KAI-VORAL-OPH-001 — Operational Handover
Template ID: TPL-09-01 | Stage: 09-Operate-and-Maintain | Version: 0.3
Status: Project record created from the controlled template.
Purpose: Transfer a newly released or changed service from the delivery team to operations with everything needed to run it.
Required inputs: Deployment record; runbook; monitoring config; known issues.
Document control
| Field |
Required entry |
| Document ID |
KAI-VORAL-OPH-001 |
| Template used |
TPL-09-01 Operational Handover v0.3 |
| Product / project / software version or commit SHA |
VORAL (Visionary Oral) / PRJ-001 / a6b4429e3165 (branch app_dev of AI-Dental-Project/Visionary_Oral) |
| Record status and version |
Draft v0.1 |
| Author / technical reviewer / quality reviewer |
Claude Code (drafted with Claude Code for KrinosAI) / Tech Lead (name to be assigned) / Security & Privacy Officer (name to be assigned) |
| Created / updated / approved dates |
2026-10-28 / 2026-10-28 / Pending |
| Applicable SOP and revision |
SOP-LC-09 v0.3 |
| Related issue, commit, requirement and evidence links |
KAI-VORAL-RUN-001; KAI-VORAL-MON-001; KAI-VORAL-ACC-001 |
| Approver and decision record |
Pending |
Applicability and evidence baseline
Product / system boundary: Web app and API (dentalapp/), doctor/admin mobile app (mobile/), on-device models (mobile/assets/models/), PDF Lambda (dentalapp/pdf-lambda/) at a6b4429e3165, and the external services they call.
Related approved requirements, risks and change records: None approved. Related drafts are listed in document control.
Retrospective record? Yes — follows the Retrospective Documentation Protocol (KrinosAI lifecycle pack, 05-References/). Items are labelled Observed (code or Git at a6b4429), Measured (dated run), Stated (named person, dated) or Not recorded. No operations records (monitoring, incidents, complaints, backups) existed before this documentation. Operations found in the code are labelled Observed; everything else is a proposal for its owner.
Acceptable evidence: an implementation reference (file:line at a commit SHA), a dated test record, a signed decision, a vendor agreement, or another independently verifiable artifact. Never invent approvals, clinical results, measurements or performance data.
1. Service scope and versions
| Service |
Version |
Environment |
| Web app and API |
a6b4429 (deployed version not recorded — OPEN-022) |
Production |
| Android app |
1.0.0 |
Doctors' phones |
| PDF Lambda |
Not recorded |
AWS |
| ML service |
External repository |
Hugging Face Space |
| Database |
MongoDB |
Host not recorded — OPEN-016 |
2. Operational documentation delivered
| Item |
Link |
| Runbook |
KAI-VORAL-RUN-001 (draft) |
| Monitoring |
KAI-VORAL-MON-001 (draft) |
| README |
KAI-VORAL-RDM-001 |
| API documentation |
KAI-VORAL-APID-001 |
| Access and secrets |
KAI-VORAL-ACC-001 |
3. Known issues and open risks
| Item |
New owner |
| BUG-001 to BUG-003 (unprotected routes, fallback secret, public admin sign-up) |
Backend Lead |
| Credentials and backups in Git (OPEN-007, OPEN-008) |
Security & Privacy Officer |
| Vulnerable dependencies (OPEN-037) |
Tech Lead |
4. Access, on-call and escalation
| Item |
Entry |
| Access |
Per KAI-VORAL-ACC-001 |
| On-call |
None — OPEN-019 |
| Escalation |
Developer → Tech Lead → Security & Privacy Officer for any data incident |
5. Acceptance decision
| Decision |
By |
Date |
Conditions |
| Pending |
Operations owner (name to be assigned) |
Pending |
Monitoring (OPEN-043) and on-call (OPEN-019) in place first |
Open issues and decisions
| ID |
Specific gap or decision |
Responsible owner |
Due date |
Blocks gate? |
Evidence required |
Status |
| OPEN-001 |
Tracker project ID, named requester and sponsor, and named reviewers are not recorded |
Product Owner |
2026-11-10 (proposed) |
Yes |
Tracker entry; names with roles |
Open |
| OPEN-007 |
Credential files committed to Git: dentalapp/google-credentials.json, dentalapp/mongoDb_usernamePassword (contents not opened) |
Security & Privacy Officer |
2026-10-31 (proposed) |
Yes |
Credentials rotated; files removed and purged from history; confirmation |
Open |
| OPEN-008 |
Database backups with personal data committed to Git: 9 files under dentalapp/backups/ (commit 92a4b77; contents not opened) |
Security & Privacy Officer |
2026-10-31 (proposed) |
Yes |
Files purged from history; breach/incident assessment recorded |
Open |
| OPEN-016 |
Data regions and transfers |
Security & Privacy Officer |
2026-11-30 (proposed) |
Yes |
Transfer assessment |
Open |
| OPEN-019 |
No named support team, support lead or on-call rota; capacity not confirmed |
Tech Lead |
2026-11-30 (proposed) |
No |
Support model accepted by a named team |
Open |
| OPEN-022 |
Production hosting (Vercel vs Render), deployed version and dated integration checks for Clerk, MongoDB, R2, AWS, OpenRouter, Groq, Cashfree and Resend not recorded |
Tech Lead |
2026-11-30 (proposed) |
No |
Environment record (stage 05) with dated checks |
Open |
| OPEN-037 |
Known vulnerable dependencies (npm audit 2026-10-27 16:50 UTC): web 4 critical (incl. next, @clerk/nextjs), 23 high; mobile 1 critical, 4 high (incl. expo) — fixes available for all |
Tech Lead |
2026-11-15 (proposed) |
Yes |
Upgraded lock files; clean re-run of npm audit |
Open |
| OPEN-043 |
No structured logging, metrics, uptime monitoring or alerting; logs are console.* only |
Tech Lead |
2026-11-30 (proposed) |
Yes |
Monitoring and alerting in place with an on-call contact |
Open |
Review and approval
| Review role |
Named individual |
Decision |
Date |
Signed / controlled record |
| Author |
Claude Code (drafted with Claude Code) |
Draft |
2026-10-28 |
This file at the commit that adds it |
| Technical reviewer |
Tech Lead (name to be assigned) |
Pending |
Pending |
Pending |
| Quality / regulatory reviewer (if applicable) |
Qualified regulatory reviewer (name to be assigned) |
Pending |
Pending |
Pending |
| Authorized approver |
Tech Lead (name to be assigned) |
Pending |
Pending |
Pending |