An interactive click-through prototype of the CARO Address Book and its license-compliance automation — the single, testable interface showing how all five intake channels (Trusted Partner Network, VRS interactions, Secure Message Portal, manual invite, and 3rd-party OCI/XATP requests) come together into one system of record, alongside the shared automatic-vs-manual confirmation setting, the reciprocal VP-exchange rule, and Legisym-backed license/compliance status (CAR-838). This prototype validates the target UX before the remaining build tickets (the VRS→address-book link and the XATP reciprocal-VP answer) are scoped.
As a Product/UX designer, I want an interactive HTML prototype of the CARO Address Book — list view, contact detail, settings and the five intake-channel entry points — so that engineering, compliance and pharma-facing stakeholders can validate the target experience before we scope build tickets for the remaining gaps.
What the CAR-893 acceptance criteria require, and whether this prototype currently covers it, plus every UI-representable requirement found by cross-checking all sub-tickets of both parent epics on 2026-09-15 (re-verified against the CAR-893 ticket, the CARO-134 epic and the CARO-133/CAR-838 Automated License Compliance ticket in Notion on 2026-09-21). Full detail: _docs/gap-analyse-prio-liste-2026-09-14.md in this folder's _docs/ subfolder. Reorganized by epic on 2026-09-24; reordered on 2026-09-29 (Design Lead): CARO-133 comes first as priority 1 — GLN (CAR-850), then PDF upload (CAR-843 / CAR-816), then Audit Trail (CAR-897) and Reporting (CAR-895), then the remaining CARO-133 tickets — followed by CARO-134, with the Trusted Partner Network (TPN) row listed last. "Priority 1" is the working order, not a Notion field after a cross-check of all sub-tickets of both epics; rows marked "added 2026-09-24" were missing before. Priority = the ticket’s Notion "Priority" field as of 2026-09-24 (one line per ticket where a row cites several).
Corrected 2026-09-21: CARO-133 ("Breckenridge" — Legisym/license-compliance automation, CAR-838) is part of this prototype's scope, not a separate one — an earlier version of this note said it had its own dedicated prototype ticket (CAR-894) and none of its requirements belonged here; that was wrong, CAR-894 now stays in Notion as an umbrella ticket pointing to CAR-893 (decided 2026-09-27). Its requirements are listed under the CARO-133 epic below. CARO-134 ("UX/UI Improvements adding to Breckenridge", this ticket’s own epic) now comes second (since 2026-09-29); its "Other CARO-134 sub-tickets" group lists items that are not part of CAR-893’s own 8 acceptance criteria.
| Requirement | Ticket | Priority | Status | Note | Page |
|---|---|---|---|---|---|
| Epic CARO-133 — Breckenridge (Automated License Compliance; corrected into scope 2026-09-21) · Priority 1 | |||||
| CAR-850 — GLN Support (pulled forward from CAR-894 on 2026-09-23) · AC status synced to the Notion ticket on 2026-09-30: Legisym GLN check replaced by Manual / Self-attestation, hierarchy limited to one sub-level | |||||
| GLN field on the partner profile: optional, DSCSA-recommended, multiple GLNs per partner (one per location), visible and editable | CAR-850 | Must | Done | Added 2026-09-23: "Locations" block (GLN) at the top of the "Locations & Licenses" tab, above the licenses table (location, GLN, role, verification, last update, request self-attestation + edit + delete actions; "Add GLN" inline form). Updated 2026-09-29: no Legisym GLN check any more (no Legisym match column, no re-check), see the verification row below. Moved there the same day from a standalone card — GLN is a per-location identifier, not a per-license column. Delete asks for confirmation (same modal pattern as license delete) and removes the entry; deleting the last GLN brings back the "No GLN on file" advisory. CVS Pharmacy shows two locations. The License Details slideover’s GLN row now shows the location’s GLN instead of "-". Demo GLNs are fictional (valid GS1 check digits), not real registrations. | contact-details.html |
| GLN hierarchy per GS1 (parent GLN + location role), manual entry, one sub-level only | CAR-850 | Must | Done | Added 2026-09-24 (extension beyond CAR-850’s own AC, decided by the Design Lead): each GLN has an optional parent location and a GS1 location role (Legal entity / Bill-to / Sold-to / Ship-to / Deliver-to). Shown as indented, always-expanded rows; deleting a parent moves its children up one level. Updated 2026-09-30: limited to one sub-level (top level → child, no deeper nesting): only top-level GLNs can be chosen as parent, a GLN with child locations stays at the top level, and the CSV import adds rows whose parent is itself a child location at the top level (note in the preview). Manual entry only — no GS1 US Data Hub/GLEIF import (automated lookup stays out of scope per CAR-850). Indented-row pattern is new: draft decision in _docs/adr-entwurf-hierarchische-tabellenzeilen-2026-09-24.md, pending approval. Company-level parent/subsidiary structure is a separate follow-up. |
contact-details.html |
| Format validation on entry: 13-digit GS1 GLN with check digit | CAR-850 | Must | Done | Client-side check on save (13 digits + GS1 mod-10 check digit), inline .error-text + .form-input.error. Newly added GLNs start as "Manual" or, with self-attestation, "Awaiting confirmation" (updated 2026-09-29; before: "Pending check" until a Legisym match). |
contact-details.html |
| Advisory indicator if GLN is missing (not blocking) | CAR-850 | Must | Done | callout-info "No GLN on file" in the Locations block (e.g. Moderna Therapeutics, Eli Lilly); neutral "Missing" pill in the list column. Never blocks any action. |
contact-details.html |
| GLN verification: Manual or Self-attestation via CARO Messages (replaces the mismatch alert against the Legisym record, 2026-09-29) | CAR-850 | Must | Done | Changed 2026-09-29 (Design Lead), CAR-850 updated in Notion on 2026-09-30: the Legisym mismatch alert is removed. In the Add/Edit GLN form the user chooses Manual (confirms the GLN themselves) or Self-attestation: the GLN is sent to a verified contact of the partner in CARO Messages (thread "GLN confirmation: <Location>", type Data Request) and confirmed there. Column "Verification": Manual / Awaiting confirmation / Self-attested + contact with a link to the thread; row action "Request self-attestation". A changed GLN or contact sends a new request, Manual or delete withdraws it, CSV imports start as Manual. The confirmation is an Audit Trail event (EV-1049). Demo: CVS Pharmacy, Distribution center (msg1068); the test panel simulates the confirmation. | contact-details.html |
| GLN used as an additional matching field in the Legisym matching logic (alongside License ID, company name, jurisdiction) | CAR-850 | Must | Out of scope | Backend logic, not representable in a click-through prototype — left unchecked in the Notion ticket. Represented on the UI side only by the explanatory line in the Locations block. Since 2026-09-29 the prototype shows no Legisym GLN check (no match status, no mismatch, no re-check). | contact-details.html |
| GLN as optional column in the partner list view | CAR-850 | Must | Done | "Show GLN" switch in the toolbar (off by default); column shows the first GLN, "+n" for further locations and a "Missing" pill (no "Mismatch" pill since 2026-09-29). | address-book.html |
| CSV import for bulk GLN assignment | CAR-850 | Must | Done | Represented only: bulk-import pane lists GLN as an optional CSV column (semicolon-separated for multiple locations); the demo result shows a GLN column, with one row flagged "Invalid check digit" → "Review needed". Same SAP-dependent simulation as the rest of bulk import — no real import. Added 2026-09-24: per-partner CSV import in contact-details.html (Locations block → "Import CSV"): a chosen .csv is parsed in the browser (columns location, gln, role, parent; comma or semicolon), every row is validated (13 digits, GS1 check digit, already assigned, unknown role/parent), a preview shows Ready / skipped rows, and only valid rows are added to the GLN hierarchy. Template download + sample data included. Nothing is uploaded or persisted. 2026-09-29/30: imported GLNs start as Manual; a parent that is itself a child location is not accepted (row added at the top level). | contact-details.html address-book.html |
| GLN in exportable audit trail / compliance reports and in transaction records | CAR-850, CAR-897 | 850: Must 897: Could |
