# Verixa — User Requirements Specification # Module 34: GDP Distribution, Warehouse, and Dispatch Controls | Field | Value | |---|---| | Document ID | VRX-URS-34 | | Version | 1.0 | | Status | Final — ready for QA, Validation, Regulatory Affairs, Information Security, Manufacturing Head, **Distribution Head / Responsible Person (Primary Owner — GDP authority)**, Site Quality Lead, Qualified Person Authority, and Founder approval. URS approval is separate from validation execution. This document becomes "Approved Controlled URS — released for engineering implementation and validation planning" only after signature capture in the Document Approval block. It becomes "Released for validation execution" only after the module migration evidence gate (URS-34-VAL-008) and validation evidence pack are satisfied. | | Document Type | User Requirements Specification (URS) | | GAMP 5 Category | Category 5 — Custom Application | | Code Modules | Target implementation binding: expected primary code module `gdp` (target backend path `packages/backend/src/modules/gdp/*`), expected supporting modules `sites`, `products`, `supplier-management`, `batch` (URS-23 — consumed for finished-goods inflow), `gmp` (URS-33 — consumed for QP-released finished-goods inflow per DEC-34-04), `audit-trail`, `auth/rbac`, `electronic_signatures`, `hitl`, `documents` (URS-12), `authority-check`, `context-filter`, `notifications`, expected API mounts `/api/v1/gdp/*` (canonical) consuming `/api/v1/gmp/*` for QP-certified released-batch inflow per URS-33, expected event-bus emission for `gdp_warehouse_receipt_completed`, `gdp_inventory_lot_created`, `gdp_inventory_lot_status_changed`, `gdp_quarantine_imposed`, `gdp_quarantine_released`, `gdp_dispatch_order_created`, `gdp_dispatch_order_released`, `gdp_dispatch_order_cancelled`, `gdp_shipment_departed`, `gdp_shipment_held`, `gdp_shipment_delivered`, `gdp_shipment_failed`, `gdp_transport_excursion_raised`, `gdp_transport_excursion_closed`, `gdp_proof_of_delivery_recorded`, `gdp_return_received`, `gdp_return_dispositioned`, `gdp_recall_execution_opened`, `gdp_recall_execution_progressed`, `gdp_recall_execution_closed`, `gdp_destruction_completed`, `gdp_program_locked`, `gdp_program_reopened`, expected MIRA context integration through `useMiraRecord('gdp_warehouse_receipt', id)`, `useMiraRecord('gdp_inventory_lot', id)`, `useMiraRecord('gdp_dispatch_order', id)`, `useMiraRecord('gdp_shipment', id)`, `useMiraRecord('gdp_transport_excursion', id)`, `useMiraRecord('gdp_return', id)`, `useMiraRecord('gdp_recall_execution', id)` mappings, expected URS-23 batch records consumer integration for finished-goods batch reference per DEC-34-04, expected URS-33 GMP consumer integration for QP-certified released-batch inflow per DEC-34-04 (URS-34 receives only from `gmp_batch_dispositions` with `disposition_type = released` AND `qp_certified` per URS-33 DEC-33-05 / DEC-33-06), expected URS-15 OOS / URS-16 Deviations / URS-17 RCA / URS-18 CAPA outbound emission for transport excursions / shipment failures / return discrepancies per DEC-34-12, expected URS-21 Findings outbound emission for chronic GDP control failures per DEC-34-15, expected URS-13 Change Control linkage for GDP transport-route effective release, expected URS-12 Document Control linkage for proof-of-delivery / destruction certificate / recall notification storage, expected URS-22 Inspection Mgmt back-room evidence retrieval source, expected URS-26 APQR data consumer for periodic GDP summary, expected URS-27 Regulatory Intelligence consumer for recall regulatory submission per DEC-34-13, expected URS-28 training qualification-gate consumer for **Responsible Person (RP)** / dispatch releaser / recall coordinator / cold-chain custodian authority per DEC-34-19, expected URS-30 Notifications outbound consumer for transport excursion / quarantine / dispatch hold / recall execution alerts per DEC-34-20, expected URS-32 MIRA outcome-label inbound emission per URS-32 DEC-32-23 (every GDP record MIRA influences carries `mira_outcome_label`), expected Authority Profile + HITL + e-signature integration for non-bypassable warehouse receipt acceptance / quarantine imposition / quarantine release / dispatch release / shipment hold / transport excursion closure / return disposition / recall execution / destruction completion / program lock / reopen, expected platform_admin / super_admin support / break-glass only paths. Implementation evidence remains subject to repository verification and validation evidence (this is a module specification — implementation evidence will be generated post-spec-release). | | Architecture Bindings | This module is subject to **ARCH-AI-001 AI Optionality and Manual Continuity** (canonical binding explicitly stated in Module specification: "any AI-assisted warehouse prioritization, FEFO recommendation, dispatch sequencing, route recommendation, temperature-excursion triage, return disposition recommendation, or MIRA GDP copilot function shall remain advisory only. Finished-goods receipt, putaway, quarantine, storage, allocation, dispatch release, transport hold, return intake, recall execution, and destruction disposition shall remain fully executable through manual controlled workflows when AI services are disabled, degraded, unavailable, or rejected. **No AI service shall be the sole path to release a GDP shipment, close a transport excursion, or disposition returned stock.**"). Verixa adopts internal forward-looking AI governance for this AI surface, aligned with the classification approach in **EU AI Act (Regulation 2024/1689) Annex III** (GDP distribution decisions impact patient safety through chain-of-custody integrity and recall execution timeliness). AI-assisted GDP surfaces (warehouse prioritization, FEFO recommendation, dispatch sequencing, route recommendation, temperature-excursion triage, return disposition recommendation, MIRA GDP copilot) are advisory only under internal AI governance aligned with EU AI Act Article 13 transparency principles + Article 14 human oversight. Every AI surface shall provide a fully functional manual warehouse receipt / putaway / quarantine / storage / allocation / dispatch release / transport hold / return intake / recall execution / destruction disposition path; GDP operations shall be executable when AI services are disabled, degraded, or overridden by the human operator. **No AI service shall be the sole path to release a GDP shipment, close a transport excursion, or disposition returned stock** (canonical binding). This module binds ARCH-AI-001 AC-1, AC-2, AC-3, AC-4, AC-6, and AC-7. Verixa treats **EU GMP Annex 22 Draft 2025 §7** as an internal forward-looking architectural control (not an enacted predicate rule); under that internal control, only static deterministic AI is permitted in critical GDP decisions; **generative / probabilistic AI is PROHIBITED in dispatch release decisions, transport excursion closure decisions, return disposition decisions, and recall execution decisions**. Static deterministic AI may surface FEFO ordering, similar prior excursions, and historical recall patterns as advisory help. Jurisdiction-specific legal enforceability of Annex 22 and the EU AI Act remains subject to a future jurisdiction-specific legal assessment. | | Regulatory Classification | Critical infrastructure substrate — operates the canonical GDP Distribution, Warehouse, and Dispatch Controls layer covering: (a) the **canonical module boundary** per DEC-34-01 — URS-34 is the **GDP post-manufacturing warehouse and distribution control layer** owning finished-goods warehouse receipt + warehouse location/stock ledger/FEFO allocation + status segregation + quarantine and hold control + dispatch preparation + shipment release + chain-of-custody + transport/cold-chain + excursion handling + proof of delivery / non-delivery / discrepancy + returns + market withdrawal + recall execution + destruction-disposition + GDP dashboards/trace exports/cross-module linkages; URS-34 does NOT duplicate URS-23 (Batch Records), URS-24 (Stability), URS-25 (EM), or URS-33 (GMP Manufacturing); (b) the **module boundary definition** per DEC-34-02 — URS-34 defines the target GDP module boundary and target implementation binding; (c) the **finished-goods inflow gate from URS-33** per DEC-34-04 — URS-34 receives only from `gmp_batch_dispositions` with `disposition_type = released` AND `qp_certified = true` per URS-33 DEC-33-05 / DEC-33-06; URS-34 rejects warehouse receipt of unreleased / unqualified batches with `GDP_BATCH_NOT_QP_RELEASED`; (d) the **warehouse receipt lifecycle** per DEC-34-05 — `received → quarantined → testing | released_for_distribution | rejected → destroyed`; (e) the **inventory lot lifecycle with FEFO allocation** per DEC-34-06 — `quarantined → released_for_distribution → allocated → shipped → delivered | returned | recalled | destroyed`; FEFO (First Expiry First Out) ordering enforced at allocation; (f) the **quarantine and hold control** per DEC-34-07 — quarantine BLOCKS distribution; hold authority required for release; (g) the **dispatch order and shipment release** per DEC-34-08 — dispatch lifecycle `draft → pending_release → released → in_transit → delivered | failed | returned`; release requires `gdp_dispatch_release_authority` (RP per EU GDP) + URS-28 qualification + HITL + bound e-signature; (h) the **transport / cold-chain / excursion handling** per DEC-34-09 — transport excursion lifecycle `raised → under_investigation → closed_acceptable | closed_unacceptable → batch_disposition_impact`; closure requires `gdp_transport_excursion_authority` + HITL + bound e-signature; cold-chain temperature data captured immutably; (i) the **proof-of-delivery / non-delivery / discrepancy** per DEC-34-10 — POD captured with delivery confirmation; non-delivery and discrepancy handling controlled; (j) the **returns lifecycle** per DEC-34-11 — return lifecycle `received → quarantined → assessed → dispositioned (return_to_stock | return_to_supplier | destroyed | held_for_investigation)`; disposition requires `gdp_return_disposition_authority` + HITL + bound e-signature; **returned stock cannot be returned to saleable inventory without QP/RP review per EU GDP Chapter 6.3 / India CDSCO rules**; (k) the **market withdrawal + recall execution** per DEC-34-12/-13 — recall lifecycle `opened → notification_dispatched → progressing → closed`; recall execution requires `gdp_recall_coordinator_authority` + HITL + bound e-signature + URS-27 Regulatory submission; recall classes per FDA/EU/CDSCO classification (Class I/II/III); (l) the **destruction-disposition** per DEC-34-14 — destruction with destruction certificate persisted as URS-12 document; (m) the **manufacturing/quality linkage to URS-33 / URS-15 / URS-16 / URS-18** per DEC-34-12 — transport excursions / shipment failures / return discrepancies emit linkage events to URS-15 OOS (where applicable) / URS-16 deviation / URS-18 CAPA; (n) the multi-dimensional context capture (`tenant_id` mandatory, `study_id` optional, `product_id` mandatory at lot level, `site_id` mandatory at warehouse level, `batch_id` mandatory at lot level, `customer_id` for dispatch, `recall_id` for recall execution); (o) the canonical API contract `/api/v1/gdp/*` per DEC-34-01; (p) the typed schema validation across every route per DEC-34-15 — no `db as any` (applying the typed-DB pattern from adjacent GMP); (q) the controlled frontend route surface; (r) the **attributable GDP audit logging** per DEC-34-16 (inheriting GMP DEC-33-03 lesson — every GDP audit-trail entry MUST persist authenticated `userId`; blank `userId` rejected); (s) the Authority/HITL/e-signature substrate on every regulated final action per DEC-34-17; (t) the AI/MIRA assistive-only constraint per DEC-34-18; (u) the post-locked record immutability across the GDP program; (v) the controlled reopen workflow with executive authority co-sign and Qualified Person co-sign per DEC-34-22; (w) the canonical findings emission to URS-21 per DEC-34-15; (x) the canonical CAPA emission to URS-18 per DEC-34-12; (y) the URS-26 APQR consumer integration per DEC-34-21; (z) the URS-28 training qualification-gate inbound consumer for RP / dispatch releaser / recall coordinator / cold-chain custodian per DEC-34-19; (aa) the URS-30 Notifications outbound consumer per DEC-34-20; (bb) the URS-32 MIRA outcome-label inbound emission per URS-32 DEC-32-23; and the per-jurisdictional regulatory expectations under **WHO GDP** (Good Distribution Practices for Pharmaceutical Products — WHO TRS 957 Annex 5); **EU GDP Guidelines (2013/C 343/01)** — primary EU predicate (full chapter set: Chapter 1 Quality Management, Chapter 2 Personnel including RP, Chapter 3 Premises and Equipment, Chapter 4 Documentation, Chapter 5 Operations, Chapter 6 Complaints/Returns/Falsified Medicinal Products/Recalls, Chapter 7 Outsourced Activities, Chapter 8 Self-Inspections, Chapter 9 Transportation); **EU GDP Guidelines for Active Substances (2015/C 95/01)** for API distribution; **PIC/S PE 