v0.5.0

v0.5.0 — Protocol-first builds and site form layouts (2026-07)

Two halves of one idea (BYOFW: the sponsor governs the data, sites adapt
the forms that capture it), grounded in CDISC USDM v4 and timed to ICH
M11's adoption as a final guideline (November 2025).

Protocol-first build path (ADR-0012)

• Import a USDM v4 protocol package (JSON; Excel authoring via the
  external usdm4-excel converter is documented) as an immutable,
  versioned protocol artifact
• The compiler derives the build from the protocol: encounters → events
  (with planned timing and visit windows carried as edc: extensions),
  scheduled activities → forms, biomedical concepts → items/codelists
  via a bundled mapping pack curated from the open COSMoS dataset
  (MIT, pinned sha; no CDISC text or runtime CDISC Library dependency)
• A review screen shows the protocol's schedule of activities with
  per-concept resolution status; surrogate/unmatched concepts become
  draft items that must be completed before publish, so published
  builds are always capture-ready
• Publishing runs through the same single build write path as ODM
  import and the visual builder; per-field protocol traceability is
  recorded relationally and in the exported ODM (edc:UsdmRef)
• New guide pages: "Why protocol-first?" (for readers new to USDM/M11)
  and "Protocol import (USDM)" (including authoring the Excel workbook
  properly)

Site form layouts (ADR-0013)

• Sites adapt form layout/workflow per site — regroup, reorder, relabel
  — as append-only-versioned variants that only reference build fields
• Data-equivalence is validated structurally on every edit (exact
  coverage of the governed items, no additions, mandatory flags may
  only strengthen); submission is blocked until clean, so the sponsor's
  approval queue reviews workflow, not data integrity
• Capture through an approved layout pins the variant version while
  every value write keys on canonical build identifiers: captured data
  is byte-identical in shape across sites regardless of layout
• Amendments revalidate approved layouts automatically: equivalent
  layouts carry forward, the rest are marked stale with notifications
  and capture falls back to the standard forms
• New permission site.forms.manage (site-scoped, seeded to the
  coordinator role); sponsor decisions ride study.manage

---

What's Changed

• Start the 0.5.0 development cycle by @tgerke in #78
• Add checked-in docs screenshot generator by @tgerke in #82
• Single-VM production deployment: compose.prod, Caddy TLS, cloud-init, Terraform, Codespaces (ADR-0011) by @tgerke in #79
• Docs: Python workbench coverage + screenshots, em-dash purge, clinical-stack cross-links by @tgerke in #81
• eTMF filing: push study builds and snapshot manifests to an eTMF (ctms-core reference) by @tgerke in #80
• Add workbench-python shot to docs screenshot generator by @tgerke in #83
• Add @edc-core/usdm: USDM v4 model, parser, validator, and SoA graph helpers by @tgerke in #84
• Add bundled BC mapping pack and resolver by @tgerke in #85
• Compile USDM protocols into ODM study builds by @tgerke in #86
• Add protocol storage, compilation review, and publish API by @tgerke in #87
• Restore pnpm-lock.yaml entry for @edc-core/usdm in apps/api by @tgerke in #88
• Add protocol import and review UI, ADR-0012, and protocol-first docs by @tgerke in #89
• Add the governed data layer and site form variants (BYOFW) by @tgerke in #90
• Add site forms UI: layout editor, approval queue, variant-aware capture by @tgerke in #91
• Integrate site layouts with amendments; ADR-0013 and guide docs by @tgerke in #92

Full Changelog: v0.4.0...v0.5.0

v0.4.0

What's Changed

• Pin R duckdb to 1.4.x to pair with the API's DuckLake catalogs by @tgerke in #63
• Bump versions to 0.4.0 for the next cycle by @tgerke in #61
• Upgrade DuckDB to 1.5.x in lockstep, migrating DuckLake catalogs at boot by @tgerke in #70
• Ship all workspace packages in the API image by @tgerke in #72
• Python workbench sidecar (#65) by @tgerke in #71
• Run API tests against a dedicated test database by @tgerke in #73
• Add the explicit break-the-blind action (#66) by @tgerke in #74
• Make RTSM intake and lab import subject-status aware (#67) by @tgerke in #75
• Replace RTSM panel OID inputs with build-driven pickers (#68) by @tgerke in #76
• Add a kill-switch for UA-strict session binding (#69) by @tgerke in #77

Full Changelog: v0.3.0...v0.4.0

v0.3.0

What's Changed

• Bump versions to 0.3.0 for the next cycle by @tgerke in #57
• Security anomaly detection and review (E6-06) by @tgerke in #58
• Data lifecycle procedures page (E6-01) by @tgerke in #59
• Docs: refresh all screenshots and close feature-coverage gaps by @tgerke in #60

Full Changelog: v0.2.0...v0.3.0

v0.2.0

What's Changed

• Bump versions to 0.2.0 for the next cycle by @tgerke in #44
• Fix flaky notifications test: scope overdue scan to the fixture study by @tgerke in #45
• RTSM integration part 1: study-scoped API keys (machine auth) by @tgerke in #46
• RTSM integration part 2: assignment intake, config, events log, and UI by @tgerke in #47
• User administration part 1: account lifecycle and password self-service by @tgerke in #48
• User administration part 2: study team management and re-grant fix by @tgerke in #49
• Subject lifecycle: screening, screen-fail, withdraw, complete, reinstate by @tgerke in #50
• Session binding and structured access logging (P11-14) by @tgerke in #51
• Deployment guide: GDPR/HIPAA hosting, encryption, backups, retention (DP-02) by @tgerke in #52
• Production web image: static nginx build (closes #53) by @tgerke in #54
• Opt-in EDC_TRUST_PROXY for real client IPs behind reverse proxies (closes #55) by @tgerke in #56

Full Changelog: v0.1.0...v0.2.0

v0.1.0

What's Changed

• Phase 1 (part 1): core data model + append-only audit enforcement by @tgerke in #20
• Phase 1 (part 2): authentication + study-scoped RBAC by @tgerke in #21
• Phase 2 (part 1): ODM v2.0 parser + versioned study-build import/export by @tgerke in #22
• Phase 2 (part 2): study builder UI by @tgerke in #23
• Phase 3 (part 1): capture API + entry-workflow state machine by @tgerke in #24
• Phase 3 (part 2): capture UI — subject matrix + data entry by @tgerke in #25
• Phase 3 (part 3): JSONata edit checks + auto-query lifecycle by @tgerke in #26
• Land Phase 3 (part 3): rules engine into main by @tgerke in #27
• Phase 5: DuckLake snapshots, exports, SQL + R analytics workbench by @tgerke in #29
• Land Phases 4 + 5 into main by @tgerke in #30
• Phase 6: study archive, validation pack, demo study, GHCR release — v0.1.0 by @tgerke in #31
• Docs: v0.1.0 doc refresh + Quarto user guide on GitHub Pages by @tgerke in #32
• Point-and-click form editing in the study builder by @tgerke in #33
• Repeating item-group entry with per-occurrence checks and queries by @tgerke in #34
• ODM 1.3.2 import shim by @tgerke in #35
• Per-subject PDF casebooks by @tgerke in #36
• OIDC SSO + roadmap update by @tgerke in #37
• Mid-study amendment migration by @tgerke in #39
• Role-based item blinding by @tgerke in #40
• Notifications: in-app inbox + optional SMTP email by @tgerke in #41
• Lab data import: central-lab CSV batches onto eCRF forms by @tgerke in #42
• Medical coding (MedDRA/WHODrug) by @tgerke in #43

Full Changelog: https://github.com/tgerke/edc-core/commits/v0.1.0