<!-- Moved from docs/archive/phase-1/Reference/codex_capa_list.md to docs/working/archive/legacy/phase-1/Reference/codex_capa_list.md on 2026-06-16 (docs reorg Phase 2) -->
# StarForth Governance – CAPA Register (Fresh Audit)

| CAPA ID | Finding Ref | Severity | Problem Statement                                                         | Initial Root Cause                                                      | Corrective Action                                                                                         | Preventive Action                                                                | Owner                    | Target Date | Status |
|---------|-------------|----------|---------------------------------------------------------------------------|-------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------|--------------------------|-------------|--------|
| CAPA-01 | F-01        | Major    | Required `ANSI_C99_COMPLIANCE_MATRIX.adoc` missing from release evidence. | Documentation deliverable never created when governance criteria added. | Author full ANSI C99 compliance matrix with compiler settings, warning scans, and attach supporting logs. | Add matrix generation/check to release checklist and CI gate.                    | Maintainer               | 2025-11-08  | Open   |
| CAPA-02 | F-02        | Major    | FORTH-79 compliance matrix omits 65 core words.                           | Matrix template frozen before population.                               | Populate matrix with all 70 words, implementation paths, and test IDs.                                    | Assign document owner and add completeness audit to Tier I exit review.          | Standards Lead           | 2025-11-08  | Open   |
| CAPA-03 | F-03        | Major    | ARM64 validation evidence absent.                                         | Tests run only on x86_64 host; log export skipped.                      | Execute Tier I/Tier II suites on ARM64, archive build/run logs, link in evidence catalog.                 | Automate ARM64 CI job with artifact retention.                                   | Validation Engineer      | 2025-11-12  | Open   |
| CAPA-04 | F-04        | Major    | Embedded platform validation not documented.                              | Embedded harness not integrated into governance records.                | Run embedded target smoke/full tests, capture logs, include summary in Validation Book.                   | Schedule embedded validation cadence and add to release gate.                    | Release Engineering      | 2025-11-22  | Open   |
| CAPA-05 | F-05        | Major    | Continuous validation claim lacks CI/output proof.                        | No pipeline artifacts exported to governance repo.                      | Document CI workflows, include recent run reports, and store schedule evidence.                           | Create automated export of CI summaries at each phase gate.                      | DevOps Lead              | 2025-11-19  | Open   |
| CAPA-06 | F-06        | Major    | Test log (`Reference/run.log`) missing metadata required by protocol.     | Raw CLI output archived without formatting template.                    | Regenerate test log with header (platform, commit, totals) per protocol.                                  | Adopt logging template and script to format future runs.                         | Validation Engineer      | 2025-11-05  | Open   |
| CAPA-07 | F-07        | Major    | Tier I coverage metrics blank in test results log.                        | Data entry skipped after coverage run.                                  | Re-run coverage collection, record actual line/branch/function percentages.                               | Embed automated coverage report export into validation workflow.                 | QA Lead                  | 2025-11-06  | Open   |
| CAPA-08 | F-08        | Major    | Mandatory checklists unchecked though status marked complete.             | Manual checklist completion not enforced before sign-off.               | Update log marking each checkbox with evidence links, then re-review.                                     | Add checklist verification step to Tier I sign-off script.                       | Validation Engineer      | 2025-11-06  | Open   |
| CAPA-09 | F-09        | Major    | Referenced ARM64 test log missing.                                        | Artifact upload step omitted.                                           | Produce and store ARM64 log matching naming convention; cross-link from log and README.                   | Add artifact existence check to release automation.                              | Validation Engineer      | 2025-11-12  | Open   |
| CAPA-10 | F-10        | Medium   | Deficiency counts left as placeholders `[N]`.                             | Template was never finalized prior to publishing.                       | Calculate and fill actual deficiency counts (by severity).                                                | Add completeness review for metrics before doc publish.                          | QA Lead                  | 2025-11-10  | Open   |
| CAPA-11 | F-11        | Minor    | Observation field left as “[Any observations]”.                           | Post-run commentary step skipped.                                       | Update entry with actual observations or explicitly note “None”.                                          | Include observation prompt in validation checklist.                              | Validation Engineer      | 2025-11-05  | Open   |
| CAPA-12 | F-12        | Major    | Tier I final report retains `__%` coverage placeholders.                  | Report compiled before metrics captured.                                | Insert verified coverage percentages and attach source report.                                            | Require metric verification prior to releasing final reports.                    | QA Lead                  | 2025-11-06  | Open   |
