{
  "id": "page:library-composition-regulated-greenfield",
  "_kind": "Page",
  "_file": "wiki/library/composition-regulated-greenfield.md",
  "_cluster": "wiki",
  "attributes": {
    "nodeKind": "Page",
    "title": "Composition: Regulated Greenfield (V-Model + DDD + Cleanroom + Waterfall) (Library)",
    "displayName": "Composition: Regulated Greenfield (V-Model + DDD + Cleanroom + Waterfall) (Library)",
    "slug": "library/composition-regulated-greenfield",
    "articlePath": "wiki/library/composition-regulated-greenfield.md",
    "article": "\n# Composition: Regulated Greenfield (V-Model + DDD + Cleanroom + Waterfall)\n\nHIPAA-compliant patient-portal archetype: Waterfall stage sequencing over DDD\nclinical-domain modeling, Cleanroom formal specification/verification for\nPHI-handling components, and V-Model paired verification levels with\nper-component parallel verification. Every stage exit is guarded by an\n**executed** requirement-to-verification traceability gate plus a routed\nqa-lead sign-off breakpoint; PHI access and production deploy are policy-gated\ncompliance-officer breakpoints that never auto-execute.\n\n## Why this quadrant\n\nThis composition fills the **compliance / formal-verification quadrant** of the\nmethodology matrix and pairs with the `data-privacy-compliance` specialization:\n\n- **Waterfall** supplies frozen, sign-off-gated stage sequencing — the shape\n  regulators audit.\n- **DDD** keeps the clinical domain honest (Patient Management, Scheduling,\n  Medical Records, Billing, Communication contexts with a shared clinical\n  glossary).\n- **Cleanroom** supplies formal specification and correctness verification for\n  exactly the components that handle PHI.\n- **V-Model** pairs every left-side design artifact with its right-side test\n  level, making requirement-to-verification traceability computable instead of\n  aspirational.\n\n**Provenance**: implements `library/methodologies/backlog.md` Example 2\n(\"Healthcare Patient Portal - HIPAA Compliant\", previously *Not Implemented*).\n\n## Stage map\n\n```\n  Waterfall stage           Ingredient ownership (left V | right V)\n  ---------------           ----------------------------------------\n  Stage 1 Requirements      waterfall:requirements-gathering (SRS)\n                            v-model:requirements-with-acceptance ----+\n                            crg:phi-classification                   |\n  Stage 2 Domain modeling   ddd strategic+tactical tasks             |\n                            v-model:system-design-with-system-test -+|\n  Stage 3 Formal spec       cleanroom:create-formal-specification   ||\n   (PHI components)         cleanroom:design-with-verification      ||\n                            v-model:architecture-with-integration -+||\n                            v-model:module-design-with-unit-test -+|||\n  Stage 4 Implementation    crg:implement-component               ||||\n  Stage 5 Verification      v-model:execute-tests  unit <---------+|||\n                             + cleanroom:code-inspection (PHI)     |||\n                            v-model:execute-tests  integration <---+||\n                            v-model:execute-tests  system <---------+|\n                            v-model:execute-tests  acceptance <------+\n  Stage 6 Deploy            v-model:traceability-matrix (full)\n                            waterfall:deployment (guarded)\n```\n\nEvery stage boundary runs `regulatedStageExit` (see contract below). Stage\nboundaries are strictly sequential; `ctx.parallel.all` is used only *within*\na stage.\n\n## Ingredients composed by name\n\nIngredient `process()` functions are **not** called — only exported\n`defineTask` tasks are composed, so ingredient-internal breakpoints/loops\nnever double-fire.