011-1** (Good Distribution Practice); **MHRA UK GDP** (Statutory Instrument 2012 No. 1916); **FDA Drug Supply Chain Security Act (DSCSA)** + 21 CFR Parts 203/205 (PDMA) — primary FDA predicate; **21 CFR Part 211 §211.142 / §211.150** (Holding and Distribution); **21 CFR Part 11**; EU GMP Annex 11; EU GMP Annex 22 Draft 2025 §7 (HITL — internal forward-looking control); EU AI Act (Regulation 2024/1689) Annex III + Articles 13/14 (adopted as internal forward-looking AI governance); MHRA Data Integrity Guidance (ALCOA+); GAMP 5 Cat 5; ICH Q9 R1 (Quality Risk Management); ICH Q10 (Pharmaceutical Quality System); WHO TRS 961 Annex 9 (Model guidance for storage and transport of time- and temperature-sensitive pharmaceutical products); **India CDSCO Drug Distribution under D&C Act 1940 / Drugs Rules 1945 + Drug Distribution Schedule + Schedule M-III §16** for India distribution scope subject to a future jurisdiction-specific legal assessment for Verixa's exact CDSCO obligations. | | Date of Issue | 2026-05-07 | | Module Owner (Engineering) | Distribution / GDP Squad | | Module Owner (Quality Validation) | CSV / CSA Lead — GDP Distribution | | Module Owner (Compliance) | **Distribution Head / Responsible Person (RP) (Primary Owner — GDP authority per EU GDP Chapter 2)**, Quality Assurance, Regulatory Affairs, Manufacturing | | Approving Authority | Founder / Chairman & MD; QA Head; **Distribution Head / Responsible Person (Primary Owner)**; Manufacturing Head; Validation Head; RA Head; Information Security Head; Qualified Person (QP) Authority; Site Quality Lead | --- ## 0. Document Framing ### 0.1 Purpose of this document This URS defines the target expected state for Verixa's GDP Distribution, Warehouse, and Dispatch Controls module (Module 34). It is the binding contract between product, engineering, quality validation, regulatory affairs, **distribution (primary owner — RP per EU GDP Chapter 2)**, manufacturing, the Qualified Person authority, information security, and the executive authority for the design, implementation, validation, release, and on-going periodic review of the regulated GDP substrate: the **canonical module boundary** as the GDP post-manufacturing warehouse and distribution control layer per DEC-34-01; the ** posture** Module specification (no standalone GDP evidenced in the controlled gate) per DEC-34-02; the **finished-goods inflow gate from URS-33** per DEC-34-04; the warehouse receipt lifecycle per DEC-34-05; the inventory lot lifecycle with FEFO allocation per DEC-34-06; the quarantine and hold control per DEC-34-07; the dispatch order and shipment release per DEC-34-08; the transport / cold-chain / excursion handling per DEC-34-09; the proof-of-delivery / non-delivery / discrepancy per DEC-34-10; the returns lifecycle per DEC-34-11; the market withdrawal + recall execution per DEC-34-12/-13; the destruction-disposition per DEC-34-14; the manufacturing/quality linkage to URS-33/-15/-16/-18 per DEC-34-12; the multi-dimensional context capture; the canonical API contract `/api/v1/gdp/*`; the typed schema validation per DEC-34-15; the controlled frontend route surface; the attributable GDP audit logging per DEC-34-16; the Authority/HITL/e-signature substrate per DEC-34-17; the AI/MIRA assistive-only constraint per DEC-34-18; the post-locked record immutability; the controlled reopen workflow per DEC-34-22; the canonical findings emission to URS-21 per DEC-34-15; the canonical CAPA emission to URS-18 per DEC-34-12; the URS-26 APQR consumer integration; the URS-28 training qualification-gate inbound consumer for **Responsible Person (RP)** / dispatch releaser / recall coordinator / cold-chain custodian authority per DEC-34-19; the URS-30 Notifications outbound consumer per DEC-34-20; the URS-32 MIRA outcome-label inbound emission per URS-32 DEC-32-23; the audit trail coverage with reason-for-change discipline; and the per-jurisdictional regulatory expectations including the **full EU GDP Guidelines (2013/C 343/01) Chapter set** + **WHO GDP (TRS 957 Annex 5)** + **PIC/S PE 011-1** + **FDA DSCSA + 21 CFR Parts 203/205** + **21 CFR Part 211 §§211.142/.150** + **WHO TRS 961 Annex 9** (cold chain) + **India CDSCO D&C Act / Schedule M-III §16**. Compliance with this URS is mandatory. ### 0.2 Audience Engineering, QA, RA, Manufacturing, Qualified Person Authority, **Distribution (primary owner — RP)**, Cold-Chain Custodians, Recall Coordinators, Validation, Information Security, executive authority, the platform's Implementation team, internal and external auditors, and inspectors from regulatory bodies (FDA, EMA, MHRA, Health Canada, **CDSCO (India launch scope)**, PIC/S, PMDA, WHO). ### 0.3 Cross-references - **URS-01** Authentication, Session & Access Control - **URS-02** RBAC & Permissions — `gdp:*` permission set - **URS-03** Context Gate & Approval Scope - **URS-04** Workflow / HITL / E-Signature / Approval Authority - **URS-05** Authority Profile / Delegation / SoD — `gdp_warehouse_authority`, `gdp_quarantine_authority`, `gdp_dispatch_release_authority` (RP per EU GDP), `gdp_transport_excursion_authority`, `gdp_return_disposition_authority`, `gdp_recall_coordinator_authority`, `gdp_destruction_authority`, `qualified_person_authority`, `final_quality_approver`, `executive_authority` - **URS-06** Audit Trail / Hash Chain — attributable per DEC-34-16 - **URS-07** Study Management — optional study-scope - **URS-08** Tenant Management Lifecycle - **URS-09** Site / Facility Management — mandatory site-scope at warehouse level - **URS-10** Product / SKU / Drug Master Data — mandatory product-scope - **URS-11** Supplier Management — return-to-supplier linkage - **URS-12** Document Control — POD / destruction certificate / recall notification storage - **URS-13** Change Control — GDP transport-route effective release - **URS-14** Complaints — return-precipitated complaint linkage - **URS-15** OOS / OOT — outbound for transport excursion impact per DEC-34-12 - **URS-16** Deviations — outbound for transport excursion / shipment failure per DEC-34-12 - **URS-17** RCA — outbound consumer - **URS-18** CAPA — outbound for chronic GDP control failures per DEC-34-12 - **URS-19** Risk Assessment — outbound consumer - **URS-20** Reviews — outbound consumer - **URS-21** Findings — outbound for chronic GDP control failures per DEC-34-15 - **URS-22** Inspection Mgmt — back-room evidence retrieval source - **URS-23** Batch Records — **consumed for finished-goods batch reference** per DEC-34-04 - **URS-24** Stability — consumed - **URS-25** EM — consumed - **URS-26** APQR — primary periodic GDP-summary consumer - **URS-27** Regulatory Intelligence — primary outbound for recall regulatory submission per DEC-34-13 - **URS-28** Training — **primary inbound qualification-gate consumer** for RP / dispatch releaser / recall coordinator / cold-chain custodian per DEC-34-19 - **URS-29** Screen Reader — outbound provenance consumer - **URS-30** Notifications — primary outbound for transport excursion / quarantine / dispatch hold / recall execution alerts per DEC-34-20 - **URS-31** DQG — outbound provenance consumer - **URS-32** MIRA AI — read-only context; **MIRA outcome-label inbound emission per URS-32 DEC-32-23** - **URS-33** GMP Manufacturing — **primary consumed module per DEC-34-04** (URS-34 receives only QP-released finished-goods) - **URS-35** Infrastructure / Backup-Restore ### 0.4 Plain-language primer In a regulated pharmaceutical operation, **Good Distribution Practices (GDP)** is the controlled set of policies + workflows + audit-trail discipline ensuring finished medicinal products maintain their quality, integrity, and traceability throughout the distribution chain — from QP-released finished goods leaving manufacturing, through warehouse storage with FEFO allocation, through dispatch + transport (often cold-chain) to customers/distributors/pharmacies, through proof-of-delivery, returns, market withdrawals, and recalls. Module 34 is in the highest regulatory scope under: **EU GDP Guidelines (2013/C 343/01)** — primary EU predicate (full Chapter 1–9 set including Responsible Person (RP) accountability per Chapter 2; Operations + Returns + Recalls per Chapters 5/6); **WHO GDP (TRS 957 Annex 5)**; **PIC/S PE 011-1**; **FDA Drug Supply Chain Security Act (DSCSA)** + **21 CFR Parts 203/205 (PDMA)** — primary FDA predicate; **21 CFR Part 211 §§211.142/.150** (Holding and Distribution); **WHO TRS 961 Annex 9** (cold chain); **MHRA UK GDP**; **India CDSCO D&C Act / Drugs Rules 1945 / Schedule M-III §16** (for India launch scope). The most consequential design decision in Module 34 is the **module boundary definition** per DEC-34-02 — URS-34 defines the target GDP module boundary and target implementation binding. The second most consequential is the **finished-goods inflow gate from URS-33** per DEC-34-04 — URS-34 receives ONLY from `gmp_batch_dispositions` with `disposition_type = released` AND `qp_certified = true` per URS-33; warehouse receipt of unreleased / unqualified batches rejected with `GDP_BATCH_NOT_QP_RELEASED`. The third is the **quarantine BLOCKS distribution** principle per DEC-34-07. The fourth is the **FEFO (First Expiry First Out) allocation** per DEC-34-06 mandatory at allocation. The fifth is the **Responsible Person (RP) accountability** per EU GDP Chapter 2 — the RP MUST be URS-28 qualified per DEC-34-19; dispatch release MUST transit `gdp_dispatch_release_authority` (RP) + HITL + bound e-signature. The sixth is the **recall execution** per DEC-34-13 — recall coordinator MUST be URS-28 qualified; recall classes per FDA/EU/CDSCO (Class I/II/III); URS-27 Regulatory Intelligence submission triggered. The seventh is the **return-to-saleable-inventory restriction** per EU GDP Chapter 6.3 / India CDSCO — returned stock cannot return to saleable inventory without QP/RP review. The **AI-assistance** dimension is canonically explicit: "**no AI service shall be the sole path to release a GDP shipment, close a transport excursion, or disposition returned stock.**" Static deterministic AI (FEFO ordering, route optimization deterministic algorithms) may surface advisory help. Generative AI / LLMs are PROHIBITED in dispatch release / transport excursion closure / return disposition / recall execution decisions under the internal Annex 22 §7 + EU AI Act Annex III control. Every GDP record MIRA influences carries `mira_outcome_label` per URS-32 DEC-32-23. The **two-step release path** mirrors every other Module: this URS becomes "Approved Controlled URS — released for engineering implementation and validation planning" upon signature capture in the Document Approval block; it becomes "Released for validation execution" only after URS-34-VAL-008 (Migration Evidence Gate including the full implementation evidence) and the §17 validation evidence pack are satisfied. ### 0.5 Conventions Each requirement has a unique identifier. "MUST" denotes a mandatory requirement; "SHOULD" denotes a strong recommendation; "MAY" denotes an option. The document is self-contained: front end (§5), back end (§6), data model (§6.2), application programming interface (§6.3), workflow (§6.4), business rules (§6.5), audit (§6.6), security (§12), regulatory mapping (§14), test cases (§16), and validation evidence (§17) are all in this single file. ### 0.6 Glossary | Term | Definition | |---|---| | GDP | Good Distribution Practices — the regulated framework governing distribution of medicinal products from QP-released finished goods through dispatch, transport, return, and recall. | | Responsible Person (RP) | The named accountable person per EU GDP Chapter 2 § 2.2 with documented authority for distribution operations + recall execution; URS-28 qualified per DEC-34-19. | | Warehouse receipt | Inflow of finished-goods batch from URS-33 QP-released; lifecycle `received → quarantined → testing | released_for_distribution | rejected → destroyed` per DEC-34-05. | | Inventory lot | Tracked unit of finished goods in GDP stock ledger; lifecycle `quarantined → released_for_distribution → allocated → shipped → delivered | returned | recalled | destroyed` per DEC-34-06. | | FEFO | First Expiry First Out — mandatory allocation ordering per DEC-34-06 (selects lots with earliest expiry first within released_for_distribution state). | | Quarantine | Distribution block; controlled hold preventing dispatch; release requires `gdp_quarantine_authority` per DEC-34-07. | | Dispatch order | Customer order with allocated lots; lifecycle `draft → pending_release → released → in_transit → delivered | failed | returned`; release requires `gdp_dispatch_release_authority` (RP) per DEC-34-08. | | Transport excursion | Cold-chain temperature deviation or other transport incident; lifecycle `raised → under_investigation → closed_acceptable | closed_unacceptable → batch_disposition_impact` per DEC-34-09. | | Proof of Delivery (POD) | Confirmed delivery record with document + signature; non-delivery and discrepancy controlled per DEC-34-10. | | Return | Inflow of returned stock; lifecycle `received → quarantined → assessed → dispositioned (return_to_stock | return_to_supplier | destroyed | held_for_investigation)` per DEC-34-11. | | Market withdrawal | Voluntary product withdrawal short of recall. | | Recall | Mandatory product retrieval per regulatory class (Class I / II / III FDA; Class 1 / 2 / 3 EU); lifecycle `opened → notification_dispatched → progressing → closed` per DEC-34-13. | | Destruction | Final disposition with destruction certificate persisted as URS-12 document per DEC-34-14. | | Reopen | A governed transition event from `locked → in_progress` requiring `executive_authority` co-sign AND `qualified_person_authority` co-sign + reason; appends new program iteration without mutating prior locked evidence per DEC-34-22. | | ARCH-AI-001 | Platform architecture binding; canonically explicit GDP binding. | | Annex 22 | EU GMP Annex 22 (Draft 2025) §7 — internal forward-looking control. | | MIRA | Modular Intelligent Regulatory Assistant — read-only context; assistive only per DEC-34-18; outcome_label per URS-32 DEC-32-23. | ### 0.7 Module-34 architectural picture ```mermaid flowchart TD M33[/URS-33 GMP — QP-certified released batches/] --> WR[/Warehouse Receipt — DEC-34-05/] WR --> INV[/Inventory Lots — FEFO — DEC-34-06/] INV --> QUAR[/Quarantine / Hold — DEC-34-07/] INV --> ALLOC[Allocation — FEFO] ALLOC --> DO[/Dispatch Orders — DEC-34-08/] DO --> REL[Release — RP + URS-28 + HITL + bound e-sign] REL --> SHIP[/Shipments — DEC-34-08/] SHIP --> TRANSIT[In Transit] TRANSIT --> COLD[/Cold-Chain Monitoring/] COLD --> EXC[/Transport Excursions — DEC-34-09/] EXC --> M15[URS-15 OOS] EXC --> M16[URS-16 Deviations] TRANSIT --> POD[/Proof of Delivery — DEC-34-10/] POD --> DELIVERED[Delivered] POD --> FAILED[Failed] FAILED --> RET[/Returns — DEC-34-11/] DELIVERED -. customer return.