P18 · Validation & Usability
Evidence before closure.
Scientific review, scenario validation, accessibility, cognitive load, latency and hardware limitations are recorded explicitly. A pending critical criterion cannot be presented as a pass.
Validation criteria
Scientific implementation baseline is Biomarker Matrix v1.1 and remains non-diagnostic.
Method: automated · critical
Evidence: Biomarker Matrix v1.1 is recorded as the reviewed implementation baseline in docs/SCIENTIFIC_GOVERNANCE.md and docs/SCIENTIFIC_BASELINE_V1_1.md.
Same P17 scenario and seed reproduce the same fingerprint without silent imputation.
Method: automated · critical
Evidence: P17 deterministic replay and no-imputation tests pass in the repository test suite.
Critical story can be followed from live monitoring through explainability, guidance, offline mode and ground sync without broken navigation.
Method: manual browser · critical
Evidence: Browser walkthrough (headless Chromium 1280x1800, local dev origin) of the Mission Day 127 critical story: / -> /mission/live -> /mission/readiness -> /mission/intelligence -> /mission/guidance -> /mission/offline -> /mission/ground -> /mission/simulation -> /mission/validation. Every route rendered with its own title, exactly one <main> and one <h1>, zero console/page errors and zero horizontal overflow. Mission -> Mission Scenario resolved to /mission/simulation and About -> Validation & Limitations navigated to /mission/validation (title 'Validation & Usability | The Mitochondria'). No broken navigation observed.
All critical routes, menus, controls and dialogs are reachable and operable by keyboard with visible focus.
Method: manual browser · critical
Evidence: Keyboard-only review on / and /mission/live. Tab order reached logo, skip/section links, all six top-level menu triggers, the external NASA link and hero actions; on /mission/live it reached Readiness, Public site, Connect BLE heart rate, the self-check select, the note input and Record check-in. Focus is visible via :focus-visible (document.activeElement.matches(':focus-visible') true; ring box-shadow oklch(0.79 0.145 206) 1px). Menus open with Enter, move with ArrowDown to role=menuitem, and close with Escape. The self-check select opened with Enter, changed value by ArrowDown+Enter ('Monitor / not at best'), and Record check-in activated with Enter, producing the 'Last recorded at' confirmation. No keyboard trap and no hover-only control encountered.
Critical routes remain usable on narrow/touch layouts without horizontal overflow or inaccessible controls.
Method: manual browser · critical
Evidence: Responsive/touch review at 390x844 with touch and mobile emulation. All nine critical routes reported 0px horizontal overflow and no page errors. The mobile navigation opened by tap into a role=dialog panel and body overflow became 'hidden' (scroll lock). Primary buttons and menu rows met touch sizing. Observation, not a blocker: inline footer/menu text links render about 20px tall, below a 24px box, and are documented for future refinement rather than claimed as fully compliant.
The required P11 daily demo assessment remains below three minutes.
Method: automated · critical
Evidence: P11 automated test verifies the required daily demo assessment completes in under 180 seconds.
Browser validation records sample-to-visible-update timing for the local live path; no cloud round-trip is required.
Method: manual browser · critical
Evidence: Measured local sample-to-visible-update latency on /mission/live using the local self-check capture path (no backend call). Five consecutive runs from user action to the visible confirmation/timeline update: 148.23, 97.76, 116.30, 86.53, 84.55 ms (median 97.76 ms, max 148.23 ms). Network capture during the measurement recorded zero requests to the backend origin or /api/, confirming the visible update requires no cloud round-trip. Latency was measured against locally captured/synthetic input only; target-hardware wearable timing is not included.
Measure software/device battery impact on target wearable hardware when hardware is available.
Method: hardware · noncritical
Evidence: Target-hardware battery drain cannot be truthfully measured without selected wearable hardware; limitation is documented for final evidence collection.
Encrypted local capture survives transport failure and later synchronizes idempotently.
Method: automated · critical
Evidence: P14 encrypted offline queue/reconnect tests and P15 authenticated transport gates pass.
Ground/research authorization and de-identification gates remain enforced.
Method: automated · critical
Evidence: P15/P16 role-separation, RLS and research export security gates pass.
Artifact/dropout scenarios never silently fill safety-relevant values.
Method: automated · critical
Evidence: P17 artifact/dropout tests preserve poor/missing quality states without silent imputation.
Known limitations
No clinical validation or medical-device certification
Impact: highThe Mitochondria is not clinically validated: it is a challenge prototype and decision-support platform; P18 does not establish clinical validation, diagnosis, treatment efficacy or medical-device certification.
Mitigation: Keep all medical conclusions human-governed and seek qualified clinical review before operational medical use.
Target-hardware battery drain is not yet characterized
Impact: moderateBattery impact depends on the selected wearable, radio path, sampling cadence and mobile/edge host. The repository cannot truthfully infer this from synthetic data.
Mitigation: Run an instrumented hardware session before final submission when the target wearable is available and attach measured evidence.
Not every adapter path is backed by physical hardware
Impact: moderateThe direct Web Bluetooth heart-rate path is implemented; several Health Connect, HealthKit, vendor, environmental and radiation paths still depend on host bridges, credentials or target hardware.
Mitigation: Use the canonical adapter contracts and P17 synthetic fixtures for reproducible demonstration while preserving clear source labels.
Synthetic scenarios are validation fixtures, not physiological truth
Impact: moderateMission Day 127 and other P17 scenarios test software behavior and narrative reproducibility; they do not establish expected astronaut physiology or causal relationships.
Mitigation: Keep all synthetic records explicitly classified and retain the v1.1 scientific guardrails.
