P18 · Validation & Usability

Evidence before closure.

Scientific review, scenario validation, accessibility, cognitive load, latency and hardware limitations are recorded explicitly. A pending critical criterion cannot be presented as a pass.

Passed
10
Pending human
0
Known limitations
1
P18 closure
READY

Validation criteria

SCI-001 · Biologist-reviewed scientific baselinePASS

Scientific implementation baseline is Biomarker Matrix v1.1 and remains non-diagnostic.

Method: automated · critical

Evidence: Biomarker Matrix v1.1 is recorded as the reviewed implementation baseline in docs/SCIENTIFIC_GOVERNANCE.md and docs/SCIENTIFIC_BASELINE_V1_1.md.

SCN-001 · Deterministic synthetic mission replayPASS

Same P17 scenario and seed reproduce the same fingerprint without silent imputation.

Method: automated · critical

Evidence: P17 deterministic replay and no-imputation tests pass in the repository test suite.

SCN-002 · Mission Day 127 end-to-end browser reviewPASS

Critical story can be followed from live monitoring through explainability, guidance, offline mode and ground sync without broken navigation.

Method: manual browser · critical

Evidence: Browser walkthrough (headless Chromium 1280x1800, local dev origin) of the Mission Day 127 critical story: / -> /mission/live -> /mission/readiness -> /mission/intelligence -> /mission/guidance -> /mission/offline -> /mission/ground -> /mission/simulation -> /mission/validation. Every route rendered with its own title, exactly one <main> and one <h1>, zero console/page errors and zero horizontal overflow. Mission -> Mission Scenario resolved to /mission/simulation and About -> Validation & Limitations navigated to /mission/validation (title 'Validation & Usability | The Mitochondria'). No broken navigation observed.

A11Y-001 · Keyboard-only critical workflow reviewPASS

All critical routes, menus, controls and dialogs are reachable and operable by keyboard with visible focus.

Method: manual browser · critical

Evidence: Keyboard-only review on / and /mission/live. Tab order reached logo, skip/section links, all six top-level menu triggers, the external NASA link and hero actions; on /mission/live it reached Readiness, Public site, Connect BLE heart rate, the self-check select, the note input and Record check-in. Focus is visible via :focus-visible (document.activeElement.matches(':focus-visible') true; ring box-shadow oklch(0.79 0.145 206) 1px). Menus open with Enter, move with ArrowDown to role=menuitem, and close with Escape. The self-check select opened with Enter, changed value by ArrowDown+Enter ('Monitor / not at best'), and Record check-in activated with Enter, producing the 'Last recorded at' confirmation. No keyboard trap and no hover-only control encountered.

A11Y-002 · Touch and responsive critical workflow reviewPASS

Critical routes remain usable on narrow/touch layouts without horizontal overflow or inaccessible controls.

Method: manual browser · critical

Evidence: Responsive/touch review at 390x844 with touch and mobile emulation. All nine critical routes reported 0px horizontal overflow and no page errors. The mobile navigation opened by tap into a role=dialog panel and body overflow became 'hidden' (scroll lock). Primary buttons and menu rows met touch sizing. Observation, not a blocker: inline footer/menu text links render about 20px tall, below a 24px box, and are documented for future refinement rather than claimed as fully compliant.

COG-001 · Daily readiness flow time budgetPASS

The required P11 daily demo assessment remains below three minutes.

Method: automated · critical

Evidence: P11 automated test verifies the required daily demo assessment completes in under 180 seconds.

LAT-001 · Local critical-path latency observationPASS

Browser validation records sample-to-visible-update timing for the local live path; no cloud round-trip is required.

Method: manual browser · critical

Evidence: Measured local sample-to-visible-update latency on /mission/live using the local self-check capture path (no backend call). Five consecutive runs from user action to the visible confirmation/timeline update: 148.23, 97.76, 116.30, 86.53, 84.55 ms (median 97.76 ms, max 148.23 ms). Network capture during the measurement recorded zero requests to the backend origin or /api/, confirming the visible update requires no cloud round-trip. Latency was measured against locally captured/synthetic input only; target-hardware wearable timing is not included.

BAT-001 · Target-hardware battery impact measurementKNOWN LIMITATION

Measure software/device battery impact on target wearable hardware when hardware is available.

Method: hardware · noncritical

Evidence: Target-hardware battery drain cannot be truthfully measured without selected wearable hardware; limitation is documented for final evidence collection.

