Requirements Traceability Matrix (RTM)

Field	Value
Document	RTM — Requirements Traceability Matrix (end-to-end, bidirectional)
DRD ref	ECSS-E-ST-40C Rev.1 §5.8 (traceability); Annex D <7> (SRS trace), Annex F <6> (design trace), Annex I/J <14>/<9> (verification trace)
Container	Design Justification File (DJF) — compliance/traceability/; referenced as RD-9 by the SRS, RD-11 by the SDD, RD-10 by the V&V Plan
Project	msi-processor (gitlab.eopf.copernicus.eu/ipf/msi-processor)
Software criticality	Category C (ECSS-Q-ST-80C Rev.2 / ECSS-E-ST-40C Annex R)
Baselined at	CDR (Critical Design Review)
Status	Draft for CDR

This RTM is the consolidated, authoritative traceability artefact that every constituent document defers to (SRS <7>, SDD <6>, ICD <7>, V&V <14>, SSS <5.1>). It realises the end-to-end chain SYS-* (SSS / RD-2) → REQ-IF-* (IRD / RD-3) / REQ-* (SRS / RD-4) → design components C-* (SDD / RD-5) + processing modules DPM-M-* (DPM / RD-6) + algorithms ALG-* (ATBD / RD-7), bound to external interfaces ICD-IF-* (ICD), and closed to verification (V&V Plan method T/A/I/R · tier A/B/C, validation task VT-1..VT-10). It provides both the forward (requirement → design → test) and backward (test/design → requirement; component/algorithm → requirement; upper-level → requirement) coverage, and an explicit orphan / gap analysis. This is the CDR traceability gate artefact; implementation (SDP WP-5) starts only after CDR.

---

<1> Purpose, scope and method

Purpose. Demonstrate, at CDR, that (a) every software requirement decomposes from at least one upper-level (system or interface) requirement; (b) every requirement is allocated to at least one design component and, for processing requirements, to a DPM module and ATBD algorithm; (c) every requirement is bound to at least one verification method and validation task; and, conversely, (d) every upper-level requirement, design component, processing module and algorithm traces down to at least one requirement — i.e. there are no orphans and no unverified or unimplemented requirements.

Scope of identifiers covered.

Namespace	Tier	Source (authoritative)	Count
SYS-*	System requirement	SSS <5> (RD-2)	66
REQ-IF-*	Interface requirement	IRD <5> (RD-3)	31
REQ-*	Software requirement	SRS <5> (RD-4)	95
C-*	Design component	SDD <5.3>/<5.4> (RD-5)	20 (+1 container C-COMPUTING)
DPM-M-*	Processing module	DPM <8> (RD-6)	11
ALG-*	Algorithm	ATBD <5> (RD-7)	33
ICD-IF-*	External interface	ICD <5.3>	8 families (28 items)
VT-1..VT-10	Validation task	V&V <9> (RD-8)	10

Method (tailored, Category C / single-developer). The matrix is maintained as the inverse of the inline Trace: fields of the SRS/ICD/ATBD and the allocation/trace tables of the SDD (<5.3>, <6.1>), DPM (<8>) and V&V Plan (<14>). It is the single source of truth; the per-document trace summaries are its views. Where an upper-level correspondence is not stated verbatim in a source document it is marked (derived) and its derivation basis is given. The forward/backward closure is intended to be machine-checkable post-CDR (a CI lint that fails on any unresolved REQ-*).

Legend.

• Method — T (Test) · A (Analysis) · I (Inspection) · R (Review of design).

• Tier — A (CI-blocking, public, synthetic) · B (local/SDE integration, non-blocking in public CI) · C (local numerical budget validation → SVR) · “—” (static / review evidence, no dynamic tier).

• (opt) — optional, profile-toggleable stage; not required for a valid baseline L2A.

• [impl] — code internal legitimately finalised in implementation (post-CDR), specified here at interface + algorithm level.

• (new) — no reuse heritage; designed in this project (atmospheric chain).

---

<2> Applicable and reference documents

Id	Document	Path
RD-1	SDP — Software Development Plan	compliance/software-development-plan.md
RD-2	SSS — Software System Specification (SYS-*)	compliance/drd/sss-software-system-specification.md
RD-3	IRD — Interface Requirements Document (REQ-IF-*)	compliance/drd/ird-interface-requirements.md
RD-4	SRS — Software Requirements Specification (REQ-*)	compliance/drd/srs-software-requirements.md
RD-5	SDD — Software Design Document (C-*)	compliance/drd/sdd-software-design.md
RD-6	DPM — Data Processing Model (DPM-*)	compliance/drd/dpm-data-processing-model.md
RD-7	ATBD — Algorithm Theoretical Basis Document (ALG-*)	compliance/drd/atbd-algorithm-theoretical-basis.md
RD-8	V&V Plan (SVerP/SValP/SUITP merged; VT-*)	compliance/drd/vv-plan.md
RD-9	ICD — Interface Control Document (ICD-IF-*)	compliance/drd/icd-interface-control.md
AD-1	ECSS-E-ST-40C Rev.1 (30 April 2025) — §5.8, Annex D/F/I/J	—
AD-2	ECSS-Q-ST-80C Rev.2 — §6.2.6 verification	—

---

<3> Master end-to-end forward matrix — REQ-* → up / down / verify

The REQ-* (SRS) is the trace spine: each row gives the upstream parents (SYS-* and/or REQ-IF-*), the implementing design component(s) C-*, the processing module / algorithm (DPM-M-* / ALG-*), the bound external interface(s) ICD-IF-*, and the verification (method · tier) and validation task. Upstream from the SRS Trace: fields (RD-4 <5>); design from SDD <5.3>/<6.1> (RD-5); module/algorithm from DPM <8> and ATBD <5>; verification from V&V <14> and <9>. Secondary C-COM-* services used by every PU wrapper (PRODUCT, ADF, PROFILE, PROV, QAFLAG, CHUNK) are listed once in <5.3> and abbreviated here to the stage-distinctive ones.

