Work packages, milestone gates and funding tranches

Complete Web ↔ NestJS ↔ QDIP contracts, identity, company isolation, permissions, real end-to-end tests and rollback.

Exit: repeatable CI and QA E2E, negative security cases, approved go/no-go and a controlled deployment record.

Formalize decision policies and baselines, calibration and abstention, missingness tests, rule/model/hybrid comparisons and the statistical plan.

Exit: preregistered research protocol, reproducible synthetic benchmarks and an uncertainty/bias report, including failed hypotheses.

Define consent, minimization, study population, user experience protocol and appropriately controlled real-world feasibility. No recruitment partner is represented as already signed.

Exit: approved ethics/legal framework, responsibly gathered data, qualitative UX findings and non-inflated outcome reporting.

If suitable data are available, evaluate decision usefulness and human control; prepare independent review, monitoring, support and the sustainability model.

Exit: auditable results, documented go/no-go, operational checklist, refreshed risk and financial register.

WP1 is a release prerequisite; WP2 can run in parallel using synthetic data. WP3 cannot collect real data before required safety/ethics conditions; WP4 requires appropriate evidence quality.

Unmet gates trigger a scope/financing review, not a success claim.

Budget buckets: engineering, Decision Science/ML, privacy/security/ethics, UX and participants, infrastructure and operations.

The signed project plan must contain named owners, verified effort and direct costs, timetable, eligible expenses, legal applicant and reporting cadence.