-> RET RET --> RDISP[Return Disposition — RP + HITL + bound e-sign] RDISP --> R2STK[return_to_stock — QP review per EU GDP 6.3] RDISP --> R2SUP[return_to_supplier] RDISP --> DESTR[/Destruction — DEC-34-14/] RDISP --> HELD[held_for_investigation] RECALL[/Recall Execution — DEC-34-13/] RECALL --> M27[URS-27 Regulatory Intelligence] RECALL --> NOTIF[/Recall Notifications via URS-30/] AI[MIRA AI — read-only context] -. outcome_label per URS-32 DEC-32-23.-> WR / INV / DO / SHIP / EXC / RET / RECALL M21[URS-21 Findings] <-- chronic GDP failures per DEC-34-15 M18[URS-18 CAPA] <-- chronic GDP CAPA per DEC-34-12 M30[URS-30 Notifications] <-- excursion / quarantine / dispatch hold / recall alerts per DEC-34-20 M28[URS-28 Training] -- qualification gate for RP / dispatch / recall / cold-chain --> REL / EXC / RDISP / RECALL M26[URS-26 APQR] <-- periodic GDP summary M22[URS-22 Inspection] -- back-room retrieval --> INV / SHIP / RECALL LOCK[Program Lock] --> WR LOCK -. governed reopen + executive + QP co-sign.-> WR ``` --- ## 1. Scope and Out-of-Scope ### 1.1 In-scope - The canonical GDP post-manufacturing warehouse and distribution control layer (Module specification). - The finished-goods inflow gate from URS-33 (QP-released batches only). - The warehouse receipt, inventory lot, FEFO allocation, quarantine, dispatch, shipment, transport excursion, POD, return, recall, destruction lifecycles. - The Authority/HITL/e-signature substrate on every regulated final action. - The attributable GDP audit logging (lesson learned from GMP DEC-33-03). - The typed DB schema enforcement (lesson learned from GMP DEC-33-04). - The MIRA copilot read-only context integration with `mira_outcome_label` inbound per URS-32 DEC-32-23. - The findings emission to URS-21. - The CAPA emission to URS-18. - The deviations emission to URS-16. - The OOS emission to URS-15 (transport excursion impact). - The change-control linkage to URS-13 for GDP transport-route effective release. - The URS-12 Document Control linkage for POD / destruction certificate / recall notification storage. - The URS-26 APQR consumer integration. - The URS-27 Regulatory Intelligence submission for recalls. - The URS-28 training qualification-gate inbound consumer for RP / dispatch releaser / recall coordinator / cold-chain custodian. - The URS-30 Notifications outbound consumer for GDP critical alerts. - The governed reopen workflow. - The per-jurisdictional regulatory expectations including the full EU GDP Chapter set + WHO GDP + PIC/S PE 011-1 + FDA DSCSA + 21 CFR Parts 203/205/211 + WHO TRS 961 Annex 9 + India CDSCO D&C Act / Schedule M-III §16. ### 1.2 Out-of-scope - **Batch execution / batch records authoring** — owned by URS-23. - **Stability authoring** — owned by URS-24. - **EM authoring** — owned by URS-25. - **GMP manufacturing operations / batch review / QP certification / batch disposition** — owned by URS-33 (consumed not duplicated). - The CAPA / change-control / findings / document-control / training / notifications / MIRA registers themselves. - Direct integration with specific 3PL / TMS vendors — generic shipment-tracking pattern in scope; vendor connectors are future-state. - Direct integration with serialization providers (Saviynt / TraceLink) — DSCSA serialization data scope is identifiers + integration hooks; full vendor connectors are future-state. --- ## 2. Preconditions, Dependencies, Constraints ### 2.1 Operating preconditions The following preconditions MUST hold for this URS to apply at validation time. Each bullet is a binding precondition; deviations require a controlled exception per URS-13 Change Control. - The platform's foundational substrates (URS-01.URS-13, URS-22.URS-28, URS-30, URS-32, URS-33, URS-35) are released and operational at validation time. - Responsible Persons (RPs), dispatch releasers, recall coordinators, cold-chain custodians are URS-28 qualified per DEC-34-19. - AI-assisted GDP surfaces are advisory only. - The tenant operating jurisdiction(s) are configured, with **India CDSCO as a primary launch scope jurisdiction**. ### 2.2 Dependencies - URS-01.URS-33, URS-35 platform contracts. - The `electronic_signatures` substrate. - The `authority` substrate. - The `hitl` substrate. - The `audit_trail` substrate. - The `documents` substrate (URS-12). - The `gmp` substrate (URS-33 — consumed for QP-released finished-goods inflow). - The `batch` substrate (URS-23 — consumed for batch reference). - The `change_control` substrate (URS-13). - The training `qualification-gate` substrate (URS-28). - The `notifications` substrate (URS-30). - The MIRA `outcome_label` outbound emission per URS-32 DEC-32-23. ### 2.3 Constraints - The canonical API mount is `/api/v1/gdp/*`. - **URS-34 receives only QP-released finished-goods from URS-33** per DEC-34-04 — no warehouse receipt of unreleased / unqualified batches. - AI-assisted content is advisory-only; **no AI service is the sole path to release a GDP shipment, close a transport excursion, or disposition returned stock**. - Generative AI is prohibited in dispatch release / transport excursion closure / return disposition / recall execution decisions. - **FEFO allocation mandatory** at lot allocation per DEC-34-06. - **Quarantine BLOCKS distribution** per DEC-34-07. - **Returned stock cannot return to saleable inventory without QP/RP review** per EU GDP Chapter 6.3 / DEC-34-11. - Lifecycle status mutation through generic update / generic PATCH rejected per DEC-34-15. - GDP audit-trail entries MUST persist authenticated `userId` per DEC-34-16 (lesson learned from GMP). - Every GDP DB query MUST use typed schema per DEC-34-15 (lesson learned from GMP). - RP / dispatch releaser / recall coordinator / cold-chain custodian MUST satisfy URS-28 qualification-gate per DEC-34-19. --- ## 3. Closed Launch Decisions ### 3.1 Decision register | Decision ID | Title | Locked decision | |---|---|---| | DEC-34-01 | Two-step release path + canonical API contract + canonical module boundary | Module 34 follows the same two-step release path; canonical API mount `/api/v1/gdp/*`; **URS-34 is the GDP post-manufacturing warehouse and distribution control layer over URS-33 (QP-released finished-goods inflow consumer) — URS-34 does NOT duplicate URS-23/24/25/33 record models; URS-34 governs warehouse + dispatch + transport + return + recall + destruction**. | | DEC-34-02 | Module boundary definition | URS-34 defines the target GDP module boundary and target implementation binding. Target backend code module: `packages/backend/src/modules/gdp/*`. Target frontend pages: `packages/frontend/src/pages/gdp/*`. Target frontend API hooks: `packages/frontend/src/api/hooks/useGdp.ts`. | | DEC-34-03 | Multi-dimensional context model | `tenant_id` mandatory, `study_id` optional, `product_id` mandatory at lot level, `site_id` mandatory at warehouse level, `batch_id` mandatory at lot level (FK to URS-23), `customer_id` for dispatch, `recall_id` for recall execution. | | DEC-34-04 | **Finished-goods inflow gate from URS-33** | URS-34 receives ONLY from `gmp_batch_dispositions` with `disposition_type = released` AND `qp_certified = true` per URS-33 DEC-33-05 / DEC-33-06; warehouse receipt of unreleased / unqualified batches rejected with `GDP_BATCH_NOT_QP_RELEASED`; cross-module gate enforced at warehouse receipt creation. | | DEC-34-05 | Warehouse receipt lifecycle | Warehouse receipt lifecycle is `received → quarantined → testing | released_for_distribution | rejected → destroyed`; release-for-distribution requires `gdp_warehouse_authority` + URS-28 qualification + HITL + bound e-signature; rejection requires reason + URS-15 OOS / URS-16 deviation linkage where applicable. | | DEC-34-06 | **Inventory lot lifecycle with FEFO allocation** | Inventory lot lifecycle is `quarantined → released_for_distribution → allocated → shipped → delivered | returned | recalled | destroyed`; **FEFO (First Expiry First Out) ordering MANDATORY at allocation** — system selects lots with earliest expiry first within `released_for_distribution` state; manual override permitted only with `gdp_warehouse_authority` + reason; FEFO override audited. | | DEC-34-07 | **Quarantine and hold control — quarantine BLOCKS distribution** | Quarantine on inventory lot BLOCKS dispatch + allocation; release from quarantine requires `gdp_quarantine_authority` + HITL + bound e-signature + reason; quarantine reasons captured (lab test pending, suspected damage, suspected counterfeit per FDA DSCSA, recall hold, regulatory hold). | | DEC-34-08 | **Dispatch order and shipment release with RP authority** | Dispatch order lifecycle is `draft → pending_release → released → in_transit → delivered | failed | returned`; release from `pending_release → released` requires `gdp_dispatch_release_authority` (Responsible Person per EU GDP Chapter 2) + URS-28 qualification + HITL + bound e-signature per DEC-34-19; dispatch release validates: all allocated lots in `released_for_distribution` state, no quarantine, no active recall on any allocated lot, customer authorized for product class, transport conditions appropriate per cold-chain requirements. | | DEC-34-09 | **Transport / cold-chain / excursion handling** | Transport excursion lifecycle is `raised → under_investigation → closed_acceptable | closed_unacceptable → batch_disposition_impact`; cold-chain temperature data captured immutably (every reading with timestamp + location + device ID); excursion raised automatically on temperature breach beyond configurable threshold OR manually; closure requires `gdp_transport_excursion_authority` + HITL + bound e-signature + scientific assessment; `closed_unacceptable` triggers URS-15 OOS / URS-16 deviation linkage and impacts batch disposition (URS-33). | | DEC-34-10 | Proof-of-Delivery / non-delivery / discrepancy | POD captured with delivery confirmation + recipient signature + timestamp + photo (where applicable) — POD document persisted in URS-12; non-delivery requires reason + investigation; discrepancy (missing units, damaged packaging) triggers URS-16 deviation linkage. | | DEC-34-11 | **Returns lifecycle — return-to-saleable-inventory restriction per EU GDP 6.3** | Return lifecycle is `received → quarantined → assessed → dispositioned (return_to_stock | return_to_supplier | destroyed | held_for_investigation)`; **`return_to_stock` requires QP/RP review per EU GDP Chapter 6.3 and India CDSCO** + `gdp_return_disposition_authority` + HITL + bound e-signature; CDSCO/EU/FDA "no return to saleable inventory without strict criteria" rule enforced (return must satisfy: original packaging intact, controlled storage chain maintained, no temperature excursion in transit, no contamination, within product expiry, RP-signed certification). | | DEC-34-12 | Manufacturing/quality linkage to URS-33/-15/-16/-18 | Transport excursions / shipment failures / return discrepancies emit linkage events: `gdp_transport_excursion_oos_linked` to URS-15 (where OOS classification applies), `gdp_transport_excursion_deviation_created` to URS-16, `gdp_return_discrepancy_deviation_created` to URS-16, batch-impact events to URS-33 batch disposition; chronic GDP failures escalated to CAPA emit `gdp_capa_linked` event consumed by URS-18. | | DEC-34-13 | **Market withdrawal + recall execution per regulatory class** | Recall lifecycle is `opened → notification_dispatched → progressing → closed`; recall execution requires `gdp_recall_coordinator_authority` + URS-28 qualification + HITL + bound e-signature; **recall classes per FDA / EU / CDSCO classification**: FDA Class I (serious adverse health consequences) / Class II (temporary/medically reversible) / Class III (not likely to cause adverse consequences); EU Class 1 / 2 / 3 parallel; CDSCO classification per CDSCO Recall Guidelines; URS-27 Regulatory Intelligence submission triggered for regulator notification per timeline (FDA 24h for Class I; EU 24h for Class 1; CDSCO per CDSCO Recall Guidelines); URS-30 Notifications dispatch to affected customers + supply chain. | | DEC-34-14 | Destruction-disposition with destruction certificate | Destruction final disposition with destruction certificate persisted as URS-12 controlled document; `gdp_destruction_authority` + HITL + bound e-signature; destruction reason captured (expired, damaged, recalled, counterfeit per DSCSA, return-rejected). | | DEC-34-15 | **Typed DB schema enforcement + non-bypassable lifecycle transitions + findings emission to URS-21** | (a) Every GDP DB query MUST use typed schema; `db as any` prohibited at build time (lesson learned from GMP DEC-33-04); (b) Lifecycle status mutation through generic update / generic PATCH prohibited; dedicated transition routes only; (c) Chronic GDP control failures (chronic excursion patterns, chronic dispatch failures, chronic return discrepancies, chronic recall ineffectiveness) emit `gdp_finding_created` event to URS-21 with `gdp_distribution_control` source type. | | DEC-34-16 | **Attributable GDP audit logging** (inheriting GMP DEC-33-03 lesson) | Every GDP service create / update / transition method MUST persist authenticated `userId` from session context in audit-trail entry; **blank `userId` is rejected with `GDP_AUDIT_USER_ID_REQUIRED`**; ensures ALCOA+ Attributable principle compliance; explicit lesson learned from canonical GMP audit gap closed via DEC-33-03. | | DEC-34-17 | Authority/HITL/e-signature on every regulated final action | Warehouse receipt acceptance + quarantine imposition + quarantine release + dispatch release (RP) + shipment hold + transport excursion closure + return disposition + recall execution + destruction completion + program lock + reopen all use `withAuthority(.)` + HITL + bound e-signature persisted via `electronic_signatures` substrate. | | DEC-34-18 | AI/MIRA assistive-only constraint + URS-32 MIRA outcome-label inbound emission | AI/MIRA remains assistive only per ARCH-AI-001 binding; **MIRA never the sole path to release a GDP shipment, close a transport excursion, or disposition returned stock**; advisory-only labeling on AI surfaces (warehouse prioritization, FEFO recommendation, dispatch sequencing, route recommendation, temperature-excursion triage, return disposition recommendation); **every GDP record MIRA influences carries `mira_outcome_label`** per URS-32 DEC-32-23 inbound emission — `mira_outcome_label` column added to every GDP primary record table; GenAI prohibited in dispatch release / transport excursion closure / return disposition / recall execution decisions per Annex 22 §7 internal control. | | DEC-34-19 | **URS-28 training qualification-gate inbound consumer for RP / dispatch releaser / recall coordinator / cold-chain custodian** | The Responsible Person (RP) per EU GDP Chapter 2 + dispatch release authority + recall coordinator + cold-chain custodian MUST satisfy URS-28 qualification-gate per URS-28 DEC-28-23 — `GET /training/qualification/:userId/responsible_person` for RP; `GET /training/qualification/:userId/dispatch_release` for dispatch release; `GET /training/qualification/:userId/recall_coordinator` for recall coordinator; `GET /training/qualification/:userId/cold_chain_custodian` for cold-chain custodian; qualification-gate failure rejects with `GDP_AUTHORITY_QUALIFICATION_GATE_FAILED`. | | DEC-34-20 | URS-30 Notifications outbound consumer for GDP critical alerts | GDP critical alerts (warehouse receipt failure, quarantine imposition, dispatch hold, transport excursion raised, transport excursion closed_unacceptable, return discrepancy, recall execution opened, recall progress milestones, destruction completed) emitted as events consumed by URS-30 Notifications dispatcher per DEC-34-20 + URS-30 mandatory-alert allowlist per URS-30 DEC-30-05 (these are mandatory alerts forced regardless of user preferences). | | DEC-34-21 | URS-26 APQR periodic GDP-summary consumer | URS-26 APQR consumes periodic GDP-control summary (warehouse receipt rate, dispatch on-time rate, transport excursion rate, return rate, recall rate, destruction rate) for periodic product quality review per URS-26 lifecycle. | | DEC-34-22 | GDP program reopen as governed transition | Program `locked → in_progress` requires `executive_authority` co-sign AND `qualified_person_authority` co-sign + documented reason; appends a new program iteration without mutating prior locked evidence (consistent with M14.M33 reopen pattern). | | DEC-34-23 | platform_admin / super_admin support / break-glass + India CDSCO launch scope | `platform_admin` / `super_admin` are support / break-glass only paths; **India CDSCO Drug Distribution under D&C Act 1940 / Drugs Rules 1945 + Schedule M-III §16 + India Drug Distribution Schedule is a primary launch-scope jurisdiction** subject to a future jurisdiction-specific legal assessment; aligned with URS-33 India launch scope priority. | ### 3.2 Locked-decision rationale narrative The decisions above define the binding launch posture for Module 34 v1.0. The most consequential locked controls are: (a) **DEC-34-02 anchors the module boundary posture** — URS-34 defines the target GDP module boundary and target implementation binding, leveraging adjacent GMP/manufacturing patterns; (b) **DEC-34-04 establishes the finished-goods inflow gate from URS-33** — the cross-module integrity contract ensuring only QP-released batches enter distribution; (c) **DEC-34-06 mandates FEFO allocation** — the fundamental GDP allocation principle preventing aged-stock-first dispatch; (d) **DEC-34-07 establishes quarantine BLOCKS distribution** — the fundamental GDP segregation principle; (e) **DEC-34-08 anchors RP authority for dispatch release** per EU GDP Chapter 2 — the named accountable distribution authority pattern; (f) **DEC-34-11 enforces return-to-saleable-inventory restriction per EU GDP 6.3** — preventing degraded returned stock from re-entering supply chain; (g) **DEC-34-13 anchors recall execution per regulatory class** with URS-27 Regulatory Intelligence submission and URS-30 Notifications dispatch within regulatory timelines (FDA 24h Class I); (h) **DEC-34-15 + DEC-34-16 mandate typed schema + attributable audit** consistent with the GMP pattern (URS-33 DEC-33-04 / DEC-33-03); (i) **DEC-34-18 binds AI/MIRA to assistive-only** with `outcome_label` inbound; (j) **DEC-34-19 introduces URS-28 qualification-gate inbound consumption** for RP / dispatch releaser / recall coordinator / cold-chain custodian; (k) DEC-34-22 defines reopen as a governed append-only transition consistent with the Module-14..-33 reopen pattern. ### 3.3 Closed launch decisions: cross-link to items | Specification item | Evidence basis | Locked decision | |---|---|---| | Module boundary definition | URS-34 defines target GDP module boundary | DEC-34-02 | | Module boundary against URS-23/24/25/33 | Canonical revised series boundary | DEC-34-01 / DEC-34-04 | | Shared platform controls exist but not GDP-bound | Adjacent GMP/manufacturing controls evidenced | DEC-34-15 / DEC-34-16 / DEC-34-17 | | GDP audit attribution cannot inherit weak patterns | Lesson learned from GMP DEC-33-03 | DEC-34-16 | | GDP workflow transitions shall be non-bypassable from first release | Canonical | DEC-34-15 | | AI/MIRA assistive-only binding | Canonical ARCH-AI-001 explicit | DEC-34-18 | ### 3.4 Locked-decision authority Each locked decision is approved by the Founder / Chairman & MD on signature capture in the Document Approval block of this URS (§19). Decisions cannot be unlocked except through controlled URS revision under the URS change-control process and re-approval. ### 3.5 Worked examples **Worked example 1 — Warehouse receipt of QP-released finished goods.** URS-33 emits `gmp_batch_qp_certified` for batch `BR-PTabs-2026-08-12-001` with disposition `released`. URS-34 consumes the event and creates a warehouse receipt record `WR-PTabs-2026-08-15-001` in `received` state. The receipt validates per DEC-34-04 — batch is QP-certified AND disposition is `released` — passes. Operator A enters quantities + storage location; receipt transitions `received → quarantined`. Lab QC samples; transitions `quarantined → testing → released_for_distribution` per DEC-34-05 with `gdp_warehouse_authority` + URS-28 qualification + HITL + bound e-signature. Inventory lot `LOT-PTabs-2026-08-15-001` created in `released_for_distribution` state per DEC-34-06. **Worked example 2 — Inflow rejected (batch not QP-certified).** A user attempts to create warehouse receipt referencing batch `BR-PTabs-NEW` which is in `qa_review_pending` state in URS-33 (not yet QP-certified). Per DEC-34-04 cross-module gate, URS-34 rejects with `GDP_BATCH_NOT_QP_RELEASED`. Operator must wait for URS-33 QP certification before warehouse receipt can be created. **Worked example 3 — FEFO allocation on dispatch order.** Customer orders 10,000 units of P-Tabs. Available lots in `released_for_distribution`: LOT-A (expiry 2027-01-15, 5000 units), LOT-B (expiry 2027-03-20, 8000 units), LOT-C (expiry 2027-06-10, 12000 units). Per DEC-34-06 FEFO, system allocates: LOT-A 5000 + LOT-B 5000 = 10000 units. Dispatch order created with allocated lots. Override permitted only with `gdp_warehouse_authority` + reason + audit (e.g., customer-specific product code mismatch). **Worked example 4 — Quarantine BLOCKS dispatch.** LOT-A is in quarantine due to suspected damage (lab investigation). Operator B attempts dispatch order using LOT-A. Per DEC-34-07, system rejects. After investigation, `gdp_quarantine_authority` releases LOT-A from quarantine with HITL + bound e-signature + reason. Dispatch order can now proceed. **Worked example 5 — RP dispatch release per EU GDP Chapter 2.** Dispatch order `DO-2026-08-20-001` is in `pending_release` state. The Responsible Person (RP) per EU GDP Chapter 2 — Mr. X — is URS-28 qualified per `responsible_person` role per DEC-34-19. The RP reviews dispatch with HITL + bound e-signature; system validates: all allocated lots in `released_for_distribution`, no quarantine, no active recall, customer authorized, transport conditions appropriate. Dispatch transitions `pending_release → released → in_transit`. **Worked example 6 — Cold-chain transport excursion.** Shipment `SHIP-2026-08-21-001` (cold-chain product, 2–8°C) is in transit. Cold-chain monitor records temperature breach to 12°C for 4 hours. Transport excursion `EXC-2026-08-21-001` raised automatically per DEC-34-09. Excursion transitions `raised → under_investigation`. Quality assessment: temperature excursion exceeds product stability shelf-life impact threshold per URS-24 stability data. `gdp_transport_excursion_authority` (URS-28 qualified) closes excursion as `closed_unacceptable` with HITL + bound e-signature; emits `gdp_transport_excursion_oos_linked` to URS-15 + `gdp_transport_excursion_deviation_created` to URS-16; batch disposition impact triggered per URS-33. **Worked example 7 — Return to saleable inventory rejected per EU GDP 6.3.** Customer returns 100 units of P-Tabs reporting wrong product. Return `RET-2026-08-25-001` received → quarantined → assessed. Per EU GDP Chapter 6.3, RP review required for `return_to_stock`. Investigation finds packaging damaged; RP determines criteria not met (packaging not intact); disposition is `held_for_investigation` then `destroyed` per DEC-34-11 + DEC-34-14; destruction certificate persisted as URS-12 document. **Worked example 8 — FDA Class I recall execution.** Quality investigation determines product P-Tabs may cause serious adverse health consequences. Recall opened as FDA Class I per DEC-34-13. `gdp_recall_coordinator_authority` (URS-28 qualified) opens recall execution with HITL + bound e-signature. URS-27 Regulatory Intelligence regulatory submission triggered to FDA within 24 hours per FDA Class I timeline. URS-30 Notifications dispatch to all affected customers + distributors + pharmacies. Recall transitions `opened → notification_dispatched → progressing`. As affected lots are returned, return records created with `recall` linkage. Recall closes when affected stock recovered + destroyed. **Worked example 9 — India CDSCO Drug Distribution scope.** A batch manufactured at India site for India CDSCO market follows India CDSCO Drug Distribution under D&C Act 1940 + Drugs Rules 1945 + Schedule M-III §16 per DEC-34-23. RP qualifications per India CDSCO drug distribution rules verified per DEC-34-19; URS-27 Regulatory submission for any recall follows CDSCO Recall Guidelines. **Worked example 10 — Governed reopen of locked GDP program.