# Verixa — User Requirements Specification

# Module 28: Training Management and Qualification

| Field | Value |
|---|---|
| Document ID | VRX-URS-28 |
| Version | 1.0 |
| Status | Final — ready for QA, Validation, Regulatory Affairs, Information Security, Manufacturing Head, Site Quality Lead, Qualified Person Authority, Human Resources Authority, and Founder approval. URS approval is separate from validation execution. This document becomes "Approved Controlled URS — released for engineering implementation and validation planning" only after signature capture in the Document Approval block. It becomes "Released for validation execution" only after the module migration evidence gate (URS-28-VAL-008) and validation evidence pack are satisfied. |
| Document Type | User Requirements Specification (URS) |
| GAMP 5 Category | Category 5 — Custom Application |
| Code Modules | Target implementation binding: expected primary code module `training`, expected API mounts `/api/v1/training/*` (canonical), expected supporting modules `studies`, `context-filter`, `rbac`, `audit-log`, `authority`, `electronic_signatures`, `hitl`, `documents` (URS-12 — primary linkage for SOP-driven training), expected event-bus emission for `training_curriculum_created`, `training_curriculum_released_effective`, `training_curriculum_superseded`, `training_question_bank_created`, `training_question_bank_released`, `training_assignment_created`, `training_assignment_completed`, `training_assignment_waived`, `training_assignment_exempted`, `training_record_created`, `training_record_completed`, `training_record_verified`, `training_assessment_submitted`, `training_assessment_graded`, `training_matrix_refreshed`, `training_gap_opened`, `training_gap_remediated`, `training_gap_closed`, `training_trigger_created`, `training_trigger_executed`, `training_program_locked`, `training_program_reopened`, expected MIRA context integration through `useMiraRecord('training_curriculum', id)`, `useMiraRecord('training_record', id)`, and `useMiraRecord('training_gap', id)` mappings, expected URS-12 Document Control SOP-revision trigger consumer (primary trigger source — SOP revision auto-assigns retraining), expected URS-13 Change Control trigger consumer (change-event-driven training auto-assignment), expected URS-18 CAPA trigger consumer (CAPA-event-driven training auto-assignment + CAPA linkage), expected URS-21 Findings emission for overdue training gaps + verification gate findings, expected URS-22 Inspection Mgmt evidence retrieval source, expected URS-26 APQR consumer for periodic training summary, expected URS-23 batch-record consumer for batch-executor training-status verification (qualification gate per DEC-28-04), expected URS-24 stability consumer for stability-analyst training-status, expected URS-25 EM consumer for EM-analyst training-status, expected Authority Profile + HITL + e-signature integration for non-bypassable record completion + verification + waiver / exemption + program lock + reopen, expected platform_admin / super_admin support / break-glass only paths. Implementation evidence remains subject to repository verification and validation evidence. |
| Architecture Bindings | This module is subject to **ARCH-AI-001 AI Optionality and Manual Continuity**. Verixa internally classifies this AI surface as **limited-risk under internal AI governance**, aligned with the limited-risk transparency approach in **EU AI Act (Regulation 2024/1689) Article 13**, escalating to **internal forward-looking AI governance aligned with EU AI Act Annex III concepts** where AI output supports training-qualification disposition (e.g., AI-generated assessment grading on qualification-critical exams, AI-generated waiver / exemption recommendations). AI-assisted training surfaces (AI assessment-question generation, AI assessment grading suggestion on essay questions, AI training-gap prioritization, AI curriculum recommendation, MIRA training copilot) are advisory only under internal AI governance aligned with EU AI Act Article 13 transparency principles. Every AI surface shall provide a fully functional manual curriculum, assignment, recording, completion, verification, and qualification path; curriculum authoring, assignment, training execution, record completion, signature capture, verification, waiver / exemption, and qualification disposition shall be executable when AI services are disabled, degraded, or overridden by the training program owner. **AI-generated content (questions, grading, gap prioritization, waiver recommendations) shall be visibly labeled as advisory; no AI service shall be the sole path to grade a qualification-critical assessment, sign a verification step, approve a waiver / exemption, or finalize qualification disposition.** This module binds ARCH-AI-001 AC-1, AC-2, AC-3, AC-4, and AC-7. Verixa treats **EU GMP Annex 22 Draft 2025 §7** as an internal forward-looking architectural control (not an enacted predicate rule); under that internal control, generative AI may draft assessment questions, grading suggestions, and gap-prioritization advisory only with mandatory human acceptance recorded per DEC-28-13; generative / probabilistic AI is **PROHIBITED from being the sole path to grade qualification-critical assessments, sign verification, approve waivers / exemptions, or finalize qualification disposition**. Static deterministic AI may surface predicate-rule citations from the URS-12 document registry, similar prior assessments, and historical training-gap patterns as advisory help. Jurisdiction-specific legal enforceability of Annex 22 and the EU AI Act remains subject to a future jurisdiction-specific legal assessment. |
| Regulatory Classification | Critical infrastructure substrate — operates the canonical Training Management and Qualification system covering: (a) the training-curriculum registry with **controlled lifecycle (`draft → under_review → effective → superseded → archived` with immutable historical versions per DEC-28-03,)** + version-increment-on-update + URS-13 change-request linkage on effective release; (b) the training-question-bank registry (replaces inferred-only question authoring) with **controlled lifecycle and version immutability after `effective` release** per DEC-28-06; (c) the training-assignment registry with **controlled assignment-state transitions + qualification-gating logic** per DEC-28-04; (d) the training-record registry with **server-attributed signature evidence (IP / user-agent / timestamp derived from request context, never client-supplied) per DEC-28-05**; (e) the training-record verification lifecycle (`completed → verified` with **non-bypassable verifier authority + HITL + bound e-signature** per DEC-28-05 — wires the dormant `verified` status in `TrainingRecordStatus` to a controlled flow); (f) the training-assessment lifecycle with **assessment-version provenance + question-version snapshot at submission time + reproducible scoring** per DEC-28-06; (g) the training-matrix registry with **governed matrix-generation writer + immutable snapshots + scheduled / on-demand refresh** per DEC-28-07; (h) the training-gap registry with **non-passive remediation workflow** (`open → assigned → in_progress → remediated → closed`) + assignment + due-date + closure evidence per DEC-28-08; (i) the training-trigger registry with **active execution engine** (SOP-revision triggers from URS-12, change-control triggers from URS-13, CAPA triggers from URS-18, periodic triggers, new-hire triggers) + auto-assignment processor + reconciliation log per DEC-28-09; (j) the multi-dimensional context capture (`tenant_id` mandatory, `study_id` mandatory matching service behavior —, `site_id` removed from schemas because not persisted, `role_id` for role-based training, `user_id` for assignee); (k) the canonical API contract `/api/v1/training/*`; (l) the typed schema validation across every route with shared-schema/service-behavior alignment; (m) the controlled frontend route surface with explicit page coverage for `/training/:id/assignments/:assignmentId`; (n) the audit-trail coverage with reason-for-change discipline on every mutable record + answer-level evidence + verification events per DEC-28-11; (o) the Authority/HITL/e-signature substrate on every regulated final action per DEC-28-10; (p) the post-locked record immutability across the program lock; (q) the controlled reopen workflow with executive authority co-sign and Qualified Person co-sign per DEC-28-22; (r) the canonical findings-source emission to URS-21 for overdue training gaps + verification gate findings per DEC-28-15; (s) the canonical CAPA-source emission to URS-18 with `training_gap` source type for chronic gaps per DEC-28-16; (t) the **qualification-gate API for downstream modules** — URS-23 batch-record execution / URS-24 stability analyst / URS-25 EM analyst consume `GET /training/qualification/:userId/:roleId` to verify training-status before regulated execution per DEC-28-04 / DEC-28-23; (u) the URS-26 APQR consumer for periodic training summary; (v) the AI-assisted assessment-grading + question-generation + gap-prioritization substrate with **provenance + mandatory human acceptance** per DEC-28-13 (target requirement, ARCH-AI-001 binding); (w) the MIRA copilot read-only context integration on training records; and the per-jurisdictional regulatory expectations under FDA 21 CFR Part 11, **FDA 21 CFR Part 211 §211.25** (Personnel Qualifications — primary FDA predicate), 21 CFR Part 211 §211.180, FDA Quality System Regulation 21 CFR Part 820.25 (medical devices), EU GMP Annex 11, **EU GMP Chapter 2 §2.10–§2.18** (Personnel Training and Qualification — primary EU predicate), EU GMP Annex 22 Draft 2025 §7 (internal forward-looking control), EU AI Act (Regulation 2024/1689) Art. 13 / Annex III (internal forward-looking control), MHRA Data Integrity Guidance (ALCOA+), GAMP 5 Cat 5, ICH Q10 §3.2.3 (Training Management — primary ICH predicate), ICH Q9 (Quality Risk Management), ICH E6(R3) §2.8 (GCP Sponsor Training), ISO 13485:2016 §6.2 (Medical Device Personnel Competence), 21 CFR Part 58 (GLP Personnel — where applicable), and India CDSCO Schedule M (Revised) §5 (Personnel — primary India predicate) and Schedule M-III §3.1 (Medical Device Personnel) subject to a future jurisdiction-specific legal assessment for Verixa's exact CDSCO obligations. |
| Date of Issue | 2026-05-07 |
| Module Owner (Engineering) | Quality / Training Management Squad |
| Module Owner (Quality Validation) | CSV / CSA Lead — Training Management |
| Module Owner (Compliance) | Quality Assurance, Manufacturing, Human Resources Authority, Regulatory Affairs, Qualified Person Authority |
| Approving Authority | Founder / Chairman & MD; QA Head; Manufacturing Head; Validation Head; RA Head; Information Security Head; Qualified Person (QP) Authority; Human Resources Authority; Site Quality Lead |

---

## 0. Document Framing

### 0.1 Purpose of this document

This URS defines the target expected state for Verixa's Training Management and Qualification module (Module 28). It is the binding contract between product, engineering, quality validation, regulatory affairs, manufacturing, the Qualified Person authority, human resources authority, distribution, laboratory operations, information security, and the executive authority for the design, implementation, validation, release, and on-going periodic review of the regulated training-management substrate: the canonical training-curriculum registry with controlled lifecycle and version governance per DEC-28-03; the training-question-bank registry per DEC-28-06; the training-assignment registry per DEC-28-04; the training-record registry with server-attributed signature evidence per DEC-28-05; the training-record verification lifecycle wiring the dormant `verified` status to a controlled flow; the training-assessment lifecycle with assessment-version provenance + question-version snapshot per DEC-28-06; the training-matrix registry with governed matrix-generation writer per DEC-28-07; the training-gap registry with non-passive remediation workflow per DEC-28-08; the training-trigger registry with active execution engine + auto-assignment processor per DEC-28-09; the multi-dimensional context capture (`tenant_id`, `study_id` mandatory, `role_id`, `user_id`); the canonical API contract `/api/v1/training/*`; the typed schema validation across every route with study-scope alignment per DEC-28-02; the controlled frontend route surface with explicit page coverage for `/training/:id/assignments/:assignmentId`; the audit-trail coverage with reason-for-change discipline including answer-level evidence + verification events per DEC-28-11; the Authority/HITL/e-signature substrate on every regulated final action per DEC-28-10; the post-locked record immutability; the controlled reopen workflow with executive authority co-sign and Qualified Person co-sign per DEC-28-22; the canonical findings emission to URS-21 per DEC-28-15; the canonical CAPA emission to URS-18 (`training_gap` source type) per DEC-28-16; the **qualification-gate API for downstream modules** per DEC-28-04 / DEC-28-23; the URS-12 Document Control SOP-revision trigger consumer (primary trigger source); the URS-13 Change Control trigger consumer; the URS-18 CAPA trigger consumer; the URS-26 APQR consumer; the URS-23/-24/-25 qualification-gate consumer; the AI-assisted assessment / grading / gap-prioritization substrate with provenance and mandatory human acceptance per DEC-28-13; the MIRA copilot read-only context integration with **AI advisory only — never the sole path to grade a qualification-critical assessment, sign verification, approve a waiver / exemption, or finalize qualification disposition** under the internal Annex 22 §7 + EU AI Act Annex III controls; the audit trail coverage with reason-for-change discipline; and the per-jurisdictional regulatory expectations. Compliance with this URS is mandatory.

### 0.2 Audience

Engineering, QA, RA, Manufacturing, Qualified Person Authority, Human Resources Authority, Distribution, Laboratory Operations, Validation, Information Security, executive authority, the platform's Implementation team, internal and external auditors, and inspectors from regulatory bodies (FDA, EMA, MHRA, Health Canada, CDSCO, PIC/S, PMDA, WHO). The plain-language primer (§0.4) and worked examples (§3.5) make Module 28 accessible to non-domain engineers, product owners, validation engineers, and quality investigators.