<3.1> Functional requirements (REQ-F-*)

REQ-*	Summary	Upstream SYS-*	Upstream REQ-IF-*	Design C-*	DPM-M-* / ALG-*	ICD-IF-*	Verify (method·tier)	VT
REQ-F-L0-01	Decode L0c→per-band/detector samples	SYS-CAP-01	REQ-IF-IN-L0-01, REQ-IF-SW-04	C-PU-L0, C-COM-PRODUCT	DPM-M-L0 / ALG-L0-DEC	ICD-IF-L0	T,I·A	VT-1,2
REQ-F-L0-02	Lost-packet/line-loss detect+flag	SYS-CAP-01, SYS-OBS-02	—	C-PU-L0, C-COM-QAFLAG	DPM-M-L0 / ALG-L0-LOSS	ICD-IF-L0	T·A	VT-1
REQ-F-L0-03	Legality checks; resolve profile/ADF	SYS-CAP-01	REQ-IF-IN-L0-02, REQ-IF-SEC-01	C-PU-L0, C-COM-PROFILE, C-COM-ADF	DPM-M-L0	ICD-IF-L0, ICD-IF-PROF	T·A	VT-1
REQ-F-L0-04	Assemble self-describing L1A EOProduct	SYS-CAP-01	REQ-IF-IN-L0-01, REQ-IF-OUT-02	C-PU-L0, C-COM-PRODUCT	DPM-M-L0	ICD-IF-OUT	T,I·A	VT-1
REQ-F-L0-05	L0 read-only	—	REQ-IF-IN-L0-03, REQ-IF-SEC-03	C-PU-L0, C-COM-IO	DPM-M-L0	ICD-IF-L0	A,I·—	VT-9
REQ-F-L0-06	Canonical L0 ground decode (bit-exact)	SYS-CAP-01	REQ-IF-IN-L0-01	C-PU-L0 (ground_decode)	DPM-M-L0 / ALG-L0-DEC	ICD-IF-L0	T·—	VT-1
REQ-F-RAD-01	Dark/DSNU subtraction	SYS-CAP-02	REQ-IF-IN-ADF-01, REQ-IF-IN-ADF-02	C-PU-RAD, C-COM-ADF	DPM-M-RAD / ALG-RAD-DARK	ICD-IF-ADF	T,A·A+C	VT-1,3
REQ-F-RAD-02	NUC/PRNU flat-field	SYS-CAP-02	REQ-IF-IN-ADF-01	C-PU-RAD, C-COM-ADF	DPM-M-RAD / ALG-RAD-NUC	ICD-IF-ADF	T,A·A+C	VT-1,3
REQ-F-RAD-03	Bad-pixel detect + replace + flag	SYS-CAP-02, SYS-OBS-02	—	C-PU-RAD, C-COM-QAFLAG	DPM-M-RAD / ALG-RAD-BPR	—	T·A	VT-1
REQ-F-RAD-04	Saturation/no-data clip + flag	SYS-CAP-02, SYS-OBS-02	—	C-PU-RAD, C-COM-QAFLAG	DPM-M-RAD / ALG-RAD-SAT	—	T·A	VT-1
REQ-F-RAD-05 (opt)	Derive NUC gain/offset ADF	SYS-CAP-02, SYS-MNT-02	REQ-IF-IN-ADF-01	C-PU-RAD (calib mode)	DPM-M-RAD (DPM-ADF-NUC) / ALG-RAD-NUC	ICD-IF-ADF	T,A·B	VT-1
REQ-F-TOA-01	DN→TOA radiance	SYS-CAP-02, SYS-CAP-03	REQ-IF-IN-ADF-01	C-PU-TOA, C-COM-ADF	DPM-M-TOA / ALG-TOA-RAD	ICD-IF-ADF	T,A·A+C	VT-1,3
REQ-F-TOA-02 (opt)	TOA radiance→reflectance	SYS-CAP-03	—	C-PU-TOA	DPM-M-TOA / ALG-TOA-REF	—	T,A·A+C	VT-1,3
REQ-F-TOA-03	Emit L1B EOProduct + QA + prov	SYS-CAP-08	REQ-IF-OUT-02	C-PU-TOA, C-COM-PRODUCT, C-COM-PROV	DPM-M-TOA	ICD-IF-OUT	T,I·A	VT-1
REQ-F-ENH-01 (opt)	Configurable per-band denoise	SYS-CAP-02, SYS-ADP-01	—	C-PU-ENH	DPM-M-ENH / ALG-ENH-BWLP/WAVE/PCA/MA/GAUSS/FFTDARK	—	T,A·A+C	VT-1
REQ-F-ENH-02 (opt)	Deconvolution/sharpening	SYS-CAP-02, SYS-ADP-01	—	C-PU-ENH	DPM-M-ENH / ALG-ENH-DECONV	—	T,A·A+C	VT-1
REQ-F-ENH-03	Toggleable; default-off; QA impact	SYS-ADP-01, SYS-QUA-04	—	C-PU-ENH, C-PU-QA	DPM-M-ENH / DPM-M-QA	—	T,R·A	VT-1
REQ-F-COR-01	Inter-band co-registration to ref band	SYS-CAP-04	REQ-IF-CAP-01	C-PU-COR	DPM-M-COR / ALG-COR-FEAT/HOM/WARP	—	T,A·A	VT-1,4
