# SMOA Compliance Status Matrix
## Quick Reference Guide

**Last Updated:** 2026-03-24  
**Application:** Secure Mobile Operations Application (SMOA)  
**Version:** 1.1  

**Authoritative task rows:** [TASKS.md](../../TASKS.md) · **External gates:** [TODO.md](../../TODO.md)  
This matrix is refreshed against the repository periodically; it is **not** a legal attestation.

---

## Table of Contents

1. [Compliance Status Legend](#compliance-status-legend)
2. [Compliance Matrix](#compliance-matrix)
3. [Priority Summary](#priority-summary)
4. [Implementation Roadmap](#implementation-roadmap)
5. [Risk Assessment](#risk-assessment)
6. [See Also](#see-also)

---

## Compliance Status Legend

- ✅ **COMPLIANT** - Implemented in codebase for intended scope (may still need deployment QA)
- ⚠️ **PARTIAL** - Framework, simulation, or incomplete vs formal standard
- ❌ **NON-COMPLIANT** - Not implemented or blocked by external dependency
- N/A - Not applicable to this application

---

## Compliance Matrix

| Standard/Requirement | Status | Priority | Implementation Status | Notes |
|---------------------|--------|----------|----------------------|-------|
| **eIDAS (EU)** | | | | |
| Multi-Factor Authentication | ✅ | P1 | Implemented | PIN + Biometric |
| Qualified Electronic Signatures (QES) | ❌ | P1 | External / product gate | QTSP, trust lists — see [EIDASService](../../core/eidas/) |
| Qualified Certificates | ❌ | P1 | Not production | No EU trust list validation |
| Qualified Timestamping | ❌ | P1 | Not Started | TSA integration |
| Electronic Seals | ⚠️ | P2 | Partial | SHA-256 verify in `ElectronicSealService`; not qualified seal |
| Identity Assurance Levels | ⚠️ | P2 | Partial | No formal LOA labeling |
| Immutable Audit Records | ⚠️ | P1 | Partial | Audit/evidence models; formal immutability policy varies by deploy |
| **Central Bureau / credentialing** | | | | |
| Credential Format Standards | ⚠️ | P1 | Partial | `SmoaCredentialType`, templates, Room cache, pull/sync |
| Authority Delegation | ❌ | P1 | Not Started | Chain-of-command tracking |
| Central Identifier Schemes | ⚠️ | P1 | Partial | Holder/ORI/UCN fields in domain models |
| Credential Revocation | ⚠️ | P1 | Partial | Local CRL + optional HTTP CDP fetch in `CertificateManager`; OCSP not wired |
| Cross-Agency Validation | ❌ | P2 | Not Started | Federated validation |
| **PDF417 / ISO/IEC 15438** | | | | |
| PDF417 Generation | ✅ | P1 | Implemented | `core/barcode` |
| AAMVA DL/ID Format | ⚠️ | P1 | Partial | Encoder + credential type; jurisdiction QA / vectors — see GAPS doc |
| ICAO 9303 Format | ⚠️ | P1 | Partial | Encoder + `icao9303_mrtd`; production QA pending |
| Barcode Display | ✅ | P1 | Implemented | Compose + ZXing |
| Barcode Scanning | ⚠️ | P2 | Partial | Scanner integration present; device QA per deploy |
| Error Correction Levels | ✅ | P2 | Implemented | Levels 0–8 in generator |
| **ATF / Law Enforcement** | | | | |
| ATF Form Support | ⚠️ | P1 | Partial | Models, Room drafts — live eTrace external |
| ATF eTrace Integration | ❌ | P1 | External gate | Federal approval |
| NCIC Integration | ⚠️ | P1 | Partial | Service + local log; live API CJIS |
| III Integration | ⚠️ | P1 | Partial | Framework; live external |
| ORI/UCN Support | ⚠️ | P1 | Partial | In NCIC/query models |
| Evidence Chain of Custody | ⚠️ | P1 | Partial | Room, transfers, UI module — formal NIST SP 800-88 program per agency |
| NIBRS Reporting | ❌ | P1 | Not Started | |
| UCR Format | ❌ | P1 | Not Started | |
| Warrant Management | ⚠️ | P1 | Partial | Orders module (warrant types in domain) |
| Case Management | ⚠️ | P2 | Partial | Judicial module framework |
| **Diplomatic credentialing** | | | | |
| Diplomatic Note Formats | ❌ | P1 | Not Started | |
| ICAO 9303 Travel Docs | ⚠️ | P1 | Partial | Same as PDF417/ICAO row |
| Official Seal Rendering | ❌ | P1 | Not Started | |
| Diplomatic Immunity | ❌ | P2 | Not Started | |
| Credential Hierarchy | ❌ | P2 | Not Started | |
| Consular DB Integration | ❌ | P2 | Not Started | |
| Multi-Language Support | ⚠️ | P2 | Partial | |
| **AS4 Gateway** | | | | |
| AS4 Message Envelope | ⚠️ | P1 | Partial | Framework / stub — [core/as4/README.md](../../core/as4/README.md) |
| WS-Security | ⚠️ | P1 | Partial | |
| XML Digital Signature | ❌ | P1 | Not Started | Full XMLDSig interop |
| XML Encryption | ❌ | P1 | Not Started | |
| WS-ReliableMessaging | ❌ | P1 | Not Started | |
| AS4 Pull Protocol | ❌ | P2 | Not Started | |
| MPC Support | ❌ | P2 | Not Started | |
| Receipt Handling | ❌ | P1 | Not Started | |
| Error Signals | ❌ | P1 | Not Started | |
| CPA Management | ❌ | P2 | Not Started | |
| **ISO Standards** | | | | |
| ISO/IEC 27001 (ISMS) | ⚠️ | P2 | Partial | Controls in app; no formal ISMS cert |
| ISO/IEC 15438 (PDF417) | ✅ | P1 | Implemented | Via barcode module |
| ISO/IEC 7816 (Smart Cards) | ❌ | P3 | Stub | `SmartCardReader` not bound to PC/SC |
| ISO/IEC 19794 (Biometrics) | ⚠️ | P2 | Partial | Platform APIs; limited ISO templates |
| ISO 8601 (Date/Time) | ⚠️ | P2 | Partial | |
| ISO 3166 (Country Codes) | ⚠️ | P2 | Partial | `CountryCodes` helper |
| **Reporting & Orders** | | | | |
| Report Generation | ⚠️ | P1 | Partial | Multi-format generator + UI |
| Orders Management | ⚠️ | P1 | Partial | Room, sync, list/detail UI |
| Order Copy Provision | ⚠️ | P1 | Partial | Domain support; policy per deploy |
| Regulatory Reporting | ❌ | P1 | Not Started | NIBRS/UCR |
| Evidence Reports | ⚠️ | P1 | Partial | Reports + evidence modules |
| Compliance Reports | ⚠️ | P2 | Partial | Report types in domain |
| **Military Operations** | | | | |
| MIL-STD-2525 (Symbols) | ⚠️ | P1 | Partial | Module support |
| MIL-STD-129 (IDs) | ⚠️ | P1 | Partial | Credential template |
| JTF Integration | ❌ | P2 | Not Started | |
| Classification Markings | ⚠️ | P1 | Partial | Military + remote watermark config |
| DODI 8500.01 | ⚠️ | P1 | Partial | Security controls partial |
| **Judicial Operations** | | | | |
| Court Order Management | ⚠️ | P1 | Partial | Judicial + orders overlap |
| Case File Management | ⚠️ | P1 | Partial | Framework |
| Subpoena Management | ⚠️ | P1 | Partial | Framework |
| Sealed Records | ❌ | P1 | Not Started | |
| Court Scheduling | ❌ | P2 | Not Started | |
| **Intelligence Operations** | | | | |
| Compartmented Access | ⚠️ | P1 | Partial | MLS framework in module |
| SCI Handling | ⚠️ | P1 | Partial | Framework |
| ICD 503 Compliance | ❌ | P1 | Not Started | |
| ICD 704 Compliance | ❌ | P1 | Not Started | |
| Source Protection | ⚠️ | P1 | Partial | Framework |
| Classification Lifecycle | ❌ | P2 | Not Started | |