### 0.3 Cross-references

- **URS-01** Authentication, Session & Access Control — identity envelope for every training mutation
- **URS-02** RBAC & Permissions — the `training:*`, `training:curriculum:*`, `training:question_bank:*`, `training:assignment:*`, `training:record:*`, `training:record:verify:*`, `training:assessment:*`, `training:matrix:*`, `training:gap:*`, `training:trigger:*`, `training:waiver:*`, `training:exemption:*`, `training:qualification_gate:*` permission set
- **URS-03** Context Gate & Approval Scope — context-gate enforcement for training scope dimensions
- **URS-04** Workflow / HITL / E-Signature / Approval Authority — Controlled Approval Modal contract for record completion / verification / waiver / exemption / curriculum release / question-bank release / program lock / reopen
- **URS-05** Authority Profile / Delegation / SoD — Authority Profiles consumed (`training_curriculum_authority`, `training_question_bank_authority`, `training_record_completion_authority`, `training_record_verifier_authority`, `training_waiver_authority`, `training_exemption_authority`, `training_assessment_grader_authority`, `qualified_person_authority`, `final_quality_approver`, `executive_authority`, `human_resources_authority`)
- **URS-06** Audit Trail / Hash Chain / Tamper-Evident — append-only audit substrate
- **URS-07** Study Management — mandatory study-scope dimension consumed
- **URS-08** Tenant Management Lifecycle — tenant context for training records
- **URS-09** Site / Facility Management — site-scope inherited via `studies` parent (where study-bound)
- **URS-10** Product / SKU / Drug Master Data — optional product-scope dimension
- **URS-12** Document Control / SOP — **primary linkage**: SOP-driven training; SOP-revision triggers via URS-12 emit `training_trigger_executed` events for auto-assignment per DEC-28-09
- **URS-13** Change Control — change-event-driven training auto-assignment per DEC-28-09; curriculum effective-release linkage
- **URS-14** Complaints — read-only complaint context for training-trend findings
- **URS-15** OOS / OOT — OOS-precipitated retraining triggers
- **URS-16** Deviations — deviation-precipitated retraining triggers
- **URS-17** RCA — RCA-precipitated retraining triggers
- **URS-18** CAPA — primary downstream consumer for training-gap CAPA via `training_gap` source type per DEC-28-16; CAPA-event-driven training auto-assignment per DEC-28-09
- **URS-19** Risk Assessment — risk-precipitated retraining triggers
- **URS-20** Reviews — periodic training program review consumer
- **URS-21** Findings — primary downstream consumer for training findings (overdue gaps, verification gate findings) per DEC-28-15
- **URS-22** Inspection Mgmt — training-evidence retrieval source for inspection back-room (URS-22)
- **URS-23** Batch Records — **primary qualification-gate consumer**: batch executor training status verified before batch execution per DEC-28-04 / DEC-28-23
- **URS-24** Stability — stability analyst qualification gate
- **URS-25** Environmental Monitoring — EM analyst qualification gate (gowning, aseptic technique training)
- **URS-26** APQR — periodic training summary consumer
- **URS-27** Regulatory Intelligence — predicate-rule citation source for FDA §211.25 / EU GMP Chapter 2 / ICH Q10 §3.2.3
- **URS-30** Notifications — primary consumer of `training_assignment_due_soon` / `training_gap_overdue` events
- **URS-31** DQG — data-quality gate evidence
- **URS-32** MIRA AI — read-only MIRA copilot context integration; AI advisory drafting only with mandatory human acceptance per DEC-28-13
- **URS-33** GMP Manufacturing — GMP training scope
- **URS-34** GDP Distribution — GDP training scope
- **URS-35** Infrastructure / Backup-Restore — operational continuity

### 0.4 Plain-language primer

In a regulated pharmaceutical operation, **training management and qualification** is the formal system that ensures every person performing GxP work is qualified for the work they perform: trained on the applicable Standard Operating Procedures (SOPs), assessed for competency, retrained on SOP revisions, and re-qualified on a periodic basis. Training is a standalone regulatory obligation under: **FDA 21 CFR Part 211 §211.25** ("Each person engaged in the manufacture, processing, packing, or holding of a drug product shall have education, training, and experience, or any combination thereof, to enable that person to perform the assigned functions" — primary FDA predicate); **EU GMP Chapter 2 §2.10–§2.18** (Personnel Training and Qualification — primary EU predicate); **ICH Q10 §3.2.3** (Training Management — primary ICH predicate); **ISO 13485:2016 §6.2** (Medical Device Personnel Competence); **ICH E6(R3) §2.8** (GCP Sponsor Training); **21 CFR Part 820.25** (Medical Device QSR Personnel); and **India CDSCO Schedule M (Revised) §5** (Personnel — primary India predicate). The training program covers: (1) curriculum authoring with controlled lifecycle, (2) question-bank authoring for assessments, (3) assignment of training to users by role / SOP / change event / new-hire / periodic, (4) training-record creation when training is delivered, (5) record completion with attributable signature, (6) **verification** of completion by a qualified verifier (the `verified` status — distinct from `completed`), (7) assessment submission and grading, (8) training-matrix view of who is qualified for what, (9) gap analysis with controlled remediation workflow, (10) trigger execution for SOP revisions / change events / CAPA events / periodic re-qualification / new-hire onboarding. Module 28 is the target specification for this regulated workflow.

The most common mistake in regulated training handling is **client-supplied signature metadata being accepted as authoritative qualification evidence**. The regulator's tell-tale at inspection is a training record with `signature_ip_address` or `signature_user_agent` taken directly from the request body. Module 28 enforces the pathway: signature evidence (IP / user-agent / timestamp) is **server-attributed** from the request context per DEC-28-05; client-supplied signature evidence is rejected. The second most common mistake is **completed training records counted as qualification without a separate verifier step**. Module 28 enforces the pathway: the `verified` status in `TrainingRecordStatus` is wired to a controlled verification flow with `training_record_verifier_authority` + HITL + bound e-signature per DEC-28-05; the verifier MUST be SoD-distinct from the trainee per SoD-28-02. The third most common mistake is **training trigger definitions without execution engines** — SOP revisions in URS-12 don't auto-assign retraining; change events in URS-13 don't auto-assign retraining; CAPA events in URS-18 don't auto-assign retraining. Module 28 enforces the pathway: an active execution engine processes triggers from URS-12, URS-13, URS-18 (and periodic / new-hire) into auto-assignments per DEC-28-09 with reconciliation log for failed processing.

The fourth most common mistake is **batch execution / stability / EM activities performed by personnel without verified qualification**. Module 28 exposes a **qualification-gate API** (`GET /training/qualification/:userId/:roleId`) per DEC-28-04 / DEC-28-23 consumed by URS-23 batch-record execution, URS-24 stability analyst routes, URS-25 EM analyst routes — making qualification a hard gate on regulated execution.

The **AI-assistance** dimension is critical. Static deterministic AI may surface "predicate-rule citations from URS-12 document registry", "similar prior assessments by curriculum / role", or "historical training-gap patterns by role / curriculum" as advisory help. **Generative AI (LLMs / MIRA copilot) is PROHIBITED from being the sole path to grade qualification-critical assessments, sign verification, approve waivers / exemptions, or finalize qualification disposition** under the internal Annex 22 §7 + EU AI Act Annex III controls. MIRA copilot may draft advisory assessment-question candidates, grading suggestions on essay questions, and gap-prioritization recommendations via the controlled `training_ai_assistance` substructure with full provenance + mandatory human acceptance per DEC-28-13. The qualified human training program owner / verifier's signed disposition is the system of record.

The **two-step release path** mirrors every other Module: this URS becomes "Approved Controlled URS — released for engineering implementation and validation planning" upon signature capture in the Document Approval block; it becomes "Released for validation execution" only after URS-28-VAL-008 (Migration Evidence Gate) and the §17 validation evidence pack are satisfied.

### 0.5 Conventions

Each requirement has a unique identifier. "MUST" denotes a mandatory requirement; "SHOULD" denotes a strong recommendation; "MAY" denotes an option. The document is self-contained: front end (§5), back end (§6), data model (§6.2), application programming interface (§6.3), workflow (§6.4), business rules (§6.5), audit (§6.6), security (§12), regulatory mapping (§14), test cases (§16), and validation evidence (§17) are all in this single file. Every requirement is mandatory unless explicitly marked SHOULD or MAY.

### 0.6 Glossary

| Term | Definition |
|---|---|
| Curriculum | A controlled-template document defining a training program for a role / SOP / function; lifecycle `draft → under_review → effective → superseded → archived` per DEC-28-03; immutable historical versions. |
| Question bank | A controlled-template document of assessment questions linked to a curriculum; lifecycle parallels curriculum per DEC-28-06. |
| Assessment | An execution of a question-bank version against a trainee; auto-scored against `correct_answer` for objective questions; manual graded for essay questions; submission captures `question_bank_version_snapshot`. |
| Training assignment | A row assigning a curriculum to a user; lifecycle `assigned → in_progress → completed → waived | exempted` per DEC-28-04. |
| Training record | The execution evidence for a single user × curriculum × assignment; lifecycle `created → in_progress → completed → verified` per DEC-28-05. |
| Verification | The post-completion verifier sign-off (SoD-distinct from trainee) with bound e-signature per DEC-28-05; the `verified` status is the qualification-evidence state. |
| Training matrix | An immutable governed snapshot of who-is-qualified-for-what; refreshed on demand or on schedule per DEC-28-07. |
| Training gap | A row representing an overdue training requirement (assigned but not completed by due date, or a role-required curriculum without an assignment); lifecycle `open → assigned → in_progress → remediated → closed` per DEC-28-08. |
| Trigger | A definition that emits training auto-assignments on events from URS-12 (SOP revision), URS-13 (change request), URS-18 (CAPA), periodic schedule, or new-hire event per DEC-28-09. |
| Waiver | An authority-gated decision to waive a training requirement for a specific user × curriculum pair; requires `training_waiver_authority` + HITL + bound e-signature + reason per DEC-28-04 / DEC-28-10. |
| Exemption | An authority-gated decision to exempt a user from a curriculum based on prior qualification (e.g., external certification); requires `training_exemption_authority` + HITL + bound e-signature + evidence per DEC-28-04 / DEC-28-10. |
| Qualification gate | The API consumed by URS-23 / URS-24 / URS-25 / URS-33 / URS-34 to verify a user is qualified for a regulated task per DEC-28-23. |
| Reopen | A governed transition event from `locked → in_progress` requiring `executive_authority` co-sign AND `qualified_person_authority` co-sign + documented reason; appends a new program iteration without mutating prior locked evidence per DEC-28-22. |
| ARCH-AI-001 | Platform architecture binding requiring manual continuity for every AI surface (AC-1, AC-2, AC-3, AC-4, AC-7). |
| Annex 22 | EU GMP Annex 22 (Draft 2025) §7. Verixa treats Annex 22 §7 + EU AI Act high-risk / transparency as internal forward-looking AI governance controls. AI may draft advisory assessment / grading / gap-prioritization with mandatory human acceptance; AI is prohibited from being the sole path to grade qualification-critical assessments, sign verification, approve waivers / exemptions, or finalize qualification disposition. Binding predicate-rule obligations remain those listed in §14. |
| MIRA | The platform's read-only AI copilot service; for Module 28 MIRA may propose advisory drafts via `training_ai_assistance`; no MIRA write paths to system-of-record training fields without explicit human confirmation; no AI signs verification or qualification disposition. |

### 0.7 Module-28 architectural picture

```mermaid
flowchart TD
 AUTH[Curriculum Author] --> CUR[/Curricula — controlled lifecycle/]
 AUTH --> QB[/Question Banks — controlled lifecycle/]
 TRG[/Triggers — execution engine/]
 TRG -. SOP revision.-> CUR
 TRG -. change event.-> CUR
 TRG -. CAPA event.-> CUR
 TRG -. periodic.-> CUR
 TRG -. new-hire.-> CUR
 CUR --> ASN[/Assignments — controlled lifecycle/]
 TRG --> ASN
 ASN --> REC[/Training Records — server-attributed signature/]
 REC --> VER[Verification — SoD-distinct verifier + bound e-sign — DEC-28-05]
 REC --> ASS[Assessments — version snapshot]
 ASS --> SCO[Auto-score + Manual grade — version-bound]
 REC -- qualification --> MTX[/Training Matrix — governed writer/]
 REC -- qualification --> QGATE[/Qualification Gate API/]
 M23[URS-23 Batch Records] -- consume --> QGATE
 M24[URS-24 Stability] -- consume --> QGATE
 M25[URS-25 EM] -- consume --> QGATE
 GAP[/Training Gaps — non-passive remediation/]
 MTX --> GAP
 GAP -. overdue.-> M21[URS-21 Findings] / M30[URS-30 Notifications]
 GAP --> CAPA_LINK[Gap→CAPA via URS-18 — DEC-28-16]
 AI[MIRA AI] --> AIA[/Training AI Assistance — advisory + provenance + acceptance/]
 M12[URS-12 Document Control — SOP] --> TRG (primary trigger source — DEC-28-09)
 M13[URS-13 Change Control] --> TRG / CUR (release linkage)
 M18[URS-18 CAPA] --> TRG / CAPA_LINK
 M26[URS-26 APQR] <-- MTX / GAP (periodic consumer)
 WAIVER[Waiver / Exemption — authority-gated]
 WAIVER --> ASN
 LOCK[Program Lock] --> CUR
 LOCK -. governed reopen + executive + QP co-sign.-> CUR
```

The platform shall implement: a controlled curriculum registry with lifecycle and version governance per DEC-28-03; a controlled question-bank registry per DEC-28-06; a training-assignment registry with controlled state transitions and waiver / exemption authority gates per DEC-28-04; a training-record registry with **server-attributed signature evidence** and a **separate verification step** with bound e-signature per DEC-28-05; an assessment lifecycle with question-version snapshot per DEC-28-06; a training-matrix registry with governed writer per DEC-28-07; a training-gap registry with non-passive remediation per DEC-28-08; a training-trigger registry with active execution engine per DEC-28-09; mandatory `study_id` per DEC-28-02; canonical API contract `/api/v1/training/*`; typed schema validation; controlled frontend route surface including `/training/:id/assignments/:assignmentId`; audit-trail coverage with reason-for-change including answer-level evidence + verification events per DEC-28-11; Authority/HITL/e-signature substrate per DEC-28-10; post-locked record immutability; governed reopen with executive + QP co-sign per DEC-28-22; canonical findings emission per DEC-28-15; canonical CAPA emission per DEC-28-16; **qualification-gate API** consumed by URS-23/-24/-25 per DEC-28-23; URS-12 / URS-13 / URS-18 trigger consumer integration; URS-26 APQR consumer; AI-assisted assessment / grading / gap-prioritization substrate with provenance and mandatory human acceptance per DEC-28-13; MIRA copilot read-only with advisory drafting only; and per-jurisdictional regulatory expectations.