REQ-F-COR-02	Residual ≤ BAND_COREG	SYS-CAP-05	—	C-PU-COR, C-PU-QA	DPM-M-COR	—	A,T·C	VT-4
REQ-F-COR-03	Fail-stop on insufficient matches	SYS-CAP-05, SYS-RAM-02	—	C-PU-COR, C-COM-ORC, C-COM-QAFLAG	DPM-M-COR	ICD-IF-DIAG	T·A	VT-1
REQ-F-GEO-01	Viewing-model geolocation	SYS-CAP-04	REQ-IF-IN-ADF-01, REQ-IF-IN-L0-01	C-PU-GEO, C-COM-ADF	DPM-M-GEO / ALG-GEO-ORBIT/GSD	ICD-IF-ADF	T,A·A+B	VT-1,4
REQ-F-GEO-02	DEM ortho + GCP + resample to CRS	SYS-CAP-04, SYS-ADP-02	—	C-PU-GEO, C-COM-ADF	DPM-M-GEO / ALG-GEO-GCP/ORTHO/RESAMP	ICD-IF-ADF	T,A·A+B	VT-1,4
REQ-F-GEO-03	Geolocation ≤ GEO_CE90	SYS-CAP-05	—	C-PU-GEO, C-PU-QA	DPM-M-GEO	—	A,T·C	VT-4
REQ-F-GEO-04	Emit L1C EOProduct + CRS/geoloc	SYS-CAP-08	REQ-IF-OUT-02	C-PU-GEO, C-COM-PRODUCT	DPM-M-GEO	ICD-IF-OUT	T,I·A	VT-1
REQ-F-PAN-01 (opt)	MS↔PAN fusion to high-res MS	SYS-CAP-04, SYS-ADP-01	—	C-PU-PAN	DPM-M-PAN / ALG-PAN-ALIGN/FUSE	—	T,A·A+B	VT-1
REQ-F-PAN-02 (opt)	Preserve spectral fidelity; QA	SYS-QUA-04	—	C-PU-PAN, C-PU-QA	DPM-M-PAN	—	A,T·C	VT-1
REQ-F-ATM-01 (new)	Retrieve/ingest AOT + water vapour	SYS-CAP-06	REQ-IF-IN-ADF-01	C-PU-ATM, C-COM-ADF	DPM-M-ATM / ALG-ATM-PAR	ICD-IF-ADF	T,A·A+C	VT-1,5
REQ-F-ATM-02 (new)	TOA→BOA surface reflectance	SYS-CAP-06	—	C-PU-ATM	DPM-M-ATM / ALG-ATM-RT	—	T,A·A+C	VT-1,5
REQ-F-ATM-03 (new)	Scene classification + cloud/shadow mask	SYS-CAP-07, SYS-OBS-02	—	C-PU-ATM, C-COM-QAFLAG	DPM-M-ATM / ALG-ATM-SCM	—	T·A	VT-1
REQ-F-ATM-04 (new)	Emit L2A EOProduct	SYS-CAP-08	REQ-IF-OUT-02	C-PU-ATM, C-COM-PRODUCT	DPM-M-ATM	ICD-IF-OUT	T,I·A	VT-1
REQ-F-QA-01	Per-band/stage metrics (SNR/RMSE/PSNR/MSE/var)	SYS-OBS-02, SYS-OBS-03, SYS-QUA-04	—	C-PU-QA	DPM-M-QA / ALG-QA-SNR/RMSE/PSNR/MSE/VAR	ICD-IF-OUT	T·A+C	VT-1,3,4,5
REQ-F-QA-02	Per-pixel QA flag propagation	SYS-OBS-02, SYS-CAP-08	—	C-PU-QA, C-COM-QAFLAG	DPM-M-QA	ICD-IF-OUT	T·A	VT-1
REQ-F-PRD-01	Write cloud-native Zarr EOProduct	SYS-CAP-08	REQ-IF-OUT-01, REQ-IF-OUT-02	C-COM-PRODUCT	DPM-M-PRD	ICD-IF-OUT, ICD-IF-SW	T,I·A+B	VT-2
REQ-F-PRD-02	Provenance (input/ADF/profile/version ids)	SYS-OBS-01	REQ-IF-CAP-03, REQ-IF-OUT-04	C-COM-PROV, C-COM-PRODUCT	DPM-M-PRD	ICD-IF-OUT	I,T·A	VT-1
REQ-F-ORC-01	PU declares I/O; run level/sub/full-chain	SYS-CAP-10	REQ-IF-CAP-01, REQ-IF-SW-01	C-COM-ORC, C-COMPUTING	DPM-M-PRD / DPM-BKP-*	ICD-IF-TRIG, ICD-IF-SW	T,R·A	VT-2
REQ-F-ORC-02	Chunked, bounded memory, optional Dask	SYS-CAP-11	REQ-IF-CAP-02	C-COM-CHUNK, C-COM-ORC	DPM-PRM-GEN-02	ICD-IF-SW	T,A·B	VT-2,6
REQ-F-DEP-01	Fail-stop; no partial product published	SYS-OPS-02, SYS-RAM-02, SYS-SAF-01	—	C-COM-ORC	DPM-M-PRD	ICD-IF-DIAG	T·A	VT-2,7
REQ-F-DEP-02	Deterministic / reproducible	SYS-RAM-01	REQ-IF-CAP-04	all Cores (seeds), C-COM-ORC	ATBD <6> / <4.3>	—	T,A·A+B	VT-1,2