WF-001 · Offline disconnect/reconnect and syncPASS

Encrypted local capture survives transport failure and later synchronizes idempotently.

Method: automated · critical

Evidence: P14 encrypted offline queue/reconnect tests and P15 authenticated transport gates pass.

WF-002 · Role separation and research de-identificationPASS

Ground/research authorization and de-identification gates remain enforced.

Method: automated · critical

Evidence: P15/P16 role-separation, RLS and research export security gates pass.

WF-003 · Poor/missing data remains visiblePASS

Artifact/dropout scenarios never silently fill safety-relevant values.

Method: automated · critical

Evidence: P17 artifact/dropout tests preserve poor/missing quality states without silent imputation.

Known limitations

No clinical validation or medical-device certification

Impact: high

The Mitochondria is not clinically validated: it is a challenge prototype and decision-support platform; P18 does not establish clinical validation, diagnosis, treatment efficacy or medical-device certification.

Mitigation: Keep all medical conclusions human-governed and seek qualified clinical review before operational medical use.

Target-hardware battery drain is not yet characterized

Impact: moderate

Battery impact depends on the selected wearable, radio path, sampling cadence and mobile/edge host. The repository cannot truthfully infer this from synthetic data.

Mitigation: Run an instrumented hardware session before final submission when the target wearable is available and attach measured evidence.

Not every adapter path is backed by physical hardware

Impact: moderate

The direct Web Bluetooth heart-rate path is implemented; several Health Connect, HealthKit, vendor, environmental and radiation paths still depend on host bridges, credentials or target hardware.

Mitigation: Use the canonical adapter contracts and P17 synthetic fixtures for reproducible demonstration while preserving clear source labels.

Synthetic scenarios are validation fixtures, not physiological truth

Impact: moderate

Mission Day 127 and other P17 scenarios test software behavior and narrative reproducibility; they do not establish expected astronaut physiology or causal relationships.

Mitigation: Keep all synthetic records explicitly classified and retain the v1.1 scientific guardrails.

Clinical threshold and escalation wording remain separately governed

Impact: high

The reviewed biological baseline does not authorize autonomous clinical thresholds, diagnosis, treatment or flight-rule decisions.

Mitigation: Require qualified clinical/flight-medicine governance for any future safety-critical threshold or escalation wording.

P32 · Independent scientific review

Scientific approval is pending

Automated software checks are not independent scientific review. The review gates below require named external assessors, traceable signed decisions and explicit limitations before any approval claim. This screen cannot grant approval.

Scientific validation gate: NOT APPROVED

8 of 8 independent review gates pending. Clinical validation: NOT CLAIMED. Operational clinical activation: DISABLED.

Review evidence is prepared for human assessment; the repository does not contain completed independent signoffs.

P32-SCI-01 · Independent reviewer identity and conflict-of-interest disclosure

PENDING INDEPENDENT REVIEW

Independent scientific reviewer named, credentials and COI documented

Repository handoff: docs/P21_14_INDEPENDENT_SCIENTIFIC_REVIEW_HANDOFF.md

Reviewer: not recorded · Signed evidence: not recorded

P32-SCI-02 · Full-text source appraisal and traceability

PENDING INDEPENDENT REVIEW

Primary studies and extraction decisions independently appraised

Repository handoff: docs/P21_11_LIMITED_FULLTEXT_EXTRACTION.md

Reviewer: not recorded · Signed evidence: not recorded

P32-SCI-03 · Biomarker measurement and context validity

PENDING INDEPENDENT REVIEW

Units, phase, measurement method, confounders and missingness approved

Repository handoff: docs/P21_15_SCIENTIFIC_BASELINE_FREEZE.md

Reviewer: not recorded · Signed evidence: not recorded

P32-SCI-04 · Directional relationships and temporal logic

PENDING INDEPENDENT REVIEW

Observed directions, time ordering and matched personal baseline validated; never infer inverse unmeasured changes