### 0.8 Locked Launch Controls

| Locked control | Authority | Rationale |
|---|---|---|
| Two-step release path: signature → engineering implementation → validation execution | DEC-28-01 / VAL-008 | Mirrors every other Module. |
| "No Module 28 internal decisions outstanding" | §11.6 | Captured in locked decisions DEC-28-01..DEC-28-23 (§3.2). |
| `platform_admin` / `super_admin` support / break-glass only | DEC-28-20 / SoD-28-07 | Operating-tenant training ownership is the regulated path. |
| Target implementation binding language | Module bindings | URS specifies expected implementation. |
| AI overclaim posture as **internal forward-looking governance** with **GenAI prohibition in qualification-critical grading / verification / waiver / qualification disposition** | Architecture Bindings | EU GMP Annex 22 Draft 2025 §7 + EU AI Act Annex III treated as internal controls. AI may draft advisory text; AI cannot finalize qualification disposition. |
| Enumerated error codes | §6.7 | Stable machine-readable error contract. |
| JSON multi-signature evidence as **derived snapshot** | §6.6 | The `electronic_signatures` substrate is the system of record. |
| India CDSCO §5 / Schedule M-III §3.1 row | §14 | India CDSCO personnel framework captured (subject to a future jurisdiction-specific legal assessment). |
| Version 1.0 posture | Header | First binding version. |
| Canonical API mount `/api/v1/training/*` | DEC-28-01 / TRN-001 | Frontend hooks use canonical relative `/training/*`. |
| Frontend route surface alignment | DEC-28-12 / TRN-012 | Route `/training/:id/assignments/:assignmentId` declared in `App.tsx`. |
| Mandatory study scope alignment | DEC-28-02 / TRN-002 | Schemas require `study_id` matching service behavior; `site_id` removed from schemas because not persisted; `MODULE_CONTEXT_CONFIG.training` aligned to study-scoped. |
| Curriculum controlled lifecycle | DEC-28-03 / TRN-003 | `draft → under_review → effective → superseded → archived`; version-increment-on-update; URS-13 CR linkage on effective release. |
| Assignment controlled state transitions + waiver/exemption authority gates | DEC-28-04 / TRN-004 | Generic PATCH on assignment status replaced by controlled lifecycle endpoints + authority-gated waive / exempt flows. |
| Training-record server-attributed signature + verification flow | DEC-28-05 / TRN-005 | Signature IP / user-agent / timestamp derived from request context; `verified` status wired to `training_record_verifier_authority` + HITL + bound e-signature; verifier ≠ trainee. |
| Question-bank controlled lifecycle + assessment-version snapshot | DEC-28-06 / TRN-006 | Question banks have draft/effective/superseded lifecycle; assessment submissions persist `question_bank_version_snapshot`. |
| Training matrix governed writer | DEC-28-07 / TRN-007 | Matrix is governed projection with refresh schedule + on-demand writer; immutable snapshots. |
| Gap remediation workflow | DEC-28-08 / TRN-008 | `open → assigned → in_progress → remediated → closed`; assignment + due-date + closure evidence; overdue → URS-21 finding. |
| Trigger execution engine | DEC-28-09 / TRN-009 | Active execution engine for SOP-revision / change-event / CAPA / periodic / new-hire triggers; auto-assignment processor; reconciliation log. |
| Authority/HITL/e-sign on every regulated final action | DEC-28-10 / TRN-011 | Curriculum release / question-bank release / record verification / assignment waive / exempt / program lock / reopen. |
| Audit-trail coverage + reason-for-change discipline + answer-level evidence | DEC-28-11 / TRN-010 | Verification events audited; high-risk status changes require reason-for-change; assessment answers immutable post-finalization. |
| Qualification-gate API for downstream modules (target requirement) | DEC-28-23 / DEC-28-04 | URS-23 / URS-24 / URS-25 consume `GET /training/qualification/:userId/:roleId` to verify training-status before regulated execution. |
| AI-assisted assessment / grading / gap-prioritization substrate (target requirement) | DEC-28-13 / ARCH-AI-001 | `training_ai_assistance` table with provenance + mandatory human acceptance + lock-on-acceptance. |
| Bound e-signature persistence on every regulated final action | DEC-28-10 / DEC-28-23 | Curriculum release / question-bank release / record completion / record verification / assignment waive / exempt / program lock / reopen. |
| Governed reopen pattern (`locked → in_progress`) | DEC-28-22 / SoD-28-06 | Append-only iteration; executive + QP co-sign; does NOT mutate prior locked evidence. |

---

## 1. Scope and Out-of-Scope

### 1.1 In-scope

- The canonical training-curriculum registry with controlled lifecycle and version governance.
- The training-question-bank registry with controlled lifecycle.
- The training-assignment registry with controlled state transitions and waiver / exemption authority gates.
- The training-record registry with server-attributed signature evidence and separate verification step.
- The training-assessment lifecycle with question-version snapshot.
- The training-matrix registry with governed writer.
- The training-gap registry with non-passive remediation workflow.
- The training-trigger registry with active execution engine.
- The qualification-gate API for downstream modules (URS-23 / URS-24 / URS-25 / URS-33 / URS-34).
- The Authority/HITL/e-signature substrate on every regulated final action.
- The audit-trail coverage with reason-for-change discipline.
- The MIRA copilot read-only context integration (advisory drafting only).
- The AI-assisted assessment / grading / gap-prioritization substrate with provenance.
- The findings emission to URS-21.
- The CAPA emission to URS-18.
- The trigger consumer integration with URS-12 / URS-13 / URS-18.
- The URS-26 APQR consumer integration.
- The governed reopen workflow.
- The per-jurisdictional regulatory expectations.

### 1.2 Out-of-scope

- The CAPA register itself (URS-18).
- The change-control register itself (URS-13).
- The findings register itself (URS-21).
- The document-control register itself (URS-12).
- The MIRA copilot service itself (URS-32).
- HR system of record (e.g., Workday) — out of scope for v1.0; user master comes from URS-01.
- External LMS integration (e.g., SuccessFactors) — out of scope for v1.0; tracked as future-state.
- e-Learning content authoring tools (e.g., Articulate) — content links to URS-12 documents only.

---

## 2. Preconditions, Dependencies, Constraints

### 2.1 Operating preconditions

The following preconditions MUST hold for this URS to apply at validation time. Each bullet is a binding precondition; deviations require a controlled exception per URS-13 Change Control.

- The platform's authentication and session substrate (URS-01), RBAC (URS-02), context gate (URS-03), HITL / e-sign (URS-04), Authority Profile registry (URS-05), audit-trail hash-chain (URS-06), Study Management (URS-07), document-control (URS-12), change-control (URS-13), CAPA (URS-18), findings (URS-21), and MIRA AI (URS-32) are released and operational at validation time.
- Training program owners, curriculum authors, verifiers, waiver / exemption approvers, Qualified Person, HR Authority are trained, attributable users with documented authority.
- AI-assisted training surfaces are advisory only; the human verifier's signed disposition is the system of record.
- The tenant operating jurisdiction(s) are configured and applicable predicate rules surface accordingly.

### 2.2 Dependencies

- URS-01.URS-27, URS-29.URS-35 platform contracts.
- The `electronic_signatures` substrate.
- The `authority` substrate.
- The `hitl` substrate.
- The `audit_trail` substrate.
- The `documents` substrate (URS-12 — primary trigger source).
- The `change_control` substrate (URS-13).
- The `capa` substrate (URS-18).
- The `notifications` substrate (URS-30 — primary consumer of due-soon / overdue events).

### 2.3 Constraints

- The canonical API mount is `/api/v1/training/*`. No frontend hook may use `/api/training/*` (extra `/api`).
- Module 28 is **study-scoped at curriculum / assignment / record level** matching service behavior; `site_id` is NOT persisted and removed from schemas.
- AI-assisted content is advisory-only; **no AI service grades qualification-critical assessments, signs verification, approves waivers / exemptions, or finalizes qualification disposition**.
- Signature evidence (IP / user-agent / timestamp) is server-attributed; client-supplied signature evidence rejected per DEC-28-05.
- The `verified` status requires `training_record_verifier_authority` + HITL + bound e-signature; verifier MUST be SoD-distinct from trainee per SoD-28-02.
- Effective curriculum / question-bank versions are immutable; revisions create new version rows.
- Triggers MUST execute through the active execution engine; passive trigger definitions without execution paths are rejected per DEC-28-09.

---

## 3. Closed Launch Decisions

### 3.1 Decision register

| Decision ID | Title | Locked decision |
|---|---|---|
| DEC-28-01 | Two-step release path | Module 28 follows the same two-step release path as every other Module. |
| DEC-28-02 | Mandatory study scope + context-filter alignment + typed schema | `study_id` is mandatory at curriculum / assignment / record / assessment / trigger level (matching service behavior); `site_id` removed from schemas because not persisted; `MODULE_CONTEXT_CONFIG.training` aligned to study-scoped (no `site_id` reference); `createCurriculumSchema`, `assignTrainingSchema`, `createRecordSchema`, `createAssessmentSchema`, `createTriggerSchema` require `study_id`. |
| DEC-28-03 | Curriculum controlled lifecycle + version governance | Curriculum lifecycle is `draft → under_review → effective → superseded → archived`; release to `effective` requires `training_curriculum_authority` + HITL + bound e-signature + URS-13 change-request linkage per DEC-28-19; revisions create new version rows; `version` increments on material update; superseded versions are immutable. |
| DEC-28-04 | Assignment controlled state transitions + waiver / exemption authority gates + qualification-gating | Assignment lifecycle is `assigned → in_progress → completed → waived | exempted`; the generic `PATCH /training/assignments/:id` excludes terminal `waived` / `exempted` status from allowed-fields; waiver requires `training_waiver_authority` + HITL + bound e-signature + reason per DEC-28-10; exemption requires `training_exemption_authority` + HITL + bound e-signature + evidence per DEC-28-10; qualification-gating logic (a user is qualified for `(curriculum, role)` iff at least one `verified` training record exists for the latest `effective` curriculum version, OR a current `waiver` / `exemption` is in place) consumed by URS-23 / URS-24 / URS-25 per DEC-28-23. |
| DEC-28-05 | Training-record server-attributed signature + verification flow | Training-record completion (`completeRecord`) derives `signature_ip_address`, `signature_user_agent`, `signature_timestamp` from request context (`request.ip`, `request.headers['user-agent']`, server clock); client-supplied signature evidence rejected with `TRN_SIGNATURE_EVIDENCE_CLIENT_SUPPLIED`; the dormant `verified` status in `TrainingRecordStatus` is wired to a controlled verification endpoint (`POST /training/records/:id/verify`) requiring `training_record_verifier_authority` + HITL + bound e-signature; the verifier MUST be SoD-distinct from the trainee (SoD-28-02). |
| DEC-28-06 | Question-bank controlled lifecycle + assessment-version snapshot + reproducible scoring | Question-bank lifecycle parallels curriculum (`draft → under_review → effective → superseded → archived`) per DEC-28-03; release requires `training_question_bank_authority` + HITL + bound e-signature; effective question banks are immutable; assessment submissions persist `question_bank_version_snapshot` (the exact version of the question bank at submission time) for reproducible scoring; assessment grading by `training_assessment_grader_authority` (essay questions) + HITL + bound e-signature where qualification-critical. |
| DEC-28-07 | Training matrix governed writer | Training matrix is a governed projection over `training_records` × `training_curricula` × users; refreshed `on_demand` (authorized user) or `scheduled` (configurable, default daily); generation logs persisted; matrix records are immutable snapshots with `formula_version`. |
| DEC-28-08 | Training gap remediation workflow | Gap lifecycle is `open → assigned → in_progress → remediated → closed`; gap creation triggered by training matrix refresh detecting role-required curriculum without `verified` record (or due-date passage on assigned-but-incomplete); assignment requires gap-owner identification + due date; remediation requires evidence of completed training record; closure requires `training_program_owner_authority` + HITL + bound e-signature; overdue gaps emit `training_gap_overdue` event consumed by URS-30 Notifications and `training_finding_created` to URS-21 per DEC-28-15; chronic gaps may escalate to URS-18 CAPA via `training_gap_capa_linked` event per DEC-28-16. |
| DEC-28-09 | Trigger execution engine + auto-assignment processor | Trigger registry persists trigger definitions with `trigger_type` (ENUM `sop_revision` / `change_request` / `capa_event` / `periodic` / `new_hire` / `manual`), `source_record_id`, `target_curriculum_id`, `target_role_id`, `target_user_ids` (TEXT[] nullable), `frequency` (where periodic), `enabled` (BOOLEAN); active execution engine processes triggers: SOP-revision triggers consume URS-12 `document_revised` events and auto-assign retraining for users with role-based qualification; change-request triggers consume URS-13 `change_request_approved` events; CAPA triggers consume URS-18 `capa_action_required` events; periodic triggers run on schedule; new-hire triggers consume URS-01 `user_role_assigned` events; reconciliation log persists failed trigger executions for manual review. |
| DEC-28-10 | Authority/HITL/e-sign on every regulated final action | Curriculum release / question-bank release / training-record completion / verification / assignment waive / exempt / program lock / reopen all use `withAuthority(.)` + HITL + bound e-signature persisted via `electronic_signatures` substrate. |
| DEC-28-11 | Audit-trail coverage + reason-for-change discipline + answer-level evidence | Every mutation route emits audit-trail entries; verification events audited per DEC-28-05; assessment answer-level evidence persisted (per-question response, score contribution); high-risk status changes (terminal-state transitions, waiver / exemption, reversal) require structured reason-for-change captured in audit `details` JSON; assessment answers are immutable post-finalization. |
| DEC-28-12 | Frontend route surface alignment | Frontend route `/training/:id/assignments/:assignmentId` is declared in `App.tsx`; dashboard CTAs and detail-page navigation resolve to real routes. |
| DEC-28-13 | AI-assisted assessment / grading / gap-prioritization substrate with provenance + mandatory human acceptance | `training_ai_assistance` table persists per-record columns including `assistance_type` (ENUM `assessment_question_draft` / `essay_grading_suggestion` / `gap_prioritization` / `curriculum_recommendation` / `waiver_recommendation`), `narrative_text`, `model_id`, `model_version`, `prompt_version`, `confidence`, `citation_snapshot_json`, `proposed_at`, `proposed_by_system`, `accepted_by`, `accepted_at`, `acceptance_e_signature_id`, `accepted_text_immutable`, `rejection_reason`, `status` (ENUM `proposed` / `accepted` / `rejected`); AI-generated content is advisory until accepted; promotion to system-of-record requires explicit human confirmation captured in `acceptance_e_signature_id`; **AI cannot grade qualification-critical assessments, sign verification, approve waivers / exemptions, or finalize qualification disposition** per ARCH-AI-001 (target requirement, ARCH-AI-001 binding, parallel pattern to URS-26 DEC-26-11 / URS-27 DEC-27-13). |
| DEC-28-14 | Multi-dimensional context model | `tenant_id` mandatory, `study_id` mandatory per DEC-28-02, `role_id` for role-based training, `user_id` for assignee, `product_id` optional, `site_id` removed (not persisted). |
| DEC-28-15 | Findings emission to URS-21 | Training findings (overdue gaps, verification gate findings, qualification gaps detected at qualification-gate API call) emit `training_finding_created` event to URS-21 with `training_qualification` source type. |
| DEC-28-16 | CAPA emission to URS-18 | Chronic training gaps escalated to CAPA emit `training_gap_capa_linked` event consumed by URS-18 (`training_gap` source type per URS-18 declared source set). |
| DEC-28-17 | URS-12 SOP-revision trigger consumer (primary trigger source) | Module 28 consumes URS-12 `document_revised` events; on SOP revision, the trigger execution engine identifies users qualified on the prior version and auto-assigns retraining on the new version per DEC-28-09. |
| DEC-28-18 | URS-13 / URS-18 trigger consumer | Module 28 consumes URS-13 `change_request_approved` and URS-18 `capa_action_required` events for trigger-driven auto-assignment per DEC-28-09. |
| DEC-28-19 | URS-13 change-control linkage for curriculum release | Curriculum `under_review → effective` requires URS-13 change-request linkage via `curriculum_release_change_request_id` per DEC-28-03. |
| DEC-28-20 | platform_admin / super_admin | `platform_admin` / `super_admin` are support / break-glass only paths. |
| DEC-28-21 | Reason-for-change on material updates | Captured per DEC-28-11. |
| DEC-28-22 | Training program reopen as governed transition | Curriculum / training program `locked → in_progress` requires `executive_authority` co-sign AND `qualified_person_authority` co-sign + documented reason; appends new program iteration without mutating prior locked evidence (consistent with M14.M27 reopen pattern). |
| DEC-28-23 | Qualification-gate API for downstream modules | The qualification-gate API exposes `GET /training/qualification/:userId/:roleId` returning `qualified` (BOOLEAN) + `verified_records` (UUID[] of verified training records satisfying the role) + `active_waivers` (UUID[]) + `active_exemptions` (UUID[]) + `expires_at` (TIMESTAMPTZ — earliest expiry among contributing records); URS-23 batch-record execution / URS-24 stability analyst routes / URS-25 EM analyst routes consume this API to verify training-status before regulated execution; qualification-gate failure returns `qualified = false` and the regulated module rejects the action. |