| CAPA-13 | F-13        | Major    | Final report asserts ARM64 pass without evidence.                         | Report reused template text instead of actual results.                  | Revise report to reference real ARM64 logs once generated.                                                | Implement peer review of validation reports for data integrity.                  | Validation Engineer      | 2025-11-12  | Open   |
| CAPA-14 | F-14        | Medium   | Deficiency log cited but contains no entries.                             | Governance assumed zero issues without logging baseline.                | Populate deficiency log with current status (even if zero) and rationale.                                 | Make deficiency log review part of release readiness.                            | Maintainer               | 2025-11-09  | Open   |
| CAPA-15 | F-15        | Major    | Validation engineer signature missing on Tier I report.                   | Signing workflow not executed post-validation.                          | Add signature (digital or physical) with current date.                                                    | Enforce sign-off checklist with reminder automation.                             | Validation Engineer      | 2025-11-03  | Open   |
| CAPA-16 | F-16        | Major    | Review authority signature missing.                                       | Independent reviewer not assigned post-validation.                      | Assign reviewer to examine evidence and sign report.                                                      | Establish reviewer rotation with tracked due dates.                              | QA Lead                  | 2025-11-04  | Open   |
| CAPA-17 | F-17        | Major    | Maintainer approval missing for Tier I.                                   | Maintainer not prompted to sign final report.                           | Obtain maintainer signature acknowledging Tier I completion.                                              | Tie maintainer signature to release gating checklist.                            | Maintainer               | 2025-11-04  | Open   |
| CAPA-18 | F-18        | Major    | Referenced coverage-report artifact absent.                               | Coverage HTML not exported to governance repo.                          | Publish coverage report (HTML/PDF) and link from logs.                                                    | Automate coverage artifact copy during validation run.                           | QA Lead                  | 2025-11-09  | Open   |
| CAPA-19 | F-19        | Major    | Determinism spec retains placeholder timing values.                       | Performance measurements never captured.                                | Run timing measurements, record actual min/max/variance data.                                             | Schedule periodic determinism/latency re-measurements with templates.            | Performance Engineer     | 2025-11-16  | Open   |
| CAPA-20 | F-20        | Major    | Claim of 100 identical runs lacks supporting logs.                        | Evidence collection was not archived.                                   | Capture run comparisons (diff outputs or hash summaries) and store with doc.                              | Add determinism run log export step to protocol.                                 | Validation Engineer      | 2025-11-16  | Open   |
| CAPA-21 | F-21        | Major    | Determinism spec lists ARM64 as “ready” rather than executed.             | ARM64 determinism testing deferred without doc update.                  | Execute determinism protocol on ARM64 and update results section.                                         | Track ARM64 determinism in CI with automated reporting.                          | Validation Engineer      | 2025-11-19  | Open   |
| CAPA-22 | F-22        | Major    | Determinism specification unsigned.                                       | Approval workflow missed once draft produced.                           | Secure required signatures (author, QA, governance).                                                      | Introduce DocuSign/PGP signing step for Tier II outputs.                         | Maintainer               | 2025-11-05  | Open   |
| CAPA-23 | F-23        | Major    | Governance reference manual lacks signatures.                             | Policy approvals postponed after draft.                                 | Collect signatures from PM, QA, governance stakeholders.                                                  | Add policy-review calendar with approval checkpoints.                            | Maintainer               | 2025-11-15  | Open   |
| CAPA-24 | F-24        | Major    | Quality policy unsigned.                                                  | Approval owners not engaged post-draft.                                 | Obtain signatures and document approval date.                                                             | Track policy expiry/renewal in governance tracker.                               | QA Lead                  | 2025-11-15  | Open   |
| CAPA-25 | F-25        | Major    | Security policy unsigned.                                                 | Security policy review not formally executed.                           | Secure approvals from responsible roles.                                                                  | Establish annual security policy review & signature reminder.                    | Maintainer               | 2025-11-15  | Open   |
| CAPA-26 | F-26        | Major    | Test strategy unsigned.                                                   | QA lead signature not captured after drafting.                          | Sign document and record approval date.                                                                   | Hook QA sign-off into release process board.                                     | QA Lead                  | 2025-11-10  | Open   |
| CAPA-27 | F-27        | Major    | ECR process lacks approval signatures.                                    | Process chapter migrated without sign-off step.                         | Gather signatures across required roles.                                                                  | Add process-migration checklist including approval capture.                      | Maintainer               | 2025-11-18  | Open   |