Out of scope | Not built here. As of 2026-09-24 CAR-850’s scope item 4 ("GLN in Trace & Audit Export") is explicitly handed over to CAR-897 ("Audit Function in CARO", Backlog), incl. GLN in exports/compliance reports, per event in the Audit Trail and in transaction records (CAR-897 open decision 10: no transaction-record screen exists; VRS Events/Reports as closest equivalent). Concept basis: _docs/audit-export-konzept-2026-09-23.md. |
— |
| GS1 GLN registration/issuance, automated GLN lookup, mandatory GLN enforcement | CAR-850 | Must | Out of scope | Out of scope per CAR-850 itself. | — |
| CAR-843 / CAR-816 — Partner documents upload (added 2026-09-24) | |||||
| PDF upload into the partner profile: linked to the partner, listed, clickable and downloadable | CAR-843 | Must | Done | Covered by the Files tab (see the "Document handling" row above): file picker (PDF, PNG, JPG, DOC, DOCX), file listed with upload date, download. Re-checked 2026-09-24 against the updated CAR-843 ("After upload" is now Phase 1): upload feedback (loading, errors, size limit) is listed in the next row. The "no license match" edge case belongs to the dummy-account flow (Phase 2). | contact-details.html |
| Upload several files at once, also via drag and drop (nice to have, not a must) | CAR-843 | Could | Done | Added 2026-09-30 (Design Lead), CAR-843 updated in Notion as nice to have. Files tab: file picker with multiple selection; files can be dropped anywhere on the tab. The dropzone ("Click to upload or drag and drop", same pattern as messages.html) sits above the table once files exist; in the empty state it appears only while dragging. Each file is checked on its own (format, 10 MB), rejected files are listed with the reason. One classification per upload applies to all files; each file gets its own upload date and audit entry. | contact-details.html |
| Upload feedback: loading state and maximum file size (e.g. 10 MB) with an error for files that are too large | CAR-843 | Must | Done | Added 2026-09-24: part of CAR-843 Phase 1 ("After upload"). Files tab: loading state on "Add File" (existing .btn.is-loading), inline callout-warning for wrong format and files over 10 MB, success toast, "PDF only, max. 10 MB per file" hint. Client-side simulation only. See ux-entscheidungen.md, 2026-09-24. |
contact-details.html |
| Dummy account created automatically from the uploaded license if the partner does not exist yet (PDF → partner via License ID) | CAR-843 | Must | Out of scope | Decided 2026-09-24 by the Design Lead: dummy-account creation from an uploaded license is Phase 2 and therefore not considered in this prototype. Noted in the CAR-843 Notion ticket the same day. The "no license match" edge case moves to Phase 2 with it (decided 2026-09-29). | — |
| Compliance files cannot be deleted (archive/flag only, or admin-restricted); files classifiable as "compliance evidence" vs. generic attachment | CAR-843, CAR-816 | 843: Must 816: Duplicate |
Done | Resolved 2026-09-24 (Design Lead), CAR-843 updated in Notion the same day: compliance documents can’t be overwritten or deleted by regular users — they can only archive (confirm modal). Deletion is admin-only and requires a reason (mandatory comment field in the delete dialog). Archive and delete events (who, role, when, partner, file, reason) are kept in an in-memory audit log in the prototype; the real Audit Trail is CAR-897, which now lists all audit-relevant logging from both epics. All roles see archived files tagged "Archived" and can filter Active / Archived / All. Role switch in the test panel (demo user is Admin). New upload never replaces an existing file. Classification built 2026-09-29 (Design Lead): on upload a "Classify file" dialog asks for Compliance evidence (pre-selected) or Attachment; the Files table shows it in a Classification column, files shared from Messages count as compliance evidence. Archive and delete rules are the same for both classes: regular users can only archive, deleting stays admin-only (decided 2026-09-29). | contact-details.html |
| Accepted file types | CAR-843, CAR-816 | 843: Must 816: Duplicate |
Done | Resolved 2026-09-24 (Design Lead): formats follow CAR-816 — PDF, PNG, JPG and DOC, plus DOCX (added the same day by the Design Lead). CAR-843 (now titled "Partner Information Upload", no format in the name) and CAR-838 updated in Notion the same day. Files tab: file picker and validation accept these five, each row shows the matching DesignOS file-type icon (Misc Icons/File/File type=Default: PDF, Image, Document), other formats get the "Wrong file format" callout. | contact-details.html |
| Immutable "verified on" timestamp + user ID, stored source URL/screenshot, retention date (upload + 6 years) shown | CAR-843 | Must | Done | Re-checked 2026-09-29 against the updated CAR-843: Phase 1 only needs who uploaded and when (upload date set automatically, not editable; "File uploaded" Audit Trail event with who / when). The separate "Verified on" timestamp with source is Phase 2 (OCR / AI), Screenshot-Capture is "not needed". Retention built 2026-09-29 (Design Lead: build it, although the ticket lists the flag under Phase 2): Files tab column "Retain Until" = upload date + 6 years (MM/DD/YYYY) for compliance evidence, — for attachments; the info callout says these files are never deleted automatically; Audit Trail event EV-1054 shows "Retain until". Retention reminder built 2026-09-29: compliance evidence reaching its retention date within 90 days shows an "Ends in n days" pill and a "Retention ends soon" notice with "Export files" above the table; after export the pill shows "Exported" with the date and the export is logged. Test Panel "File near retention end" adds an example file (none of the demo companies has one). | contact-details.html |
| Export partner information as PDF ("Print to PDF") | CAR-843 | Must | Done | Added 2026-09-24: "Export PDF" button (DesignOS Icons/printer.svg) in the contact-details header opens the browser print dialog ("Save as PDF"). Print layout shows header with export date and user, Location, Credentials, Locations & Licenses (incl. GLN), Contacts and Files — without app chrome, actions or prototype tools. Communication, Shared Data and Correlation Reports are not part of the export. |
contact-details.html |
| Exportable audit log of uploads/access (CSV/PDF) for inspections | CAR-843, CAR-897 | 843: Must 897: Could |
Done | Re-checked 2026-09-27 against the build (work package C): covered by the CAR-897 Audit Trail. File uploaded / downloaded / archived / deleted are Audit Trail events (category Documents) and can be exported as CSV or PDF (also JSON), e.g. the demo export EXP-0411 "Category: Documents". | audit-trail.html, compliance-exports.html |
| CAR-897 — Audit Function in CARO (added 2026-09-24) | |||||
| Central Audit Trail with export: event table, filters, detail drawer, export flow and history, GLN per event | CAR-897 | Could | Done | Own design deliverable (Notion: PM/Sales Prep). Built in this folder (decided 2026-09-27, Design Lead: everything belongs together, the overall picture should not run across several prototypes). Built 2026-09-27: sidebar group Compliance (Overview / Audit Trail / Exports); Audit Trail with 3 stat tiles, search, filters (date range, category, partner, actor, source, status transition), 8-column event table, detail drawer (before / after, checked source, GLN per location or "No GLN on file", expected action, linked objects), point-in-time lookup, export modal (3 scopes, CSV / PDF / JSON, evidence bundle "Soon", metadata header, preparing / ready / failed), not-found state, loading and empty states; Exports page with "Audit reports" and export history. Activity Log under Team Management is the Audit Trail filtered to Team & access. Roles and a forced export failure can be switched in the test panel. Prototype only: files are generated in the browser from demo data, nothing is signed or verified. Not built yet: contextual entry points from other pages (new tab) and the Dashboard to-do "Your export is ready", see the next row. Concept basis: _docs/audit-export-konzept-2026-09-23.md. |
audit-trail.html, compliance-exports.html |
| Document audit AC (from CAR-843): file uploaded, opened / downloaded, archived and deleted each appear as an Audit Trail event with who, role, when, partner and file (name / type) | CAR-897, CAR-843 | 897: Could 843: Must |