<3.2> Performance requirements (REQ-P-*)

REQ-*	Summary	Upstream SYS-*	Design C-*	DPM	Verify	VT
REQ-P-01	L1B radiometric accuracy RAD_ACC	SYS-CAP-03, SYS-QUA-04	C-PU-RAD, C-PU-TOA, C-PU-QA	DPM <7.4>	A,T·C	VT-3
REQ-P-02	GEO_CE90 + BAND_COREG	SYS-CAP-05	C-PU-COR, C-PU-GEO, C-PU-QA	DPM <7.4>	A,T·C	VT-4
REQ-P-03	L2A surface reflectance BOA_ACC	SYS-QUA-04	C-PU-ATM, C-PU-QA	DPM <7.4>	A,T·C	VT-5
REQ-P-04	End-to-end throughput THRU_SCENE	SYS-RES-04	C-COM-CHUNK, C-COM-ORC	DPM <7.4>	A,T·C	VT-6
REQ-P-05	Peak per-worker memory MEM_BUDGET	SYS-RES-03	C-COM-CHUNK	DPM-PRM-GEN-02	A,T·C	VT-6

<3.3> Interface, operational and resource requirements (REQ-I-*, REQ-O-*, REQ-R-*)

REQ-*	Summary	Upstream SYS-*	Upstream REQ-IF-*	Design C-*	ICD-IF-*	Verify	VT
REQ-I-01	Comply with all REQ-IF-* + ICD/PSFD	—	REQ-IF-* (all)	C-COM-PRODUCT, C-COM-ORC	ICD-IF-* (all)	R,I·—	VT-9
REQ-I-02	CPM Python API + non-interactive CLI	SYS-IF-01	REQ-IF-HMI-01, REQ-IF-SW-01	C-COM-CLI	ICD-IF-HMI, ICD-IF-SW	T,I·A+B	VT-7
REQ-I-03	Consume L0c/ADF per ICD; read-only	SYS-IF-02	REQ-IF-IN-L0-01, REQ-IF-IN-ADF-01, REQ-IF-IN-L0-03, REQ-IF-IN-ADF-04	C-PU-L0, C-COM-ADF, C-COM-IO	ICD-IF-L0, ICD-IF-ADF	T·A+B	VT-1,2
REQ-I-04	Produce Zarr stores on S3/POSIX, chunked	SYS-IF-03	REQ-IF-OUT-01, REQ-IF-OUT-03	C-COM-PRODUCT, C-COM-IO	ICD-IF-OUT	T,I·A+B	VT-2
REQ-I-05	Invocable via CPM triggering payload	SYS-OPS-01	REQ-IF-COM-01	C-COM-ORC	ICD-IF-TRIG	T,I·A+B	VT-7
REQ-I-06	URI-referenced, location-transparent I/O	SYS-IF-04	REQ-IF-COM-02, REQ-IF-COM-03	C-COM-IO	ICD-IF-TRIG	T·A+B	VT-2,7
REQ-I-07	EOPF data-model naming conventions	SYS-DES-06	REQ-IF-OUT-02	C-COM-PRODUCT	ICD-IF-OUT	I·—	VT-9
REQ-O-01	Operable as batch job (CLI/API), per level	SYS-OPS-01	REQ-IF-COM-01, REQ-IF-CAP-01	C-COM-CLI, C-COM-CONFIG	ICD-IF-HMI, ICD-IF-TRIG	T·A+B	VT-7
REQ-O-02	Structured logs + processing report	SYS-OPS-02, SYS-OBS-01	—	C-COM-ORC	ICD-IF-DIAG	T·A+B	VT-7
REQ-O-03	Completion status + machine-readable diag	—	REQ-IF-CAP-05	C-COM-ORC	ICD-IF-DIAG	T·A+B	VT-7
REQ-O-04	Modes configured/idle→processing→error	SYS-CAP-10	—	C-COM-ORC	ICD-IF-DIAG	R,T·A	VT-7
REQ-R-01	x86-64 Linux multi-core CPU, no GPU	SYS-RES-01	—	architecture-wide	ICD-IF-SW-05	T·B	VT-6,8
REQ-R-02	S3-compatible/POSIX; no special HW	SYS-RES-02	REQ-IF-HW-01	C-COM-IO	ICD-IF-SW-05	T·B	VT-8
REQ-R-03	Python 3.11 + eopf==2.8.1 + stack	SYS-RES-05, SYS-DES-03	REQ-IF-SW-03	architecture-wide	ICD-IF-SW-03	I,T·A+B	VT-8
REQ-R-04	Memory scales with chunk; CPU with tiles	SYS-RES-03	—	C-COM-CHUNK	—	A,T·C	VT-6
REQ-R-05	No hard real-time constraint (N/A closure)	SYS-RES-04	—	—	—	R·—	—

<3.4> Design, security, portability, quality, RAMS, delivery, data, HF, adaptation

REQ-*	Summary	Upstream SYS-*	Upstream REQ-IF-*	Design C-*	ICD-IF-*	Verify	VT
REQ-D-01	PU/EOProduct config-driven pipeline	SYS-DES-01	REQ-IF-SW-01	architecture, C-COMPUTING	ICD-IF-SW	R·—	VT-9
REQ-D-02	Coding standards + ECSS tailoring	SYS-DES-02, SYS-QUA-01	—	toolchain	—	I·—	VT-9
REQ-D-03	Pure framework-independent core	—	REQ-IF-SW-04	all Cores (core/unit split)	—	T·A	VT-1
REQ-D-04	No hard-coded constants; bounded complexity	SYS-CAP-09, SYS-QUA-05	—	all Cores, C-SENSORS	—	I,A·—	VT-9
REQ-D-05	Numerical accuracy/determinism management	SYS-RAM-01, SYS-QUA-04	—	all Cores	—	A,T·A	VT-1
REQ-D-06	Reuse only SRF components + licences	SYS-DES-03	REQ-IF-SW-02	reused comps (SRF)	ICD-IF-SW	I·—	VT-9
REQ-D-07	New sensor = new profile, no core change	SYS-DES-07, SYS-CAP-09	REQ-IF-AD-01	C-SENSORS, C-COM-PROFILE	ICD-IF-PROF	T,R·A+B	VT-10