** On `2027-04-15` an inspection finding (URS-22) reveals a previously locked GDP program may have under-recorded one transport excursion. Distribution Head initiates reopen; per DEC-34-22 + SoD-34-06, both `executive_authority` co-sign AND `qualified_person_authority` co-sign + documented reason are required. On both co-signs the program transitions `locked → in_progress` and a new program iteration is appended; the prior locked evidence is NOT mutated. --- ## 4. End-to-End User Journeys (28 launch journeys) | # | Journey | Actor | Pre-condition | Path | Post-condition | |---|---|---|---|---|---| | 1 | Receive QP-released finished-goods batch | Warehouse Operator | URS-33 batch QP-certified + released | Create warehouse receipt referencing URS-33 batch per DEC-34-04 | Receipt created in `received`; audit per DEC-34-16 | | 2 | Reject warehouse receipt of unreleased batch | System (cross-module gate per DEC-34-04) | Batch not QP-released | Reject with `GDP_BATCH_NOT_QP_RELEASED` | Operation rejected | | 3 | Putaway to warehouse location | Warehouse Operator | Receipt `received` | Record putaway; transition `received → quarantined` | Receipt `quarantined` | | 4 | Release receipt for distribution | `gdp_warehouse_authority` (URS-28 qualified) | Receipt `quarantined`; QC tested | HITL + bound e-sign per DEC-34-05 | Receipt `released_for_distribution`; lot created per DEC-34-06 | | 5 | Reject receipt | `gdp_warehouse_authority` | QC failed | HITL + bound e-sign + reason + URS-15/-16 linkage | Receipt `rejected` | | 6 | Quarantine inventory lot | `gdp_quarantine_authority` (URS-28 qualified) | Quarantine reason | HITL + bound e-sign per DEC-34-07 | Lot `quarantined`; dispatch BLOCKED | | 7 | Reject dispatch using quarantined lot | System (cross-module gate per DEC-34-07) | Dispatch attempt with quarantined lot | Reject | Operation rejected | | 8 | Release lot from quarantine | `gdp_quarantine_authority` | Quarantine investigation complete | HITL + bound e-sign per DEC-34-07 | Lot `released_for_distribution` | | 9 | Create dispatch order with FEFO allocation | Dispatch Operator | Customer order; available lots | System auto-allocates per FEFO per DEC-34-06 | Dispatch order `draft` with FEFO-allocated lots | | 10 | FEFO override with reason | `gdp_warehouse_authority` | Customer-specific product code mismatch | Override allocation + reason + audit per DEC-34-06 | Override applied; audited | | 11 | RP dispatch release | `gdp_dispatch_release_authority` (RP per EU GDP Chapter 2; URS-28 qualified per DEC-34-19) | Dispatch `pending_release`; all validations pass | HITL + bound e-sign per DEC-34-08 | Dispatch `released → in_transit` | | 12 | Reject dispatch release without RP qualification | System (per DEC-34-19) | Acting user not URS-28 qualified for `responsible_person` | Reject with `GDP_AUTHORITY_QUALIFICATION_GATE_FAILED` | Operation rejected | | 13 | Cold-chain temperature monitoring | System (continuous) | Shipment `in_transit` | Capture temperature readings immutably per DEC-34-09 | Readings persisted | | 14 | Auto-raise transport excursion on temperature breach | System (per DEC-34-09) | Temperature exceeds threshold | Create excursion `raised` | Excursion raised; URS-30 notification per DEC-34-20 | | 15 | Investigate transport excursion | `gdp_transport_excursion_authority` (URS-28 qualified) | Excursion `raised` | Transition to `under_investigation` | Investigation in progress | | 16 | Close excursion as acceptable | `gdp_transport_excursion_authority` | Investigation complete; impact assessment OK | HITL + bound e-sign + scientific assessment per DEC-34-09 | Excursion `closed_acceptable` | | 17 | Close excursion as unacceptable | `gdp_transport_excursion_authority` | Investigation complete; impact unacceptable | HITL + bound e-sign + emit URS-15/-16 linkage + URS-33 batch impact per DEC-34-12 | Excursion `closed_unacceptable`; OOS / deviation / batch impact triggered | | 18 | Record proof of delivery | Delivery Coordinator | Shipment delivered | POD with signature + timestamp + photo per DEC-34-10; persist POD as URS-12 doc | POD recorded; shipment `delivered` | | 19 | Record non-delivery / discrepancy | Delivery Coordinator | Delivery failed or discrepant | Reason + investigation + URS-16 deviation linkage per DEC-34-10 | Investigation triggered | | 20 | Receive return | Return Coordinator | Customer return arrived | Create return in `received → quarantined` per DEC-34-11 | Return quarantined | | 21 | Disposition return as `return_to_stock` (with QP/RP review) | `gdp_return_disposition_authority` + QP / RP review per EU GDP 6.3 | All criteria met (intact packaging, controlled chain, no excursion, no contamination, within expiry) | HITL + bound e-sign + RP-signed certification per DEC-34-11 | Return `dispositioned = return_to_stock`; lot returned to inventory | | 22 | Disposition return as `destroyed` | `gdp_return_disposition_authority` | Criteria not met | HITL + bound e-sign + reason; create destruction record per DEC-34-14 | Return `dispositioned = destroyed`; destruction certificate as URS-12 doc | | 23 | Open FDA Class I recall | `gdp_recall_coordinator_authority` (URS-28 qualified) | Quality investigation triggers recall | HITL + bound e-sign + URS-27 Regulatory submission within 24h + URS-30 Notifications dispatch per DEC-34-13 / DEC-34-20 | Recall `opened → notification_dispatched` | | 24 | Track recall progress | Recall Coordinator | Recall `progressing` | Update recall progress; affected lots returned recorded | Recall progressing | | 25 | Close recall | `gdp_recall_coordinator_authority` | Affected stock recovered + destroyed | HITL + bound e-sign per DEC-34-13 | Recall `closed` | | 26 | Destroy stock | `gdp_destruction_authority` | Destruction reason (expired / damaged / recalled / counterfeit / return-rejected) | HITL + bound e-sign + destruction certificate as URS-12 doc per DEC-34-14 | Destruction completed | | 27 | Reject AI-only dispatch release / excursion closure / return disposition / recall | System (per DEC-34-18) | AI service as acting principal | Reject with `GDP_AI_AS_AUTHORITATIVE_PROHIBITED` | Operation rejected | | 28 | Reopen locked GDP program (governed transition) | Distribution Head + Executive Authority + Qualified Person | Program `locked` | Executive co-sign AND QP co-sign + reason; transition `locked → in_progress`; append new iteration per DEC-34-22 | Program `in_progress`; new iteration appended; prior locked evidence NOT mutated | --- ## 5. Front-end Requirements ### 5.1 GDP Dashboard The dashboard (URS-34-FE-001) renders summary cards (warehouse receipts pending, inventory by status, quarantine queue, dispatch orders pending RP release, transport excursions raised, returns pending disposition, active recalls, destruction queue) with filters; uses canonical `/gdp/*` hooks per DEC-34-01. ### 5.2 Warehouse Console Renders warehouse receipt lifecycle per DEC-34-05 with HITL + bound e-sign ceremony; URS-33 batch reference display; URS-28 qualification UI feedback per DEC-34-19. ### 5.3 Inventory Console Renders inventory lots with FEFO allocation visualization per DEC-34-06; quarantine status display per DEC-34-07. ### 5.4 Dispatch Console Renders dispatch order lifecycle with FEFO-allocated lots; RP release ceremony per EU GDP Chapter 2 + URS-28 qualification per DEC-34-08 / DEC-34-19. ### 5.5 Transport Excursion Console Renders cold-chain monitoring + excursion lifecycle per DEC-34-09; closure ceremony with bound e-sign. ### 5.6 POD Console Renders POD with URS-12 document linkage per DEC-34-10. ### 5.7 Returns Console Renders return lifecycle per DEC-34-11; disposition ceremony with QP/RP review for `return_to_stock` per EU GDP 6.3. ### 5.8 Recall Console Renders recall execution per DEC-34-13 with regulatory class display + URS-27 Regulatory submission status + URS-30 Notifications dispatch tracking. ### 5.9 Destruction Console Renders destruction with destruction certificate UI per DEC-34-14. ### 5.10 GDP Metrics Dashboard Renders periodic GDP metrics consumed by URS-26 APQR per DEC-34-21. ### 5.11 MIRA Copilot Integration Read-only context per DEC-34-18; `mira_outcome_label` per URS-32 DEC-32-23. ### 5.12 Accessibility WCAG 2.1 AA accessible. --- ## 6. Back-end Requirements ### 6.1 Module structure `packages/backend/src/modules/gdp/` (per DEC-34-02) with `plugin.ts`, `routes.ts` (typed schemas; lifecycle status excluded from update schemas per DEC-34-15), `service.ts` (attributable audit per DEC-34-16; typed schema per DEC-34-15; FEFO allocation engine per DEC-34-06; cross-module gate from URS-33 per DEC-34-04; URS-28 qualification consumer per DEC-34-19), `workflow.ts` (state machines), `schemas.ts` (typed schemas), `events.ts`, `cross-module-gate.ts` (consumes URS-33 batch dispositions per DEC-34-04), `fefo-allocator.ts` (per DEC-34-06). ### 6.2 Data model #### 6.2.1 `gdp_warehouse_receipts` `id`, `tenant_id`, `site_id` (FK NOT NULL), `urs33_batch_disposition_id` (FK to URS-33 NOT NULL per DEC-34-04), `urs23_batch_id` (FK to URS-23 — for batch reference), `product_id` (FK to URS-10), `received_quantity`, `received_at`, `quarantined_at`, `released_by` / `released_at` / `release_e_signature_id` per DEC-34-05, `rejected_by` / `rejected_at` / `rejection_reason`, `linked_oos_id` (FK nullable to URS-15), `linked_deviation_id` (FK nullable to URS-16), `status` (ENUM `received` / `quarantined` / `testing` / `released_for_distribution` / `rejected` / `destroyed`), `mira_outcome_label`, audit columns (with mandatory `created_by` / `updated_by` per DEC-34-16). RLS enabled. #### 6.2.2 `gdp_inventory_lots` `id`, `tenant_id`, `site_id`, `warehouse_receipt_id` (FK), `urs23_batch_id` (FK), `product_id`, `lot_number`, `expiry_date`, `quantity_available`, `quantity_allocated`, `quantity_shipped`, `quantity_returned`, `quantity_destroyed`, `storage_location`, `quarantine_active` (BOOLEAN), `quarantine_reason` (TEXT nullable), `quarantine_imposed_by` / `quarantine_imposed_at` / `quarantine_e_signature_id`, `quarantine_released_by` / `quarantine_released_at` / `quarantine_release_e_signature_id`, `status` (ENUM `quarantined` / `released_for_distribution` / `allocated` / `shipped` / `delivered` / `returned` / `recalled` / `destroyed`), `mira_outcome_label`, audit columns. #### 6.2.3 `gdp_dispatch_orders` `id`, `tenant_id`, `site_id`, `customer_id`, `product_id`, `requested_quantity`, `allocated_lot_ids` (UUID[] FK), `fefo_override` (BOOLEAN), `fefo_override_reason` (TEXT nullable), `fefo_override_by` (FK nullable), `released_by` / `released_at` / `release_e_signature_id` per DEC-34-08 (RP per EU GDP Chapter 2), `status` (ENUM `draft` / `pending_release` / `released` / `in_transit` / `delivered` / `failed` / `returned`), `mira_outcome_label`, audit columns. #### 6.2.4 `gdp_shipments` `id`, `tenant_id`, `dispatch_order_id` (FK), `transport_provider`, `tracking_number`, `cold_chain_required` (BOOLEAN), `temperature_min_c` / `temperature_max_c` (NUMERIC nullable for cold-chain), `departed_at`, `delivered_at`, `delivery_attempt_count`, `status` (ENUM `pending` / `in_transit` / `delivered` / `failed` / `returned` / `held`), `mira_outcome_label`, audit columns. #### 6.2.5 `gdp_cold_chain_readings` `id`, `tenant_id`, `shipment_id` (FK), `device_id`, `recorded_at` (TIMESTAMPTZ NOT NULL), `temperature_c` (NUMERIC NOT NULL), `location_lat` / `location_lon` (NUMERIC nullable), audit columns. Append-only (immutable per DEC-34-09). #### 6.2.6 `gdp_transport_excursions` `id`, `tenant_id`, `shipment_id` (FK), `excursion_type` (ENUM `temperature_breach` / `delay` / `damage` / `theft` / `other`), `raised_at`, `raised_by` (FK nullable — system for auto-raise), `temperature_breach_duration_minutes` (INTEGER nullable), `temperature_max_c_during_breach` (NUMERIC nullable), `linked_oos_id` (FK nullable to URS-15), `linked_deviation_id` (FK nullable to URS-16), `linked_urs33_batch_disposition_impact_id` (FK nullable to URS-33), `closed_by` / `closed_at` / `closure_e_signature_id` per DEC-34-09, `closure_assessment` (TEXT), `status` (ENUM `raised` / `under_investigation` / `closed_acceptable` / `closed_unacceptable`), `mira_outcome_label`, audit columns. #### 6.2.7 `gdp_proof_of_delivery` `id`, `tenant_id`, `shipment_id` (FK), `delivered_at`, `recipient_name`, `recipient_signature_document_id` (FK to URS-12), `pod_photo_document_id` (FK to URS-12 nullable), `discrepancy_flag` (BOOLEAN), `discrepancy_description` (TEXT nullable), `linked_deviation_id` (FK nullable to URS-16), audit columns. #### 6.2.8 `gdp_returns` `id`, `tenant_id`, `site_id`, `customer_id`, `urs23_batch_id` (FK), `lot_id` (FK to `gdp_inventory_lots`), `return_quantity`, `return_reason`, `received_at`, `quarantined_at`, `assessment_complete_at`, `disposition` (ENUM `return_to_stock` / `return_to_supplier` / `destroyed` / `held_for_investigation`), `disposition_by` / `disposition_at` / `disposition_e_signature_id` per