From design to evidence.

Done when: Record the team's review of mandatory usable rPPG, nullable evidence, review guards, camera-derived templates, the C-Q comparison and outcome denominators. Resolve advisor questions in the revision log.

Depends on: No prerequisite tasks

Design / tests: LLD 1.1.3 and 3.15.2; ADR-01 to ADR-06

Evidence / record: LLD v1 dated 16 October is available. Team/advisor acceptance is not recorded in this snapshot.

Done when: Check the 16 October delivery record and complete the 23 October delivery checklist: LMS, required email recipients, coordinator form and public report/backlog links. Record actual submission and publication dates separately.

Depends on: B01

Design / tests: Syllabus pp. 1, 4 and 7

Evidence / record: LLD v1 is publicly available. LMS/email/form submission is unconfirmed; a preparation date is not proof of timely submission.

Done when: Produce LLD v2 with a dated change log. Resolve the web-first/native scope and inherited timing feasibility with the advisor; preserve the mandatory-rPPG safety rule.

Depends on: B01, B30

Design / tests: LLD 3.14 and 3.15.2; syllabus p. 7

Done when: A clean checkout starts the Core facade, API health route, database migration and experiment runner with pinned dependencies. Document the service boundaries and run a smoke check.

Depends on: B01

Design / tests: LLD 2 and 3.14; V2 19 and 20

Done when: Implement matching Python/TypeScript schemas for status, nullable values, score direction, reason codes and versioned snapshots. Contract tests distinguish unusable measurements, real zero values and technical errors.

Depends on: B01

Design / tests: LLD 1.2 and 3.1; ADR-01; TC-FUSION-01 to 08

Done when: Record exact embedding/PAD weights, checksums, preprocessing, dimensions, score semantics and permitted use. Missing or incompatible manifests fail readiness; do not redistribute unapproved artifacts.

Depends on: B01

Design / tests: LLD 3.4.2 and 3.5.4; TC-MATCH-01; TC-PAD-01

Done when: Enforce session ownership, expiry, allowed state transitions, cancellation, idempotent finalization and retry limits. Terminal sessions reject later writes and cross-user access.

Depends on: B04, B05

Design / tests: LLD 3.2; TC-AUDIT-01; TC-DASH-01

Done when: Send versioned WSS packets with monotonic offsets, sequence and dimensions. Measure delivered FPS, gaps, backpressure and dropped frames; stop camera tracks and release buffers on every terminal path.

Depends on: B05, B07

Design / tests: LLD 3.3.3 and 3.11; TC-INPUT-01; TC-QUALITY-02

Done when: Track one face with stable forehead/cheek ROIs and timed RGB traces. Detect invalid bounds, face changes, blur, exposure and movement. Test first with controlled fixtures, then browser captures from B08.

Depends on: B05, B06

Design / tests: LLD 3.3; FR-01 to FR-03 and FR-08; TC-FACE-01; TC-ROI-01

Done when: Compare compatible embeddings from quality-selected frames. Encrypt candidate/active templates, preserve camera-capture provenance and model versions, and prevent candidate templates from authorizing returning users.

Depends on: B05, B06, B09

Design / tests: LLD 3.4; ADR-06; TC-MATCH-01; TC-ENROLL-01

Done when: Run the qualified PAD adapter with exact preprocessing and deterministic sampling. Report median, lower quantile, spread and eligible counts. Separate inference errors and unusable crops from qualified attack evidence.

Depends on: B06, B09

Design / tests: LLD 3.5; V2-FR-11; TC-PAD-01 to 03

Done when: Validate timed RGB, POS/CHROM, the configured 0.7-4 Hz filter and Welch spectrum with known signals and permitted reference data. Qualify duration, SNR and agreement; missing/unusable BPM remains null.

Depends on: B05, B09, B30

Design / tests: LLD 3.6; FR-04 to FR-06; TC-RPPG-01 to 04

Done when: Compare the browser transport with a lossless research capture. Measure usable duration, timestamp gaps and compression effects before freezing minimum-rPPG criteria; record any proposed timing/profile revision.

Depends on: B08, B12, B30

Design / tests: LLD 3.3.3 and 3.6.4; TC-RPPG-02 to 04; TC-QUALITY-02

Done when: Activate an account/template only after biometric ACCEPT and an authorized review bound to the same candidate and snapshot. Test stale approvals, duplicate actions and prohibited overrides of REJECT/RETRY.

Depends on: B07, B10, B11, B12, B15

Design / tests: LLD 3.8; ADR-02 and ADR-06; TC-ENROLL-01 to 04

Done when: Test reliable-rejection precedence, technical failures, missing evidence and mandatory usable rPPG. Every actionable acceptance passes the shared gate; L1 uses a versioned validation-calibrated fixed policy.

Depends on: B10, B11, B12

Design / tests: LLD 3.7.2 and 3.7.3; ADR-05; TC-FUSION-01 to 08

Done when: Compare C-Q and L2 on identical snapshots and common gates. Unit-test PAD temporal instability, physiology disagreement and PAD suspicion with pulse. Record pattern rule versions and their cost in Retry/coverage.