REQ-D-08	No in-flight modification (N/A closure)	— (SSS <5.12>)	—	—	—	R·—	—
REQ-D-09	Zarr + EOPF/CF + STAC fields	SYS-DES-04	REQ-IF-OUT-02	C-COM-PRODUCT	ICD-IF-OUT	I,T·A	VT-9
REQ-S-01	Code public; L0/ADF private, by URI	SYS-SEC-01	REQ-IF-SEC-02, REQ-IF-IN-ADF-03	C-COM-ADF, C-COM-IO	ICD-IF-ADF	I,A·—	VT-9
REQ-S-02	Credentials via env/CI only	SYS-SEC-02	—	C-COM-IO, C-COM-CONFIG	—	I,T·A	VT-9
REQ-S-03	Least privilege (read in, write out)	SYS-SEC-03	REQ-IF-SEC-03	C-COM-IO	ICD-IF-ADF, ICD-IF-OUT	A,I·—	VT-9
REQ-S-04	Verify id/version of L0/ADF/profile	—	REQ-IF-SEC-01	C-COM-ADF, C-COM-PROFILE	ICD-IF-ADF	T·A	VT-1
REQ-S-05	Output carries provenance ids only	—	REQ-IF-SEC-02, REQ-IF-CAP-03	C-COM-PROV	ICD-IF-OUT	I,A·—	VT-9
REQ-PORT-01	SDE↔local relocatable (config only)	SYS-QUA-03	—	Core/Wrapper split, C-COM-IO	—	T,I·B	VT-8
REQ-PORT-02	Location-transparent I/O	—	REQ-IF-COM-02	C-COM-IO	ICD-IF-TRIG	T·B	VT-2
REQ-PORT-03	Local-FS path on CI shell runner	— (SYS-VV-02)	REQ-IF-COM-03	C-COM-IO, C-COM-CHUNK	ICD-IF-TRIG-03	T·A	VT-1
REQ-Q-01	ECSS-Q-80 Cat C + quality gates	SYS-QUA-01	—	toolchain	—	I·—	VT-9
REQ-Q-02	Test coverage meets gate	SYS-QUA-02	—	tests/	—	T·A	VT-9
REQ-Q-03	Numerical objectives validated locally	SYS-QUA-04	—	C-PU-QA	DPM <7.4>	A,T·C	VT-3,4,5
REQ-Q-04	Maintainability: reuse + bounded complexity	SYS-QUA-05	—	C-SENSORS, all Cores	—	I,A·—	VT-9
REQ-REL-01	Deterministic/reproducible (via DEP-02)	SYS-RAM-01	—	all Cores	—	T,A·A+B	VT-1,2
REQ-REL-02	Resumable at level granularity	SYS-RAM-02	—	C-COM-ORC	DPM-BKP-*	T·A+B	VT-2
REQ-REL-03	No availability target (N/A closure)	SYS-RAM-03	—	—	—	R·—	—
REQ-M-01	GitLab issue→branch→MR + SemVer	SYS-MNT-01	—	repo workflow	—	R·—	VT-9
REQ-M-02	Cal/aux update = swap data, no code change	SYS-MNT-02	REQ-IF-IN-ADF-03	C-COM-ADF	ICD-IF-ADF	T,R·B	VT-2
REQ-M-03	Procedure for eopf bump + re-V&V	SYS-MNT-03	REQ-IF-SW-03	process	—	R·—	VT-9
REQ-M-04	Per-stage modular structure	SYS-QUA-05	REQ-IF-SW-04	core/unit/profile split	—	I·—	VT-9
REQ-SAF-01	No safety-critical fn; data-integrity triad	SYS-SAF-01	—	C-COM-QAFLAG, C-COM-PROV, C-COM-ORC	—	R·—	VT-9
REQ-DEL-01	Versioned wheels + docs from tagged CI	SYS-DEL-01	—	CI delivery	—	T,I·A	VT-9
REQ-DEL-02	No private data in artefacts; tag integrity	SYS-DEL-02	REQ-IF-SEC-02	CI delivery	—	I·—	VT-9
REQ-DEL-03	Zarr product spec in delivered config	SYS-DES-04	—	C-COM-PRODUCT	ICD-IF-OUT	I·—	VT-9
REQ-DAT-01	Output data model per ICD/PSFD	SYS-DES-04, SYS-DES-06	REQ-IF-OUT-02	C-COM-PRODUCT	ICD-IF-OUT	I,T·A	VT-9
REQ-DAT-02	Private ADF store external; id/version/schema	SYS-ADP-02	REQ-IF-IN-ADF-01, REQ-IF-IN-ADF-02	C-COM-ADF	ICD-IF-ADF	I,R·—	VT-9
REQ-DAT-03	Profile schema versioned + load-validated	SYS-ADP-03	REQ-IF-AD-04	C-COM-PROFILE, C-SENSORS	ICD-IF-PROF	T·A	VT-1,10
REQ-HF-01	CLI/config/logs only; no GUI	SYS-IF-05	REQ-IF-HMI-01	C-COM-CLI	ICD-IF-HMI	I·—	VT-9
REQ-HF-02	Report human + machine readable	SYS-OPS-02	—	C-COM-ORC	ICD-IF-DIAG	T,I·A	VT-7
REQ-AD-01	Sensor-agnostic via profile	SYS-ADP-01, SYS-CAP-09	REQ-IF-AD-01	C-SENSORS, C-COM-PROFILE	ICD-IF-PROF	R,T·A	VT-10
REQ-AD-02	Profile id/version; per-run selection	SYS-ADP-01	REQ-IF-AD-02	C-SENSORS, C-COM-CONFIG	ICD-IF-PROF	I,T·A	VT-10
REQ-AD-03	DEM/atmos by reference, not embedded	SYS-ADP-02	REQ-IF-AD-03	C-COM-CONFIG, C-COM-ADF	ICD-IF-PROF	T,I·A+B	VT-2
REQ-AD-04	Ops/site settings externalised	SYS-ADP-02	REQ-IF-AD-03	C-COM-CONFIG	ICD-IF-PROF, ICD-IF-TRIG	I,T·A+B	VT-7
REQ-AD-05	Clean pip install + acceptance run	SYS-VV-06	—	packaging	—	T,I·B	VT-8