| CAPA-28 | F-28        | Major    | ECO process unsigned.                                                     | Same as above; sign-off deferred.                                       | Obtain required signatures and log approval.                                                              | Monitor process document approvals via signature tracker.                        | Maintainer               | 2025-11-18  | Open   |
| CAPA-29 | F-29        | Major    | CAPA process unsigned.                                                    | Documentation update not followed by approval ceremony.                 | Collect signatures for CAPA process.                                                                      | Embed approval in CAPA onboarding workflow.                                      | QA Lead                  | 2025-11-18  | Open   |
| CAPA-30 | F-30        | Major    | FMEA process unsigned.                                                    | QA leadership not looped into document release.                         | Acquire signatures and archive signed copy.                                                               | Add QA sign-off gate to FMEA process updates.                                    | QA Lead                  | 2025-11-20  | Open   |
| CAPA-31 | F-31        | Major    | Theory justification guide unsigned.                                      | Formal verification policy not routed for approval.                     | Obtain required signatures and log date.                                                                  | Include verification policy review in governance calendar.                       | Maintainer               | 2025-11-22  | Open   |
| CAPA-32 | F-32        | Major    | Comprehensive defects master unsigned.                                    | Defect inventory created but not ratified.                              | Sign document acknowledging inventory accuracy.                                                           | Require dual sign-off whenever defect inventory updates.                         | QA Lead                  | 2025-11-12  | Open   |
| CAPA-33 | F-33        | Major    | Phase 1/2 defect assessment lacks signatures.                             | Historical audit imported without approvals.                            | Sign assessment and annotate approval timestamp.                                                          | Archive signed copies for historical audits moving forward.                      | Maintainer               | 2025-11-12  | Open   |
| CAPA-34 | F-34        | Major    | Refinement CAPA register unsigned and checklists unchecked.               | Formal verification CAPAs entered without governance oversight.         | Complete checklist states, obtain approvals, and update status fields.                                    | Integrate refinement CAPA review into formal verification working group cadence. | Formal Verification Lead | 2025-11-26  | Open   |

*Review cadence:* Track CAPA progress during weekly governance syncs; escalate overdue Major items immediately to the
maintainer.
| CAPA-35 | F-35 | Major | Tier I report certifies results while evidence fields remain placeholders. | Report finalized
before evidence populated. | Populate Tier I report with actual coverage, deficiency metrics, and platform evidence;
reissue signed copy. | Add pre-sign-off checklist verifying all placeholder tokens removed. | QA Lead | 2025-11-12 |
Open |
| CAPA-36 | F-36 | Major | ARM64 log referenced in governance package does not exist. | Artifact archival step skipped
during validation. | Generate ARM64 log matching protocol format, store under evidence directory, update references. |
Script validation pipeline to fail if referenced artifacts are missing. | Validation Engineer | 2025-11-12 | Open |
| CAPA-37 | F-37 | Major | Published run log lacks metadata required for reproducibility. | Raw CLI output archived
without governance template. | Recreate test log with header (platform, commit, tester, timestamp, pass/fail summary). |
Standardize log export tooling and enforce via CI. | Validation Engineer | 2025-11-08 | Open |
| CAPA-38 | F-38 | Major | Deficiency transparency rule cites an empty template as evidence. | Deficiency logging
process never initiated. | Populate deficiency log with actual counts/status; link from Tier I report. | Integrate
deficiency log maintenance into release-go/no-go checklist. | Maintainer | 2025-11-09 | Open |
| CAPA-39 | F-39 | Major | Foundational policies/processes marked active but remain unsigned. | Signature workflow not
executed post-migration. | Secure signatures for each policy/process and update tracker. | Adopt automated
reminders/escalations for pending signatures. | Maintainer | 2025-11-18 | Open |
| CAPA-40 | F-40 | Major | Governance roadmap and CAPA logs retain `[TBD]` roles/status, creating circular
dependencies. | Ownership assignments deferred; logs left as templates. | Assign named owners/reviewers, record current
status for defect and refinement logs. | Embed owner assignment into process rollout guidance and audit monthly. |
Governance Lead | 2025-11-22 | Open |
| CAPA-41 | F-41 | Major | Continuous validation policy lacks supporting CI evidence. | CI artifacts not exported into
governance repo. | Document existing CI pipelines, capture recent execution reports, and place under evidence catalog. |
Automate routine export of CI run summaries at each release gate. | DevOps Lead | 2025-11-19 | Open |
| CAPA-42 | F-42 | Major | Automated quality standards (ISO 5055/NIST SSDF) lack supporting SonarQube or static-analysis
evidence. | Quality gate relies only on compiler warnings. | Stand up SonarQube (or equivalent) analysis for StarForth,
archive reports in governance repo, and reference results in Tier II documentation. | Integrate SonarQube scan into CI
and add report export step to release process. | DevOps Lead | 2025-11-26 | Open |