### 3.2 Locked-decision rationale narrative

The decisions above define the binding launch posture for Module 28 v1.0. The most consequential locked controls are: (a) DEC-28-02 anchors at study-scope and aligns schemas, the typed DB layer, and the platform context filter to one canonical set with `study_id` mandatory; (b) DEC-28-05 requires server-attributed signature evidence on training-record signature and wires the `verified` status to a controlled verification flow with bound e-signature + verifier SoD; (c) DEC-28-09 requires an active trigger-execution engine that processes URS-12 SOP-revision events, URS-13 change-event events, URS-18 CAPA events, periodic schedules, and new-hire events into auto-assignments; (d) DEC-28-08 requires a non-passive gap-remediation workflow with assignment + due-date + closure evidence; (e) DEC-28-23 introduces the **qualification-gate API** consumed by URS-23 / URS-24 / URS-25 — making qualification a hard gate on regulated execution; (f) DEC-28-13 introduces the AI-assisted training substrate with provenance + mandatory human acceptance, parallel to URS-26 DEC-26-11 / URS-27 DEC-27-13; (g) DEC-28-22 defines reopen as a governed append-only transition consistent with the Module-14..-27 reopen pattern.

### 3.3 Closed launch decisions: cross-link to items

| Specification item ID | Specification item | Locked decision |
|---|---|---|
| TRN-001 | Canonical route + frontend route coverage requirement | DEC-28-01 |
| TRN-002 | Study scope + context-filter conflict | DEC-28-02 |
| TRN-003 | Curriculum lifecycle missing | DEC-28-03 / DEC-28-19 |
| TRN-004 | Assignment lifecycle + waiver/exemption gates missing | DEC-28-04 |
| TRN-005 | Signature integrity + verifier flow missing | DEC-28-05 |
| TRN-006 | Question-bank lifecycle + assessment-version provenance missing | DEC-28-06 |
| TRN-007 | Matrix governed writer missing | DEC-28-07 |
| TRN-008 | Gap remediation workflow missing | DEC-28-08 |
| TRN-009 | Trigger execution engine missing | DEC-28-09 / DEC-28-17 / DEC-28-18 |
| TRN-010 | Audit + reason-for-change + answer-level gaps | DEC-28-11 / DEC-28-21 |
| TRN-011 | Authority/HITL/e-sign missing | DEC-28-10 / DEC-28-23 |
| TRN-012 | Frontend route surface broken | DEC-28-12 |
| TRN-013 | Test evidence missing | §16 + §17 |

### 3.4 Locked-decision authority

Each locked decision is approved by the Founder / Chairman & MD on signature capture in the Document Approval block of this URS (§19). Decisions cannot be unlocked except through controlled URS revision under the URS change-control process and re-approval.

### 3.5 Worked examples

**Worked example 1 — SOP revision triggering auto-assignment retraining.**
An effective Standard Operating Procedure `SOP-MFG-PTabs-Granulation-v3` is revised to `SOP-MFG-PTabs-Granulation-v4` in URS-12 Document Control with a controlled change request CC-2026-0091. URS-12 emits `document_revised` event. Module 28's trigger execution engine detects the event; finds the active trigger `TRG-SOP-MFG-PTabs-Granulation` (type `sop_revision`); identifies all users with `verified` training records on `SOP-MFG-PTabs-Granulation-v3` (47 users); auto-creates 47 training-assignments with `target_curriculum_version = v4` and due date 30 days per DEC-28-09. Each assigned user receives a notification via URS-30. As users complete training: the trainee submits the assessment (auto-scored against the v4 question bank with `question_bank_version_snapshot` captured); training record transitions `created → in_progress → completed` with **server-attributed signature evidence** per DEC-28-05; a SoD-distinct verifier (the manufacturing supervisor — NOT the trainee) signs verification with bound e-signature; record transitions `completed → verified` per DEC-28-05. The training matrix refreshes; all 47 users now show `verified` against `SOP-MFG-PTabs-Granulation-v4`.

**Worked example 2 — Qualification-gate failure on batch execution.**
On `2026-08-12` Operator A attempts to start batch record `BR-PTabs-2026-08-12-001` in URS-23. URS-23 calls the qualification-gate API per DEC-28-23: `GET /training/qualification/operator-a-id/granulation-operator-role-id`. The qualification-gate evaluates: Operator A has a `verified` record for `SOP-MFG-PTabs-Granulation-v3` but NOT for `v4` (the currently effective version). Qualification-gate returns `qualified = false`. URS-23 rejects the batch start with an authority-required error. Operator A completes training on v4; verifier signs verification; training matrix refreshes; qualification-gate now returns `qualified = true`; URS-23 batch start succeeds.

**Worked example 3 — Gap remediation workflow.**
The training matrix refresh on `2026-09-01` detects a gap: Operator B is assigned to a granulation operator role but has no `verified` record for `SOP-MFG-PTabs-Granulation-v4`. A `training_gap` is auto-created with `status = open`. The training program owner assigns the gap to Operator B's manager with due date 30 days. Operator B completes training; the verifier signs verification; the training record reaches `verified`. Gap transitions `assigned → in_progress → remediated → closed` with `training_program_owner_authority` + HITL + bound e-signature per DEC-28-08. If the gap had not been remediated by due date, an overdue event would have emitted `training_gap_overdue` to URS-30 + `training_finding_created` to URS-21 per DEC-28-15.

**Worked example 4 — Authority-gated waiver.**
Operator C transferred from a partner facility with documented training on equivalent SOP. Rather than re-training, the training program owner proposes a waiver. The waiver requires `training_waiver_authority` + HITL + bound e-signature + reason captured per DEC-28-04 / DEC-28-10. On approval, the assignment transitions `assigned → waived`; the qualification-gate now returns `qualified = true` for Operator C × granulation operator role with `active_waivers = [waiver-id]`; the waiver expiration date is set to the next periodic re-qualification cycle per the curriculum.

**Worked example 5 — AI-assisted essay grading rejected.**
The assessment for `SOP-MFG-PTabs-Granulation-v4` includes one essay question. The trainee submits the essay. MIRA proposes an advisory grading suggestion via `training_ai_assistance` with `assistance_type = essay_grading_suggestion`, model identifier, model version, prompt version, confidence, citation snapshot per DEC-28-13. The `training_assessment_grader_authority` reviews the AI suggestion, finds it incomplete, and **rejects** it; the human grader applies their own grade with bound e-signature. The rejected AI suggestion is persisted with `accepted_by = null` and reject reason for AI-quality monitoring. **AI cannot finalize the assessment grade for a qualification-critical assessment** per DEC-28-13 / ARCH-AI-001.

**Worked example 6 — Governed reopen of locked training program.**
On `2027-04-10` an inspection finding (URS-22) reveals a previously locked training program may have under-recorded one verification. The Manufacturing Head initiates a reopen; per DEC-28-22 + SoD-28-06, both `executive_authority` co-sign AND `qualified_person_authority` co-sign + documented reason are required. On both co-signs the program transitions `locked → in_progress` and a new program iteration is appended; the prior locked evidence (curriculum, assignments, records, verifications, assessments, matrix snapshots, gap closures) is NOT mutated.

---

## 4. End-to-End User Journeys (28 launch journeys)

| # | Journey | Actor | Pre-condition | Path | Post-condition |
|---|---|---|---|---|---|
| 1 | Author curriculum draft | Curriculum Author | `training:curriculum:create`; `study_id` resolved | Create curriculum `(study_id, role_id, version=1)` in `draft` | Curriculum `draft`; audit entry |
| 2 | Submit curriculum for review | Curriculum Author | Curriculum `draft` complete | Transition `draft → under_review` | Curriculum `under_review`; audit entry |
| 3 | Release curriculum to effective | `training_curriculum_authority` | Curriculum `under_review`; URS-13 CR | HITL + bound e-sign + URS-13 CR linkage; transition `under_review → effective`; supersede prior version per DEC-28-03 | Curriculum `effective`; prior `superseded`; bound e-signature; `training_curriculum_released_effective` event |
| 4 | Author question bank | `training_question_bank_authority` | `training:question_bank:create` | Create question bank in `draft`; add questions with `correct_answer` | Question bank `draft`; audit entry |
| 5 | Release question bank | `training_question_bank_authority` | Question bank `draft` | HITL + bound e-sign per DEC-28-06; transition `draft → effective` | Question bank `effective`; immutable |
| 6 | Auto-trigger from URS-12 SOP revision | System (trigger execution engine) | URS-12 `document_revised` event | Identify users with verified records on prior version; auto-assign retraining per DEC-28-09 | Assignments created; URS-30 notifications |
| 7 | Auto-trigger from URS-13 change request | System | URS-13 `change_request_approved` event | Auto-assign retraining per DEC-28-09 | Assignments created |
| 8 | Auto-trigger from URS-18 CAPA event | System | URS-18 `capa_action_required` event | Auto-assign retraining per DEC-28-09 | Assignments created |
| 9 | Periodic re-qualification trigger | System (scheduled) | Periodic schedule due | Auto-assign re-qualification per DEC-28-09 | Assignments created |
| 10 | New-hire trigger | System | URS-01 `user_role_assigned` event | Auto-assign role-based training per DEC-28-09 | Assignments created |
| 11 | Trigger reconciliation log entry | System (validation) | Trigger execution failure | Persist reconciliation log entry | Reconciliation log entry |
| 12 | Manual training assignment | Curriculum Author | `training:assignment:create` | Create assignment with `due_date` | Assignment `assigned`; audit entry |
| 13 | Start training (record creation) | Trainee | Assignment `assigned` | Create training record; transition assignment `assigned → in_progress` | Record `created`; assignment `in_progress` |
| 14 | Submit assessment | Trainee | Record `in_progress` | Submit answers; persist `question_bank_version_snapshot` per DEC-28-06; auto-score | Assessment scored; pass/fail status |
| 15 | Manual grading by grader (essay questions) | `training_assessment_grader_authority` | Assessment submitted; essay questions present | Grade with HITL + bound e-sign per DEC-28-06 | Assessment graded; bound e-signature |
| 16 | MIRA proposes essay grading suggestion | System (MIRA) | Essay submitted | Persist `training_ai_assistance` advisory per DEC-28-13 | Suggestion `proposed`; advisory only |
| 17 | Reject AI grading suggestion | `training_assessment_grader_authority` | Suggestion `proposed` | Reject with reason | Suggestion rejected; human grade applied |
| 18 | Complete training record | Trainee | Assessment passed | `completeRecord` with **server-attributed** `signature_ip_address`, `signature_user_agent`, `signature_timestamp` per DEC-28-05 | Record `completed`; assignment `completed`; bound e-signature |
| 19 | Reject client-supplied signature evidence | System (validation) | Body contains `signature_ip_address` or `signature_user_agent` | Reject with `TRN_SIGNATURE_EVIDENCE_CLIENT_SUPPLIED` per DEC-28-05 | Operation rejected |
| 20 | Verify training record | `training_record_verifier_authority` (SoD-distinct from trainee per SoD-28-02) | Record `completed` | HITL + bound e-sign; transition `completed → verified` per DEC-28-05 | Record `verified`; bound e-signature; qualification-evidence state |
| 21 | Reject same-person verification | System (SoD validation) | Verifier = trainee | Reject with `TRN_VERIFIER_TRAINEE_SOD_VIOLATION` | Operation rejected |
| 22 | Approve waiver | `training_waiver_authority` | Assignment exists | HITL + bound e-sign + reason; transition assignment `assigned → waived` per DEC-28-04 | Assignment `waived`; bound e-signature |
| 23 | Approve exemption | `training_exemption_authority` | Assignment exists; external evidence | HITL + bound e-sign + evidence; transition `assigned → exempted` | Assignment `exempted` |
| 24 | Refresh training matrix on demand | Authorized user | `training:matrix:refresh` | Generate matrix snapshot per DEC-28-07 | Matrix snapshot persisted; immutable |
| 25 | Identify training gap on matrix refresh | System (matrix refresh) | Gap detected (role-required curriculum without verified record OR assigned-but-incomplete past due) | Auto-create gap `open` per DEC-28-08 | Gap created |
| 26 | Remediate training gap | Training Program Owner | Gap `assigned` | Track training; close on verification with HITL + bound e-sign | Gap `closed`; bound e-signature |
| 27 | Qualification-gate API consumer call | URS-23 / URS-24 / URS-25 | Regulated execution attempted | `GET /training/qualification/:userId/:roleId` per DEC-28-23 | Qualification verified or rejected |
| 28 | Reopen locked training program (governed transition) | Manufacturing Head + Executive Authority + Qualified Person | Program `locked`; documented reason | Executive co-sign AND QP co-sign; transition `locked → in_progress`; append new iteration per DEC-28-22 | Program `in_progress`; new iteration appended; prior locked evidence NOT mutated |