Clinical threshold and escalation wording remain separately governed
Impact: highThe reviewed biological baseline does not authorize autonomous clinical thresholds, diagnosis, treatment or flight-rule decisions.
Mitigation: Require qualified clinical/flight-medicine governance for any future safety-critical threshold or escalation wording.
P32 · Independent scientific review
Scientific approval is pending
Automated software checks are not independent scientific review. The review gates below require named external assessors, traceable signed decisions and explicit limitations before any approval claim. This screen cannot grant approval.
8 of 8 independent review gates pending. Clinical validation: NOT CLAIMED. Operational clinical activation: DISABLED.
Review evidence is prepared for human assessment; the repository does not contain completed independent signoffs.
PENDING INDEPENDENT REVIEW
Independent scientific reviewer named, credentials and COI documented
Repository handoff: docs/P21_14_INDEPENDENT_SCIENTIFIC_REVIEW_HANDOFF.md
Reviewer: not recorded · Signed evidence: not recorded
PENDING INDEPENDENT REVIEW
Primary studies and extraction decisions independently appraised
Repository handoff: docs/P21_11_LIMITED_FULLTEXT_EXTRACTION.md
Reviewer: not recorded · Signed evidence: not recorded
PENDING INDEPENDENT REVIEW
Units, phase, measurement method, confounders and missingness approved
Repository handoff: docs/P21_15_SCIENTIFIC_BASELINE_FREEZE.md
Reviewer: not recorded · Signed evidence: not recorded
PENDING INDEPENDENT REVIEW
Observed directions, time ordering and matched personal baseline validated; never infer inverse unmeasured changes
Repository handoff: docs/P21_13_RELATIONSHIP_DECISION_MATRIX.md
Reviewer: not recorded · Signed evidence: not recorded
PENDING INDEPENDENT REVIEW
Independent domain signoff; missing immune scientific mapping stays unapproved
Repository handoff: docs/P26_FOUR_INTEGRATED_HEALTH_DOMAINS.md
Reviewer: not recorded · Signed evidence: not recorded
PENDING INDEPENDENT REVIEW
Independent assessment of transfer limits and simulated-data claims
Repository handoff: docs/P31_MULTI_ASTRONAUT_MISSION_SIMULATION.md
Reviewer: not recorded · Signed evidence: not recorded
PENDING INDEPENDENT REVIEW
No clinical diagnosis, prediction or autonomous medical decisions
Repository handoff: docs/P27_ASTRONAUT_SELF_ASSESSMENT_ACTION_GUIDANCE.md
Reviewer: not recorded · Signed evidence: not recorded
PENDING INDEPENDENT REVIEW
Real Crew Self and Researcher sessions and device evidence independently witnessed
Repository handoff: docs/P20_REAL_DEVICE_EVIDENCE.md
Reviewer: not recorded · Signed evidence: not recorded
For independent assessors: follow docs/P32_SCIENTIFIC_VALIDATION_INDEPENDENT_REVIEW.md. Do not treat literature correlation as a deterministic direction, infer an unmeasured biomarker, or claim a clinical decision.
P34 · Real-device end-to-end acceptance
Device acceptance: NOT VERIFIED
Follow the procedures on actual hardware and with authorized test accounts. These session-only notes are self-reported and do not certify acceptance. Do not enter patient information, tokens, passwords or identifiable health measurements.
15 not executed · 0 self-reported passes · 0 observed failures · 0 blocked
Independent device acceptance: NOT VERIFIED · Scientific signoff: PENDING
Export does not update the repository, Supabase or any approval state. Reload clears all notes.
Authenticate, switch mission, verify no prior-mission measurements appear
Role: Crew Self · Open workflow · Trace: P23/P24
Verify denied role links and server access; expire auth while open
Role: Operator / Researcher · Open workflow · Trace: P24/P28/P33
Grant camera permission, collect actual sample, inspect quality and provenance
Role: Crew Self · Open workflow · Trace: P20
Deny camera; disconnect/reconnect and ensure no fabricated measurement
Role: Crew Self · Open workflow · Trace: P20
Capture offline, refresh and confirm encrypted records retained
Role: Crew Self · Open workflow · Trace: P14/P23/P29
Reconnect and sync twice; confirm idempotency and audit trail
Role: Crew Self · Open workflow · Trace: P23/P29
Open two tabs, attempt concurrent sync and inspect needs_review handling
Role: Crew Self · Open workflow · Trace: P23/P29
Authenticate medical role and inspect mission-scoped snapshot
Role: Ground Medical · Open workflow · Trace: P15/P28
Use fewer than 3 contributors or 10 events; verify suppressed RPC and audit
Role: Researcher · Open workflow · Trace: P28
Verify coarse aggregate and probe direct table SELECT and snapshot RPC RLS
Role: Researcher · Open workflow · Trace: P28
Verify only observed directional changes and matched context; no clinical claims
Role: Crew Self · Open workflow · Trace: P25/P26/P32
Complete checklist, refresh and verify session-only/no upload
Role: Crew Self · Open workflow · Trace: P27
Verify four synthetic crew cannot write into real mission records
Role: Operator · Open workflow · Trace: P31
Mobile keyboard/screen reader smoke test; operational routes noindex
Role: All roles · Open workflow · Trace: P30/P33
Confirm eight pending gates and unapproved source rules remain inactive
Role: Independent reviewer · Open workflow · Trace: P30/P32
Latency evidence is an engineering observation of the local path, not a medical threshold. Target-hardware battery drain remains a documented limitation until a real instrumented wearable session is available. P18 does not claim clinical validation.