\n\n| Task | Source module | Stage |\n| --- | --- | --- |\n| `requirementsGatheringTask` | `../waterfall/waterfall.js` | 1 |\n| `deploymentTask` | `../waterfall/waterfall.js` | 6 (guarded) |\n| `identifySubdomainsTask` | `../domain-driven-design/domain-driven-design.js` | 2 |\n| `defineBoundedContextsTask` | `../domain-driven-design/domain-driven-design.js` | 2 |\n| `createContextMapTask` | `../domain-driven-design/domain-driven-design.js` | 2 |\n| `buildUbiquitousLanguageTask` | `../domain-driven-design/domain-driven-design.js` | 2 |\n| `identifyEntitiesValueObjectsTask` | `../domain-driven-design/domain-driven-design.js` | 2 (parallel per context) |\n| `defineAggregatesTask` | `../domain-driven-design/domain-driven-design.js` | 2 (parallel per context) |\n| `identifyDomainEventsTask` | `../domain-driven-design/domain-driven-design.js` | 2 (parallel per context) |\n| `validateLanguageConsistencyTask` | `../domain-driven-design/domain-driven-design.js` | 2 |\n| `createFormalSpecificationTask` | `../cleanroom/cleanroom.js` | 3 (parallel per PHI component) |\n| `designWithVerificationTask` | `../cleanroom/cleanroom.js` | 3 (bounded fix loop) |\n| `fixDesignTask` | `../cleanroom/cleanroom.js` | 3 (fix-loop body) |\n| `codeInspectionTask` | `../cleanroom/cleanroom.js` | 5a (PHI components) |\n| `fixImplementationTask` | `../cleanroom/cleanroom.js` | 5a (fix-loop body) |\n| `requirementsWithAcceptanceTask` | `../v-model/v-model.js` | 1 |\n| `systemDesignWithSystemTestTask` | `../v-model/v-model.js` | 2 |\n| `architectureWithIntegrationTestTask` | `../v-model/v-model.js` | 3 |\n| `moduleDesignWithUnitTestTask` | `../v-model/v-model.js` | 3 (parallel per component) |\n| `executeTestsTask` | `../v-model/v-model.js` | 5 (per level) |\n| `traceabilityMatrixTask` | `../v-model/v-model.js` | every stage exit + 6 |\n\nCombinators (`routedBreakpoint`, `adversarialGate`, `kipRecall`, `kipAssert`)\nare imported from\n`../../specializations/common-utilities/routed-gate-combinators.js` — never\nre-implemented.\n\nLocal `crg.*` tasks (all `kind: 'agent'`): `crg.phi-classification`,\n`crg.trace-diff`, `crg.implement-component`, `crg.fix-verification`.\n\n## Policy-gated breakpoints\n\n| breakpointId | Expert | Tags | When raised | Auto-execute |\n| --- | --- | --- | --- | --- |\n| `crg.phi-data-access-approval` | compliance-officer | crg, policy-gated, phi, hipaa | By `requirePhiApproval` BEFORE any task is scheduled with PHI-derived data (Stage 3 entry; again in Stage 4 for any dataset not already covered) | **NEVER** |\n| `crg.stage-exit.requirements` | qa-lead | crg, policy-gated, stage-exit, requirements | Stage 1 exit | **NEVER** |\n| `crg.stage-exit.domain-modeling` | qa-lead | crg, policy-gated, stage-exit, domain-modeling | Stage 2 exit | **NEVER** |\n| `crg.stage-exit.formal-specification` | qa-lead | crg, policy-gated, stage-exit, formal-specification | Stage 3 exit | **NEVER** |\n| `crg.stage-exit.implementation` | qa-lead | crg, policy-gated, stage-exit, implementation | Stage 4 exit | **NEVER** |\n| `crg.stage-exit.verification` | qa-lead | crg, policy-gated, stage-exit, verification | Stage 5 exit | **NEVER** |\n| `crg.production-deploy` | compliance-officer | crg, policy-gated, deploy, hipaa | After the final full traceability matrix, before `deploymentTask` | **NEVER** |\n\nCombinator-internal escalations (adversarial-gate owner escalation, bounded\nfix-loop exhaustion in Stages 3/5) carry their own per-stage-unique ids, e.g.\n`crg.<stage>.traceability.gate-escalation`,\n`crg.stage-3.design-escalation.<component>`,\n`crg.stage-5.unit-escalation.<component>`.\n\n## Stage-exit contract (`regulatedStageExit`)\n\n1. **Executed traceability check** — `traceabilityMatrixTask` computes the\n   stage's requirement->artifact->test matrix; `crg.trace-diff` diffs it\n   against the previous stage's stored matrix and the SRS requirement set,\n   writing `artifacts/crg/<stage>/trace-diff.json` with\n   `{coveredCount, uncovered, orphanedTests, regressions}` — a computed diff,\n   not prose.\n2. **Adversarial gate** — `adversarialGate` (`gateId: crg.<stage>.traceability`)\n   over the executed diff with `traceability-critic` + `phi-provenance-critic`,\n   IRON LAW (\"re-run the trace computation yourself or cite trace-diff.json\n   line-by-line\"), the built-in gate fixer, `maxFixAttempts` budget, and owner\n   escalation. A failed gate blocks the stage.\n3. **qa-lead sign-off** — `routedBreakpoint` with the per-stage-unique\n   `crg.stage-exit.<stage>` id. Payload schema:\n\n   ```json\n   {\n     \"question\": \"...