Example data | Added 2026-09-27 as AC in CAR-897. The Audit Trail shows demo events for all four (uploaded, downloaded, archived, deleted) with who, role, when, partner, file name and type. Not yet connected: actions in the Files tab of contact-details.html don’t write into the Audit Trail (archive / delete stay in CD_FILE_AUDIT_LOG; upload and open / download are not captured). |
audit-trail.html |
| Document audit AC (from CAR-843): delete events only come from admins and show the mandatory deletion reason; non-admin users can only archive | CAR-897, CAR-843 | 897: Could 843: Must |
Example data | Added 2026-09-27 as AC in CAR-897. The demo "File deleted" event shows role Admin, "Permission: Admin only" and the deletion reason in the detail drawer; archive events come from any role. The rule itself is in place in the Files tab (admin-only delete with mandatory reason, archive for all roles), see the CAR-843 row above. | audit-trail.html |
| Document audit AC (from CAR-843): archived files stay traceable in the Audit Trail and are tagged "Archived" | CAR-897, CAR-843 | 897: Could 843: Must |
Example data | Added 2026-09-27 as AC in CAR-897. Demo event "File archived" (Active → Archived, tag "Archived" in the drawer) stays in the Audit Trail, followed by the deletion of a duplicate file. | audit-trail.html |
| Document audit AC (from CAR-843): file events show whether the document was used during an inspection | CAR-897, CAR-843 | 897: Could 843: Must |
Example data | Added 2026-09-27 as AC in CAR-897. Every file event shows the field "Used during an inspection" (Yes / No) in the detail drawer. How it is captured is still not defined in CAR-843 or CAR-897, see Open decisions #3. | audit-trail.html |
| Document audit AC (from CAR-843): files classified as "compliance evidence" are distinguishable from generic attachments in file events | CAR-897, CAR-843 | 897: Could 843: Must |
Example data | Added 2026-09-27 as AC in CAR-897. File events carry "Classification: Compliance evidence". Since 2026-09-29 the Files tab also has the class "Attachment" (see the CAR-843 row above), but no demo Audit Trail event shows an attachment yet. | audit-trail.html |
| Document audit AC (from CAR-843): document events are part of the audit export; CAR-843 expects CSV and PDF | CAR-897, CAR-843 | 897: Could 843: Must |
Done | Added 2026-09-27 as AC in CAR-897. Document events are part of every export scope that covers them (current view, partner audit record); CSV, PDF and JSON are generated in the browser, each with a metadata header and GLN per partner and location. Same scope as the "Exportable audit log" CAR-843 row above. | compliance-exports.html |
| Contextual entry points into the Audit Trail with pre-applied filters (partner details, Compliance Overview, VRS Events / Reports, Wallet Credentials), opening in a new tab with breadcrumbs; Dashboard to-do "Your export is ready" | CAR-897 | Could | Done | Built 2026-09-27 (work package C): "View in Audit Trail" on partner details (filter partner), Compliance Overview (Compliance status), VRS Events and VRS Reports (VRS interactions), Wallet Credentials (Credentials), plus the new Notifications and Exceptions pages. Each opens a new tab; the breadcrumbs show where the user came from (from param). Dashboard to-do "Your export is ready" appears after an export or audit report and disappears when ticked or opened. Earlier state: next step after the navigation pages. The Audit Trail already reads the query params (partner, category, q / uuid, event) and shows the not-found state for an unknown partner or event (A-12, e.g. ?partner=Unknown Partner); the links on the other pages were added on 2026-09-27. |
contact-details.html, non-compliant-partners.html, vrs-events.html, vrs-reports.html, wallet-credentials.html, dashboard.html |
| CAR-895 — Reporting (added 2026-09-24) | |||||
| "Non-Authorized Trading Partner" report | CAR-895 | Could | Done | Re-checked 2026-09-27 against the build (work package C): Exports page, section "Audit reports" (CAR-897 OD 11): date range + Generate, same export flow (preparing, ready / failed, Audit Trail event, Dashboard to-do), incl. GLN. | compliance-exports.html |
| Timestamped "Master Audit Report" with historical license checks, plus timestamped credential-exchange logs | CAR-895 | Could | Done | Re-checked 2026-09-27 against the build (work package C): "Master Audit Report" (timestamped history of license checks, verification results and status changes) and the credential-exchange log are generated under Exports › Audit reports; demo export EXP-0410. | compliance-exports.html |
| Phase 2: W3C VC issuance in the CARO Digital Wallet, OCI responder verification, VRS Handshake simulation | CAR-895 | Could | Out of scope | Excluded per CAR-894; the CARO-133 epic lists Phase 2 as on hold. | — |
| CAR-838 — Automated License Compliance & Processing (parent ticket) and the sub-tickets it summarises | |||||
| Legisym-backed license verification: status/expiry/mismatch detection (Active / Expiring soon / Expired / Invalid-no-match) | CAR-838, CAR-846 | 838: Should 846: Could |
Done | licenseStatusPill() (active/expiring/expired/invalid) in address-book.html and contact-details.html; Legisym named directly as the source in non-compliant-partners.html's donut legends. (The Legisym sync log on the former System Health page was removed on 2026-09-29.) |
address-book.html contact-details.html non-compliant-partners.html |
| Compliance dashboard: status per trading partner + expiry indicators | CAR-838 | Should | Done | non-compliant-partners.html ("Compliance" in the sidebar nav): Compliance Breakdown by Category, Verification Sources, Partner Status and the non-compliant-partners follow-up table. | non-compliant-partners.html |
| License expiry alerts / renewal reminders to trading partners, incl. external recipients without a CARO account | CAR-838, CAR-844 | 838: Should 844: Must |
Done | Built 2026-09-27 (work package A): expiry alerts (90 / 60 / 30 days) and renewal reminders go to CARO users and to external partner contacts without a CARO account (email + secure link to their own license, no login). Recipients and the legal-basis confirmation are set under Notification rules. notification-settings.html stays internal-only for CAR-774 to 777. Legal review for emailing partners is still pending (callout on the rules page). | compliance-notifications.html, org-settings.html (Feature settings › Compliance), license-access.html |
| Document handling: upload & storage of license documents (PDF, PNG, JPG, DOC, DOCX; backup/audit only, no OCR) | CAR-838, CAR-843 | 838: Should 843: Must |
Done | Added 2026-09-22: contact-details.html's "Files" tab now has a working upload/list/download/delete flow (PDF-only at the time — extended to PDF, PNG, JPG, DOC, DOCX on 2026-09-24, backup/audit framing shown as an inline note, no OCR, MM/DD/YYYY dates per skill_spherity_design.md's CARO convention) — built from role_design_experience_lead's Figma reference (CARO--New- file, node 3694:56784). Every company starts from the empty state; the table only appears once a file is actually uploaded (client-side simulation only, not persisted). See ux-entscheidungen.md's 2026-09-22 entries for the full decision trail. | contact-details.html |
| CAR-844 — Compliance Notifications & Messaging Extension (added 2026-09-24) | |||||
| Compliance notification overview and drill-down: status (Active/Sent/Failed), type (Expiry/Renewal), configuration (trigger timing 90/60/30 days, recipient groups, alternate recipients, cadence), system vs. manual distinction, PDF/CSV report export, Magic Link view for external partners | CAR-844 | Must | Done | Built 2026-09-27 (work package A). Compliance › Notifications: status Active / Sent / Failed, type Expiry / Renewal, "Automated" vs. "Manual" tag, max. 3 stat tiles. Drill-down: license details, recipients with delivery status, check history and notification log, contact partner, mark resolved, PDF / CSV export (listed under Exports and logged in the Audit Trail). Failed delivery shows what failed, with resend and an alternate recipient. Scenario 1: a new license number reported through the secure link is shown for reconciliation. Notification rules: timing, reminder interval (= cooldown, default 3 weeks), recipients incl. partner contacts and an additional address, digest cadence per recipient group, legal-basis checkbox. Automated threads also appear in Messages (tag "Automated"). Demo values: see Open decision 6. | compliance-notifications.html, notification-detail.html, org-settings.html (Feature settings › Compliance), license-access.html, messages.html |