---

<4> Interface trace — REQ-IF-* → ICD-IF-* → REQ-*

The interface spine. Forward (IRD interface requirement → ICD interface) and the implementing software requirements from ICD <7.2>. The SYS-* column is (derived): the IRD (RD-3 <5>) states each interface requirement as Statement + Rationale and does not carry a per-requirement SYS-* trace field (verified against the source); the system correspondence below is derived from the IRD <4> product-perspective decomposition and the SYS-* co-cited by the implementing REQ-*. The authoritative ICD↔REQ trace is ICD <7.1>/<7.2>.

REQ-IF-*	Summary	ICD-IF-* (ICD <7.1>)	Implementing REQ-* (ICD <7.2>)	SYS-* (derived)
REQ-IF-CAP-01	Staged interfaces + breakpoints	ICD-IF-TRIG-01/04, ICD-IF-SW-01	REQ-F-ORC-01, REQ-O-01, REQ-I-01	SYS-CAP-10
REQ-IF-CAP-02	Chunked / lazy access	(ICD-IF-OUT-03, ICD-IF-SW)	REQ-F-ORC-02, REQ-I-01	SYS-CAP-11, SYS-RES-03
REQ-IF-CAP-03	Metadata / provenance propagation	ICD-IF-OUT-03	REQ-F-PRD-02, REQ-S-05, REQ-I-01	SYS-OBS-01
REQ-IF-CAP-04	Reproducible interface behaviour	(ICD-IF-OUT, ICD-IF-SW)	REQ-F-DEP-02, REQ-I-01	SYS-RAM-01
REQ-IF-CAP-05	Completion status + diagnostics	ICD-IF-DIAG-01	REQ-O-03, REQ-F-DEP-01, REQ-I-01	SYS-OPS-02, SYS-OBS-02
REQ-IF-IN-L0-01	L0 input product interface	ICD-IF-L0-01	REQ-F-L0-01/04, REQ-I-03	SYS-IF-02, SYS-CAP-01
REQ-IF-IN-L0-02	L0 identification/selection metadata	ICD-IF-L0-02	REQ-F-L0-03, REQ-I-03	SYS-IF-02, SYS-ADP-01
REQ-IF-IN-L0-03	L0 immutability	ICD-IF-L0-03	REQ-F-L0-05, REQ-I-03	SYS-SEC-03, SYS-IF-02
REQ-IF-IN-ADF-01	Calibration ADF input interface	ICD-IF-ADF-01	REQ-F-RAD-01/02, REQ-F-TOA-01, REQ-F-ATM-01, REQ-DAT-02, REQ-I-03	SYS-IF-02, SYS-CAP-02
REQ-IF-IN-ADF-02	ADF id/versioning/validity	ICD-IF-ADF-02	REQ-F-RAD-01, REQ-DAT-02	SYS-OBS-01, SYS-MNT-02
REQ-IF-IN-ADF-03	Runtime-resolved, private ADF refs	ICD-IF-ADF-03	REQ-S-01, REQ-M-02	SYS-SEC-01, SYS-MNT-02
REQ-IF-IN-ADF-04	ADF immutability	ICD-IF-ADF-04	REQ-I-03, REQ-S-03	SYS-SEC-03
REQ-IF-OUT-01	Output as cloud-native Zarr	ICD-IF-OUT-01	REQ-F-PRD-01, REQ-I-04	SYS-IF-03, SYS-DES-04
REQ-IF-OUT-02	Self-describing EOProduct	ICD-IF-OUT-02	REQ-F-PRD-01, REQ-DAT-01, REQ-D-09, REQ-I-07	SYS-DES-06, SYS-CAP-08
REQ-IF-OUT-03	Storage backends + chunked access	ICD-IF-OUT-03, ICD-IF-SW-02	REQ-I-04, REQ-R-02	SYS-RES-02, SYS-IF-03
REQ-IF-OUT-04	Output id/versioning	(ICD-IF-OUT-02)	REQ-F-PRD-02	SYS-OBS-01, SYS-DEL-02
REQ-IF-SW-01	Stages as EOProcessingUnits	ICD-IF-SW-01	REQ-D-01, REQ-F-ORC-01	SYS-DES-01
REQ-IF-SW-02	EOProduct/EOZarrStore persistence	ICD-IF-SW-02	REQ-D-06, REQ-I-04	SYS-DES-03
REQ-IF-SW-03	Framework version binding eopf==2.8.1	ICD-IF-SW-03	REQ-R-03, REQ-M-03	SYS-RES-05, SYS-MNT-03
REQ-IF-SW-04	Testable algorithmic core	ICD-IF-SW-04	REQ-D-03, REQ-M-04, REQ-F-L0-01	SYS-DES-07, SYS-QUA-05
REQ-IF-COM-01	Triggering payload interface	ICD-IF-TRIG-01	REQ-I-05, REQ-O-01	SYS-OPS-01
REQ-IF-COM-02	URI-referenced, location-transparent I/O	ICD-IF-TRIG-02	REQ-I-06, REQ-PORT-02	SYS-IF-04
REQ-IF-COM-03	Local-FS fallback (constrained env)	ICD-IF-TRIG-03	REQ-I-06, REQ-PORT-03	SYS-VV-02, SYS-QUA-03
REQ-IF-HW-01	No direct hardware interface	ICD-IF-SW-05	REQ-R-02	SYS-RES-01
REQ-IF-HMI-01	Non-interactive invocation	ICD-IF-HMI-01	REQ-I-02, REQ-HF-01	SYS-IF-05
REQ-IF-SEC-01	Input identity and integrity	ICD-IF-L0-03, ICD-IF-ADF-02	REQ-S-04, REQ-F-L0-03	SYS-SEC-01, SYS-CAP-01
REQ-IF-SEC-02	Confidentiality of private inputs	ICD-IF-ADF-03, ICD-IF-OUT-03	REQ-S-01/05, REQ-DEL-02	SYS-SEC-01
REQ-IF-SEC-03	Least-privilege access	ICD-IF-ADF-04	REQ-S-03, REQ-F-L0-05	SYS-SEC-03
REQ-IF-AD-01	Sensor-agnostic chain via profile	ICD-IF-PROF-01	REQ-AD-01, REQ-D-07	SYS-ADP-01, SYS-CAP-09
REQ-IF-AD-02	Profile id/versioning/selection	ICD-IF-PROF-02	REQ-AD-02	SYS-ADP-01
REQ-IF-AD-03	Externalised ops/site settings	ICD-IF-PROF-01	REQ-AD-03/04	SYS-ADP-02
REQ-IF-AD-04	Profile validation at load	ICD-IF-PROF-01	REQ-DAT-03	SYS-ADP-03

Closure. All 31 REQ-IF-* map to ≥1 ICD-IF-* interface and to ≥1 implementing REQ-* (no orphan interface requirement). All 8 ICD-IF-* families trace back to REQ-IF-* and forward to REQ-* (ICD <7.2>; no orphan interface).

---

<5> Backward coverage

<5.1> System requirements SYS-* → REQ-* (every SYS-* covered)

From SRS <7.2> (forward coverage). Each of the 66 SYS-* is covered by ≥1 software requirement.

SYS-* group	Covered by REQ-*
SYS-CAP-01	REQ-F-L0-01..04
SYS-CAP-02	REQ-F-RAD-01..05, REQ-F-ENH-01/02, REQ-F-TOA-01
SYS-CAP-03	REQ-F-TOA-01/02, REQ-P-01
SYS-CAP-04	REQ-F-COR-01, REQ-F-GEO-01/02, REQ-F-PAN-01
SYS-CAP-05	REQ-F-COR-02, REQ-F-GEO-03, REQ-P-02
SYS-CAP-06	REQ-F-ATM-01/02
SYS-CAP-07	REQ-F-ATM-03
SYS-CAP-08	REQ-F-TOA-03, REQ-F-GEO-04, REQ-F-ATM-04, REQ-F-PRD-01
SYS-CAP-09	REQ-D-04, REQ-D-07, REQ-AD-01
SYS-CAP-10	REQ-F-ORC-01, REQ-O-04
SYS-CAP-11	REQ-F-ORC-02, REQ-R-04
SYS-IF-01..05	REQ-I-02..07, REQ-HF-01
SYS-ADP-01..03	REQ-AD-01..04, REQ-DAT-03
SYS-RES-01..05	REQ-R-01..05, REQ-P-04/05
SYS-SEC-01..03	REQ-S-01..03
SYS-SAF-01	REQ-SAF-01, REQ-F-DEP-01
SYS-RAM-01..03	REQ-REL-01..03, REQ-F-DEP-01/02
SYS-QUA-01..05	REQ-Q-01..04, REQ-D-02/04, REQ-P-01..03
SYS-DES-01..08	REQ-D-01..09, REQ-S-01, REQ-I-07
SYS-OPS-01/02	REQ-O-01..03, REQ-F-DEP-01, REQ-HF-02
SYS-MNT-01..03	REQ-M-01..04, REQ-F-RAD-05
SYS-OBS-01..03	REQ-F-PRD-02, REQ-F-QA-01/02
SYS-DEVSEC-01..03	REQ-S-02, REQ-Q-01, REQ-PORT-03
SYS-DEL-01/02	REQ-DEL-01..03
SYS-VV-01..09	REQ-Q-02/03, REQ-AD-05, REQ-PORT-03, SRS <6> / V&V (RD-8)

<5.2> Design components C-* → REQ-* (every component implements ≥1 requirement)

From SDD <5.3> allocation table (inverse). No orphan component.