\",\n     \"stage\": \"<stage>\",\n     \"traceDiff\": { \"coveredCount\": 0, \"uncovered\": [], \"orphanedTests\": [], \"regressions\": [] },\n     \"gateResult\": { \"passed\": true, \"attempts\": 1, \"escalated\": false, \"evidence\": [] },\n     \"artifacts\": [\"artifacts/crg/<stage>/trace-diff.json\"]\n   }\n   ```\n\n   The payload is built from the executed gate result, so sign-off without\n   traceability evidence is structurally impossible.\n4. **Rejected sign-off throws** — stage boundaries are sequential; there is no\n   skip-ahead path.\n\n## PHI provenance model\n\n- `requirePhiApproval(ctx, purpose, datasets, { requestingStage, phiApprovals })`\n  raises `crg.phi-data-access-approval` **before** any task receives\n  PHI-derived data in its context.\n- Approvals are **per-dataset, never generalized**: only datasets with no\n  recorded approval are raised; each approval records\n  `{breakpointEventId, breakpointId, purpose, requestingStage, datasets, approvedAt, respondedBy}`.\n- The provenance log is threaded into every downstream PHI task context\n  (Cleanroom specs, `crg.implement-component`, the phi-provenance-critic).\n- Rejection **throws**. The process invents no de-identified fallback path.\n\n## Inputs\n\n| Input | Type | Default |\n| --- | --- | --- |\n| `projectRequirements` | `string` | **REQUIRED** — empty throws |\n| `phiComponents` | `string[]` | `[]` (hint only; `crg.phi-classification` is authoritative) |\n| `boundedContextsHint` | `string[]` | `[]` |\n| `complianceStandards` | `string[]` | `['HIPAA Security Rule', 'HIPAA Privacy Rule']` |\n| `kipDir` | `string` | `.a5c/kip` |\n| `kipModel` | `string` | `sonnet` |\n| `maxFixAttempts` | `number` | `2` |\n\n## Outputs\n\n`{ success, srs, domainModel, formalSpecs, implementation, verification, traceabilityMatrices, stageSignoffs, deployment, metadata }`\n\n- `deployment` is `null` and `success` is `false` whenever the\n  `crg.production-deploy` breakpoint is rejected — there is no fallback deploy\n  path.\n- `verification` is keyed by level: `unit` / `integration` / `system` /\n  `acceptance`.\n- `metadata.phiApprovals` is the full PHI approval provenance log.\n\n## Usage\n\n```bash\nbabysitter run:create \\\n  --process library/methodologies/composition-regulated-greenfield/composition-regulated-greenfield.js \\\n  --input '{\"projectRequirements\": \"Build a patient portal for a hospital system: appointment scheduling, medical-records access, secure messaging, billing. HIPAA Privacy + Security Rules apply.\", \"phiComponents\": [\"medical-records\", \"secure-messaging\"]}'\n```\n\n## Design notes\n\n- **No fallbacks**: missing `projectRequirements` throws; rejected sign-offs\n  and PHI denials throw; a rejected deploy returns `success:false` with\n  `deployment:null`; gate escalation is the combinator's owner breakpoint,\n  never a silent pass.\n- **Parallelism boundaries**: `ctx.parallel.all` only *within* a stage\n  (per-context tactical DDD, per-component Cleanroom spec/verify,\n  per-component implementation, per-component/per-suite Stage-5 level runs);\n  stage boundaries are strictly sequential — no speculative cross-stage\n  scheduling.\n- **Escalation semantics**: bounded fix loops (`fixDesignTask`,\n  `fixImplementationTask`, `crg.fix-verification`) run at most\n  `maxFixAttempts` times, then escalate to an owner `routedBreakpoint`;\n  owner rejection throws.\n- **kip touchpoints**: `kipRecall` at stage 0 (kind\n  `methodology-composition`), `kipAssert` after stage 6 with composition,\n  interface, pattern, and run-outcome facts.\n- **Task-registry collision**: `waterfall.js` and `v-model.js` both register\n  the task id `implementation` at module-evaluation time (known library-wide\n  shared-id issue). This composition uses neither module's `implementation`\n  task (it has `crg.implement-component`), so it imports the two modules\n  sequentially via top-level `await import(...)` and clears the inert\n  colliding definition between them.\n",
    "documents": [
      "specialization:composition-regulated-greenfield"
    ]
  },
  "outgoingEdges": [
    {
      "from": "page:library-composition-regulated-greenfield",
      "to": "specialization:composition-regulated-greenfield",
      "kind": "documents"
    }
  ],
  "incomingEdges": [
    {
      "from": "page:index",
      "to": "page:library-composition-regulated-greenfield",
      "kind": "contains_page"
    }
  ]
}