Depends on: B15

Design / tests: LLD 3.7.3 to 3.7.5; ADR-03; TC-FUSION-05 and 08

Done when: Bind successful verification to its owner, intended payout-destination change, digest and expiry. Atomically consume it once; test changed actions, expired/replayed results and concurrent double execution.

Depends on: B07, B14, B15

Design / tests: LLD 3.9; V2-FR-13; TC-DEMO-01

Done when: Render real session events, quality guidance, decisions and review state. Separate ordinary user/admin fields from consented research diagnostics, and verify authorization before event serialization.

Depends on: B08, B14, B16

Design / tests: LLD 3.10 and 3.11; V2-FR-15; TC-DASH-01 to 03

Done when: Record dataset permissions, consent scope, storage/deletion rules and a fallback if access is delayed. Distinguish PAD-labelled data, physiological reference data and a paired multimodal corpus; none substitutes for the others.

Depends on: B01

Design / tests: LLD 3.12 and 3.13; V2 17 and 18

Done when: Define test IDs, fixtures/data, expected results, environments and accountable reviewers. Freeze subject/source separation and device holdouts where feasible; keep physical PAD and injection tests separate and specify all outcome denominators.

Depends on: B05, B19

Design / tests: LLD 3.13 and 3.15; syllabus pp. 3 and 7

Done when: Run C, C-Q and D on the same evidence and splits, with A/B limited to diagnostic controls. Count ACCEPT, REJECT, RETRY and technical outcomes over initiated attempts; report coverage and capture-to-decision latency separately from cached-policy cost.

Depends on: B11, B12, B16, B20

Design / tests: LLD 3.13; ADR-04; TC-AUDIT-01; V2 21

Done when: If the paired training data is adequate, fit regularized logistic regression with training-only preprocessing and validation-only calibration. Preserve all safety holds; otherwise record L3 as unavailable and report the limitation. XGBoost remains optional.

Depends on: B21

Design / tests: LLD 3.7.6; V2 9 and 21

Done when: Record the L3 availability decision, then freeze model, capture, policy and calibration manifests before opening final labels. Produce paired policy results, per-species attack outcomes, Retry/coverage, uncertainty and p50/p95 latency without retuning on test results.

Depends on: B13, B20, B21, B22

Design / tests: LLD 3.13 and 3.14; TC-AUDIT-01

Done when: Verify cross-user isolation, review override prevention, single consumption, cancellation/expiry cleanup and retention. Confirm ordinary interfaces expose no raw frames, embeddings or unauthorized research diagnostics.

Depends on: B14, B17, B18

Design / tests: LLD 3.8 to 3.12; TC-ENROLL-01 to 04; TC-DEMO-01; TC-DASH-01 to 03

Done when: Present the current scope, academic reports, team and evaluation plan; label the earlier scenario console as simulated. This item covers the public presentation, not the operational biometric engine or live admin application.

Depends on: No prerequisite tasks

Design / tests: LLD 3.14.1; public project presentation

Evidence / record: BioAuth master commit 5381287 and the released project website, reviewed 18 October 2026. Proposed owners do not establish past individual contribution.

Done when: Pass a clean-environment build and sample integration with pinned dependencies, migrations, allowed model artifacts and notices. Prepare versioned Python/TypeScript packages without biometric data or secrets; confirm names/rights before registry publication.

Depends on: B06, B23, B24

Design / tests: LLD 3.14.4; V2-FR-17; TC-PACK-01 to 03

Done when: Report actual architecture, test-ID pass/fail evidence, measured results and limitations. Include all four members in the presentation, rehearse within 25 minutes and prepare the source/demo materials for the January date announced by the course.

Depends on: B23, B24, B26

Design / tests: Syllabus pp. 3, 4 and 7; LLD 3.15

Done when: Require a separate scope decision, fresh acquisition protocol and tests for interference with rPPG before implementation. Do not infer challenge results from existing recordings.

Depends on: B23

Design / tests: LLD 3.14.4; V2-FR-16; TC-CHAL-01 to 02

Evidence / record: Outside the committed first implementation.

Done when: Consider native capture and deep-rPPG as separate extensions after core evaluation and an explicit capacity/scope review. Keep OCR, NFC and document-authenticity models outside the initial scope.

Depends on: B23

Design / tests: LLD 3.14.4; V2 4 and 19

Evidence / record: No active owner or delivery promise.

Done when: Use a small reproducible signal/capture spike to expose the five-second window, natural frequency resolution, gap and processing-budget risks before full integration. Bring feasibility findings or unresolved risks to LLD v2 review; B13 later performs full qualification.

Depends on: No prerequisite tasks

Design / tests: LLD 3.3.3, 3.6.4 and 3.14.3

Evidence / record: Added in the 18 October planning revision to surface a critical dependency earlier.