at a6b4429e3165, and the external services they call.
Related approved requirements, risks and change records: None approved. Related drafts are listed in document control.
Retrospective record? Yes — follows the Retrospective Documentation Protocol (KrinosAI lifecycle pack, 05-References/). Items are labelled Observed (code or Git at a6b4429), Measured (dated run), Stated (named person, dated) or Not recorded. Observed from the repository, Git and build configuration at a6b4429; GitHub settings (branch protection, access lists) are not visible in the repository and are Not recorded unless stated.
Acceptable evidence: an implementation reference (file:line at a commit SHA), a dated test record, a signed decision, a vendor agreement, or another independently verifiable artifact. Never invent approvals, clinical results, measurements or performance data.
1. Repositories default branches and ownership
| Repository |
Default branch |
Owner |
Visibility |
AI-Dental-Project/Visionary_Oral |
Not recorded; active branches app_dev (a6b4429), non-compliance, app |
Proposed (Claude Code, for confirmation): AI-Dental-Project organisation admins |
Private |
AI-Dental-Project/Visionary_oral_ML |
Not recorded |
ML Lead |
Private |
suhanijn02/Visionary_Oral_docs |
main |
suhanijn02 |
Private (verified 2026-10-27) |
2. Branch protection and CODEOWNERS
| Rule |
Setting |
| Branch protection |
Not recorded — OPEN-038 |
| CODEOWNERS |
None in repository — OPEN-038 |
| Required reviews |
Not recorded — OPEN-038 |
3. Directory and doc locations
| Path |
Content |
dentalapp/ |
Web app, API routes, PDF Lambda |
mobile/ |
Expo app, on-device ML, report renderer |
mobile/docs/ml-repo/ |
ML planning pack and ADRs |
docs/ |
PRD and notes |
.github/workflows/ |
Keep-awake job only |
4. Commit PR merge and review rules
| Rule |
Setting |
| Commit messages |
Free text; no convention recorded |
| Pull requests |
Recent changes pushed directly (e.g. a6b4429, bbeeabc) — OPEN-038 |
| Merge strategy |
Not recorded |
5. Secrets dependency and license protections
| Control |
Status |
| Secret scanning |
Not recorded; two credential files committed — OPEN-007 |
| Dependency alerts |
Not recorded; npm audit finds critical issues — OPEN-037 |
| Licence checks |
None — see KAI-VORAL-SBOM-001 |
6. Audit logs access recertification
| Item |
Entry |
| Audit log review |
Not recorded |
| Access recertification |
Not recorded — OPEN-041 |
7. Recovery and repository archival
| Item |
Entry |
| Recovery |
GitHub-hosted; no mirror recorded |
| Archival |
Not applicable (active) |
Open issues and decisions
| ID |
Specific gap or decision |
Responsible owner |
Due date |
Blocks gate? |
Evidence required |
Status |
| OPEN-001 |
Tracker project ID, named requester and sponsor, and named reviewers are not recorded |
Product Owner |
2026-11-10 (proposed) |
Yes |
Tracker entry; names with roles |
Open |
| OPEN-007 |
Credential files committed to Git: dentalapp/google-credentials.json, dentalapp/mongoDb_usernamePassword (contents not opened) |
Security & Privacy Officer |
2026-10-31 (proposed) |
Yes |
Credentials rotated; files removed and purged from history; confirmation |
Open |
| OPEN-037 |
Known vulnerable dependencies (npm audit 2026-10-27 16:50 UTC): web 4 critical (incl. next, @clerk/nextjs), 23 high; mobile 1 critical, 4 high (incl. expo) — fixes available for all |
Tech Lead |
2026-11-15 (proposed) |
Yes |
Upgraded lock files; clean re-run of npm audit |
Open |
| OPEN-038 |
No branch protection, required reviews or CODEOWNERS recorded; changes are pushed directly to shared branches (app_dev, non-compliance) |
Tech Lead |
2026-11-15 (proposed) |
Yes |
Branch protection settings; PR template; CODEOWNERS |
Open |
| OPEN-041 |
No secrets vault, rotation schedule or access recertification; secrets live in host environment variables (and two were committed — OPEN-007) |
Security & Privacy Officer |
2026-11-30 (proposed) |
Yes |
Vault or managed secrets with rotation dates |
Open |
Review and approval
| Review role |
Named individual |
Decision |
Date |
Signed / controlled record |
| Author |
Claude Code (drafted with Claude Code) |
Draft |
2026-10-27 |
This file at the commit that adds it |
| Technical reviewer |
Tech Lead (name to be assigned) |
Pending |
Pending |
Pending |
| Quality / regulatory reviewer (if applicable) |
Qualified regulatory reviewer (name to be assigned) |
Pending |
Pending |
Pending |
| Authorized approver |
Tech Lead (name to be assigned) |
Pending |
Pending |
Pending |