C-*	Package	Dev type	Allocated REQ-*	DPM-M-* / ALG-*
C-COMPUTING	…computing	new	REQ-D-01, REQ-F-ORC-01	—
C-PU-L0	…computing.l0_decode	reuse-adapt (level_0)	REQ-F-L0-01..05	DPM-M-L0 / ALG-L0-*
C-PU-RAD	…computing.radiometric	reuse-adapt (level_1.NUC)	REQ-F-RAD-01..05	DPM-M-RAD / ALG-RAD-*
C-PU-ENH	…computing.enhancement (opt)	reuse-adapt (Denoiser,sharpening)	REQ-F-ENH-01..03	DPM-M-ENH / ALG-ENH-*
C-PU-TOA	…computing.toa	reuse-adapt (level_1.TOA)	REQ-F-TOA-01..03	DPM-M-TOA / ALG-TOA-*
C-PU-COR	…computing.coregistration	reuse-adapt (band_coreg)	REQ-F-COR-01..03	DPM-M-COR / ALG-COR-*
C-PU-GEO	…computing.georeference	reuse-adapt (georeferencing_v1)	REQ-F-GEO-01..04	DPM-M-GEO / ALG-GEO-*
C-PU-PAN	…computing.pansharpen (opt)	reuse-adapt (pansharp)	REQ-F-PAN-01/02	DPM-M-PAN / ALG-PAN-*
C-PU-ATM	…computing.atmospheric	new	REQ-F-ATM-01..04	DPM-M-ATM / ALG-ATM-*
C-PU-QA	…computing.qa	reuse-adapt (metrics_ips)	REQ-F-QA-01/02	DPM-M-QA / ALG-QA-*
C-SENSORS	…sensors	new	REQ-AD-01..04, REQ-DAT-03	DPM <7.4>
C-COM-PRODUCT	…common.product	new (over CPM)	REQ-F-PRD-01, REQ-DAT-01, REQ-D-09	DPM-M-PRD
C-COM-IO	…common.io	new (over CPM)	REQ-I-06, REQ-PORT-02/03	—
C-COM-ADF	…common.adf	new	REQ-F-RAD-01, REQ-DAT-02, REQ-S-04	DPM <7.2> / DPM-ADF-*
C-COM-PROFILE	…common.profile	new	REQ-AD-01/02, REQ-DAT-03	ICD <5.3.6>
C-COM-PROV	…common.provenance	new	REQ-F-PRD-02, REQ-S-05	DPM-M-PRD
C-COM-QAFLAG	…common.qaflags	new	REQ-F-QA-02	ICD <5.3.3>E
C-COM-CHUNK	…common.chunking	new (over Dask)	REQ-F-ORC-02, REQ-R-04, REQ-P-05	DPM-PRM-GEN-02
C-COM-CONFIG	…common.config	new	REQ-AD-04, REQ-O-01	ICD <5.3.5>
C-COM-ORC	…common.orchestration	new (over CPM)	REQ-F-ORC-01, REQ-F-DEP-01, REQ-I-05	DPM-M-PRD
C-COM-CLI	…common.cli	new	REQ-I-02, REQ-O-01, REQ-HF-01	ICD <5.3.7>

Design measures for the residual data-integrity hazard (Cat C, REQ-SAF-01) — pure-core isolation, no hard-coded constants, bounded complexity, typed fault containment, determinism, fail-stop+QA+ provenance — are allocated across all Cores + C-COM-ORC/QAFLAG/PROV (SDD <6.3>).

<5.3> Processing modules / algorithms DPM-M-* / ALG-* → REQ-* / C-*

From DPM <8> module table and ATBD <5> Trace: fields. Every module/algorithm traces to a requirement and a component.

DPM-M-*	ALG-*	REQ-F-*	C-*	Heritage (RD-10)
DPM-M-L0	ALG-L0-DEC, ALG-L0-LOSS	REQ-F-L0-01..05	C-PU-L0	level_0.py decode/lost_package
DPM-M-RAD	ALG-RAD-DARK, -NUC, -BPR, -SAT	REQ-F-RAD-01..05	C-PU-RAD	level_1.py NUC/dark/noise
DPM-M-ENH	ALG-ENH-BWLP/WAVE/PCA/MA/GAUSS/FFTDARK/DECONV	REQ-F-ENH-01..03	C-PU-ENH	level_1.Denoiser,sharpening [impl tuning]
DPM-M-TOA	ALG-TOA-RAD, ALG-TOA-REF	REQ-F-TOA-01..03	C-PU-TOA	level_1.TOA
DPM-M-COR	ALG-COR-FEAT, -HOM, -WARP	REQ-F-COR-01..03	C-PU-COR	band_coreg.py
DPM-M-GEO	ALG-GEO-ORBIT/GSD/GCP/ORTHO/RESAMP	REQ-F-GEO-01..04	C-PU-GEO	georeferencing_v1.py
DPM-M-PAN	ALG-PAN-ALIGN, ALG-PAN-FUSE	REQ-F-PAN-01/02	C-PU-PAN	pansharp.py [impl tuning]
DPM-M-ATM	ALG-ATM-PAR, ALG-ATM-RT, ALG-ATM-SCM	REQ-F-ATM-01..04	C-PU-ATM	none — new (ATBD RD-7) [impl]
DPM-M-QA	ALG-QA-SNR/RMSE/PSNR/MSE/VAR	REQ-F-QA-01/02	C-PU-QA	metrics_ips.py
DPM-M-PRD	— (EOPF CPM)	REQ-F-PRD-01/02, REQ-F-ORC-01/02	C-COM-PRODUCT, C-COM-PROV, C-COM-ORC	—

ADF / breakpoint / parameter families (DPM internal IDs, consumed by the modules above): DPM-ADF-DARK/FLAT/NUC/BPM/RAD/SPEC/GEOM/DEM/GCP/ATM → ICD-IF-ADF (REQ-IF-IN-ADF-*, REQ-DAT-02); DPM-BKP-L1A/RAD/ENH/L1B/COR/L1C/L2A → REQ-F-ORC-01, REQ-REL-02 (breakpoints); DPM-PRM-* → REQ-AD-01/04 (profile parameters), DPM-PRM-GEN-02 → REQ-F-ORC-02/REQ-P-05 (chunking).