DEC-34-11, `qp_rp_review_e_signature_id` (FK NOT NULL when disposition = `return_to_stock` per EU GDP 6.3), `linked_complaint_id` (FK nullable to URS-14), `linked_recall_id` (FK nullable to `gdp_recall_executions`), `linked_destruction_id` (FK nullable to `gdp_destructions`), `status` (ENUM `received` / `quarantined` / `assessed` / `dispositioned`), `mira_outcome_label`, audit columns. #### 6.2.9 `gdp_recall_executions` `id`, `tenant_id`, `recall_class` (ENUM `fda_class_i` / `fda_class_ii` / `fda_class_iii` / `eu_class_1` / `eu_class_2` / `eu_class_3` / `cdsco_recall`), `recall_reason`, `affected_product_ids` (UUID[]), `affected_batch_ids` (UUID[]), `affected_lot_ids` (UUID[]), `opened_by` / `opened_at` / `opening_e_signature_id`, `urs27_regulatory_submission_id` (FK to URS-27), `notification_dispatched_at`, `progress_milestones_json` (JSONB), `closed_by` / `closed_at` / `closure_e_signature_id`, `status` (ENUM `opened` / `notification_dispatched` / `progressing` / `closed`), `mira_outcome_label`, audit columns. #### 6.2.10 `gdp_destructions` `id`, `tenant_id`, `lot_id` (FK), `destruction_reason` (ENUM `expired` / `damaged` / `recalled` / `counterfeit` / `return_rejected`), `destruction_method`, `destruction_quantity`, `destruction_certificate_document_id` (FK to URS-12 NOT NULL per DEC-34-14), `destroyed_by` / `destroyed_at` / `destruction_e_signature_id` per DEC-34-14, `status`, `mira_outcome_label`, audit columns. #### 6.2.11 `gdp_program_locks` `id`, `tenant_id`, `period_start`, `period_end`, `locked_by`, `locked_at`, `lock_e_signature_id`, `reopened_at`, `reopened_by`, `reopen_executive_co_signer`, `reopen_qp_co_signer`, `reopen_reason`, audit columns. #### 6.2.12 RLS All Module 34 tables have RLS enabled. ### 6.3 API contract | Route | Method | Permission | Status | |---|---|---|---| | `/api/v1/gdp/warehouse-receipts` | GET / POST | `gdp:warehouse:read` / `gdp:warehouse:create` (cross-module gate per DEC-34-04) | target route | | `/api/v1/gdp/warehouse-receipts/:id/release` | POST | `gdp_warehouse_authority` + URS-28 qualification + HITL + bound e-sign per DEC-34-05 | target route | | `/api/v1/gdp/warehouse-receipts/:id/reject` | POST | `gdp_warehouse_authority` + HITL + bound e-sign + reason + URS-15/-16 linkage | target route | | `/api/v1/gdp/inventory-lots` | GET | `gdp:inventory:read` | target route | | `/api/v1/gdp/inventory-lots/:id/quarantine` | POST | `gdp_quarantine_authority` + URS-28 qualification + HITL + bound e-sign + reason per DEC-34-07 | target route | | `/api/v1/gdp/inventory-lots/:id/release-quarantine` | POST | `gdp_quarantine_authority` + URS-28 qualification + HITL + bound e-sign per DEC-34-07 | target route | | `/api/v1/gdp/dispatch-orders` | GET / POST | `gdp:dispatch:read` / `gdp:dispatch:create` (server auto-allocates FEFO per DEC-34-06) | target route | | `/api/v1/gdp/dispatch-orders/:id/fefo-override` | POST | `gdp_warehouse_authority` + reason per DEC-34-06 | target route | | `/api/v1/gdp/dispatch-orders/:id/release` | POST | `gdp_dispatch_release_authority` (RP per EU GDP Chapter 2) + URS-28 qualification per DEC-34-19 + HITL + bound e-sign per DEC-34-08 | target route | | `/api/v1/gdp/shipments` | GET | `gdp:shipment:read` | target route | | `/api/v1/gdp/shipments/:id/cold-chain-readings` | GET / POST | `gdp:cold_chain:read` / `gdp:cold_chain:create` (immutable per DEC-34-09) | target route | | `/api/v1/gdp/transport-excursions` | GET / POST | `gdp:excursion:read` / `gdp:excursion:create` | target route | | `/api/v1/gdp/transport-excursions/:id/close-acceptable` | POST | `gdp_transport_excursion_authority` + URS-28 qualification + HITL + bound e-sign + assessment per DEC-34-09 | target route | | `/api/v1/gdp/transport-excursions/:id/close-unacceptable` | POST | `gdp_transport_excursion_authority` + URS-28 qualification + HITL + bound e-sign + URS-15/-16 linkage + URS-33 batch impact per DEC-34-09 / DEC-34-12 | target route | | `/api/v1/gdp/proof-of-delivery` | POST | `gdp:pod:create` per DEC-34-10 | target route | | `/api/v1/gdp/returns` | GET / POST | `gdp:return:read` / `gdp:return:create` | target route | | `/api/v1/gdp/returns/:id/disposition` | POST | `gdp_return_disposition_authority` + URS-28 qualification + HITL + bound e-sign + (for return_to_stock) QP/RP review per EU GDP 6.3 + DEC-34-11 | target route | | `/api/v1/gdp/recall-executions` | GET / POST | `gdp:recall:read` / `gdp_recall_coordinator_authority` + URS-28 qualification + HITL + bound e-sign + URS-27 regulatory submission per DEC-34-13 / DEC-34-19 | target route | | `/api/v1/gdp/recall-executions/:id/close` | POST | `gdp_recall_coordinator_authority` + HITL + bound e-sign per DEC-34-13 | target route | | `/api/v1/gdp/destructions` | POST | `gdp_destruction_authority` + URS-28 qualification + HITL + bound e-sign + destruction certificate per DEC-34-14 | target route | | `/api/v1/gdp/program-locks` | POST | `final_quality_approver` + HITL + bound e-sign | target route | | `/api/v1/gdp/program-locks/:id/reopen` | POST | `executive_authority` co-sign AND `qualified_person_authority` co-sign + HITL + reason per DEC-34-22 | target route | ### 6.4 Workflow #### 6.4.1 Warehouse receipt lifecycle ```mermaid stateDiagram-v2 [*] --> received: create (cross-module gate URS-33 QP-released per DEC-34-04) received --> quarantined: putaway quarantined --> testing: dispatch to QC testing --> released_for_distribution: gdp_warehouse_authority + URS-28 + HITL + bound e-sign — DEC-34-05 testing --> rejected: failed QC + URS-15/-16 linkage rejected --> destroyed: destruction released_for_distribution --> [*] ``` #### 6.4.2 Inventory lot lifecycle with FEFO ```mermaid stateDiagram-v2 [*] --> quarantined: receipt released quarantined --> released_for_distribution: quarantine release released_for_distribution --> allocated: FEFO allocation (DEC-34-06) allocated --> shipped: dispatch released shipped --> delivered: POD recorded shipped --> failed: delivery failed delivered --> returned: customer return released_for_distribution --> recalled: recall opened (DEC-34-13) recalled --> destroyed: destruction returned --> destroyed: disposition = destroyed (per DEC-34-11) quarantined --> destroyed: rejection ``` #### 6.4.3 Dispatch order lifecycle with RP release ```mermaid stateDiagram-v2 [*] --> draft: create with FEFO allocation draft --> pending_release: submit pending_release --> released: gdp_dispatch_release_authority (RP per EU GDP Chapter 2) + URS-28 qualification + HITL + bound e-sign — DEC-34-08 / DEC-34-19 released --> in_transit: shipment dispatched in_transit --> delivered: POD recorded in_transit --> failed: delivery failed in_transit --> returned: customer return ``` #### 6.4.4 Transport excursion lifecycle ```mermaid stateDiagram-v2 [*] --> raised: auto on temperature breach OR manual raised --> under_investigation under_investigation --> closed_acceptable: gdp_transport_excursion_authority + URS-28 + HITL + bound e-sign + assessment — DEC-34-09 under_investigation --> closed_unacceptable: HITL + bound e-sign + URS-15/-16 linkage + URS-33 batch impact — DEC-34-12 closed_acceptable --> [*] closed_unacceptable --> [*] ``` #### 6.4.5 Recall execution lifecycle ```mermaid stateDiagram-v2 [*] --> opened: gdp_recall_coordinator_authority + URS-28 + HITL + bound e-sign — DEC-34-13 opened --> notification_dispatched: URS-27 regulatory submission + URS-30 notifications dispatched notification_dispatched --> progressing progressing --> closed: HITL + bound e-sign — DEC-34-13 ``` ### 6.5 Business rules - BR-34-01: Canonical module boundary per DEC-34-01. - BR-34-02: posture per DEC-34-02. - BR-34-03: **Finished-goods inflow gate from URS-33** per DEC-34-04 — URS-34 receives only QP-released finished-goods; non-QP-released rejected with `GDP_BATCH_NOT_QP_RELEASED`. - BR-34-04: Warehouse receipt lifecycle per DEC-34-05. - BR-34-05: **FEFO allocation MANDATORY** per DEC-34-06 — earliest expiry first; override audited. - BR-34-06: **Quarantine BLOCKS distribution** per DEC-34-07. - BR-34-07: Dispatch order release requires `gdp_dispatch_release_authority` (RP) + URS-28 qualification + HITL + bound e-sign per DEC-34-08 / DEC-34-19. - BR-34-08: Cold-chain readings immutable per DEC-34-09. - BR-34-09: Transport excursion auto-raised on temperature breach per DEC-34-09. - BR-34-10: Excursion closure requires `gdp_transport_excursion_authority` + URS-28 + HITL + bound e-sign per DEC-34-09. - BR-34-11: `closed_unacceptable` excursion emits URS-15/-16 linkage + URS-33 batch impact per DEC-34-09 / DEC-34-12. - BR-34-12: POD recorded with URS-12 document linkage per DEC-34-10. - BR-34-13: Return lifecycle per DEC-34-11. - BR-34-14: **Return-to-saleable-inventory restriction per EU GDP 6.3** — `return_to_stock` requires QP/RP review + `gdp_return_disposition_authority` + URS-28 + HITL + bound e-sign + RP-signed certification per DEC-34-11. - BR-34-15: Recall execution requires `gdp_recall_coordinator_authority` + URS-28 + HITL + bound e-sign + URS-27 regulatory submission per DEC-34-13 / DEC-34-19. - BR-34-16: Recall regulatory submission timeline per regulatory class (FDA Class I 24h; EU Class 1 24h; CDSCO per CDSCO Recall Guidelines) per DEC-34-13. - BR-34-17: Destruction requires destruction certificate as URS-12 document per DEC-34-14. - BR-34-18: Typed DB schema enforcement per DEC-34-15; `db as any` rejected. - BR-34-19: Lifecycle status mutation through generic update / generic PATCH rejected per DEC-34-15. - BR-34-20: Findings emission to URS-21 per DEC-34-15. - BR-34-21: **Attributable GDP audit logging** per DEC-34-16; blank `userId` rejected. - BR-34-22: Authority/HITL/e-signature on every regulated final action per DEC-34-17. - BR-34-23: AI/MIRA assistive-only constraint per DEC-34-18; `mira_outcome_label` per URS-32 DEC-32-23. - BR-34-24: **AI cannot release a GDP shipment, close a transport excursion, disposition returned stock, or execute a recall** per ARCH-AI-001 / DEC-34-18. - BR-34-25: URS-28 qualification-gate inbound consumer per DEC-34-19. - BR-34-26: URS-30 Notifications outbound consumer per DEC-34-20. - BR-34-27: URS-26 APQR consumer integration per DEC-34-21. - BR-34-28: Material reopen `locked → in_progress` requires `executive_authority` co-sign AND `qualified_person_authority` co-sign per DEC-34-22. - BR-34-29: `platform_admin` / `super_admin` are support / break-glass only paths per DEC-34-23. - BR-34-30: India CDSCO Drug Distribution + Schedule M-III §16 launch scope per DEC-34-23. ### 6.6 Audit trail Every Module 34 record mutation persists an audit-trail entry **with authenticated `userId` mandatory per DEC-34-16**. Material updates persist `reason_for_change`. Regulated final actions persist a bound e-signature via the `electronic_signatures` substrate. Append-only. ### 6.7 Error handling | Code | HTTP | Meaning | |---|---|---| | `GDP_VALIDATION_FAILED` | 400 | Schema validation failure | | `GDP_UNAUTHORIZED` | 401 | Authentication required | | `GDP_FORBIDDEN` | 403 | RBAC denied | | `GDP_NOT_FOUND` | 404 | Resource not found | | `GDP_DUPLICATE_KEY` | 409 | Uniqueness violation | | `GDP_INVALID_TRANSITION` | 422 | Lifecycle transition not permitted | | `GDP_TERMINAL_STATE_PATCH_FORBIDDEN` | 422 | Direct PATCH on lifecycle status per DEC-34-15 | | `GDP_BATCH_NOT_QP_RELEASED` | 422 | Warehouse receipt of non-QP-released batch per DEC-34-04 | | `GDP_LOT_QUARANTINED` | 422 | Dispatch attempt with quarantined lot per DEC-34-07 | | `GDP_LOT_RECALLED` | 422 | Dispatch attempt with recalled lot per DEC-34-13 | | `GDP_FEFO_VIOLATION` | 422 | Manual allocation violates FEFO without override per DEC-34-06 | | `GDP_RETURN_TO_STOCK_QP_RP_REVIEW_REQUIRED` | 422 | `return_to_stock` without QP/RP review per DEC-34-11 / EU GDP 6.3 | | `GDP_AUTHORITY_REQUIRED` | 422 | Authority Profile missing | | `GDP_AUTHORITY_QUALIFICATION_GATE_FAILED` | 422 | URS-28 qualification gate failed per DEC-34-19 | | `GDP_HITL_DECISION_REQUIRED` | 422 | HITL decision capture missing | | `GDP_E_SIGNATURE_REQUIRED` | 422 | Bound e-signature persistence missing | | `GDP_AUDIT_USER_ID_REQUIRED` | 422 | Audit-trail write with blank `userId` per DEC-34-16 | | `GDP_AI_AS_AUTHORITATIVE_PROHIBITED` | 422 | AI service attempted regulated GDP action per ARCH-AI-001 / DEC-34-18 | | `GDP_RECALL_REGULATORY_SUBMISSION_REQUIRED` | 422 | Recall opened without URS-27 submission per DEC-34-13 | | `GDP_DESTRUCTION_CERTIFICATE_REQUIRED` | 422 | Destruction without URS-12 certificate per DEC-34-14 | | `GDP_REASON_FOR_CHANGE_REQUIRED` | 422 | Material update without reason-for-change | | `GDP_REOPEN_AUTHORITY_REQUIRED` | 422 | Reopen attempted without executive AND QP co-sign per DEC-34-22 | | `GDP_INTERNAL` | 500 | Sanitized server error | ### 6.8 Configuration rules - Cold-chain temperature thresholds configurable per product per DEC-34-09. - FEFO override permitted only with `gdp_warehouse_authority` per DEC-34-06. - Recall regulatory timelines configurable per jurisdiction per DEC-34-13 / DEC-34-23. --- ## 7. Non-functional Requirements - NFR-34-01: List pagination (default 50, max 200). - NFR-34-02: List p95 < 800ms (10k inventory lots per tenant). - NFR-34-03: FEFO allocation p95 < 500ms. - NFR-34-04: Cold-chain reading append p99 < 100ms. - NFR-34-05: Audit-trail append p99 < 200ms. - NFR-34-06: Concurrent GDP users per tenant: 100. - NFR-34-07: Storage scalability: 10M cold-chain readings per tenant. - NFR-34-08: Backup / restore RPO ≤ 15 min; RTO ≤ 4 hours per URS-35. - NFR-34-09: Bound e-signature persistence transaction p95 < 1.5s. - NFR-34-10: URS-28 qualification-gate consumption p95 < 200ms. --- ## 8. Localization English (en-US, en-GB), Hindi (hi-IN), Marathi (mr-IN), Japanese (ja-JP) at launch. **India launch scope priority** per DEC-34-23. --- ## 9. Migration ### 9.1 Migration scope per DEC-34-02 — greenfield at launch. No legacy GDP data to migrate. ### 9.2 Schema migration NEW migrations create all `gdp_*` tables per §6.2 with attributable audit columns + typed schema + cross-module FK to URS-33 batch dispositions per DEC-34-04 + `mira_outcome_label` ENUM column per DEC-34-18 / URS-32 DEC-32-23 + `gdp_program_locks` per DEC-34-22. ### 9.3 Migration evidence gate (URS-34-VAL-008) (a) all migrations applied; (b) RLS verified; (c) typed schema verified per DEC-34-15 (`db as any` rejected); (d) attributable audit verified per DEC-34-16 (blank `userId` rejected); (e) cross-module gate from URS-33 verified per DEC-34-04 (warehouse receipt of non-QP-released batch rejected); (f) FEFO allocation verified per DEC-34-06; (g) quarantine BLOCKS distribution verified per DEC-34-07; (h) RP dispatch release per EU GDP Chapter 2 + URS-28 qualification verified per DEC-34-08 / DEC-34-19; (i) cold-chain immutable readings verified per DEC-34-09; (j) transport excursion lifecycle + URS-15/-16/-33 linkage verified per DEC-34-09 / DEC-34-12; (k) POD with URS-12 doc verified per DEC-34-10; (l) return lifecycle + EU GDP 6.3 QP/RP review verified per DEC-34-11; (m) recall execution + URS-27 submission + URS-30 dispatch verified per DEC-34-13; (n) destruction certificate as URS-12 doc verified per DEC-34-14; (o) AI/MIRA assistive-only verified per DEC-34-18; (p) URS-28 qualification-gate consumption verified per DEC-34-19; (q) URS-30 notifications outbound verified per DEC-34-20; (r) URS-26 APQR consumer verified per DEC-34-21; (s) URS-32 MIRA outcome-label inbound emission verified; (t) cross-module event emission verified; (u) governed reopen verified per DEC-34-22; (v) §17 validation evidence pack signed. --- ## 10. Decommissioning Module 34 records subject to platform record-retention policy (retained per FDA 21 CFR §211.180 + EU GDP record retention). On tenant decommissioning, records exported per URS-35. --- ## 11. Decisions, Dependencies, Risks, and Error Handling ### 11.1 Closed decision posture **No Module 34 internal decisions outstanding.** All decision items captured in locked decisions DEC-34-01..DEC-34-23. All launch-critical GDP controls are locked in this URS. ### 11.2 External dependencies - URS-33 must emit QP-certified released-batch events per URS-33 DEC-33-05 / DEC-33-06. - URS-12 Document Control must support POD / destruction certificate / recall notification storage. - URS-13 change-control register must support GDP transport-route effective release linkage. - URS-15 / URS-16 must accept linkage events per DEC-34-12. - URS-18 CAPA register must accept `gdp_distribution_control` source type per DEC-34-12. - URS-21 findings register must accept `gdp_distribution_control` source type per DEC-34-15. - URS-22 Inspection must support GDP back-room evidence retrieval. - URS-26 APQR must consume periodic GDP-control summary per DEC-34-21. - URS-27 Regulatory Intelligence must accept recall regulatory submissions per DEC-34-13. - URS-28 training must expose qualification-gate API for RP / dispatch / recall / cold-chain authority per DEC-34-19. - URS-30 Notifications must consume GDP critical alerts per DEC-34-20. - URS-32 MIRA AI must emit `outcome_label` per URS-32 DEC-32-23 inbound to GDP records. ### 11.3 Risks - Risk-34-01: Cross-module gate latency from URS-33. Mitigation: NFR-34-03 latency budget; cache layer. - Risk-34-02: Cold-chain reading volume at scale. Mitigation: NFR-34-04 / NFR-34-07; partitioned table. - Risk-34-03: FDA Class I recall 24h regulatory timeline pressure. Mitigation: dedicated `gdp_recall_coordinator_authority` with URS-28 qualification + URS-27 fast-track regulatory submission path. - Risk-34-04: India CDSCO interpretation evolution. Mitigation: jurisdiction-specific advisory layer. - Risk-34-05: Reopen workflow gravity may delay urgent investigations. Mitigation: documented reopen SLA. ### 11.4 Out-of-scope risks tracked elsewhere - GMP manufacturing (URS-33). - Batch execution (URS-23). ### 11.5 Risk owner Module-34 risk register owned by Distribution / GDP Squad with quarterly review by **Distribution Head / RP (Primary Owner)** + QA Head + Validation Head + Qualified Person Authority + RA Head. ### 11.6 Decision discipline No Module 34 internal decisions outstanding. ### 11.7 Error Handling and Negative Paths This section defines the controlled error envelope, the enumerated machine-code catalogue, and the negative-path response contract required for this module. The error envelope is the standard platform envelope (human message, machine code in upper-snake-case, optional structured details, correlation identifier). Errors are returned with the appropriate HTTP status; the UI surfaces inline errors at the field of cause where applicable, otherwise a controlled error toast or modal. Every error path is logged to the URS-06 audit substrate when the originating action is regulated; errors that occur before authentication are logged without `userId`. Audit-trail write failure on a state-changing action MUST cause the originating action to NOT commit (atomic write per URS-04 BR-04-15). The enumerated machine codes for this module's negative paths are defined alongside the corresponding lifecycle gates, segregation-of-duties controls, and authority-resolution outcomes throughout §6 (Back-end Requirements) and §13 (Segregation of Duties); engineering MUST surface every enumerated machine code through the standard envelope and MUST NOT swallow errors silently. Cross-module error propagation follows the §20 Cross-Module Event Contract. --- ## 12. Security - SEC-34-01: Tenant isolation enforced at RLS on every Module 34 table. - SEC-34-02: RBAC enforced on every route via `requirePermission(.)` using dedicated `gdp:*` permission set. - SEC-34-03: Authority resolution enforced on regulated final actions before HITL + e-signature. - SEC-34-04: HITL decision capture enforced before bound e-signature persistence. - SEC-34-05: Bound e-signature persistence via `electronic_signatures` substrate. - SEC-34-06: PII redaction in logs. - SEC-34-07: Audit-trail integrity via URS-06 hash chain; **`userId` mandatory per DEC-34-16**. - SEC-34-08: AI-request provenance via `ai_requests`; **AI cannot release shipment / close excursion / disposition return / execute recall** per ARCH-AI-001; AI may draft advisory only. - SEC-34-09: `platform_admin` / `super_admin` break-glass actions logged per DEC-34-23. - SEC-34-10: Typed DB schema enforcement per DEC-34-15. - SEC-34-11: Cross-module gate enforcement at URS-33 inflow per DEC-34-04. - SEC-34-12: URS-28 qualification-gate consumed at RP / dispatch / recall / cold-chain authority per DEC-34-19. - SEC-34-13: Cold-chain readings immutable per DEC-34-09. - SEC-34-14: DSCSA serialization data integrity (where applicable per FDA DSCSA). --- ## 13. Segregation of Duties | SoD ID | Constraint | |---|---| | SoD-34-01 | The Warehouse Receipt creator MUST NOT also be the Warehouse Release authority for the same receipt. | | SoD-34-02 | The Dispatch Order creator MUST NOT also be the Dispatch Release authority (RP) for the same order (DB-level constraint). | | SoD-34-03 | The Transport Excursion raiser MUST NOT also be the Excursion Closure authority for the same excursion. | | SoD-34-04 | The Return Receiver MUST NOT also be the Return Disposition authority for the same return. | | SoD-34-05 | The Recall Coordinator MUST NOT also be the regulatory submission author (per URS-27). | | SoD-34-06 | The reopen co-signers (executive AND Qualified Person per DEC-34-22) MUST NOT be the original lock signer. | | SoD-34-07 | The `platform_admin` / `super_admin` support / break-glass action MUST NOT be a regulated production action; logged and reviewed per DEC-34-23. | --- ## 14. Regulatory Mapping | Predicate rule | Section | Module 34 binding | |---|---|---| | **FDA 21 CFR Part 11** §§11.10(a)/(d)/(e), 11.50, 11.70, 11.200 | E-records and E-signatures | URS-34-VAL-008 + bound e-sign + audit-trail + attributable per DEC-34-16 | | **FDA Drug Supply Chain Security Act (DSCSA)** | Drug supply chain security | Serialization + verification + tracing + suspect/illegitimate product handling | | **FDA 21 CFR Part 203** | Prescription Drug Marketing Act (PDMA) | Drug sample distribution control | | **FDA 21 CFR Part 205** | Wholesale distribution requirements | Wholesale GDP scope | | **FDA 21 CFR Part 211 §211.142** | Warehousing procedures | Warehouse receipt + storage per DEC-34-05 | | **FDA 21 CFR Part 211 §211.150** | Distribution procedures | FEFO allocation + dispatch per DEC-34-06 / DEC-34-08 | | **EU GDP Guidelines (2013/C 343/01)** | EU GDP — primary EU predicate | Full Chapter set: Chapter 1 (Quality Management), Chapter 2 (Personnel including RP), Chapter 3 (Premises and Equipment), Chapter 4 (Documentation), Chapter 5 (Operations), Chapter 6 (Complaints/Returns/Falsified Medicinal Products/Recalls), Chapter 7 (Outsourced Activities), Chapter 8 (Self-Inspections), Chapter 9 (Transportation) | | **EU GDP Guidelines for Active Substances (2015/C 95/01)** | EU GDP for APIs | API distribution scope | | **EU GMP Annex 11** §§4, 5, 9, 12, 14, 16 | Computerised Systems | Validation; data; audit trails; security; e-records; incident management | | EU GMP Annex 22 Draft 2025 | §7 — HITL / GenAI prohibition in critical GDP decisions | Internal forward-looking control | | EU AI Act (Regulation 2024/1689) | Annex III + Articles 13/14 | Adopted as internal forward-looking AI governance | | **MHRA Data Integrity Guidance** | ALCOA+ | Module 34 per-record ALCOA+-compliant; **attributable per DEC-34-16** | | **MHRA UK GDP** | Statutory Instrument 2012 No. 1916 | UK GDP scope | | GAMP 5 Cat 5 | Custom-application validation lifecycle | URS-34 validation evidence pack per URS-34-VAL-008 | | **ICH Q9 R1** | Quality Risk Management | Risk-precipitated GDP control | | **ICH Q10** | Pharmaceutical Quality System | Quality system foundation | | **WHO GDP TRS 957 Annex 5** | WHO Good Distribution Practices | WHO GDP scope | | **WHO TRS 961 Annex 9** | Storage and transport of time- and temperature-sensitive pharmaceutical products | Cold chain per DEC-34-09 | | **PIC/S PE 011-1** | International harmonization with EU GDP | PIC/S members | | **India CDSCO D&C Act 1940** | Drug control framework | India distribution baseline | | **India Drugs Rules 1945** | Drug rules including distribution | India distribution scope | | **India Drug Distribution Schedule** | India CDSCO drug distribution rules | India CDSCO distribution scope | | **India CDSCO Schedule M-III §16** | Distribution requirements | India distribution per DEC-34-23 (subject to a future jurisdiction-specific legal assessment) | | **India Medical Devices Rules 2017** | Medical device distribution | Medical device GDP scope | | **India CDSCO Recall Guidelines** | Drug recall guidelines | Recall execution per DEC-34-13 | --- ## 15. Code Modules | Code module | Path | Status | |---|---|---| | `gdp` plugin | `packages/backend/src/modules/gdp/plugin.ts` | per DEC-34-02 | | `gdp` routes | `packages/backend/src/modules/gdp/routes.ts` | | | `gdp` service | `packages/backend/src/modules/gdp/service.ts` | (attributable audit per DEC-34-16; typed schema per DEC-34-15; cross-module gate per DEC-34-04; FEFO per DEC-34-06; URS-28 qualification consumer per DEC-34-19) | | `gdp` workflow | `packages/backend/src/modules/gdp/workflow.ts` | | | `gdp` schemas | `packages/backend/src/modules/gdp/schemas.ts` | | | `gdp` events | `packages/backend/src/modules/gdp/events.ts` | | | `gdp` cross-module-gate | `packages/backend/src/modules/gdp/cross-module-gate.ts` | per DEC-34-04 | | `gdp` fefo-allocator | `packages/backend/src/modules/gdp/fefo-allocator.ts` | per DEC-34-06 | | Migration | `packages/backend/src/db/migrations/.