| CAR-846 — Legisym Integration: Additional Information (added 2026-09-24) | |||||
| Detail view comparing Legisym data vs. CARO data per license; fallback state when the Legisym API is unavailable | CAR-846 | Could | Done | Work package B built 2026-09-27. Partner details › Licenses › open a license: section "Legisym verification" with result (Matches / Mismatch / Not found / Check pending), last verified time and source, and a table "On file (CARO)" vs. "Legisym" (number, licensee, state, type, status, expiry); differing fields are marked. Fallback when Legisym does not answer: the Legisym column shows the last confirmed record greyed out, "for reference only, not treated as current". Expiry date now comes from Legisym. Examples: Walgreens (legal name differs), Bristol Myers Squibb (not found), AstraZeneca (Legisym did not respond), Merck (matches). Mismatch / not found link to Exceptions. Demo values for Legisym records and expiry dates. | contact-details.html |
| CAR-849 — Pre-Transaction Check: Manual Trigger + Automated Monitoring (added 2026-09-24) | |||||
| Manual on-demand check ("Check Now") and "Last checked at" on the partner profile | CAR-849 | Could | Done | Shown as "Refresh license status" (hold-to-confirm) and "Last verified" on contact-details.html. Resolved 2026-09-27 (Design Lead): this counts as coverage, even though the wording differs from the ticket. | contact-details.html |
| "Check pending" state when Legisym is unavailable (last-known status not kept as valid) | CAR-849 | Could | Done | Work package B built 2026-09-27. License status "Check pending" (licenses table, detail view), notice above the Licenses table with the last confirmed status ("not treated as current"), the automatic retry time and "Re-check now". Per the rule, the outage is also a notification: Compliance › Notifications, type "Check pending" (CN-2044), bell entry, Audit Trail event EV-1061 (source Legisym, "external service failure, not a CARO error") and a System Health log line. A successful re-check resolves the notification automatically. Example: AstraZeneca; Test Panel "Legisym unavailable" turns any re-check into Check pending. Earlier state: not built on the partner page (work package B). The Audit Trail already has the outage and the re-run as events (EV-1057 "Legisym unavailable · license check pending", EV-1058). Rule for package B (Design Lead, 2026-09-27): the outage is also recorded as a notification in the log and framed as a failure on the partner’s side (Legisym), not a CARO error. | contact-details.html, notification-detail.html, audit-trail.html |
| Alert history per partner + immutable, exportable check log (timestamp, license, result, trigger source user/system) | CAR-849, CAR-897 | 849: Could 897: Could |
Done | Re-checked 2026-09-27 against the build. Done: every scheduled and manual check is an Audit Trail event with timestamp, license, result and trigger source; the re-check is logged as two events (A-05, EV-1003 / EV-1004); exportable as CSV / PDF / JSON. Alert history per license: notification drill-down. Alert history on the partner page: built with work package B, section "Alert history" in the license detail view (all notifications for that license, linked, plus the Audit Trail filtered to the license). A manual re-check is logged as "re-check triggered" and "re-check result". | audit-trail.html, contact-details.html |
| Configurable check interval and advance warning for "Expiring soon" (90 / 60 / 30 days) | CAR-849 | Could | Done | Built 2026-09-27 (work package A) on Notification rules: check interval (every 6 / 12 hours, daily = default), immediate alert on Expired / Invalid / Not found, advance warning 90 / 60 / 30 days. Saving is logged in the Audit Trail (Organization settings). | org-settings.html (Feature settings › Compliance) |
| CAR-894 — Breckenridge Prototype for License Compliance (added 2026-09-24) | |||||
| Follow-on prototype ticket: external notifications, exception queue (unmatched emails, licenses without a Legisym match), reports | CAR-894 | Should | Done | Done 2026-09-27. Built here in two work packages. Work package A (external notifications + exception queue): see the CAR-838 external-recipients row, CAR-844 and the CAR-849 interval row; exception queue under Compliance › Exceptions (licenses without a Legisym match; "Unmatched emails" shown as Soon, because CAR-845 Email Ingestion is on hold, Design Lead decision). Work package C (audit entry points and reports): see the CAR-897 entry-points row, CAR-895 and CAR-843 export rows. Notion was not updated. Earlier state: Decision made, build still open (re-checked 2026-09-27). Notion: In Progress, 2 of 9 ACs checked (both built here). Whether its remaining scope (CAR-844 and CAR-895 rows above) stays a separate prototype or moves into this one was decided 2026-09-27 (Design Lead): CAR-894 stays in Notion as an umbrella ticket that points to CAR-893. Its scope is built here, CAR-844 and the exception queue first; reports (CAR-895) follow together with the CAR-897 audit decisions. The separate CAR-844 click-dummy folder has been deleted. | compliance-notifications.html, compliance-exceptions.html, compliance-exports.html |
| Epic CARO-134 — UX/UI Improvements adding to Breckenridge | |||||
| CAR-893 — this ticket’s own acceptance criteria · Screens | |||||
| Address Book list/overview — source tag + verification status per entry | CAR-893, CAR-886 | 893: Could 886: Should |
Done | — | address-book.html |
| Contact Detail — verification result + timestamp, license status | CAR-893 | Could | Done | — | contact-details.html |
| Settings — single auto/manual confirmation, applies to all 5 channels | CAR-893, CAR-885 | 893: Could 885: Should |
Done | — | org-settings.html (Feature settings › Address Book) |
| CAR-893 · Intake entry points (all 5 required) | |||||
| VRS interaction | CAR-893, CAR-882 | 893: Could 882: Should |
Done | Future-state placeholder only, as required. Note: CAR-882 now exists in Notion (status: PM/Sales Prep) — the on-screen copy still says "no ticket yet", worth checking if that should be updated. | vrs-trading-partners.html address-book.html |
| Secure Message pull-through | CAR-893, CAR-810, CAR-887 | 893: Could 810: Must 887: Should |
Done | Placeholder only, per ticket scope (CAR-810 explicitly out of scope here) | address-book.html |
| Manual invite (single + CSV) | CAR-893, CAR-486 | 893: Could 486: Must |
Done | — | invitations.html address-book.html (Add Contact modal) |
| XATP inbound request | CAR-893, CAR-811, CAR-883 | 893: Could 811: Should 883: Should |
Done | Reciprocal VP answer shown as placeholder only, as required. Note: CAR-811 and CAR-883 both now exist as real tickets (Backlog / PM/Sales Prep) — same "no ticket yet"-style copy-accuracy note as VRS above (CAR-884 not found as a separate resolvable ticket). | address-book.html |
| CAR-893 · Exception states | |||||
| No credential available → unverified manual entry | CAR-893 | Could | Done | "Unverified" pill (e.g. "Jane Doe Logistics") | address-book.html |
| Failed 3rd-party VP verification → no entry, flagged for review | CAR-893 | Could | Done | "Flagged for review" notice above the list | address-book.html |
| CAR-893 · Build constraints | |||||
| Only existing DesignOS components/tokens, no invented styles | CAR-893 | Could | Done | All 49 icons verified against the DesignOS library | — |
| Fixed demo names (Jane Doe / John Smith) | CAR-893 | Could | Done | Resolved 2026-09-22: dashboard.html's three metric tiles now show distinct placeholder deltas (ATP Credentials 94.7% / 3.4%, VRS Interactions 97.2% / 5.1%, Credential Exchange Coverage 80% / 2.2%) instead of the identical 3.4% each carried before — still invented demo figures, not real period-over-period data, but no longer visually identical across unrelated metrics. | dashboard.html |
| CAR-893 · Known example/placeholder data | |||||
| KPI trend badges (Verified Partners/Self-evaluated/Invited) — dashboard-hierarchy-variants.html | — | — | Done | Counted as Done (2026-09-27, Design Lead), status was "Example data (approved)". dashboard.html has no real period-over-period figures for these 3 metrics. The Design Lead explicitly approved invented example deltas (+18 / +6 / +3 “vs. last period”) for this POC on 2026-09-15, after first asking for the arrow-only badge to say a number — replace with real figures before this leaves POC status. | dashboard.html |