---

## 5. Front-end Requirements

### 5.1 Training List

The training list (URS-28-FE-001) renders curricula, assignments, records, gaps with filters by study, role, status; uses canonical `/training/*` hooks per DEC-28-01.

### 5.2 Training Detail

The training detail (URS-28-FE-002) renders curriculum metadata, assignment list with **navigable rows linking to `/training/:id/assignments/:assignmentId`** (per DEC-28-12), records list, assessment list.

### 5.3 Assignment Detail

The assignment detail (URS-28-FE-003) renders the controlled assignment lifecycle UI: `assigned → in_progress → completed → waived | exempted` with HITL + bound e-signature ceremony for waive / exempt per DEC-28-04 / DEC-28-10; new route `/training/:id/assignments/:assignmentId` per DEC-28-12.

### 5.4 Training Matrix

The training matrix (URS-28-FE-004) renders matrix snapshot with refresh action (governed writer per DEC-28-07); snapshot version + `formula_version` badge.

### 5.5 Gap Console

The gap console (URS-28-FE-005) renders gap registry with assignment + due-date + closure ceremony; HITL + bound e-signature on closure per DEC-28-08.

### 5.6 Trigger Console

The trigger console (URS-28-FE-006) renders trigger registry with execution log + reconciliation log; supports trigger definition + enable/disable per DEC-28-09.

### 5.7 Question Bank Editor

The question bank editor (URS-28-FE-007) supports question-bank draft authoring; release flow with HITL + e-signature per DEC-28-06.

### 5.8 Training Record Verification Console

The verification console (URS-28-FE-008) renders pending records for verification with verifier ceremony; bound e-signature + SoD-distinct enforcement per DEC-28-05.

### 5.9 AI Assistance Console

The AI assistance console (URS-28-FE-009) renders AI-generated assistance with provenance (model, model version, prompt version, confidence, citation snapshot), accept ceremony with bound e-signature, reject ceremony with reason; advisory-only labeling per DEC-28-13.

### 5.10 MIRA Copilot Integration

MIRA copilot (URS-28-FE-010) is read-only context on training records. **AI-generated content is advisory only with mandatory human acceptance per DEC-28-13; no AI grades qualification-critical assessments; no AI signs verification; no AI approves waivers / exemptions; no AI finalizes qualification disposition.**

### 5.11 Accessibility

WCAG 2.1 AA accessible.

---

## 6. Back-end Requirements

### 6.1 Module structure

`packages/backend/src/modules/training/` with `plugin.ts`, `routes.ts` (typed schemas), `service.ts` (server-attributed signature evidence; verification flow; trigger execution engine; gap remediation workflow; matrix governed writer; AI assistance substrate; audit-trail coverage), `handlers.ts`, `schemas.ts` (aligned with service behavior — `study_id` mandatory, `site_id` removed), `events.ts` (event emission for `training_*` events), `trigger-engine.ts` (active execution engine for SOP-revision / change-event / CAPA / periodic / new-hire triggers), `qualification-gate.ts` (qualification-gate API logic).

### 6.2 Data model

#### 6.2.1 `training_curricula`

`id`, `tenant_id`, `study_id` (NOT NULL FK per DEC-28-02), `role_id` (FK nullable — role-based curricula), `curriculum_code`, `title`, `version` (INTEGER NOT NULL), `effective_from`, `effective_to`, `supersedes_curriculum_id` (self-FK nullable), `curriculum_release_change_request_id` (FK to URS-13 per DEC-28-19), `linked_sop_document_ids` (UUID[] FK to URS-12), `linked_question_bank_id` (FK to `training_question_banks` nullable), `re_qualification_period_months` (INTEGER nullable), `approved_by`, `approved_at`, `e_signature_id` (FK), `status` (ENUM `draft` / `under_review` / `effective` / `superseded` / `archived`), audit columns. Uniqueness `(tenant_id, study_id, curriculum_code, version)`. RLS enabled.

#### 6.2.2 `training_question_banks`

`id`, `tenant_id`, `study_id` (FK), `linked_curriculum_id` (FK), `version` (INTEGER NOT NULL), `effective_from`, `effective_to`, `supersedes_question_bank_id` (self-FK nullable), `pass_threshold` (NUMERIC(3,2)), `approved_by`, `approved_at`, `e_signature_id`, `status` (ENUM `draft` / `under_review` / `effective` / `superseded` / `archived`), audit columns.

#### 6.2.3 `training_questions`

`id`, `tenant_id`, `question_bank_id` (FK), `question_text`, `question_type` (ENUM `multiple_choice` / `single_choice` / `true_false` / `short_answer` / `essay`), `correct_answer` (TEXT — for objective questions), `weight`, audit columns. Immutable on `effective` question banks.

#### 6.2.4 `training_assignments`

`id`, `tenant_id`, `study_id` (FK), `curriculum_id` (FK to effective curriculum at assignment time), `curriculum_version_snapshot` (INTEGER), `assigned_user_id` (FK), `assigned_role_id` (FK nullable), `assignment_source` (ENUM `manual` / `sop_revision_trigger` / `change_request_trigger` / `capa_trigger` / `periodic_trigger` / `new_hire_trigger`), `source_record_id` (UUID nullable — links to URS-12 / URS-13 / URS-18 source record), `due_date`, `completed_at` (TIMESTAMPTZ nullable), `waived_by` (FK nullable), `waived_at` (TIMESTAMPTZ nullable), `waiver_e_signature_id` (FK nullable per DEC-28-04 / DEC-28-10), `waiver_reason` (TEXT nullable), `exempted_by` (FK nullable), `exempted_at` (TIMESTAMPTZ nullable), `exemption_e_signature_id` (FK nullable), `exemption_evidence` (TEXT nullable), `status` (ENUM `assigned` / `in_progress` / `completed` / `waived` / `exempted`), audit columns.

#### 6.2.5 `training_records`

`id`, `tenant_id`, `study_id` (FK), `assignment_id` (FK), `user_id` (FK), `curriculum_id` (FK), `curriculum_version_snapshot` (INTEGER), `started_at`, `completed_at` (TIMESTAMPTZ nullable), `signature_timestamp` (TIMESTAMPTZ nullable — server-attributed per DEC-28-05), `signature_ip_address` (TEXT nullable — server-attributed per DEC-28-05), `signature_user_agent` (TEXT nullable — server-attributed per DEC-28-05), `completion_e_signature_id` (FK nullable), `verified_by` (FK nullable per DEC-28-05), `verified_at` (TIMESTAMPTZ nullable), `verification_e_signature_id` (FK nullable), `status` (ENUM `created` / `in_progress` / `completed` / `verified`), audit columns. Constraint: `verified_by != user_id` (verifier ≠ trainee per SoD-28-02).

#### 6.2.6 `training_assessments`

`id`, `tenant_id`, `record_id` (FK), `question_bank_id` (FK), `question_bank_version_snapshot` (INTEGER NOT NULL per DEC-28-06), `submitted_at`, `submitted_by` (FK), `score` (NUMERIC(5,2)), `pass_threshold_snapshot` (NUMERIC(3,2)), `pass_status` (ENUM `pass` / `fail` / `pending_grade`), `graded_by` (FK nullable), `graded_at` (TIMESTAMPTZ nullable), `grade_e_signature_id` (FK nullable per DEC-28-06), audit columns.

#### 6.2.7 `training_assessment_answers`

`id`, `tenant_id`, `assessment_id` (FK), `question_id` (FK), `answer_text`, `is_correct` (BOOLEAN nullable for essay), `score_contribution`, `manual_grade_score` (NUMERIC nullable), `manual_grade_comment` (TEXT nullable), audit columns. Immutable post-finalization per DEC-28-11.

#### 6.2.8 `training_matrix_snapshots`

`id`, `tenant_id`, `study_id` (FK), `formula_version`, `generated_by`, `generated_at`, `refresh_mode` (ENUM `manual` / `scheduled` / `on_demand`), `matrix_data_json` (JSONB), audit columns. Immutable snapshot per DEC-28-07.

#### 6.2.9 `training_gaps`

`id`, `tenant_id`, `study_id` (FK), `user_id` (FK), `curriculum_id` (FK), `gap_type` (ENUM `missing_record` / `overdue_assignment` / `expired_qualification` / `superseded_curriculum`), `assigned_owner_id` (FK nullable), `due_date` (TIMESTAMPTZ nullable), `remediated_at` (TIMESTAMPTZ nullable), `remediated_by` (FK nullable), `closed_by` (FK nullable), `closed_at` (TIMESTAMPTZ nullable), `closure_e_signature_id` (FK nullable per DEC-28-08), `linked_capa_id` (FK to URS-18 nullable per DEC-28-16), `is_overdue` (BOOLEAN GENERATED), `status` (ENUM `open` / `assigned` / `in_progress` / `remediated` / `closed`), audit columns.

#### 6.2.10 `training_triggers`

`id`, `tenant_id`, `trigger_code`, `trigger_type` (ENUM `sop_revision` / `change_request` / `capa_event` / `periodic` / `new_hire` / `manual` per DEC-28-09), `target_curriculum_id` (FK), `target_role_id` (FK nullable), `target_user_ids` (UUID[] nullable), `source_filter_json` (JSONB — e.g., for `sop_revision`: `{ document_id:. }`), `frequency_cron` (TEXT nullable for periodic), `enabled` (BOOLEAN), `last_executed_at` (TIMESTAMPTZ nullable), `last_executed_outcome` (ENUM `success` / `partial` / `failed` nullable), audit columns.

#### 6.2.11 `training_trigger_reconciliation_log`

`id`, `tenant_id`, `trigger_id` (FK), `executed_at`, `outcome`, `assignments_created_count`, `error_message` (TEXT nullable), audit columns.

#### 6.2.12 `training_ai_assistance`

`id`, `tenant_id`, `assistance_type` (ENUM per DEC-28-13), `linked_record_type` (ENUM `assessment` / `assessment_answer` / `gap` / `assignment` / `curriculum`), `linked_record_id` (UUID), `narrative_text`, `model_id`, `model_version`, `prompt_version`, `confidence`, `citation_snapshot_json`, `proposed_at`, `proposed_by_system`, `accepted_by` (FK nullable), `accepted_at`, `acceptance_e_signature_id` (FK nullable), `accepted_text_immutable` (TEXT nullable), `rejection_reason`, `status` (ENUM `proposed` / `accepted` / `rejected`), audit columns.

#### 6.2.13 `training_program_locks`

`id`, `tenant_id`, `study_id` (FK), `period_start`, `period_end`, `locked_by`, `locked_at`, `lock_e_signature_id` (FK), `reopened_at` (TIMESTAMPTZ nullable), `reopened_by` (FK nullable), `reopen_executive_co_signer` (FK nullable per DEC-28-22), `reopen_qp_co_signer` (FK nullable per DEC-28-22), `reopen_reason` (TEXT nullable), audit columns.

#### 6.2.14 RLS

All Module 28 tables have RLS enabled.

