KAI-VORAL-CHC-001 — Change Control Record
Template ID: TPL-09-08 | Stage: 09-Operate-and-Maintain | Version: 0.3
Status: Project record created from the controlled template.
Purpose: Assess, approve, implement and verify a change to a product in operation, including model and configuration changes.
Required inputs: Change trigger (incident, CAPA, request); affected records.
Document control
| Field |
Required entry |
| Document ID |
KAI-VORAL-CHC-001 |
| Template used |
TPL-09-08 Change Control Record v0.3 |
| Product / project / software version or commit SHA |
VORAL (Visionary Oral) / PRJ-001 / a6b4429e3165 (branch app_dev of AI-Dental-Project/Visionary_Oral) |
| Record status and version |
Draft v0.1 |
| Author / technical reviewer / quality reviewer |
Claude Code (drafted with Claude Code for KrinosAI) / Tech Lead (name to be assigned) / Security & Privacy Officer (name to be assigned) |
| Created / updated / approved dates |
2026-10-28 / 2026-10-28 / Pending |
| Applicable SOP and revision |
SOP-LC-09 v0.3 |
| Related issue, commit, requirement and evidence links |
BUG-001; BUG-003; WP-02; docs/lifecycle/_evidence/api-inventory-a6b4429.md |
| Approver and decision record |
Pending |
Applicability and evidence baseline
Product / system boundary: Web app and API (dentalapp/), doctor/admin mobile app (mobile/), on-device models (mobile/assets/models/), PDF Lambda (dentalapp/pdf-lambda/) at a6b4429e3165, and the external services they call.
Related approved requirements, risks and change records: None approved. Related drafts are listed in document control.
Retrospective record? Yes — follows the Retrospective Documentation Protocol (KrinosAI lifecycle pack, 05-References/). Items are labelled Observed (code or Git at a6b4429), Measured (dated run), Stated (named person, dated) or Not recorded. No operations records (monitoring, incidents, complaints, backups) existed before this documentation. Operations found in the code are labelled Observed; everything else is a proposal for its owner. This is the first planned controlled change; it is not implemented.
Acceptable evidence: an implementation reference (file:line at a commit SHA), a dated test record, a signed decision, a vendor agreement, or another independently verifiable artifact. Never invent approvals, clinical results, measurements or performance data.
1. Change trigger scope and reason
| Change ID |
Trigger |
Scope |
| CHC-001 |
BUG-001, BUG-003 (OPEN-026, OPEN-033) |
Add authentication to the 20 routes without an auth check, or confirm and limit those that must stay public |
2. Risk security privacy and regulatory impact
| Area |
Impact |
| Security |
Removes access to patient and doctor data without sign-in |
| Mobile app |
Uses API-075 and API-089 (APC), which already check auth — no change |
| Web admin login |
Uses API-002 (APC) — must keep working until moved to Clerk |
| Regulatory |
None |
3. Affected requirements design tests and labels
| Record |
Update |
KAI-VORAL-APC-001 |
Auth column for each route |
KAI-VORAL-THM-001 |
Close the related threats |
KAI-VORAL-TC-001 |
Run TC-115 |
KAI-VORAL-RTM-001 |
REQ-034 result |
4. Approvals and validation plan
| Item |
Entry |
| Approvals |
Tech Lead and Security & Privacy Officer, Pending |
| Validation |
TC-115 passes; TC-001 to TC-014 still pass |
5. Implementation rollback and audit trail
| Item |
Link |
| Implementation |
Pull request (not yet opened) |
| Rollback |
KAI-VORAL-RBP-001 |
| Audit trail |
Git history and this record |
6. Effectiveness followup
| Check |
Result |
| Route inventory re-run shows no route without an auth check (except approved public routes) |
Not run |
Open issues and decisions
| ID |
Specific gap or decision |
Responsible owner |
Due date |
Blocks gate? |
Evidence required |
Status |
| OPEN-001 |
Tracker project ID, named requester and sponsor, and named reviewers are not recorded |
Product Owner |
2026-11-10 (proposed) |
Yes |
Tracker entry; names with roles |
Open |
| OPEN-017 |
Admin session signing uses a hard-coded fallback secret when JWT_SECRET is unset (dentalapp/src/lib/admin/session.js:4) |
Backend Lead |
2026-11-10 (proposed) |
Yes |
Code fix; secret confirmed set |
Open |
| OPEN-026 |
Critical: 20 API routes have no authentication check, incl. /api/admin/patient-sample (patient emails) and /api/admin/api-usage (doctor names and emails), support tickets/messages, and paid AI routes (/api/detect-gemini, /api/speech-to-text, /api/validate-scan) — see docs/lifecycle/_evidence/api-inventory-a6b4429.md |
Backend Lead |
2026-10-31 (proposed) |
Yes |
Auth added to each route; re-run of the inventory shows none unprotected |
Open |
| OPEN-033 |
Critical: deprecated POST /api/admin/signup is public and creates admin profiles with a password for anyone (dentalapp/src/app/api/admin/signup/route.js:14-60); POST /api/admin/auth issues admin sessions signed with a fallback secret (OPEN-017). Full privilege path not verified |
Backend Lead |
2026-10-31 (proposed) |
Yes |
Routes removed or locked down; check that no password-based admin can sign in |
Open |
Review and approval
| Review role |
Named individual |
Decision |
Date |
Signed / controlled record |
| Author |
Claude Code (drafted with Claude Code) |
Draft |
2026-10-28 |
This file at the commit that adds it |
| Technical reviewer |
Tech Lead (name to be assigned) |
Pending |
Pending |
Pending |
| Quality / regulatory reviewer (if applicable) |
Qualified regulatory reviewer (name to be assigned) |
Pending |
Pending |
Pending |
| Authorized approver |
Tech Lead (name to be assigned) |
Pending |
Pending |
Pending |