| CAR-893 · Delivery | |||||
| Filed under design-mockups/CARO, briefing.html entry point, registered in index.html | CAR-893 | Could | Done | Registered with lifecycle status "active" | — |
| Other CARO-134 sub-tickets — not part of CAR-893’s own AC (cross-check 2026-09-15, updated 2026-09-21 and 2026-09-24) | |||||
| Manual invite: choose supplier/client category when adding a contact | CAR-486 | Must | Done | Added 2026-09-21, icon choice confirmed 2026-09-22: Supplier/Client radio-card selector in the Invite Contact pane (reuses the wallet-credentials.html Credential Type pattern), "Supplier" pre-selected by default. Icons: package for Supplier, building for Client (replacing the earlier users-icon placeholder, which read as people rather than organization) — both existing DesignOS sprite symbols already used elsewhere in the prototype. | address-book.html |
| Manual invite: invite via SSI identifier (DID) as an alternative to email | CAR-486 | Must | Done | Added 2026-09-21: Email/DID toggle (tab-pill-group) in the Invite Contact pane — DID shown as an alternative input, not alongside email, per the gap note wording. | address-book.html |
| Event-driven notifications: verification failures / duplicate merges / ATP status changes | CAR-774, CAR-775, CAR-776, CAR-777 | 774: Must 775: Must 776: Must 777: Must |
Done | Own scope bullet in the CARO-134 epic, alongside CAR-893, but not one of CAR-893's 8 ACs. Addressed via org-settings.html (Feature settings › Address Book › Event alerts), linked from settings.html — immediate bell alerts + digest cadence, internal recipients only | org-settings.html (Feature settings › Address Book › Event alerts) org-settings.html (Feature settings › Address Book) |
| "ATP Credential Dashboard" tier badges (Gold = ATP Verified / Silver = Verified / Unverified = Pending) | CAR-774 | Must | Done | Corrected 2026-09-22 - this was built 2026-09-21 and the checklist was never updated. non-compliant-partners.html's "Verification Tiers" tab now has a dedicated Gold/Silver/Unverified tile row plus per-tier partner group breakdown. The ticket's own "Workflow Actions (API)" and "Audit Trail" parts are explicitly out of scope here (no real API/backend exists in this prototype) — a documented decision, not an open gap. | non-compliant-partners.html |
| Duplicate-entry prevention (no new entry if partner already exists, matched by DID/GLN) | CAR-882 | Should | Done | Represented via the VRS locked-banner copy (address-book.html) and a worked example on vrs-trading-partners.html (Merck & Co./Moderna Therapeutics = new entry via VRS; AstraZeneca = matched by DID, no duplicate). Added 2026-09-21. Decided 2026-09-27 (Design Lead): VRS contacts are only ever created automatically, no pending path. This conflicts with the single Contact Confirmation setting on settings.html (CAR-885), which covers all five channels including VRS; decided 2026-09-27, see Decided. | address-book.html vrs-trading-partners.html |
| Sales dashboard: clean triage overview with charts from data CARO holds, wording without any compliance promise | CAR-858 | Must | Done | Added to this checklist 2026-09-24 (built, but was not listed). dashboard.html: "Compliance – Needs your attention", 4 KPI tiles linking to real CARO pages, filters marked "Soon", scope-caveat tooltip on Credential Exchange Coverage. Compliance Breakdown/VRS chart live on non-compliant-partners.html per the 2026-09-16 "Dashboard = Triage, not Analysis" decision. Notion status: PM Testing. | dashboard.html |
| TPN Connect | CAR-893 | Could | Done | Interactive — target flow, not yet live in production | tpn-registry.html |
Example data approved by the Design Lead counts as Done; the note keeps the hint that real figures are still needed.
Everything that still needs a decision in this prototype, in one place. Each row links to where the context lives. Once an item is decided, record it in _docs/ux-entscheidungen.md, remove it here and add it to "Decided" below.
| # | Decision needed | Options / context | Owner | Source |
|---|---|---|---|---|
| Scope & tickets | ||||
| 1 | CAR-843: retention flag (Phase 1 or 2) | CAR-843 was updated on 2026-09-27. Screenshot capture is no longer in the AC (resolved). Timestamp: the AC now ask for an immutable upload timestamp with user ID; read as the upload timestamp, not the separate "Verified on" timestamp, which stays "not needed" (Design Lead: ok, 2026-09-27). Still open: retention. The AC ask for "retention date = upload + 6 years, displayed", while the Technical Details keep the retention flag in Phase 2. Not built until this is settled. | Design Lead, Product Manager | CAR-843 |
| 2 | CAR-897 Audit Trail: remaining open points | Resolved 2026-09-27 (Design Lead), see CAR-897 in Notion: built in this folder; Compliance group (Overview / Audit Trail / Exports); Team Activity Log becomes a filtered view of the Audit Trail; Admin and Auditor export, Credential Manager view only (export disabled); all three scopes and CSV / PDF / JSON, evidence bundle shown as "Soon"; message content and sign-in events; audit reports on the Exports page. Retention decided 2026-09-27: audit data is kept for 6 years. Still open: (7) DSCSA field set (Legal, not Design). The Product Manager review (8) was given on 2026-09-27. | Design Lead, Legal (7) | _docs/audit-export-konzept-2026-09-23.md |
| 3 | CAR-897 build: remaining demo assumptions | Built on 2026-09-27; (a), (c), (d) and (f) were decided the same day, see Decided. Still to confirm: (b) "Used during an inspection" is shown as Yes / No on file events (source: CAR-843 Technical Details and CAR-897 Documents logging / AC), but how it is captured is undefined; the Yes / No values are demo values. (e) is resolved (2026-09-29, Design Lead): the logged-in company is always Breckenridge; the prototype switch now changes the user role (Credential Manager / Admin) instead of the company. | Design Lead | audit-trail.html, compliance-exports.html |
| Dashboard & navigation | ||||
| 4 | KPI tile link routing | (a) and (c) decided 2026-09-27 (own ticket for the onboarding tiles; tiles are real links now, see Decided). Still open: (b) "Credential Exchange Coverage" links to the unfiltered list, because no exchange-status filter exists. | Design Lead | dashboard.html |
| Screens & content | ||||
| 5 | Notification cadence vs. Figma "Anti-Spam Logic" board | (a) merge the three per-event cadence controls into one per-recipient cadence; (c) show the Daily ("avoid empty noise") and Monthly ("always send") rules in the UI. (b) cooldown setting was decided and built on 2026-09-27, see Decided. Related: CAR-844 is now built in this prototype; its former click-dummy had a cooldown setting. Since 2026-09-27 the license notifications (Notification rules) use one cadence per recipient group (CARO users / partner contacts) and show the Daily / Weekly / Monthly send rules; the reminder interval doubles as the cooldown there. Still open for the three internal event alerts (now Settings & Help › Feature settings › Address Book › Event alerts): (a) and (c). | Design Lead | org-settings.html (Feature settings › Address Book › Event alerts) |
| 6 | CAR-844 / CAR-894 build: demo assumptions to confirm | Built on 2026-09-27. (a) License expiry dates and partner email addresses (*-demo.com) are demo values; contact-details.html stores no expiry date. (b) The exception queue has one real case (Bristol Myers Squibb, EV-1009) and two demo cases (Walgreens: legal name differs; Pfizer: status mismatch, already reviewed). (c) Contextual entry points show the origin in the breadcrumbs (e.g. Address Book › Merck › Audit Trail); the sidebar keeps Audit Trail active. (d) The secure-link page names the sending organization like the topbar (CVS Pharmacy in the Dispenser view, see 3e). (e) "Automated" tag in Messages uses the TPN accent colour plus an icon. (f) "View in Audit Trail" on VRS Events / Reports is a page-level link (category VRS), not per Correlation UUID. |
Design Lead | compliance-notifications.html, compliance-exceptions.html |
Decisions taken for this prototype, newest first, decided by the Design Lead unless noted. Pure bug fixes and process notes are left out; the full reasoning is in _docs/ux-entscheidungen.md, under the entry named in the last column (§ = numbered entry).
