Trace

Audit-ready traceability for medical-device software teams: a Rovo agent and Jira app that proves every requirement is tested and every risk is controlled, live, from the work you already do.

Comment

Inspiration

Software in medical devices is regulated (IEC 62304, ISO 14971, FDA design controls). Before every audit, teams rebuild a traceability matrix by hand: requirements ↔ risks ↔ tests. It takes weeks, and it's wrong the moment someone edits a requirement. The classic audit finding, "requirement changed after verification", is almost impossible to spot in a spreadsheet. We wanted the evidence to keep itself up to date.

What it does

Trace turns plain Jira issues into live audit evidence:

  • Audit readiness score per project, with every gap explained and the fix spelled out.
  • Seven auditor rules: untested, failing, unverified and changed-after-verification requirements; uncontrolled risks; unverified risk controls; orphan tests. High-severity hazards escalate to blockers.
  • Traceability matrix and risk-control table in a Jira project page, plus a trace panel on every issue.
  • One-click fixes: a linked Jira task per gap, never duplicated.
  • One-click documentation: publishes the Design History File traceability page to Confluence.
  • Trace Auditor (Rovo agent): ask "Is GLU ready for audit?", "What breaks if we change GLU-4?", "Open tasks for the blocking gaps", "Write the DHF page". Read actions answer instantly; write actions always ask for confirmation.

How we built it

  • Forge app (Runs on Atlassian: no egress, no storage) with UI Kit.
  • Modules: rovo:agent with 4 actions (audit-readiness, trace-issue, create-gap-tasks, generate-dhf), jira:projectPage, jira:issueContext.
  • Jira REST API v3: search/jql with changelog (to detect requirement edits after tests passed), bulk create, issue links, transitions. Confluence REST API v2: pages in storage format with status macros.
  • A pure, unit-tested traceability engine shared by the UI, the agent and the export, so all three always agree.
  • Every call runs asUser(), so Trace never shows or changes anything the user couldn't already.

Challenges we ran into

  • Forge's 25-second limit: loading a realistic demo means dozens of API calls. We split it into idempotent phases with pooled parallel requests, so it's safe to retry or double-click.
  • Search is eventually consistent: issues just created don't show up in JQL right away, so seeding tracks the keys it created instead of searching for them.
  • Staleness without false alarms: linking or commenting changes an issue's updated date, so we read the changelog and only count edits to summary or description.

Accomplishments that we're proud of

A judge can install Trace, click Load demo, and see a medical-device project scored, explained, fixed and documented, end to end in Jira, Confluence and Rovo, in under two minutes.

What we learned

In regulated work the agent has to be trustworthy before it's clever: deterministic rules decide the facts, the AI explains them and proposes actions, and a human approves every change.

What's next

Bitbucket and CI test results as live verification evidence, Teamwork Graph to pull requirements from other tools, baselines per release (fixVersion), and a Marketplace listing for regulated industries (medtech, automotive ISO 26262, aerospace DO-178C).

Share this project:

Updates

Submission history