# Release gates

## Gate L0 - Concept

- Intended purpose documented
- Non-goals documented
- MIKA navigation policy drafted
- No real patient data

Status at project start: passed.

## Gate L1 - Local synthetic prototype

- Application starts locally
- PDF and image input works
- Russian and English OCR available offline
- Barcode detector available offline
- Manual review interface works
- Every page requires confirmation
- New raster PDF is produced
- Strict verification blocks unsafe output
- Unit and synthetic end-to-end tests pass
- Visual PDF QA passes
- NPO NT copyright and `AGPL-3.0-only` licence recorded
- Full AGPL text, source offer, direct SBOM, and third-party notices present

Allowed data: synthetic only.

## Gate D1 - External calibration ready

- L1 passed
- Dataset validator available
- Dataset contract approved
- Secure handoff route approved
- Dataset is synthetic or lawfully pre-de-identified
- No identifiers in filenames or annotation notes

This is the first point at which the initial external dataset is requested.

## Gate P0 - Private controlled pilot

- Locked validation metrics approved
- Independent security review complete
- Privacy and legal review complete
- Intended-purpose and user notices approved
- Signed installer and model manifest
- AGPL decision documented and independently reviewed for the exact distribution architecture
- Exact binary/source pairing and durable public source URL verified
- Registered NPO NT legal name, postal address, and public security contact recorded
- Full dependency SBOM, licence notices, and vulnerability review complete
- Update signature process
- Support and incident process
- Controlled participant consent and instructions
- Pilot access list and deletion date
- MIKA receiving contour independently verified

Allowed data: only data explicitly approved for the controlled pilot.

## Gate P1 - Patient release

- P0 findings closed
- Patient usability study complete
- Representative validation complete
- False-negative and rejection behavior approved by privacy and clinical reviewers
- Windows/macOS installer verification complete
- Every binary download visibly offers equal access to its exact Corresponding Source
- Official-build and trademark-use policy published
- Rollback and revocation process tested
- Operator roles, MFA, audit, storage, backup restore, retention, and deletion verified
- Public documentation does not claim complete anonymity

## Gate I1 - Direct MIKA upload

- P1 passed
- Upload module is separate from the local de-identification engine
- Exact outgoing file shown before transfer
- Explicit action-time confirmation
- One-time token and protected POST/API
- No identity, diagnosis, case number, or filename in URL or external analytics
- Server-side file validation and malware handling
- Authoritative upload receipt
- No automatic retry that could create duplicate cases