### 6.3 API contract

| Route | Method | Permission | Status |
|---|---|---|---|
| `/api/v1/training/curricula` | GET / POST | `training:curriculum:read` / `training:curriculum:create` | (typed schema) |
| `/api/v1/training/curricula/:id` | GET / PATCH (draft only) | `training:curriculum:read` / `training:curriculum:update` | |
| `/api/v1/training/curricula/:id/release` | POST | `training_curriculum_authority` + HITL + bound e-sign + URS-13 CR per DEC-28-03 / DEC-28-19 | target route |
| `/api/v1/training/question-banks` | GET / POST | `training:question_bank:read` / `training:question_bank:create` | target route per DEC-28-06 |
| `/api/v1/training/question-banks/:id` | GET / PATCH (draft only) | `training:question_bank:read` / `training:question_bank:update` | target route |
| `/api/v1/training/question-banks/:id/release` | POST | `training_question_bank_authority` + HITL + bound e-sign per DEC-28-06 | target route |
| `/api/v1/training/assignments` | GET / POST | `training:assignment:read` / `training:assignment:create` | |
| `/api/v1/training/assignments/:id` | GET / PATCH (terminal status excluded per DEC-28-04) | `training:assignment:read` / `training:assignment:update` | |
| `/api/v1/training/assignments/:id/waive` | POST | `training_waiver_authority` + HITL + bound e-sign + reason per DEC-28-04 | target route |
| `/api/v1/training/assignments/:id/exempt` | POST | `training_exemption_authority` + HITL + bound e-sign + evidence per DEC-28-04 | target route |
| `/api/v1/training/records` | GET / POST | `training:record:read` / `training:record:create` | |
| `/api/v1/training/records/:id` | GET / PATCH (status excluded) | `training:record:read` / `training:record:update` | |
| `/api/v1/training/records/:id/complete` | POST | `training_record_completion_authority` + HITL + bound e-sign + **server-attributed signature evidence** per DEC-28-05 | |
| `/api/v1/training/records/:id/verify` | POST | `training_record_verifier_authority` (SoD-distinct from trainee per SoD-28-02) + HITL + bound e-sign per DEC-28-05 | target route |
| `/api/v1/training/assessments` | GET / POST | `training:assessment:read` / `training:assessment:create` | |
| `/api/v1/training/assessments/:id/submit` | POST | `training:assessment:submit` (auto-score + persist `question_bank_version_snapshot` per DEC-28-06) | |
| `/api/v1/training/assessments/:id/grade` | POST | `training_assessment_grader_authority` + HITL + bound e-sign per DEC-28-06 | |
| `/api/v1/training/matrix` | GET | `training:matrix:read` | |
| `/api/v1/training/matrix/refresh` | POST | `training:matrix:refresh` per DEC-28-07 | target route |
| `/api/v1/training/gaps` | GET / POST | `training:gap:read` / `training:gap:create` | |
| `/api/v1/training/gaps/:id` | GET / PATCH | `training:gap:read` / `training:gap:update` | |
| `/api/v1/training/gaps/:id/assign` | POST | `training_program_owner_authority` | target route per DEC-28-08 |
| `/api/v1/training/gaps/:id/remediate` | POST | `training_program_owner_authority` | target route per DEC-28-08 |
| `/api/v1/training/gaps/:id/close` | POST | `training_program_owner_authority` + HITL + bound e-sign per DEC-28-08 | target route |
| `/api/v1/training/gaps/:id/link-capa` | POST | `training_program_owner_authority` (emits `training_gap_capa_linked`) | target route per DEC-28-16 |
| `/api/v1/training/triggers` | GET / POST | `training:trigger:read` / `training:trigger:create` | |
| `/api/v1/training/triggers/:id` | GET / PATCH | `training:trigger:read` / `training:trigger:update` | |
| `/api/v1/training/triggers/:id/execute` | POST | system (or `training:trigger:execute` for manual) per DEC-28-09 | target route |
| `/api/v1/training/qualification/:userId/:roleId` | GET | `training:qualification_gate:read` (consumed by URS-23/-24/-25) per DEC-28-23 | target route |
| `/api/v1/training/ai-assistance` | GET / POST | `training:ai_assistance:read` / `training:ai_assistance:propose` (advisory only) per DEC-28-13 | target route |
| `/api/v1/training/ai-assistance/:id/accept` | POST | `training:ai_assistance:accept` + HITL + bound e-sign per DEC-28-13 | target route |
| `/api/v1/training/ai-assistance/:id/reject` | POST | `training:ai_assistance:reject` + reason | target route |
| `/api/v1/training/program-locks` | POST | `final_quality_approver` + HITL + bound e-sign | target route |
| `/api/v1/training/program-locks/:id/reopen` | POST | `executive_authority` co-sign AND `qualified_person_authority` co-sign + HITL + reason per DEC-28-22 | target route |

### 6.4 Workflow

#### 6.4.1 Curriculum lifecycle

```mermaid
stateDiagram-v2
 [*] --> draft: create
 draft --> under_review: submit for review
 under_review --> effective: release (training_curriculum_authority + HITL + e-sign + URS-13 CR — DEC-28-03)
 effective --> superseded: revise (new version)
 superseded --> archived: archive
```

#### 6.4.2 Assignment lifecycle

```mermaid
stateDiagram-v2
 [*] --> assigned: create (manual or trigger-driven)
 assigned --> in_progress: trainee starts
 in_progress --> completed: record completed
 assigned --> waived: waive (training_waiver_authority + HITL + e-sign + reason — DEC-28-04)
 assigned --> exempted: exempt (training_exemption_authority + HITL + e-sign + evidence — DEC-28-04)
```

#### 6.4.3 Record lifecycle

```mermaid
stateDiagram-v2
 [*] --> created: create
 created --> in_progress: trainee starts
 in_progress --> completed: complete (server-attributed signature — DEC-28-05)
 completed --> verified: verify (training_record_verifier_authority SoD-distinct + HITL + bound e-sign — DEC-28-05)
```

#### 6.4.4 Gap lifecycle

```mermaid
stateDiagram-v2
 [*] --> open: matrix refresh detects gap
 open --> assigned: gap owner assigned + due date
 assigned --> in_progress: remediation in progress
 in_progress --> remediated: training verified
 remediated --> closed: close (training_program_owner_authority + HITL + bound e-sign — DEC-28-08)
```

#### 6.4.5 Trigger execution

```mermaid
sequenceDiagram
 participant URS12 as URS-12 Doc Control
 participant ENGINE as Trigger Engine
 participant ASN as Assignments
 participant LOG as Reconciliation Log
 URS12->>ENGINE: document_revised event
 ENGINE->>ENGINE: identify users with verified records on prior version
 ENGINE->>ASN: auto-create assignments (target_curriculum_version = new)
 ENGINE->>LOG: persist execution outcome
 Note right of ENGINE: parallel for URS-13 / URS-18 / periodic / new-hire triggers — DEC-28-09
```

### 6.5 Business rules

- BR-28-01: Curriculum uniqueness `(tenant_id, study_id, curriculum_code, version)` per DEC-28-03.
- BR-28-02: Curriculum effective release requires `training_curriculum_authority` + HITL + bound e-sign + URS-13 CR linkage per DEC-28-03 / DEC-28-19.
- BR-28-03: Effective curriculum / question-bank versions are immutable; revisions create new version rows.
- BR-28-04: Question-bank effective release requires `training_question_bank_authority` + HITL + bound e-sign per DEC-28-06.
- BR-28-05: Assessment submissions persist `question_bank_version_snapshot` per DEC-28-06.
- BR-28-06: Assessment grading requires `training_assessment_grader_authority` + HITL + bound e-sign for qualification-critical essay grading per DEC-28-06.
- BR-28-07: Assignment terminal-state (`waived` / `exempted`) cannot be set via direct PATCH per DEC-28-04.
- BR-28-08: Waiver requires `training_waiver_authority` + HITL + bound e-sign + reason per DEC-28-04.
- BR-28-09: Exemption requires `training_exemption_authority` + HITL + bound e-sign + evidence per DEC-28-04.
- BR-28-10: Training-record completion derives signature evidence from request context per DEC-28-05; client-supplied signature evidence rejected.
- BR-28-11: Training-record verification requires `training_record_verifier_authority` + HITL + bound e-sign per DEC-28-05.
- BR-28-12: Verifier MUST NOT be the trainee per SoD-28-02.
- BR-28-13: Training matrix refresh persists immutable snapshot with `formula_version` per DEC-28-07.
- BR-28-14: Training gaps emit `training_gap_overdue` to URS-30 + `training_finding_created` to URS-21 on overdue per DEC-28-15.
- BR-28-15: Chronic training gaps emit `training_gap_capa_linked` to URS-18 per DEC-28-16.
- BR-28-16: Trigger execution engine processes URS-12 / URS-13 / URS-18 events + periodic + new-hire per DEC-28-09.
- BR-28-17: Trigger reconciliation log persists failed executions per DEC-28-09.
- BR-28-18: Qualification-gate API (`GET /training/qualification/:userId/:roleId`) returns `qualified` based on verified records + active waivers + active exemptions per DEC-28-23.
- BR-28-19: Material updates after draft require structured reason-for-change per DEC-28-21.
- BR-28-20: Bound e-signature persistence on every regulated final action per DEC-28-10 / DEC-28-23.
- BR-28-21: Program reopen `locked → in_progress` requires `executive_authority` co-sign AND `qualified_person_authority` co-sign + reason per DEC-28-22.
- BR-28-22: `platform_admin` / `super_admin` are support / break-glass only paths per DEC-28-20.
- BR-28-23: **AI cannot grade qualification-critical assessments, sign verification, approve waivers / exemptions, or finalize qualification disposition**; AI may draft advisory text only.

### 6.6 Audit trail

Every Module 28 record mutation persists an audit-trail entry. Material updates after draft persist `reason_for_change` per DEC-28-21. Verification events captured per DEC-28-05. Assessment answer-level evidence persisted per DEC-28-11. Regulated final actions persist a bound e-signature via the `electronic_signatures` substrate. Append-only.

### 6.7 Error handling

| Code | HTTP | Meaning |
|---|---|---|
| `TRN_VALIDATION_FAILED` | 400 | Schema validation failure |
| `TRN_UNAUTHORIZED` | 401 | Authentication required |
| `TRN_FORBIDDEN` | 403 | RBAC denied |
| `TRN_NOT_FOUND` | 404 | Resource not found |
| `TRN_DUPLICATE_KEY` | 409 | Uniqueness violation |
| `TRN_INVALID_TRANSITION` | 422 | Lifecycle transition not permitted |
| `TRN_TERMINAL_STATE_PATCH_FORBIDDEN` | 422 | Direct PATCH attempted on terminal status per DEC-28-04 |
| `TRN_SIGNATURE_EVIDENCE_CLIENT_SUPPLIED` | 422 | Client-supplied signature evidence per DEC-28-05 |
| `TRN_VERIFIER_TRAINEE_SOD_VIOLATION` | 422 | Verifier = trainee per SoD-28-02 |
| `TRN_QUESTION_BANK_VERSION_SNAPSHOT_REQUIRED` | 422 | Assessment submission missing version snapshot per DEC-28-06 |
| `TRN_AUTHORITY_REQUIRED` | 422 | Authority Profile missing |
| `TRN_HITL_DECISION_REQUIRED` | 422 | HITL decision capture missing |
| `TRN_E_SIGNATURE_REQUIRED` | 422 | Bound e-signature persistence missing |
| `TRN_REASON_FOR_CHANGE_REQUIRED` | 422 | Material update / terminal transition without reason-for-change |
| `TRN_AI_CANNOT_GRADE_QUALIFICATION_CRITICAL` | 422 | AI service attempted to grade qualification-critical assessment per ARCH-AI-001 |
| `TRN_AI_CANNOT_SIGN_VERIFICATION` | 422 | AI service attempted to sign verification per ARCH-AI-001 |
| `TRN_AI_CANNOT_APPROVE_WAIVER` | 422 | AI service attempted to approve waiver / exemption per ARCH-AI-001 |
| `TRN_AI_ASSISTANCE_NOT_ACCEPTED` | 422 | Attempt to promote AI assistance to system-of-record without human acceptance per DEC-28-13 |
| `TRN_TRIGGER_EXECUTION_FAILED` | 500 | Trigger execution engine failure (logged in reconciliation log) |
| `TRN_QUALIFICATION_GATE_FAILED` | 422 | Qualification-gate API returned `qualified = false` (consumed by URS-23/-24/-25) |
| `TRN_REOPEN_AUTHORITY_REQUIRED` | 422 | Reopen attempted without executive AND QP co-sign per DEC-28-22 |
| `TRN_CONTEXT_FILTER_MISMATCH` | 422 | Query against context column not present in schema |
| `TRN_INTERNAL` | 500 | Sanitized server error |

### 6.8 Configuration rules

- Trigger reconciliation log retention configurable per tenant.
- Matrix refresh schedule (default daily) configurable per tenant.
- Periodic re-qualification frequency configurable per curriculum (`re_qualification_period_months`).
- Trigger types (SOP-revision / change-event / CAPA / periodic / new-hire) configured at platform level.

---

## 7. Non-functional Requirements

- NFR-28-01: List pagination (default 50, max 200).
- NFR-28-02: List p95 < 800ms (10k records, 1k curricula, 5k gaps per tenant).
- NFR-28-03: Qualification-gate API p95 < 200ms (consumed at scale by URS-23/-24/-25).
- NFR-28-04: Matrix refresh p95 < 30s.
- NFR-28-05: Trigger execution p95 < 60s for 1000-user batch.
- NFR-28-06: Audit-trail append p99 < 200ms.
- NFR-28-07: Concurrent trainees per tenant: 200.
- NFR-28-08: Storage scalability: 1M training records per tenant; 100k assessment answers per tenant.
- NFR-28-09: Backup / restore RPO ≤ 15 min; RTO ≤ 4 hours per URS-35.
- NFR-28-10: Bound e-signature persistence transaction p95 < 1.5s.

---

## 8. Localization

English (en-US, en-GB), Hindi (hi-IN), Marathi (mr-IN), Japanese (ja-JP) at launch.

