# Traceability

> A Claude skill from AminAlam/meddev-agent-skills.

- **Type:** Skill
- **Install:** `agentstack add skill-aminalam-meddev-agent-skills-traceability`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [AminAlam](https://agentstack.voostack.com/s/aminalam)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [AminAlam](https://github.com/AminAlam)
- **Source:** https://github.com/AminAlam/meddev-agent-skills/tree/main/documentation/traceability

## Install

```sh
agentstack add skill-aminalam-meddev-agent-skills-traceability
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Requirements Traceability

## Purpose
Ensure bidirectional traceability between requirements, hazards/risks, design, code, tests, and anomalies for medical device software.

## When to Apply
- All lifecycle phases; especially during changes and release preparation.

## Requirements (testable)
1. ID Schema: Use stable IDs for requirements (`REQ-###`), hazards (`HZ-###`), risks/controls (`RISK-CTRL-###`), design (`DES-###`), tests (`TEST-###`), and anomalies (`ANOM-###`). Rationale: unambiguous linkage.
2. Bidirectionality: Maintain trace both forward (REQ->DES->CODE->TEST) and backward (TEST->REQ). Rationale: completeness and impact analysis.
3. Automation: Generate traceability matrices from managed artifacts (reqs tool + code tags + test metadata). Rationale: reduce drift.
4. Change Impact: For each change, update trace links and assess affected items/tests. Rationale: controlled updates.
5. Evidence Storage: Store trace outputs as release artifacts; version them with builds. Rationale: auditability.
6. SDP Traceability [Class A, B, C]: Maintain trace from system requirements to software requirements, system tests, and software risk controls per development plan. Rationale: 5.1.1 c.
7. Software Hazard Chain [Class B, C]: Maintain links: hazardous situation → software item → cause → risk control → control verification. Rationale: 7.3.3.

## Recommended Practices
- Keep a `traceability.yaml` or use ALM exports to CSV/HTML for submissions.
- Include trace tags in code comments and test names.
- Integrate trace checks in CI (e.g., missing links).

## Patterns
Traceability entry (YAML):
```yaml
# REQ-TRC-01
REQ-62304-102:
  design: [DES-PUMP-01]
  code: [pump_stop_on_door_open]
  tests: [TEST-410, TEST-411]
  hazards: [HZ-07]
  risks: [RISK-CTRL-19]
```

CI check (concept):
```text
Validate: every TEST-* references a REQ-*; fail build on missing link.
```

## Anti-Patterns (risks)
- Trace only in one direction -> risk: missing coverage.
- Manual spreadsheets without automation -> risk: drift and errors.
- Unlabeled code/tests -> risk: broken trace in audits.
- Trace outputs not baselined -> risk: mismatch to released build.

## Verification Checklist
- [ ] IDs consistent and present across artifacts.
- [ ] Forward/backward traces maintained; gaps resolved.
- [ ] Trace matrices generated automatically and stored per release.
- [ ] Change impact updates traces and triggers required tests.
- [ ] CI checks for missing/invalid links in code/tests.
- [ ] Software hazard trace chain maintained for Class B/C (7.3.3).

## Traceability
- Central `traceability.yaml`/tool export; code/test tags; release-stored matrices.

## References
- IEC 62304:2006+A1:2015, 5.1.1 c, 7.3.3, 5.3.6 (trace analyses).
- `REG-IEC62304-SWRM`, `DOC-SW-REQ`.
- ISO 14971:2019 for hazard-to-control linkage.
- FDA/MDR submission expectations for trace matrices.

## Changelog
- 1.1.0 (2026-05-21): Added 5.1.1 c and 7.3.3 software hazard trace chain.
- 1.0.0 (2026-01-04): Initial traceability skill with IDs, automation, and CI checks.

## Audit History
- **2026-01-04**: Audit performed. Verified:
  - IEC 62304 traceability (5.1-5.6) references accurate
  - ISO 14971 hazard-to-control linkage correctly noted
  - FDA/MDR trace matrix expectations appropriate

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [AminAlam](https://github.com/AminAlam)
- **Source:** [AminAlam/meddev-agent-skills](https://github.com/AminAlam/meddev-agent-skills)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-aminalam-meddev-agent-skills-traceability
- Seller: https://agentstack.voostack.com/s/aminalam
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.