` | (per §9.2) | | Shared types | `packages/shared/src/types/gdp.ts` | | | Shared schemas | `packages/shared/src/schemas/gdp.schema.ts` | | | Frontend hooks | `packages/frontend/src/api/hooks/useGdp.ts` | | | Frontend dashboard | `packages/frontend/src/pages/gdp/GDPDashboard.tsx` | | | Frontend warehouse console | `packages/frontend/src/pages/gdp/WarehouseConsole.tsx` | per DEC-34-05 | | Frontend inventory console | `packages/frontend/src/pages/gdp/InventoryConsole.tsx` | per DEC-34-06 | | Frontend dispatch console | `packages/frontend/src/pages/gdp/DispatchConsole.tsx` | per DEC-34-08 | | Frontend transport excursion console | `packages/frontend/src/pages/gdp/TransportExcursionConsole.tsx` | per DEC-34-09 | | Frontend POD console | `packages/frontend/src/pages/gdp/PODConsole.tsx` | per DEC-34-10 | | Frontend returns console | `packages/frontend/src/pages/gdp/ReturnsConsole.tsx` | per DEC-34-11 | | Frontend recall console | `packages/frontend/src/pages/gdp/RecallConsole.tsx` | per DEC-34-13 | | Frontend destruction console | `packages/frontend/src/pages/gdp/DestructionConsole.tsx` | per DEC-34-14 | | Frontend GDP metrics dashboard | `packages/frontend/src/pages/gdp/GDPMetricsDashboard.tsx` | per DEC-34-21 | --- ## 16. Test Cases ### 16.1 Unit tests - TC-34-U-001: Warehouse receipt of non-QP-released batch rejected with `GDP_BATCH_NOT_QP_RELEASED` per DEC-34-04. - TC-34-U-002: Lifecycle status mutation through generic PATCH rejected with `GDP_TERMINAL_STATE_PATCH_FORBIDDEN` per DEC-34-15. - TC-34-U-003: Audit-trail write with blank `userId` rejected with `GDP_AUDIT_USER_ID_REQUIRED` per DEC-34-16. - TC-34-U-004: `db as any` rejected at build time per DEC-34-15. - TC-34-U-005: Quarantined lot dispatch attempt rejected with `GDP_LOT_QUARANTINED` per DEC-34-07. - TC-34-U-006: Recalled lot dispatch attempt rejected with `GDP_LOT_RECALLED` per DEC-34-13. - TC-34-U-007: FEFO allocation order verified per DEC-34-06. - TC-34-U-008: FEFO override without authority rejected per DEC-34-06. - TC-34-U-009: Dispatch release without RP URS-28 qualification rejected with `GDP_AUTHORITY_QUALIFICATION_GATE_FAILED` per DEC-34-19. - TC-34-U-010: Cold-chain readings immutable post-creation per DEC-34-09. - TC-34-U-011: Transport excursion auto-raised on temperature breach per DEC-34-09. - TC-34-U-012: `closed_unacceptable` excursion emits URS-15/-16/-33 linkage per DEC-34-12. - TC-34-U-013: `return_to_stock` without QP/RP review rejected with `GDP_RETURN_TO_STOCK_QP_RP_REVIEW_REQUIRED` per DEC-34-11. - TC-34-U-014: Recall opened without URS-27 submission rejected with `GDP_RECALL_REGULATORY_SUBMISSION_REQUIRED` per DEC-34-13. - TC-34-U-015: Destruction without URS-12 certificate rejected with `GDP_DESTRUCTION_CERTIFICATE_REQUIRED` per DEC-34-14. - TC-34-U-016: AI service attempting dispatch release / excursion closure / return disposition / recall rejected with `GDP_AI_AS_AUTHORITATIVE_PROHIBITED` per DEC-34-18. - TC-34-U-017: Reopen without executive AND QP co-sign rejected per DEC-34-22. ### 16.2 Integration tests - TC-34-I-001: Warehouse receipt of QP-released finished goods per Worked Example 1. - TC-34-I-002: Inflow rejected (batch not QP-certified) per Worked Example 2. - TC-34-I-003: FEFO allocation on dispatch order per Worked Example 3. - TC-34-I-004: Quarantine BLOCKS dispatch per Worked Example 4. - TC-34-I-005: RP dispatch release per EU GDP Chapter 2 per Worked Example 5. - TC-34-I-006: Cold-chain transport excursion per Worked Example 6. - TC-34-I-007: Return to saleable inventory rejected per EU GDP 6.3 per Worked Example 7. - TC-34-I-008: FDA Class I recall execution per Worked Example 8. - TC-34-I-009: India CDSCO Drug Distribution scope per Worked Example 9. - TC-34-I-010: Governed reopen per Worked Example 10. - TC-34-I-011: Cross-module event emission verified (URS-12, URS-13, URS-15, URS-16, URS-18, URS-21, URS-22, URS-23, URS-26, URS-27, URS-28, URS-30, URS-32, URS-33). ### 16.3 End-to-end tests - TC-34-E-001 through TC-34-E-010: Worked Examples 1–10 end-to-end. - TC-34-E-011: Concurrent GDP users — 100 — NFR-34-06. - TC-34-E-012: India CDSCO full-lifecycle scenario. ### 16.4 Performance tests - TC-34-P-001: List p95 latency (NFR-34-02). - TC-34-P-002: FEFO allocation p95 latency (NFR-34-03). - TC-34-P-003: Cold-chain reading append p99 latency (NFR-34-04). - TC-34-P-004: Audit-trail append p99 latency (NFR-34-05). - TC-34-P-005: Bound e-signature p95 latency (NFR-34-09). - TC-34-P-006: URS-28 qualification-gate p95 latency (NFR-34-10). ### 16.5 Security tests - TC-34-S-001: Cross-tenant access rejected by RLS. - TC-34-S-002: Missing RBAC rejected. - TC-34-S-003: Missing Authority Profile rejected. - TC-34-S-004: Missing HITL rejected. - TC-34-S-005: Missing bound e-signature rejected. - TC-34-S-006: SQL injection rejected. - TC-34-S-007: Audit-trail UPDATE / DELETE rejected. - TC-34-S-008: AI service attempting authoritative GDP action rejected per DEC-34-18. - TC-34-S-009: PII redaction in logs verified. - TC-34-S-010: Blank `userId` in audit rejected per DEC-34-16. - TC-34-S-011: `db as any` rejected per DEC-34-15. - TC-34-S-012: Cold-chain reading tampering detected (immutable). - TC-34-S-013: URS-28 qualification-gate enforced. --- ## 17. Validation Evidence ### 17.1 URS-34-VAL-001: Requirements traceability matrix Complete RTM mapping every URS-34 requirement (DEC-34-01.DEC-34-23, BR-34-01.BR-34-30, NFR-34-01.NFR-34-10, SoD-34-01.SoD-34-07, SEC-34-01.SEC-34-14) to test cases and code modules. ### 17.2 URS-34-VAL-002: Design qualification (DQ) Architecture, data model, API contract, workflow, business rules, audit trail, security, integration; signed by Validation Head, QA Head, **Distribution Head / RP (Primary Owner)**, RA Head, Manufacturing Head, Information Security Head, Qualified Person Authority. ### 17.3 URS-34-VAL-003: Installation qualification (IQ) Migration application + RLS verification + route mount verification + frontend hook resolution + cross-module gate integration verification. ### 17.4 URS-34-VAL-004: Operational qualification (OQ) Happy-path execution of every test case with evidence captures. ### 17.5 URS-34-VAL-005: Performance qualification (PQ) NFR-34-01.NFR-34-10 verification. ### 17.6 URS-34-VAL-006: AI/ML governance evidence Per ARCH-AI-001: (a) MIRA read-only context integration with `mira_outcome_label` per URS-32 DEC-32-23 inbound emission; (b) AI advisory drafting only; (c) **AI cannot release GDP shipment, close transport excursion, disposition return, or execute recall** verification; (d) Annex 22 §7 + EU AI Act Annex III internal forward-looking control compliance evidence. ### 17.7 URS-34-VAL-007: Regulatory mapping evidence FDA 21 CFR Part 11 + DSCSA + Part 203 + Part 205 + Part 211 §§211.142/.150; **EU GDP Guidelines (2013/C 343/01) full Chapter 1–9 set** + EU GDP for APIs (2015/C 95/01); EU GMP Annex 11 §§4, 5, 9, 12, 14, 16; Annex 22 Draft 2025 §7; EU AI Act Art. 13 / 14 / Annex III; MHRA Data Integrity (ALCOA+); MHRA UK GDP; GAMP 5 Cat 5; ICH Q9 R1, Q10; **WHO GDP TRS 957 Annex 5** + **WHO TRS 961 Annex 9** (cold chain); PIC/S PE 011-1; **India CDSCO D&C Act 1940 + Drugs Rules 1945 + Drug Distribution Schedule + Schedule M-III §16 + Medical Devices Rules 2017 + CDSCO Recall Guidelines**. ### 17.8 URS-34-VAL-008: Migration evidence gate Per §9.3. ### 17.9 URS-34-VAL-009: Signature manifest QA Head, **Distribution Head / RP (Primary Owner)**, Manufacturing Head, RA Head, Validation Head, Qualified Person Authority, Information Security Head, Site Quality Lead, Founder / Chairman & MD per §19. ### 17.10 URS-34-VAL-010: Post-launch periodic-review pack (a) GDP control metrics; (b) attributable audit verification (no blank `userId`); (c) typed schema enforcement (no `db as any`); (d) FEFO allocation compliance; (e) RP qualification compliance; (f) recall execution timeline compliance per regulatory class; (g) cold-chain excursion rate; (h) return-to-stock QP/RP review compliance; (i) AI-assistance acceptance rate; (j) reopen-event audit; (k) cross-tenant break-glass audit; (l) cross-module event integrity; periodic review at quarterly cadence by Distribution Head / RP + QA Head + Validation Head + Qualified Person Authority + RA Head. --- ## 18. Document Change History | Version | Date | Author | Change Summary | |---|---|---|---| | 1.0 | 2026-05-07 | Founder Doctrine — Verixa URS Cell | First issued user requirements specification for Module 34. | --- ## 19. Document Approval | Role | Name | Signature | Date | |---|---|---|---| | Founder / Chairman & MD | Vimal | __________ | __________ | | QA Head | __________ | __________ | __________ | | Distribution Head / Responsible Person (Primary Owner) | __________ | __________ | __________ | | Manufacturing Head | __________ | __________ | __________ | | RA Head | __________ | __________ | __________ | | Validation Head | __________ | __________ | __________ | | Information Security Head | __________ | __________ | __________ | | Qualified Person Authority | __________ | __________ | __________ | | Site Quality Lead | __________ | __________ | __________ | --- ## 20. Cross-Module Event Contract | Event | Emitter | Consumer | Payload key fields | |---|---|---|---| | `gdp_warehouse_receipt_completed` | Module 34 | URS-30 | `receipt_id`, `urs33_batch_disposition_id`, `received_quantity` | | `gdp_inventory_lot_status_changed` | Module 34 | URS-30, URS-22 | `lot_id`, `from_status`, `to_status` | | `gdp_quarantine_imposed` | Module 34 | URS-30 (mandatory alert) | `lot_id`, `quarantine_reason`, `imposed_by` | | `gdp_quarantine_released` | Module 34 | URS-30 | `lot_id`, `released_by`, `release_e_signature_id` | | `gdp_dispatch_order_released` | Module 34 | URS-30, URS-22 | `dispatch_order_id`, `released_by` (RP), `release_e_signature_id` | | `gdp_shipment_departed` | Module 34 | URS-30 | `shipment_id`, `departed_at` | | `gdp_shipment_held` | Module 34 | URS-30 (mandatory alert) | `shipment_id`, `hold_reason` | | `gdp_transport_excursion_raised` | Module 34 | URS-30 (mandatory alert) | `excursion_id`, `excursion_type`, `temperature_max_c_during_breach` | | `gdp_transport_excursion_closed` | Module 34 | URS-30 | `excursion_id`, `status`, `closed_by`, `closure_e_signature_id` | | `gdp_transport_excursion_oos_linked` | Module 34 | **URS-15 (OOS — primary consumer)** | `excursion_id`, `oos_id`, `severity` | | `gdp_transport_excursion_deviation_created` | Module 34 | **URS-16 (Deviations — primary consumer)** | `excursion_id`, `deviation_id` (URS-16) | | `gdp_proof_of_delivery_recorded` | Module 34 | URS-30 | `pod_id`, `delivered_at`, `recipient_signature_document_id` | | `gdp_return_received` | Module 34 | URS-30 | `return_id`, `customer_id`, `return_reason` | | `gdp_return_dispositioned` | Module 34 | URS-30 | `return_id`, `disposition`, `disposition_e_signature_id` | | `gdp_recall_execution_opened` | Module 34 | URS-30 (mandatory alert), **URS-27 (Regulatory — primary consumer)** | `recall_id`, `recall_class`, `affected_lot_ids`, `urs27_regulatory_submission_id` | | `gdp_recall_execution_progressed` | Module 34 | URS-30 | `recall_id`, `progress_milestones_json` | | `gdp_recall_execution_closed` | Module 34 | URS-30 | `recall_id`, `closed_by`, `closure_e_signature_id` | | `gdp_destruction_completed` | Module 34 | URS-30 | `destruction_id`, `destruction_certificate_document_id` | | `gdp_finding_created` | Module 34 | **URS-21 (Findings — primary consumer)** | `finding_id` (URS-21), `severity`, `finding_type` | | `gdp_capa_linked` | Module 34 | **URS-18 (CAPA — primary consumer)** | `capa_id`, `linked_by`, `source_type = gdp_distribution_control` | | `gdp_program_locked` | Module 34 | URS-30 | `program_lock_id`, `locked_by`, `lock_e_signature_id` | | `gdp_program_reopened` | Module 34 | URS-30, URS-21 | `program_lock_id`, `reopened_by`, `executive_co_signer`, `qp_co_signer`, `reopen_reason` | --- ## 21. References - ARCH-AI-001 — AI Optionality and Manual Continuity (canonical binding architecture) - VRX-SPEC-URS-034-GDP-Distribution-Warehouse-and-Dispatch-Controls.md (Module specification) - URS-01.URS-33, URS-35 (cross-module contracts) - **FDA 21 CFR Part 11** §§11.10(a)/(d)/(e), 11.50, 11.70, 11.200 - **FDA Drug Supply Chain Security Act (DSCSA)** - **FDA 21 CFR Part 203** (PDMA Drug Sample Distribution) - **FDA 21 CFR Part 205** (Wholesale Distribution) - **FDA 21 CFR Part 211 §211.142** (Warehousing) - **FDA 21 CFR Part 211 §211.150** (Distribution) - **EU GDP Guidelines (2013/C 343/01)** — full Chapter 1–9 set — primary EU predicate - **EU GDP Guidelines for Active Substances (2015/C 95/01)** — APIs - **EU GMP Annex 11** §§4, 5, 9, 12, 14, 16 - EU GMP Annex 22 (Draft 2025) §7 — internal forward-looking control - EU AI Act (Regulation 2024/1689) Annex III + Articles 13/14 — internal forward-looking control - **MHRA Data Integrity Guidance (2018)** — ALCOA+ - **MHRA UK GDP** (Statutory Instrument 2012 No. 1916) - GAMP 5 Cat 5 - **ICH Q9 R1** — Quality Risk Management - **ICH Q10** — Pharmaceutical Quality System - **WHO GDP TRS 957 Annex 5** - **WHO TRS 961 Annex 9** — storage and transport of time- and temperature-sensitive pharmaceutical products - **PIC/S PE 011-1** — international harmonization with EU GDP - **India CDSCO D&C Act 1940** - **India Drugs Rules 1945** - **India Drug Distribution Schedule** - **India CDSCO Schedule M-III §16** — Distribution requirements - **India Medical Devices Rules 2017** - **India CDSCO Recall Guidelines** --- **END OF VRX-URS-34 — GDP DISTRIBUTION, WAREHOUSE, AND DISPATCH CONTROLS — VERSION 1.0**