---

## 9. Migration

### 9.1 Migration scope

Greenfield at launch. Legacy training data migration subject to URS-28-VAL-008 evidence gate.

### 9.2 Schema migration

Migration baseline aligned with service behavior (study-scoped, `site_id` removed) per DEC-28-02; target migrations add curriculum lifecycle + e-signature FKs per DEC-28-03; question-bank table per DEC-28-06; assignment waive/exempt e-signature FKs per DEC-28-04; record verification FKs + server-attributed signature evidence per DEC-28-05; assessment `question_bank_version_snapshot` + grade e-signature FK per DEC-28-06; assessment-answer immutable post-finalization per DEC-28-11; matrix snapshots per DEC-28-07; gap remediation columns + linked CAPA FK per DEC-28-08 / DEC-28-16; trigger reconciliation log per DEC-28-09; AI assistance table per DEC-28-13; program lock + reopen columns per DEC-28-22; `MODULE_CONTEXT_CONFIG.training` aligned to study-scoped (no `site_id` reference).

### 9.3 Migration evidence gate (URS-28-VAL-008)

(a) all migrations applied; (b) RLS verified; (c) typed schema validation verified; (d) `study_id` mandatory + `site_id` removed verified; (e) curriculum lifecycle + URS-13 CR linkage verified; (f) question-bank lifecycle + assessment-version snapshot verified; (g) server-attributed signature evidence verified (client-supplied rejection tested); (h) verification flow + verifier SoD verified; (i) assignment waive/exempt authority gates verified; (j) trigger execution engine + URS-12/-13/-18 consumer verified; (k) gap remediation workflow verified; (l) qualification-gate API consumed by URS-23/-24/-25 verified; (m) AI assistance substrate verified; (n) matrix governed writer verified; (o) cross-module event emission verified (URS-12, URS-13, URS-18, URS-21, URS-26, URS-30); (p) audit-trail coverage verified; (q) governed reopen verified; (r) §17 validation evidence pack signed.

---

## 10. Decommissioning

Module 28 records subject to platform record-retention policy: retained for the longer of (a) 30 years from program lock (FDA 21 CFR §211.180) or (b) duration of personnel employment + 30 years (per typical training-record retention). On tenant decommissioning, records exported per URS-35.

---

## 11. Decisions, Dependencies, Risks, and Error Handling
### 11.1 Closed decision posture

**No Module 28 internal decisions outstanding.** Launch decisions are captured in the locked decisions above.

### 11.2 External dependencies

- URS-12 Document Control must emit `document_revised` events per DEC-28-17.
- URS-13 change-control register must emit `change_request_approved` events per DEC-28-18 + support `curriculum_release_change_request_id` linkage per DEC-28-19.
- URS-18 CAPA register must emit `capa_action_required` events + accept `training_gap` source type per DEC-28-16 / DEC-28-18.
- URS-21 findings register must accept `training_qualification` source type per DEC-28-15.
- URS-23 / URS-24 / URS-25 / URS-33 / URS-34 must consume qualification-gate API per DEC-28-23.
- URS-26 APQR must consume training matrix snapshots and gap summary.
- URS-30 Notifications must consume `training_assignment_due_soon` and `training_gap_overdue` events.
- URS-32 MIRA AI must support read-only `useMiraRecord(.)` mappings; AI advisory drafting only with mandatory human acceptance.

### 11.3 Risks

- Risk-28-01: Trigger execution under high tenant load. Mitigation: NFR-28-05 latency budget; reconciliation log + retry; off-peak processing.
- Risk-28-02: Qualification-gate latency cascading to batch / stability / EM execution. Mitigation: NFR-28-03 latency budget (p95 < 200ms); cache layer with TTL; revalidation on training events.
- Risk-28-03: AI-assistance acceptance rate may be high if reviewers rubber-stamp. Mitigation: acceptance-rate audit; periodic review by QA Head + Validation Head + Founder.
- Risk-28-04: Verifier SoD enforcement may delay small-tenant cycles. Mitigation: tenant-configurable cross-team verifier waiver (default disabled) with audit-flag; documented training.
- Risk-28-05: Reopen workflow gravity may delay urgent post-marketing investigation. Mitigation: documented reopen SLA.

### 11.4 Out-of-scope risks tracked elsewhere

- HR system of record integration (future-state).
- External LMS integration (future-state).
- e-Learning content authoring (future-state).

### 11.5 Risk owner

Module-28 risk register owned by Quality / Training Management Squad with quarterly review by QA Head + Manufacturing Head + Validation Head + Qualified Person Authority + Human Resources Authority.

### 11.6 Decision discipline

No Module 28 internal decisions outstanding.

### 11.7 Error Handling and Negative Paths

This section defines the controlled error envelope, the enumerated machine-code catalogue, and the negative-path response contract required for this module. The error envelope is the standard platform envelope (human message, machine code in upper-snake-case, optional structured details, correlation identifier). Errors are returned with the appropriate HTTP status; the UI surfaces inline errors at the field of cause where applicable, otherwise a controlled error toast or modal. Every error path is logged to the URS-06 audit substrate when the originating action is regulated; errors that occur before authentication are logged without `userId`. Audit-trail write failure on a state-changing action MUST cause the originating action to NOT commit (atomic write per URS-04 BR-04-15). The enumerated machine codes for this module's negative paths are defined alongside the corresponding lifecycle gates, segregation-of-duties controls, and authority-resolution outcomes throughout §6 (Back-end Requirements) and §13 (Segregation of Duties); engineering MUST surface every enumerated machine code through the standard envelope and MUST NOT swallow errors silently. Cross-module error propagation follows the §20 Cross-Module Event Contract.


---

## 12. Security

- SEC-28-01: Tenant isolation enforced at RLS on every Module 28 table.
- SEC-28-02: RBAC enforced on every route via `requirePermission(.)`.
- SEC-28-03: Authority resolution enforced on regulated final actions before HITL + e-signature.
- SEC-28-04: HITL decision capture enforced before bound e-signature persistence.
- SEC-28-05: Bound e-signature persistence via `electronic_signatures` substrate.
- SEC-28-06: PII redaction in logs (training records contain user PII; redaction enforced).
- SEC-28-07: Audit-trail integrity via URS-06 hash chain.
- SEC-28-08: Signature evidence (IP / user-agent / timestamp) is server-attributed per DEC-28-05; client-supplied evidence rejected.
- SEC-28-09: AI-request provenance via `ai_requests` linked to `training_ai_assistance`; **AI cannot grade qualification-critical assessments, sign verification, approve waivers, or finalize qualification disposition**; AI may draft advisory only.
- SEC-28-10: `platform_admin` / `super_admin` break-glass actions logged per DEC-28-20.
- SEC-28-11: Verifier ≠ trainee enforced at DB constraint per SoD-28-02.
- SEC-28-12: Qualification-gate API is read-only, RBAC-gated, and rate-limited.

---

## 13. Segregation of Duties

| SoD ID | Constraint |
|---|---|
| SoD-28-01 | The curriculum releaser MUST NOT be the curriculum author when tenant policy requires content-author/releaser separation. |
| SoD-28-02 | The training-record verifier MUST NOT be the trainee (DB-level constraint per DEC-28-05). |
| SoD-28-03 | The assessment grader MUST NOT be the trainee. |
| SoD-28-04 | The waiver / exemption approver MUST NOT be the trainee or trainee's direct line manager (default tenant policy; configurable). |
| SoD-28-05 | The gap closure authority MUST NOT be the trainee. |
| SoD-28-06 | The reopen co-signers (executive AND Qualified Person per DEC-28-22) MUST NOT be the original lock signer. |
| SoD-28-07 | The `platform_admin` / `super_admin` support / break-glass action MUST NOT be a regulated production action; logged and reviewed per DEC-28-20. |

---

## 14. Regulatory Mapping

| Predicate rule | Section | Module 28 binding |
|---|---|---|
| FDA 21 CFR Part 11 | §11.10(a), §11.10(d), §11.10(e), §11.50, §11.70 | URS-28-VAL-008 + bound e-sign on every regulated final action + audit-trail on every mutation |
| **FDA 21 CFR Part 211 §211.25** | Personnel qualifications — primary FDA predicate | "Each person engaged. shall have education, training, and experience" — Module 28 system of record |
| FDA 21 CFR Part 211 §211.180 | Records retention | Training record retention per regulatory schedule |
| **FDA 21 CFR Part 820.25** | Medical Device QSR Personnel | Training program for medical device personnel |
| FDA 21 CFR Part 58 | GLP Personnel | GLP training where applicable |
| EU GMP Annex 11 | §1, §4, §9, §12, §16 | Risk; validation; audit trails; security |
| **EU GMP Chapter 2 §2.10–§2.18** | Personnel Training and Qualification — primary EU predicate | Module 28 system of record |
| EU GMP Annex 22 Draft 2025 | §7 — HITL / GenAI advisory only | Internal forward-looking control |
| EU AI Act (Regulation 2024/1689) | Annex III; Art. 13 transparency | Internal forward-looking control |
| MHRA Data Integrity Guidance | ALCOA+ | Audit-trail; bound e-signature; record retention |
| GAMP 5 Cat 5 | Custom-application validation lifecycle | URS-28 validation evidence pack per URS-28-VAL-008 |
| **ICH Q10 §3.2.3** | Training Management — primary ICH predicate | Module 28 system of record |
| ICH Q9 | Quality Risk Management | Training-precipitated risk |
| ICH E6(R3) §2.8 | GCP Sponsor Training | GCP sponsor training scope |
| **ISO 13485:2016 §6.2** | Medical Device Personnel Competence | Medical device personnel competence |
| **India CDSCO Schedule M (Revised) §5** | Personnel — primary India predicate | India operations regulatory baseline subject to a future jurisdiction-specific legal assessment |
| India CDSCO Schedule M-III §3.1 | Medical Device Personnel | India medical device personnel subject to a future jurisdiction-specific legal assessment |

---

## 15. Code Modules

| Code module | Path | Status |
|---|---|---|
| `training` plugin | `packages/backend/src/modules/training/plugin.ts` | (canonical mount) |
| `training` routes | `packages/backend/src/modules/training/routes.ts` | (typed schemas; route additions per §6.3) |
| `training` handlers | `packages/backend/src/modules/training/handlers.ts` | |
| `training` service | `packages/backend/src/modules/training/service.ts` | (server-attributed signature evidence; verification flow; gap remediation; matrix governed writer; AI assistance substrate; audit + reason-for-change) |
| `training` schemas | `packages/backend/src/modules/training/schemas.ts` | (study_id mandatory; site_id removed; client signature evidence rejected) |
| `training` events | `packages/backend/src/modules/training/events.ts` | target route |
| `training` trigger engine | `packages/backend/src/modules/training/trigger-engine.ts` | target route per DEC-28-09 |
| `training` qualification-gate | `packages/backend/src/modules/training/qualification-gate.ts` | target route per DEC-28-23 |
| Training migrations | `packages/backend/src/db/migrations/.` | (study_id mandatory; site_id removed; question_banks table; assessment version snapshot; verification e-sig FK; trigger reconciliation log; AI assistance table; matrix snapshots; gap remediation columns; program locks) |
| Shared types | `packages/shared/src/types/training.ts` | |
| Shared schemas | `packages/shared/src/schemas/training.schema.ts` | |
| Frontend hooks | `packages/frontend/src/api/hooks/useTraining.ts` | (canonical relative `/training/*`) |
| Frontend list | `packages/frontend/src/pages/TrainingList.tsx` | |
| Frontend detail | `packages/frontend/src/pages/TrainingDetail.tsx` | (assignment row navigation resolves) |
| Frontend matrix | `packages/frontend/src/pages/TrainingMatrix.tsx` | (refresh action) |
| Frontend assignment detail | `packages/frontend/src/pages/TrainingAssignmentDetail.tsx` | target route per DEC-28-12 |
| Frontend question bank editor | `packages/frontend/src/pages/TrainingQuestionBankEditor.tsx` | target route per DEC-28-06 |
| Frontend verification console | `packages/frontend/src/pages/TrainingVerificationConsole.tsx` | target route per DEC-28-05 |
| Frontend gap console | `packages/frontend/src/pages/TrainingGapConsole.tsx` | target route per DEC-28-08 |
| Frontend trigger console | `packages/frontend/src/pages/TrainingTriggerConsole.tsx` | target route per DEC-28-09 |
| Frontend AI assistance console | `packages/frontend/src/pages/TrainingAIAssistance.tsx` | target route per DEC-28-13 |
| App routing | `packages/frontend/src/App.tsx` | (per DEC-28-12) |

---

## 16. Test Cases

### 16.1 Unit tests

- TC-28-U-001: Curriculum uniqueness `(tenant_id, study_id, curriculum_code, version)` rejects duplicate.
- TC-28-U-002: `study_id` null on curriculum create rejects with `TRN_VALIDATION_FAILED`.
- TC-28-U-003: Curriculum effective release without URS-13 CR rejects.
- TC-28-U-004: Effective curriculum / question-bank edit rejects with `TRN_INVALID_TRANSITION`.
- TC-28-U-005: Assessment submission without `question_bank_version_snapshot` rejects with `TRN_QUESTION_BANK_VERSION_SNAPSHOT_REQUIRED`.
- TC-28-U-006: Direct PATCH setting assignment `status = waived` rejects with `TRN_TERMINAL_STATE_PATCH_FORBIDDEN`.
- TC-28-U-007: Waiver without `training_waiver_authority` rejects with `TRN_AUTHORITY_REQUIRED`.
- TC-28-U-008: Exemption without evidence rejects.
- TC-28-U-009: Client-supplied `signature_ip_address` rejects with `TRN_SIGNATURE_EVIDENCE_CLIENT_SUPPLIED`.
- TC-28-U-010: Verification by trainee rejects with `TRN_VERIFIER_TRAINEE_SOD_VIOLATION`.
- TC-28-U-011: Verification without `training_record_verifier_authority` rejects.
- TC-28-U-012: Trigger execution engine processes URS-12 `document_revised` event correctly.
- TC-28-U-013: Trigger execution engine processes URS-13 `change_request_approved` event correctly.
- TC-28-U-014: Trigger execution engine processes URS-18 `capa_action_required` event correctly.
- TC-28-U-015: Trigger execution failure persists reconciliation log entry.
- TC-28-U-016: Matrix refresh persists immutable snapshot.
- TC-28-U-017: Gap closure without authority rejects.
- TC-28-U-018: Qualification-gate API returns `qualified = false` when no verified record exists.
- TC-28-U-019: Qualification-gate API returns `qualified = true` with active waiver.
- TC-28-U-020: AI assistance promotion without acceptance rejects with `TRN_AI_ASSISTANCE_NOT_ACCEPTED`.
- TC-28-U-021: AI service grading qualification-critical assessment rejects with `TRN_AI_CANNOT_GRADE_QUALIFICATION_CRITICAL`.
- TC-28-U-022: Reopen without executive AND QP co-sign rejects.

