defiQUG
4f78404f87
- Extend RBAC modules/permissions; Home + drawer + Nav routes for ATF/NCIC/military/judicial/intelligence - Wire Orders/Evidence/Reports/ATF/NCIC/Military/Judicial/Intelligence Compose flows with Hilt ViewModels - Evidence: custody chain merge in repository; list/detail UI; fix transfer entity evidenceId - SyncService: hydrate credential payloads after list pull; CredentialCacheSyncPort API + tests - CredentialCacheMerger hydrateMissingPayloads; CredentialsViewModel refresh/hydrate split - OrderServiceTest; SyncService + CredentialCacheMerger tests; NCIC operator display - docs: OUTSTANDING-PRODUCTION-AND-COMPLIANCE-WORK.md; GAPS updates; README implementation status - Misc doc/build updates (OpenAPI test, compliance matrix, etc.) Made-with: Cursor
8.2 KiB
8.2 KiB
SMOA Compliance Status Matrix
Quick Reference Guide
Last Updated: 2026-03-24
Application: Secure Mobile Operations Application (SMOA)
Version: 1.1
Authoritative task rows: TASKS.md · External gates: TODO.md
This matrix is refreshed against the repository periodically; it is not a legal attestation.
Table of Contents
- Compliance Status Legend
- Compliance Matrix
- Priority Summary
- Implementation Roadmap
- Risk Assessment
- See Also
Compliance Status Legend
- ✅ COMPLIANT - Implemented in codebase for intended scope (may still need deployment QA)
- ⚠️ PARTIAL - Framework, simulation, or incomplete vs formal standard
- ❌ NON-COMPLIANT - Not implemented or blocked by external dependency
- N/A - Not applicable to this application
Compliance Matrix
| Standard/Requirement | Status | Priority | Implementation Status | Notes |
|---|---|---|---|---|
| eIDAS (EU) | ||||
| Multi-Factor Authentication | ✅ | P1 | Implemented | PIN + Biometric |
| Qualified Electronic Signatures (QES) | ❌ | P1 | External / product gate | QTSP, trust lists — see EIDASService |
| Qualified Certificates | ❌ | P1 | Not production | No EU trust list validation |
| Qualified Timestamping | ❌ | P1 | Not Started | TSA integration |
| Electronic Seals | ⚠️ | P2 | Partial | SHA-256 verify in ElectronicSealService; not qualified seal |
| Identity Assurance Levels | ⚠️ | P2 | Partial | No formal LOA labeling |
| Immutable Audit Records | ⚠️ | P1 | Partial | Audit/evidence models; formal immutability policy varies by deploy |
| Central Bureau / credentialing | ||||
| Credential Format Standards | ⚠️ | P1 | Partial | SmoaCredentialType, templates, Room cache, pull/sync |
| Authority Delegation | ❌ | P1 | Not Started | Chain-of-command tracking |
| Central Identifier Schemes | ⚠️ | P1 | Partial | Holder/ORI/UCN fields in domain models |
| Credential Revocation | ⚠️ | P1 | Partial | Local CRL + optional HTTP CDP fetch in CertificateManager; OCSP not wired |
| Cross-Agency Validation | ❌ | P2 | Not Started | Federated validation |
| PDF417 / ISO/IEC 15438 | ||||
| PDF417 Generation | ✅ | P1 | Implemented | core/barcode |
| AAMVA DL/ID Format | ⚠️ | P1 | Partial | Encoder + credential type; jurisdiction QA / vectors — see GAPS doc |
| ICAO 9303 Format | ⚠️ | P1 | Partial | Encoder + icao9303_mrtd; production QA pending |
| Barcode Display | ✅ | P1 | Implemented | Compose + ZXing |
| Barcode Scanning | ⚠️ | P2 | Partial | Scanner integration present; device QA per deploy |
| Error Correction Levels | ✅ | P2 | Implemented | Levels 0–8 in generator |
| ATF / Law Enforcement | ||||
| ATF Form Support | ⚠️ | P1 | Partial | Models, Room drafts — live eTrace external |
| ATF eTrace Integration | ❌ | P1 | External gate | Federal approval |
| NCIC Integration | ⚠️ | P1 | Partial | Service + local log; live API CJIS |
| III Integration | ⚠️ | P1 | Partial | Framework; live external |
| ORI/UCN Support | ⚠️ | P1 | Partial | In NCIC/query models |
| Evidence Chain of Custody | ⚠️ | P1 | Partial | Room, transfers, UI module — formal NIST SP 800-88 program per agency |
| NIBRS Reporting | ❌ | P1 | Not Started | |
| UCR Format | ❌ | P1 | Not Started | |
| Warrant Management | ⚠️ | P1 | Partial | Orders module (warrant types in domain) |
| Case Management | ⚠️ | P2 | Partial | Judicial module framework |