---

## Priority Summary

Approximate counts from the matrix above (P1/P2/P3 rows only):

| Priority | ✅ | ⚠️ | ❌ |
|----------|----|----|-----|
| P1 | ~8 | ~28 | ~22 |
| P2 | ~1 | ~8 | ~11 |
| P3 | 0 | 0 | 1 |

Use [COMPLIANCE_EVALUATION.md](COMPLIANCE_EVALUATION.md) for narrative gap analysis.

---

## Implementation Roadmap

### Done in repo (baseline)
- PDF417 generation/display, credential sync/pull + cache, backend sync/pull API, orders/evidence/reports UI layers, Android enterprise auth/pinning (see TASKS.md).

### Near-term (engineering)
- Play Integrity **server** verification; WebRTC/media; smart card driver; OCSP; stronger tenant **data** scoping (beyond `X-Unit` attribute).
- AAMVA/ICAO production test vectors and jurisdiction sign-off.

### External / legal
- NCIC/III, ATF eTrace, QTSP, full AS4 CPA, Knox/WebRTC binaries, shipped iOS app.

---

## Risk Assessment

### High residual risk
- Live law-enforcement and identity systems (NCIC, CJIS, qualified trust services).
- AS4/XML interop without partner CPA.

### Medium
- eIDAS-qualified workflows; multi-tenant isolation until RLS or token claims enforce data bounds.

### Lower
- Smart card reader binding per deployment; extended biometric interchange formats.

---

## See Also

- [COMPLIANCE_EVALUATION.md](COMPLIANCE_EVALUATION.md)
- [GAPS-AND-INCONSISTENCIES.md](GAPS-AND-INCONSISTENCIES.md)
- [IMPLEMENTATION_STATUS.md](../status/IMPLEMENTATION_STATUS.md)

**Document Version:** 1.1  
**Next Review:** Quarterly or after major milestones