| Decision | Where | Log entry |
|---|---|---|
| 2026-09-30 | ||
| GLN hierarchy limited to one sub-level (top level → child). Only top-level GLNs can be a parent; a GLN with child locations stays at the top level; the CSV import adds rows with a child location as parent at the top level. CAR-850 updated. | contact-details.html | GLN-Hierarchie: nur eine Unterebene |
| Files tab: several files per upload and drag and drop (nice to have, CAR-843). Invalid files are rejected one by one with the reason; one classification per upload applies to all files. | contact-details.html | Files-Tab: mehrere Dateien und Drag and Drop |
| Compliance › "Notifications" is renamed "License Alerts" (sidebar, headline, breadcrumbs, back links). It is an outbox of license alerts, not an inbox, and the old name clashed with the topbar bell. File name stays; single entries are still "notifications". CAR-844 and CAR-894 updated. | compliance-notifications.html | Compliance „Notifications“ umbenannt in „License Alerts“ |
| Compliance Overview: the tab "Your Compliance" is hidden while the organization holds only one credential (ATP); the page opens on "Partner Compliance". The code stays so the tab can come back. | non-compliant-partners.html | Compliance Overview: Tab „Your Compliance“ ausgeblendet |
| 2026-09-29 | ||
| GLN verification: Manual or Self-attestation instead of the Legisym GLN check. Self-attestation sends the GLN to a verified partner contact in CARO Messages; status Manual / Awaiting confirmation / Self-attested. The Address Book GLN column has no Mismatch pill; Audit Trail event EV-1049 now shows the partner’s confirmation. CAR-850 and CAR-894 updated. | contact-details.html, messages.html, address-book.html | GLN: Manual oder Self-attestation statt Legisym-Abgleich; System Health als Tab in Settings & Help |
| System Health keeps only Platform Status and Trust Center and becomes the tab "System Health" in Settings & Help. No sidebar entry, no card on the Dashboard, no incident list, response times or health metrics for customers; system-health.html redirects to the tab. The "CARO Status Monitor" card opens the tab. Supersedes the earlier System Health decisions below. CAR-858 updated. | org-settings.html (System Health), dashboard.html | GLN: Manual oder Self-attestation statt Legisym-Abgleich; System Health als Tab in Settings & Help |
| Retention reminder (CAR-843): compliance evidence within 90 days of its retention date gets an "Ends in n days" pill and a "Retention ends soon" notice with "Export files"; exported files show "Exported" with the date. CARO never deletes these files. | contact-details.html | Retention reminder |
| Attachments follow the same rule as compliance evidence: regular users can only archive, only admins delete (with a reason). | contact-details.html | Retention reminder |
| The CAR-843 edge case "no license match" moves to Phase 2, together with the dummy account. | — | Retention reminder |
| Retention date is built (CAR-843), although the ticket lists the retention flag under Phase 2: "Retain Until" = upload date + 6 years for compliance evidence, shown in the Files tab and in the upload event of the Audit Trail; never deleted automatically. | contact-details.html | Retention & classification |
| Files get a real classification at upload (CAR-843): Compliance evidence (default, pre-selected) or Attachment. Attachments have no retention date. Files shared from Messages count as compliance evidence. | contact-details.html | Retention & classification |
| 2026-09-27 | ||
| Work package B (Legisym status per license): comparison on file vs. Legisym and alert history in the license detail view; "Check pending" when Legisym does not answer, never the last confirmed status as current. A Legisym outage is also a notification (type "Check pending", bell, daily digest, Audit Trail, System Health), worded as a failure of the external service (Legisym), not a CARO error. | contact-details.html | Work package B |
| Feature settings (Variant B, after a CHALLENGE review; to be tested): Settings & Help has the tabs General / Notifications / Feature settings / Security / Integrations. Feature settings (Admin only) lists the features as button tabs in sidebar order (Compliance, Address Book, more to follow); each feature is one page with sections instead of a third row of tabs: Compliance › Notification rules; Address Book › Contact rules and Event alerts. The Notifications tab keeps only the general notifications and points to the feature notifications. Feature buttons (settings-04) open their section directly. Replaces the separate tabs Contact rules / Notification rules from earlier the same day; old links forward. Principle added to DesignOS: foundation_cognitive_principles 1.1 "Breadth over depth". | org-settings.html | Settings consolidation |
| All settings live in one place, Settings & Help (org-settings.html), with the tabs General / Notifications / Contact rules / Notification rules / Security / Integrations. Address Book Settings became the tab "Contact rules", the license notification rules the tab "Notification rules", and the Address Book event alerts (CAR-774 to 777) moved into the Notifications tab. The old pages settings.html, notification-rules.html and notification-settings.html only forward to the new tabs. | org-settings.html | Settings consolidation |
| Feature pages keep a button to their own settings, so users know separate settings exist: "Contact rules" in the Address Book, "Notification rules" on Compliance › Notifications (and "Edit rules" on a notification). These buttons use the icon settings-04; the gear (settings-02) stays reserved for the general Settings & Help in the topbar. Opened from a feature page, Settings shows a Back button to that page. Contact rules, Notification rules and the event alerts are visible to the Admin role only; other roles don't see the buttons or tabs, and a deep link shows "Only admins can change these settings". | address-book.html, compliance-notifications.html | Settings consolidation |
| CAR-844 / CAR-894 placement: Notifications and Exceptions are sub-items of the Compliance group (Overview / Notifications / Exceptions / Audit Trail / Exports). Notification rules get their own page, reached from Notifications; notification-settings.html stays for the internal event alerts. | compliance-notifications.html, org-settings.html (Feature settings › Compliance) | Work package A |
| Exception queue: only "No Legisym match" is built. "Unmatched emails" is shown as a Soon tab, because it depends on CAR-845 Email Ingestion (on hold). | compliance-exceptions.html | Work package A |
| Work package B rule: when Legisym is unavailable, this is also recorded as a notification in the log. It is a failure on the partner’s side (Legisym), not a CARO error, and is worded that way. To be built with package B (Legisym status per license on the partner page). | audit-trail.html | Work package B |
| Work order for the missing requirements: first work package A (CAR-844 notifications incl. CAR-838 external recipients, CAR-849 interval / advance warning, exception queue), then package C (CAR-897 entry points, re-check of CAR-843 / CAR-849 / CAR-895 against the build). Before each package, briefing and prototype are re-read so the work starts from the latest state. | briefing.html | Work packages |
| CAR-894 is marked Done in this briefing once packages A and C are built, with a pointer to both packages. Notion is not updated. | briefing.html | Work packages |
| Briefing gets a Progress bar above the tabs: share of requirements that are Done / Open / Missing, counted live from the checklist, Out of scope excluded. The legend filters the checklist (click again or "Show all" to reset). | briefing.html | Progress bar |
| Approved example data counts as Done; the note keeps the hint. Applied to the KPI trend badges (was "Example data (approved)"). Example data without approval stays Open. | dashboard.html | Progress bar |
| CAR-897: audit data is retained for 6 years. The DSCSA field set is still open (Legal). | audit-trail.html, compliance-exports.html | Retention |
Dashboard KPI tiles are real links: the tile title is an <a> that covers the whole tile (stretched link), so right-click and open in new tab work; info-tip buttons stay clickable on top. |
dashboard.html | KPI tiles |
| VRS counterparties: a completed VRS handshake exchanges ATP credentials and adds the partner to the Address Book. Merganser Pharma (Manufacturer) and Ravenna Distribution (Wholesaler) are now VRS contacts (ATP verified, tier Silver, no GLN, partner type derived from the name); their Audit Trail events link to the partner page. Eider Pharmacy’s DEA lookup found no credential, so the handshake is not completed and it is no contact. | address-book.html, contact-details.html, audit-trail.html | VRS contacts |
| Exports stay downloadable for 7 days, then show "Expired". The Credential Manager sees no export history, because the role can’t create exports. | compliance-exports.html | CAR-897 exports |