### 16.2 Integration tests

- TC-28-I-001: Full curriculum draft → effective lifecycle with URS-13 CR.
- TC-28-I-002: SOP revision triggering auto-assignment retraining per Worked Example 1.
- TC-28-I-003: Qualification-gate failure on batch execution per Worked Example 2.
- TC-28-I-004: Gap remediation workflow per Worked Example 3.
- TC-28-I-005: Authority-gated waiver per Worked Example 4.
- TC-28-I-006: AI-assisted essay grading rejected per Worked Example 5.
- TC-28-I-007: Governed reopen of locked program per Worked Example 6.
- TC-28-I-008: Trigger execution from URS-13 change request.
- TC-28-I-009: Trigger execution from URS-18 CAPA event.
- TC-28-I-010: Periodic re-qualification trigger.
- TC-28-I-011: New-hire trigger from URS-01 `user_role_assigned` event.
- TC-28-I-012: URS-23 batch-record execution consumes qualification-gate.
- TC-28-I-013: URS-24 stability analyst consumes qualification-gate.
- TC-28-I-014: URS-25 EM analyst consumes qualification-gate.
- TC-28-I-015: URS-26 APQR consumes training matrix + gaps.
- TC-28-I-016: Cross-tenant `platform_admin` break-glass logged.

### 16.3 End-to-end tests

- TC-28-E-001: SOP revision retraining scenario per Worked Example 1.
- TC-28-E-002: Qualification-gate failure scenario per Worked Example 2.
- TC-28-E-003: Gap remediation scenario per Worked Example 3.
- TC-28-E-004: Waiver scenario per Worked Example 4.
- TC-28-E-005: AI grading rejection scenario per Worked Example 5.
- TC-28-E-006: Reopen scenario per Worked Example 6.
- TC-28-E-007: Concurrent trainees — 200 users — NFR-28-07 verification.
- TC-28-E-008: India CDSCO Schedule M §5 personnel scenario.

### 16.4 Performance tests

- TC-28-P-001: List p95 latency (NFR-28-02).
- TC-28-P-002: Qualification-gate API p95 latency (NFR-28-03).
- TC-28-P-003: Matrix refresh p95 latency (NFR-28-04).
- TC-28-P-004: Trigger execution p95 latency (NFR-28-05).
- TC-28-P-005: Bound e-signature p95 latency (NFR-28-10).

### 16.5 Security tests

- TC-28-S-001: Cross-tenant access rejected by RLS.
- TC-28-S-002: Missing RBAC rejected.
- TC-28-S-003: Missing Authority Profile rejected on regulated final action.
- TC-28-S-004: Missing HITL rejected.
- TC-28-S-005: Missing bound e-signature rejected.
- TC-28-S-006: SQL injection against typed-schema route rejected.
- TC-28-S-007: Audit-trail UPDATE / DELETE rejected at DB level.
- TC-28-S-008: AI service attempting verification / waiver / qualification-disposition rejected.
- TC-28-S-009: PII redaction in logs verified.
- TC-28-S-010: Client-supplied signature evidence rejected.
- TC-28-S-011: Verifier ≠ trainee DB constraint enforced.

---

## 17. Validation Evidence

### 17.1 URS-28-VAL-001: Requirements traceability matrix

Complete RTM mapping every URS-28 requirement (DEC-28-01.DEC-28-23, BR-28-01.BR-28-23, NFR-28-01.NFR-28-10, SoD-28-01.SoD-28-07, SEC-28-01.SEC-28-12) to test cases (TC-28-U-001.TC-28-U-022, TC-28-I-001.TC-28-I-016, TC-28-E-001.TC-28-E-008, TC-28-P-001.TC-28-P-005, TC-28-S-001.TC-28-S-011) and code modules (§15).

### 17.2 URS-28-VAL-002: Design qualification (DQ)

Architecture, data model, API contract, workflow, business rules, audit trail, security, integration; signed by Validation Head, QA Head, RA Head, Manufacturing Head, Qualified Person Authority, Human Resources Authority.

### 17.3 URS-28-VAL-003: Installation qualification (IQ)

Migration application + RLS verification + route mount verification + frontend hook resolution + frontend route surface verification.

### 17.4 URS-28-VAL-004: Operational qualification (OQ)

Happy-path execution of every test case with evidence captures.

### 17.5 URS-28-VAL-005: Performance qualification (PQ)

NFR-28-01.NFR-28-10 verification with focus on qualification-gate API latency at scale.

### 17.6 URS-28-VAL-006: AI/ML governance evidence

Per ARCH-AI-001: (a) MIRA read-only context integration; (b) AI advisory drafting only with mandatory human acceptance via `training_ai_assistance`; (c) **AI cannot grade qualification-critical assessments; AI cannot sign verification; AI cannot approve waivers / exemptions; AI cannot finalize qualification disposition** verification; (d) Annex 22 §7 + EU AI Act Annex III internal forward-looking control compliance evidence.

### 17.7 URS-28-VAL-007: Regulatory mapping evidence

FDA 21 CFR Part 11, **§211.25** (primary FDA predicate), §211.180, **§820.25**, §58 (where applicable); EU GMP Annex 11, **EU GMP Chapter 2 §2.10–§2.18** (primary EU predicate), Annex 22 Draft 2025 §7, EU AI Act Art. 13 / Annex III, MHRA Data Integrity (ALCOA+), GAMP 5 Cat 5, **ICH Q10 §3.2.3** (primary ICH predicate), ICH Q9, ICH E6(R3) §2.8, **ISO 13485:2016 §6.2**, **India CDSCO Schedule M (Revised) §5** (primary India predicate), Schedule M-III §3.1.

### 17.8 URS-28-VAL-008: Migration evidence gate

Per §9.3.

### 17.9 URS-28-VAL-009: Signature manifest

QA Head, RA Head, Validation Head, Manufacturing Head, Qualified Person Authority, Human Resources Authority, Information Security Head, Site Quality Lead, Founder / Chairman & MD per §19.

### 17.10 URS-28-VAL-010: Post-launch periodic-review pack

(a) Training metrics (records per tenant, verification cycle time, gap remediation time); (b) AI-assistance acceptance rate; (c) audit-trail integrity; (d) reopen-event audit; (e) cross-tenant break-glass audit; (f) cross-module event integrity (URS-12, URS-13, URS-18, URS-21, URS-23, URS-24, URS-25, URS-26, URS-30); (g) trigger execution reliability; (h) qualification-gate API reliability + latency; (i) verifier SoD compliance; periodic review at quarterly cadence by QA Head + Manufacturing Head + Validation Head + Qualified Person Authority + Human Resources Authority.

---

## 18. Document Change History

| Version | Date | Author | Change Summary |
|---|---|---|---|
| 1.0 | 2026-05-07 | Founder Doctrine — Verixa URS Cell | First issued user requirements specification for Module 28. |

---

## 19. Document Approval

| Role | Name | Signature | Date |
|---|---|---|---|
| Founder / Chairman & MD | Vimal | __________ | __________ |
| QA Head | __________ | __________ | __________ |
| RA Head | __________ | __________ | __________ |
| Validation Head | __________ | __________ | __________ |
| Manufacturing Head | __________ | __________ | __________ |
| Qualified Person Authority | __________ | __________ | __________ |
| Human Resources Authority | __________ | __________ | __________ |
| Information Security Head | __________ | __________ | __________ |
| Site Quality Lead | __________ | __________ | __________ |

---

## 20. Cross-Module Event Contract

| Event | Emitter | Consumer | Payload key fields |
|---|---|---|---|
| `training_curriculum_created` | Module 28 | URS-30 | `curriculum_id`, `tenant_id`, `study_id`, `version` |
| `training_curriculum_released_effective` | Module 28 | URS-30, URS-13 | `curriculum_id`, `change_request_id`, `released_by`, `e_signature_id` |
| `training_curriculum_superseded` | Module 28 | URS-30 | `prior_curriculum_id`, `new_curriculum_id` |
| `training_question_bank_created` | Module 28 | URS-30 | `question_bank_id`, `linked_curriculum_id`, `version` |
| `training_question_bank_released` | Module 28 | URS-30 | `question_bank_id`, `released_by`, `e_signature_id` |
| `training_assignment_created` | Module 28 | URS-30 | `assignment_id`, `user_id`, `curriculum_id`, `assignment_source`, `due_date` |
| `training_assignment_due_soon` | Module 28 | URS-30 | `assignment_id`, `due_date`, `lead_time_days` |
| `training_assignment_completed` | Module 28 | URS-30 | `assignment_id`, `completed_at` |
| `training_assignment_waived` | Module 28 | URS-30 | `assignment_id`, `waived_by`, `waiver_reason`, `waiver_e_signature_id` |
| `training_assignment_exempted` | Module 28 | URS-30 | `assignment_id`, `exempted_by`, `exemption_evidence`, `exemption_e_signature_id` |
| `training_record_created` | Module 28 | URS-30 | `record_id`, `assignment_id`, `user_id` |
| `training_record_completed` | Module 28 | URS-30 | `record_id`, `completed_at`, `signature_timestamp` (server-attributed), `completion_e_signature_id` |
| `training_record_verified` | Module 28 | URS-30, **URS-23/-24/-25 (qualification consumer)** | `record_id`, `verified_by`, `verification_e_signature_id` |
| `training_assessment_submitted` | Module 28 | URS-30 | `assessment_id`, `record_id`, `question_bank_version_snapshot`, `score`, `pass_status` |
| `training_assessment_graded` | Module 28 | URS-30 | `assessment_id`, `graded_by`, `grade_e_signature_id` |
| `training_matrix_refreshed` | Module 28 | URS-26 (APQR consumer), URS-30 | `snapshot_id`, `formula_version`, `generated_by` |
| `training_gap_opened` | Module 28 | URS-30 | `gap_id`, `user_id`, `curriculum_id`, `gap_type` |
| `training_gap_overdue` | Module 28 | **URS-30 Notifications (primary consumer)**, URS-21 | `gap_id`, `due_date`, `days_overdue` |
| `training_gap_remediated` | Module 28 | URS-30 | `gap_id`, `remediated_by` |
| `training_gap_closed` | Module 28 | URS-30 | `gap_id`, `closed_by`, `closure_e_signature_id` |
| `training_gap_capa_linked` | Module 28 | **URS-18 (CAPA — primary consumer)**, URS-30 | `gap_id`, `capa_id`, `linked_by`, `source_type = training_gap` |
| `training_finding_created` | Module 28 | **URS-21 (Findings — primary consumer)**, URS-30 | `finding_id` (URS-21), `severity`, `finding_type`, `source_record_id` |
| `training_trigger_created` | Module 28 | URS-30 | `trigger_id`, `trigger_type`, `target_curriculum_id` |
| `training_trigger_executed` | Module 28 | URS-30 | `trigger_id`, `executed_at`, `outcome`, `assignments_created_count` |
| `training_program_locked` | Module 28 | URS-30 | `program_lock_id`, `study_id`, `locked_by`, `lock_e_signature_id` |
| `training_program_reopened` | Module 28 | URS-30, URS-21 (governed-reopen audit) | `program_lock_id`, `reopened_by`, `executive_co_signer`, `qp_co_signer`, `reopen_reason` |

---

## 21. References

- ARCH-AI-001 — AI Optionality and Manual Continuity (binding architecture)
- VRX-SPEC-URS-028-Training-Management-and-Qualification.md (Module specification)
- URS-01.URS-27, URS-29.URS-35 (cross-module contracts)
- FDA 21 CFR Part 11
- **FDA 21 CFR Part 211 §211.25** — Personnel Qualifications — primary FDA predicate
- FDA 21 CFR Part 211 §211.180
- **FDA 21 CFR Part 820.25** — Medical Device QSR Personnel
- FDA 21 CFR Part 58 — GLP Personnel
- EU GMP Annex 11
- **EU GMP Chapter 2 §2.10–§2.18** — Personnel Training and Qualification — primary EU predicate
- EU GMP Annex 22 (Draft 2025) §7 — internal forward-looking control
- EU AI Act (Regulation 2024/1689) Art. 13 / Annex III — internal forward-looking control
- MHRA Data Integrity Guidance (2018) — ALCOA+
- GAMP 5 Cat 5
- **ICH Q10 §3.2.3** — Training Management — primary ICH predicate
- ICH Q9
- ICH E6(R3) §2.8 GCP Sponsor Training
- **ISO 13485:2016 §6.2** Medical Device Personnel Competence
- **India CDSCO Schedule M (Revised) §5** — Personnel — primary India predicate
- India CDSCO Schedule M-III §3.1 — Medical Device Personnel

---

**END OF VRX-URS-28 — TRAINING MANAGEMENT AND QUALIFICATION — VERSION 1.0**