Repository handoff: docs/P21_13_RELATIONSHIP_DECISION_MATRIX.md

Reviewer: not recorded · Signed evidence: not recorded

P32-SCI-05 · Bone, immune, cardiovascular and behavioral domain review

PENDING INDEPENDENT REVIEW

Independent domain signoff; missing immune scientific mapping stays unapproved

Repository handoff: docs/P26_FOUR_INTEGRATED_HEALTH_DOMAINS.md

Reviewer: not recorded · Signed evidence: not recorded

P32-SCI-06 · Synthetic versus real-world external validity

PENDING INDEPENDENT REVIEW

Independent assessment of transfer limits and simulated-data claims

Repository handoff: docs/P31_MULTI_ASTRONAUT_MISSION_SIMULATION.md

Reviewer: not recorded · Signed evidence: not recorded

P32-SCI-07 · Non-diagnostic action and safety review

PENDING INDEPENDENT REVIEW

No clinical diagnosis, prediction or autonomous medical decisions

Repository handoff: docs/P27_ASTRONAUT_SELF_ASSESSMENT_ACTION_GUIDANCE.md

Reviewer: not recorded · Signed evidence: not recorded

P32-SCI-08 · Real-device and authenticated workflow acceptance

PENDING INDEPENDENT REVIEW

Real Crew Self and Researcher sessions and device evidence independently witnessed

Repository handoff: docs/P20_REAL_DEVICE_EVIDENCE.md

Reviewer: not recorded · Signed evidence: not recorded

For independent assessors: follow docs/P32_SCIENTIFIC_VALIDATION_INDEPENDENT_REVIEW.md. Do not treat literature correlation as a deterministic direction, infer an unmeasured biomarker, or claim a clinical decision.

P34 · Real-device end-to-end acceptance

Device acceptance: NOT VERIFIED

Follow the procedures on actual hardware and with authorized test accounts. These session-only notes are self-reported and do not certify acceptance. Do not enter patient information, tokens, passwords or identifiable health measurements.

Human test execution ledger

15 not executed · 0 self-reported passes · 0 observed failures · 0 blocked

Independent device acceptance: NOT VERIFIED · Scientific signoff: PENDING

Export does not update the repository, Supabase or any approval state. Reload clears all notes.

AUTH-01 · Crew Self sign-in and mission isolation

Authenticate, switch mission, verify no prior-mission measurements appear

Role: Crew Self · Open workflow · Trace: P23/P24

AUTH-02 · Role access denial and expiry

Verify denied role links and server access; expire auth while open

Role: Operator / Researcher · Open workflow · Trace: P24/P28/P33

DEVICE-01 · Real camera PPG capture

Grant camera permission, collect actual sample, inspect quality and provenance

Role: Crew Self · Open workflow · Trace: P20

DEVICE-02 · Permission denied and device interruption

Deny camera; disconnect/reconnect and ensure no fabricated measurement

Role: Crew Self · Open workflow · Trace: P20

OFFLINE-01 · Airplane-mode encrypted capture

Capture offline, refresh and confirm encrypted records retained

Role: Crew Self · Open workflow · Trace: P14/P23/P29

OFFLINE-02 · Reconnect and duplicate prevention

Reconnect and sync twice; confirm idempotency and audit trail

Role: Crew Self · Open workflow · Trace: P23/P29

OFFLINE-03 · Multi-tab contention and conflict review

Open two tabs, attempt concurrent sync and inspect needs_review handling

Role: Crew Self · Open workflow · Trace: P23/P29

GROUND-01 · Ground Medical authorized snapshot

Authenticate medical role and inspect mission-scoped snapshot

Role: Ground Medical · Open workflow · Trace: P15/P28

PRIVACY-01 · Researcher small-cohort suppression

Use fewer than 3 contributors or 10 events; verify suppressed RPC and audit

Role: Researcher · Open workflow · Trace: P28

PRIVACY-02 · Researcher aggregate and direct-read denial

Verify coarse aggregate and probe direct table SELECT and snapshot RPC RLS

Role: Researcher · Open workflow · Trace: P28

SCIENCE-01 · Directional and baseline interpretation

Verify only observed directional changes and matched context; no clinical claims

Role: Crew Self · Open workflow · Trace: P25/P26/P32

GUIDANCE-01 · Voluntary self-assessment confidentiality

Complete checklist, refresh and verify session-only/no upload

Role: Crew Self · Open workflow · Trace: P27

SIM-01 · Synthetic versus live separation

Verify four synthetic crew cannot write into real mission records

Role: Operator · Open workflow · Trace: P31

UX-01 · Mobile navigation, accessibility and noindex

Mobile keyboard/screen reader smoke test; operational routes noindex

Role: All roles · Open workflow · Trace: P30/P33

SCIENCE-02 · Independent signoff and source provenance

Confirm eight pending gates and unapproved source rules remain inactive

Role: Independent reviewer · Open workflow · Trace: P30/P32

Latency evidence is an engineering observation of the local path, not a medical threshold. Target-hardware battery drain remains a documented limitation until a real instrumented wearable session is available. P18 does not claim clinical validation.