| Demo users (A-09): the duplicate "Chris Muscovy" users are replaced by Alex Miller (Credential Manager) and Sam Taylor (Auditor). Both act in the Audit Trail: Alex Miller archives a file, Sam Taylor signs in and generates the Master Audit Report. | team-overview.html, audit-trail.html | Demo users |
CAR-897 navigation pages: Compliance becomes a sidebar group (Overview / Audit Trail / Exports); the Activity Log under Team Management opens the Audit Trail filtered to Team & access in the same window, team-activity-log.html only forwards old links; the Compliance Overview breadcrumb reads Compliance › Overview. Contextual entry points follow in a second step. |
audit-trail.html, compliance-exports.html, Activity Log | CAR-897 nav pages |
| Invite Contact: "Supplier" stays the default Relationship selection in the prototype. | address-book.html | Relationship default |
| CAR-882 vs. CAR-885 resolved: VRS always adds new contacts automatically. If the partner already exists from another channel (same DID or GLN), CARO creates no duplicate; a new "VRS Matches" setting decides whether a team member confirms the match (default, "Match to review" with Confirm match / Not the same partner) or the contact is merged automatically. Contact Confirmation now covers the other four channels only. | org-settings.html (Feature settings › Address Book), vrs-trading-partners.html | VRS matches |
| GLN wording and pill colours confirmed: Missing = neutral, Mismatch = warning, the "DSCSA-recommended" tag, "Pending check" (never checked) vs. "No Legisym record" (checked, no entry). | contact-details.html | GLN |
| Invite Contact: the field "Category" (Supplier / Client) is now called "Relationship". | address-book.html | Relationship |
| The three onboarding KPI tiles (Verified Partners / Self-evaluated / Invited) get a separate ticket, because the address-book data has no onboarding-stage field yet. Until then they stay unlinked. | dashboard.html | KPI tiles |
| The non-dashboard tables get the canonical always-visible pagination footer with result count: Team Activity Log, Identifiers, and on contact details the Licenses, Communication, Contacts, Credentials and Files tables. Exception: the GLN table (hierarchical rows) has no pagination, so a page break never splits a parent from its children. | team-activity-log.html, wallet-identifiers.html, contact-details.html | Pagination |
"All non-compliant partners": two visible row actions are accepted for this table. Order: Message partner first, then Open partner details as a chevron-right (was arrow-right) at the far right. Documented exception in pattern_data_table v1.17. |
non-compliant-partners.html | Row actions |
| The dashboard tables (explore-news-todo, non-compliant-partners) need no pagination footer. The other five tables get the canonical footer (see next row). | explore-news-todo.html, non-compliant-partners.html | Pagination |
| Walgreens Boots Alliance becomes self-attested + Accepted, tier Silver (was ATP + Accepted + Silver, which contradicted the tier rule). Shown as a neutral "Self-attested" status pill without an icon (the DesignOS Licence family has none); the Credentials tab shows a "Self-attested (no credential)" entry without a detail page. | address-book.html, contact-details.html, non-compliant-partners.html | Walgreens |
| Notification settings get a Cooldown setting (Figma "Anti-Spam Logic", point b): an open item already sent in a digest is left out of the following digests until the cooldown ends, then included again if still open. Options 1 / 2 / 3 / 4 weeks, default 3 weeks (as on the Figma board); applies to all three digests, immediate bell alerts are not affected. | org-settings.html (Feature settings › Address Book › Event alerts) | Cooldown |
| Product Manager approves the structural decisions (Compliance as its own sidebar entry, System Health as its own page, audit placement), with one condition: roll out first for Breckenridge, and to other customers only after feedback and revision. | product_caro.md |
PM approval |
| CAR-897 Audit Trail is built in this folder, not in its own ticket folder: a deliberate exception to one folder per ticket, because it extends existing pages and needs their deep links. Audit reports (Master Audit Report, Non-Authorized Trading Partner report, credential-exchange logs) get their own "Audit reports" section on the Compliance Exports page. No new navigation item. | Compliance / Exports |
CAR-897 entry |
| CAR-897 details: Compliance group with Overview / Audit Trail / Exports; Team Activity Log becomes a filtered view of the Audit Trail; Admin and Auditor can export, Credential Manager can only view; all three scopes and CSV / PDF / JSON; evidence bundle shown as "Soon"; message content and sign-in events are logged. Full list in the Notion ticket. | CAR-897 (Notion) |
CAR-897 entry |
| CAR-894 stays in Notion as an umbrella ticket pointing to CAR-893. Its scope is built here: CAR-844 and the exception queue first, reports (CAR-895) together with CAR-897. The separate CAR-844 click-dummy folder was deleted (restorable from git). | CAR-894 (Notion) |
Decision round |
| CAR-849 "Check Now" / "Last checked at" is covered by "Refresh license status" (hold-to-confirm) and "Last verified". | contact-details.html | Decision round |
| CAR-882: VRS contacts are only ever created automatically, no pending path. The conflict with the global confirmation setting was resolved the same day (see VRS Matches). | vrs-trading-partners.html, org-settings.html (Feature settings › Address Book) | Decision round |
| News and To-Dos stay on the dashboard: no separate inbox and no extra sidebar entry. | dashboard.html | Decision round |
| System Health keeps its own page in the navigation. One clickable row out of seven in "General" is enough for the prototype. | system-health.html | Decision round |
| KPI data discrepancies (tile counts vs. filtered tables, license outlook vs. donut legend) are acceptable for a prototype. | dashboard.html, non-compliant-partners.html | Decision round |
Dashboard hero stat approved for the authenticated app: 64px, companion steps 44 / 32px, one per screen (foundation_typography v1.5, type.display.stat). |
dashboard.html | Decision round |
Hierarchical Rows ADR accepted: depth-first, always expanded, 24px indent per level, CSS-only connector (pattern_data_table v1.16). |
contact-details.html | Decision round |
Icons stay as they are for now (System Health uses check-circle; git-merge not copied to "Misc Icons"). |
system-health.html, org-settings.html (Feature settings › Address Book › Event alerts) | Decision round |
Confirmation modals: title = verb + noun + "?" (never "Are you sure?"), object in bold, "This action cannot be undone." for irreversible actions, button repeats the verb + noun. Archive has no "cannot be undone", because the file stays available (pattern_confirmation v1.3). |
contact-details.html, invitations.html, team-overview.html | Confirmation modals |
| 2026-09-24 | ||
| GLN hierarchy per GS1: manual entry only (no GS1 / GLEIF import), each GLN has an optional parent location and a location role, shown as indented, always-expanded rows. Company-level parent/child structure comes later. | contact-details.html | GLN hierarchy |
| Each GLN row has Refresh → Edit → Delete. Refresh re-checks the GLN against Legisym with the same hold-to-confirm dialog as licenses and shows the result (Matched / Mismatch / No Legisym record). | contact-details.html | GLN hierarchy |
| CSV import for bulk GLN assignment, validated per row; only valid rows are imported. | contact-details.html | GLN hierarchy |
| Partners with Identification = ATP and Invitation = Accepted list their ATP credential in the contact’s Credentials tab. | contact-details.html | GLN hierarchy |
| New credential detail page for own and partner credentials. Own ATP keeps "Expires in 18 days" with the screenshot date; partner ATP issuer = Legisym; MM/DD/YYYY dates. | credential-details.html | credential-details |
| Files tab accepts PDF, PNG, JPG, DOC and DOCX (as in CAR-816). | contact-details.html | GLN hierarchy |
| Deleting a file requires a reason; archive and delete events are logged for the audit trail (UI in CAR-897). | contact-details.html | GLN hierarchy |
Official identification numbers (GLN, license numbers, DID, UUIDs …) are always set in mono and never wrap (foundation_typography v1.4). |
all pages |
GLN hierarchy |
| 2026-09-23 | ||
| CAR-850 GLN support pulled forward into CAR-893: GLN card with 13-digit + GS1 check-digit validation, "Missing" as a non-blocking advisory, "Mismatch" against Legisym as a warning. GLN in exports / reports handed over to CAR-897. | contact-details.html, address-book.html | CAR-850 |
| GLNs can be deleted (with a confirmation modal); order of row actions Edit → Delete. | contact-details.html | CAR-850 |