| Diplomatic credentialing | ||||
| Diplomatic Note Formats | ❌ | P1 | Not Started | |
| ICAO 9303 Travel Docs | ⚠️ | P1 | Partial | Same as PDF417/ICAO row |
| Official Seal Rendering | ❌ | P1 | Not Started | |
| Diplomatic Immunity | ❌ | P2 | Not Started | |
| Credential Hierarchy | ❌ | P2 | Not Started | |
| Consular DB Integration | ❌ | P2 | Not Started | |
| Multi-Language Support | ⚠️ | P2 | Partial | |
| AS4 Gateway | ||||
| AS4 Message Envelope | ⚠️ | P1 | Partial | Framework / stub — core/as4/README.md |
| WS-Security | ⚠️ | P1 | Partial | |
| XML Digital Signature | ❌ | P1 | Not Started | Full XMLDSig interop |
| XML Encryption | ❌ | P1 | Not Started | |
| WS-ReliableMessaging | ❌ | P1 | Not Started | |
| AS4 Pull Protocol | ❌ | P2 | Not Started | |
| MPC Support | ❌ | P2 | Not Started | |
| Receipt Handling | ❌ | P1 | Not Started | |
| Error Signals | ❌ | P1 | Not Started | |
| CPA Management | ❌ | P2 | Not Started | |
| ISO Standards | ||||
| ISO/IEC 27001 (ISMS) | ⚠️ | P2 | Partial | Controls in app; no formal ISMS cert |
| ISO/IEC 15438 (PDF417) | ✅ | P1 | Implemented | Via barcode module |
| ISO/IEC 7816 (Smart Cards) | ❌ | P3 | Stub | SmartCardReader not bound to PC/SC |
| ISO/IEC 19794 (Biometrics) | ⚠️ | P2 | Partial | Platform APIs; limited ISO templates |
| ISO 8601 (Date/Time) | ⚠️ | P2 | Partial | |
| ISO 3166 (Country Codes) | ⚠️ | P2 | Partial | CountryCodes helper |
| Reporting & Orders | ||||
| Report Generation | ⚠️ | P1 | Partial | Multi-format generator + UI |
| Orders Management | ⚠️ | P1 | Partial | Room, sync, list/detail UI |
| Order Copy Provision | ⚠️ | P1 | Partial | Domain support; policy per deploy |
| Regulatory Reporting | ❌ | P1 | Not Started | NIBRS/UCR |
| Evidence Reports | ⚠️ | P1 | Partial | Reports + evidence modules |
| Compliance Reports | ⚠️ | P2 | Partial | Report types in domain |
| Military Operations | ||||
| MIL-STD-2525 (Symbols) | ⚠️ | P1 | Partial | Module support |
| MIL-STD-129 (IDs) | ⚠️ | P1 | Partial | Credential template |
| JTF Integration | ❌ | P2 | Not Started | |
| Classification Markings | ⚠️ | P1 | Partial | Military + remote watermark config |
| DODI 8500.01 | ⚠️ | P1 | Partial | Security controls partial |
| Judicial Operations | ||||
| Court Order Management | ⚠️ | P1 | Partial | Judicial + orders overlap |
| Case File Management | ⚠️ | P1 | Partial | Framework |
| Subpoena Management | ⚠️ | P1 | Partial | Framework |
| Sealed Records | ❌ | P1 | Not Started | |
| Court Scheduling | ❌ | P2 | Not Started | |
| Intelligence Operations | ||||
| Compartmented Access | ⚠️ | P1 | Partial | MLS framework in module |
| SCI Handling | ⚠️ | P1 | Partial | Framework |
| ICD 503 Compliance | ❌ | P1 | Not Started | |
| ICD 704 Compliance | ❌ | P1 | Not Started | |
| Source Protection | ⚠️ | P1 | Partial | Framework |
| Classification Lifecycle | ❌ | P2 | Not Started |
Priority Summary
Approximate counts from the matrix above (P1/P2/P3 rows only):
| Priority | ✅ | ⚠️ | ❌ |
|---|---|---|---|
| P1 | ~8 | ~28 | ~22 |
| P2 | ~1 | ~8 | ~11 |
| P3 | 0 | 0 | 1 |
Use COMPLIANCE_EVALUATION.md for narrative gap analysis.
Implementation Roadmap
Done in repo (baseline)
- PDF417 generation/display, credential sync/pull + cache, backend sync/pull API, orders/evidence/reports UI layers, Android enterprise auth/pinning (see TASKS.md).
Near-term (engineering)
- Play Integrity server verification; WebRTC/media; smart card driver; OCSP; stronger tenant data scoping (beyond
X-Unitattribute). - AAMVA/ICAO production test vectors and jurisdiction sign-off.
External / legal
- NCIC/III, ATF eTrace, QTSP, full AS4 CPA, Knox/WebRTC binaries, shipped iOS app.
Risk Assessment
High residual risk
- Live law-enforcement and identity systems (NCIC, CJIS, qualified trust services).
- AS4/XML interop without partner CPA.
Medium
- eIDAS-qualified workflows; multi-tenant isolation until RLS or token claims enforce data bounds.
Lower
- Smart card reader binding per deployment; extended biometric interchange formats.
See Also
Document Version: 1.1
Next Review: Quarterly or after major milestones