<5.4> Validation tasks VT-* → requirement groups (V&V <9>)

VT-*	Item under test	Requirement groups	Tier
VT-1	Pure algorithmic cores	all REQ-F-* (+ REQ-D-03/05, REQ-PORT-03, REQ-S-04, REQ-DAT-03)	A
VT-2	PU chain + sub-chains at breakpoints	REQ-F-ORC-01/02, REQ-F-PRD-01, REQ-F-DEP-01, REQ-REL-02, REQ-I-03/04, REQ-M-02, REQ-PORT-02, REQ-AD-03	B
VT-3	Radiometric accuracy L1B	REQ-P-01, REQ-F-RAD-, REQ-F-TOA-, REQ-Q-03	C
VT-4	Geometric accuracy L1C	REQ-P-02, REQ-F-GEO-, REQ-F-COR-, REQ-Q-03	C
VT-5	Surface-reflectance accuracy L2A	REQ-P-03, REQ-F-ATM-*, REQ-Q-03	C
VT-6	Performance	REQ-P-04/05, REQ-R-01/04, REQ-F-ORC-02	C
VT-7	Operational procedures	REQ-O-01..04, REQ-I-02/05, REQ-HF-02	A/B
VT-8	Installation & acceptance	REQ-AD-05, REQ-R-02/03, REQ-PORT-01	B
VT-9	Quality-requirements validation	REQ-Q-01/02/04, REQ-D-02/06/09, REQ-S-, REQ-DEL-, REQ-DAT-01/02, REQ-I-01/07, REQ-HF-01, REQ-M-*, REQ-SAF-01	A
VT-10	Adaptation / second profile	REQ-D-07, REQ-AD-01/02, REQ-DAT-03	A/B

---

<6> Orphan and gap analysis

<6.1> Forward closure (requirement → design → verification)

• Design allocation. All 95 REQ-* are allocated to ≥1 C-* (SDD <5.3>/<6.1>); design-/process- level requirements (REQ-D/Q/M/REL/SAF/DEL-*) map to the architecture, toolchain or workflow as recorded in <3.4>. No unimplemented requirement.

• Verification binding. All 95 REQ-* carry ≥1 method (T/A/I/R) and a tier or a documented static-evidence “—” (V&V <14>). Every REQ-F-* is in VT-1; budgeted requirements add a Tier-C VT. No unverified requirement.

<6.2> Backward closure (upper-level / design / algorithm → requirement)

• SYS-*: all 66 covered by ≥1 REQ-* (<5.1>). No orphan system requirement.

• REQ-IF-*: all 31 covered by ≥1 REQ-* and ≥1 ICD-IF-* (<4>). No orphan interface requirement.

• C-*: all 20 components (+ container) allocate ≥1 REQ-* (<5.2>). No orphan component.

• DPM-M-* / ALG-*: all 11 modules and 33 algorithms trace to REQ-F-* and a C-* (<5.3>). No orphan module/algorithm.

• ICD-IF-*: all 8 families trace to REQ-IF-* and REQ-* (ICD <7.2>). No orphan interface.

<6.3> Gaps, watch-items and recorded exclusions

Ref	Item	Classification	Disposition
G-1	C-PU-ATM / DPM-M-ATM / ALG-ATM-PAR/RT/SCM are new — no reuse heritage; RT engine + scene classifier [impl] (ATBD <5.8> “new/to-be-defined”)	Design-complete, algorithm down-selection deferred to implementation	Track to SDP WP-5; interfaces frozen at CDR; re-validate via VT-1/VT-5. Risk in Risk Register.
G-2	Tier-C numerical budgets RAD_ACC/GEO_CE90/BAND_COREG/BOA_ACC/THRU_SCENE/MEM_BUDGET (REQ-P-01..05, REQ-Q-03, REQ-F-COR-02/GEO-03/PAN-02)	Verification deferred (private real data)	Pass/fail verdicts to SVR; deferral recorded per V&V <8.8>; private numbers withheld (data policy).
G-3	N/A closures REQ-D-08, REQ-R-05, REQ-REL-03	Verified by review, no test	Recorded; not a coverage gap (V&V <14>).
G-4	Static-evidence requirements with tier “—” (REQ-F-L0-05, REQ-S-01/03/05, REQ-D-04, REQ-I-01/07, REQ-Q-01/04, REQ-DEL-02/03, REQ-DAT-02, REQ-HF-01, REQ-M-01/03/04, REQ-SAF-01)	Verified by I/A/R (no dynamic tier)	Evidenced by CI/grep/review artefacts; valid closure.
G-5	Optional stages (opt) REQ-F-ENH-, REQ-F-PAN-, REQ-F-TOA-02, REQ-F-RAD-05	Profile-toggleable; default-off where not validated	Verified when enabled; not required for baseline L2A.
G-6	[impl] code internals: L0 bit-codec body (NDA), geolocation collinearity kernel, atmospheric RT/classifier, filter/matcher tunings	Specified at interface+algorithm level; bodies post-CDR	Expected per SDP; not a CDR gap.
G-7	QAFlag bit 7 reserved [TBC@CDR] (SDD <5.4.1>)	Open design detail	Confirm/close at CDR; spare bit, no functional impact.
G-8	System-level validation items (real E4 trigger, E5 dissemination at scale, Dask-gateway scaling, mission-volume throughput)	Beyond validation environment (V&V <13>)	Need host ground-segment support; do not affect the Cat-C item-level V&V conclusion.

Conclusion. The traceability is closed in both directions with no orphan or unimplemented/ unverified requirement at this baseline. The only open technical item is the new atmospheric chain (G-1) and the numerical-budget verifications pending private data (G-2); both are managed, recorded deferrals, not traceability gaps. The matrix satisfies the CDR traceability gate (ECSS-E-ST-40C §5.8; Annex D <7>, Annex F <6>, Annex I/J).

---

<7> Maintenance

This RTM is a configuration item under Git, changed only through reviewed MRs (ECSS-M-ST-40C; SPAP). It is regenerated/checked when any source Trace: field or trace table changes (SRS, IRD, ICD, SDD, DPM, ATBD, V&V). A post-CDR CI lint shall fail the pipeline if any REQ-* lacks an upstream parent, a design component, or a verification binding, making the forward/backward closure machine-checkable. At QR/AR the verification-result columns (Tier-A pass evidence, Tier-B/C verdicts) are consolidated from the SVR (RD-8) into this matrix.

End of RTM. Authored per ECSS-E-ST-40C Rev.1 §5.8 / Annex D <7> / Annex F <6> / Annex I-J, tailored Category C, single-developer. Upstream IDs reused verbatim from RD-2..RD-9; no new requirement, design or algorithm IDs are introduced here (this is a consolidation artefact).