Pagination is always visible: Prev/Next disabled at the boundary, result count always shown (pattern_data_table v1.13). |
all tables |
DesignOS |
Pill rule: category = no dot, no icon; status = always a coloured dot; at most one identity badge per row with a full icon (pattern_data_table v1.14). |
address-book.html | DesignOS |
| 2026-09-22 | ||
| Files tab built: upload, list, download, archive, delete; framed as backup / audit only, no OCR. | contact-details.html | Files tab |
| Dates follow the CARO convention MM/DD/YYYY, not the Figma example. | contact-details.html | Files tab date format |
| PDFs received via Messages are also stored in the contact’s Files tab; a Source column shows Upload vs. Shared. Demo uses CVS Pharmacy and real cross-page wiring. | messages.html, contact-details.html | Message PDFs |
| Messages uses an email-inbox layout per Figma: inline reply, "Open" stays blue (not the Figma amber), one tag derived from the message type. | messages.html | Messages inbox |
| Top-navigation Settings links to Organization Settings, which gets a Notifications tab; notifications deep-link to the contact. | org-settings.html | §55 |
| Notion ticket mentions are moved out of the page text into one "Ticket references" info alert. | org-settings.html (Feature settings › Address Book › Event alerts) | §56 |
| 2026-09-21 | ||
| Event notifications (CAR-774 to 777) are built in this prototype instead of a separate mockup, using CAR-844’s settings structure but this folder’s styles. Bell animates on a new notification; a dot indicates new messages. | org-settings.html (Feature settings › Address Book › Event alerts) | Event notifications |
| Compliance dashboard gets a Verification Tiers tab (Gold / Silver / Unverified). Workflow actions via API and the audit trail are out of scope here. | non-compliant-partners.html | Verification tiers |
| "Your Licenses" and "Your Compliance Snapshot" are linked; Address Book gets a verification-tier filter; all tables get zebra striping. | non-compliant-partners.html, address-book.html | Links + zebra |
| Invite Contact gets a Supplier / Client category and DID as an alternative to email (label "Relationship" and default "Supplier" decided on 2026-09-27). | address-book.html | Invite Contact |
| Duplicate-entry prevention (CAR-882) shown via the VRS copy and a worked example: matched by DID / GLN, no duplicate entry. | vrs-trading-partners.html, address-book.html | CAR-882 |
| Automatic channels (TPN, VRS, Secure Message, XATP) are no longer tabs in the Add Contact modal; an info-icon tooltip explains them and names CAR-882. | address-book.html | §49, §53 |
| Radio / checkbox groups: 1px border, Figma node 124-2838 is the canonical source, "Icon card" anatomy (header row, divider, description) for both card variants. The selected card is highlighted with a border. | address-book.html, wallet-credentials.html, org-settings.html (Feature settings › Address Book) | §52, §54 |
| 2026-09-18 | ||
| "All non-compliant partners" rows get two actions: open partner details and message partner (accepted as an exception on 2026-09-27). | non-compliant-partners.html | 2026-09-18 |
| "Back to Dashboard" removed (navigation and breadcrumbs are enough); "Your open items" card removed as a duplicate of the snapshot. | non-compliant-partners.html | 2026-09-18 |
| News entries can have images; the teaser gets "Read full post" (new tab) and "View all news" is linked. | dashboard.html | 2026-09-18 |
| System Health mini tiles filter the list, the active tile gets a border, clicking it again clears the filter. | system-health.html | 2026-09-18 |
| 2026-09-17 | ||
| News shown like blog posts, To-Dos as a checklist; System Health as sections (General / Response times / Incidents) instead of tabs; Platform Status and Trust Center embedded as iframes with an "Open" fallback; the compliance tabs switch the whole page content, not just the charts. | dashboard.html, system-health.html, non-compliant-partners.html | 2026-09-17 |
| 2026-09-16 | ||
| Dashboard rebuilt as "triage, not analysis"; the compliance breakdown moves to its own Compliance page with its own sidebar entry. | dashboard.html, non-compliant-partners.html | Dashboard rebuild |
| System Health gets its own subpage with more depth, and a "View all" link from the dashboard card. | system-health.html | system-health subpage |
| 2026-09-15 | ||
| Info bar (version + briefing link) on every page of the prototype. | all pages |
Info bar |
| Dashboard link routing: the hero CTA jumps to the partner-compliance breakdown, the license KPI tile opens the Address Book pre-filtered to expiring licenses; the onboarding tiles are left for a separate ticket (decided 2026-09-27). | dashboard.html, address-book.html | Link routing |
| 2026-09-14 | ||
Focus ring uses --accent-cyan (backport of policy_accessibility v1.5). |
assets/styles.css |
§53 |
| 2026-09-11 | ||
| Cards and tables never combine border and shadow: shadow removed. | assets/styles.css |
§44 |
| News & To-Dos laid out side by side (variant B). | dashboard.html | §48 |
| "Upcoming Regulations and Features" shown under News, no separate dashboard block. | dashboard.html | §49 |
| News filter: All / Maintenance / Regulations / Feature Updates. | dashboard.html | §50 |
| Top navigation shows the customer Breckenridge as the active company (Manufacturer role). | all pages |
§52 |
| 2026-09-10 | ||
| Prototype screens carry no DesignOS governance banner / meta tags (POL-0043 v1.1 exemption); the governance reference lives once in this briefing. | briefing.html | §43 |
| Global rule: filter tabs that would return zero results are disabled, not hidden. | all pages |
§29 |
| ATP icon always Style=Certified; LIC icon Certified unless the source is VRS / XATP. | address-book.html | §30 |
| Address Book gets a Filters flyout (Status / Type / Created / Overdue) reusing the existing filter builder; source tabs get icons. | address-book.html | §31 |
| Invitations: "To-Do" renamed to "Open"; status tabs extended with Generic and Accepted; the separate Filters button removed; accepted invitations stay in the list. | invitations.html | §32–34 |
| Organization settings get their own page, separate from the Address Book settings. | org-settings.html, org-settings.html (Feature settings › Address Book) | §35 |
| Dashboard metric tiles are clickable and open the matching page. | dashboard.html | §36 |
| Team Activity Log gets search and a type filter ("Changed Roles" wording); Team Overview becomes "Team Members" with three roles and a role filter. | team-activity-log.html, team-overview.html | §37, §38 |
| Every clickable element shows a pointer cursor. | all pages |
§41 |
| 2026-09-09 | ||
| The earlier addressbook work is the base for this prototype, not reference-minimal; demo names are not changed retroactively. | all pages |
§1, §3 |
| Exception states are shown inline, not on a separate screen. | address-book.html | §5 |
| Address Book settings as a separate page: one Contact Confirmation setting (Automatic / Manual) for all five channels, default Manual. | org-settings.html (Feature settings › Address Book) | §6 |
| Test panel on the Address Book: yes. | address-book.html | §7 |
| Invitation status "Declined" and a license status badge added. | address-book.html | §10b |
| All former "Soon" navigation items are real pages (taken from reference-minimal). | all pages |
§11 |
| Contact details is a full page (from a production screenshot); every Address Book row opens it, no slideover. | contact-details.html, address-book.html | §14, §17, §20 |
| License refresh opens a hold-to-confirm "Verify license?" modal; the arrow opens a License Details slideover. | contact-details.html | §16 |
| Callout headings are never h2 or higher, h3 at most. | all pages |
§18 |
| "2 inbound requests flagged for review" links to the filtered Invitations view and appears as a dashboard To-Do. | address-book.html, dashboard.html | §19 |
| "Trading Partners" page under VRS Interactions. | vrs-trading-partners.html | §21 |
| Trusted Partner Network back in the navigation, with a guide page as the first-time flow (reverses the 2026-08-31 removal). | tpn-guide.html, tpn-registry.html | §22 |
| Breadcrumbs are linked on every page. | all pages |
§23 |
| Contact details "Additional Information" uses seven button tabs with real empty states. | contact-details.html | §26 |
| Placeholder role names ("Pharmacist A" …) removed from the contact subtitle. | contact-details.html | §27 |
The prototype screens in this folder intentionally do not carry the DesignOS GovernanceBanner, governance comment block or designos-* meta tags. Product-UI artifacts classified Prototype (CARO/VERA/EIDA/KYLE ticket folders) are exempt from these per POL-0043-Skill-Integrity v1.1 (2026-09-10, confirmed by Lead Design) — the governance reference lives once, here, instead of on every screen. Full decision record: _docs/ux-entscheidungen.md, entry 43, in this folder's _docs/ subfolder.