bryan-basg/samd-starter-kit

**English · Español**
Quickstart · Getting started · The 12 agents · Design History File · Worked example · Contributing
---
This kit distills the experience of a real SaMD Class B project: a team of specialized AI agents, the compliance ruleset, multi-agent workflows, the persistent memory structure, and a complete regulatory Design History File (DHF) — all generalized into ready-to-adapt templates.
This repository is **not an application**. It is the **scaffolding and methodology** so that you (and your AI coding agent, such as Claude Code) can start a SaMD from scratch without reinventing the compliance, testing, and traceability process that **IEC 62304 + ISO 14971** demand.
60-second quickstart
**Then open GETTING_STARTED.md** — the guided path: classify your software (A/B/C), fill the four foundation documents in order, wire your stack, and learn the daily loop with the agent team. It tells you which of the 50+ documents actually apply to *your* class, so you don't drown in templates.
Who is this for?
- **A solo founder or startup** building health software who doesn't want to discover regulatory compliance the hard way.
- **A medtech / medical-device company** that wants a ready process scaffold (IEC 62304 + ISO 14971) with traceability by design.
- **Teams working with AI agents** (Claude Code) who want a crew of specialists with the SaMD rules pre-loaded.
What's inside
| Piece | Path | What it is |
|---|---|---|
| **Agent ruleset** | CLAUDE.md | The **core**: "Rule 0" (SaMD is the absolute priority) + how the agent works, empathy, boy scout, impact analysis and block closure. |
| **Per-layer rules** | .claude/rules/ | The rest of the ruleset, split in eight: four **path-scoped** (backend, clinical UX, testing, CI) that load only when that layer is touched, and four cross-cutting (orchestration, agents, commands, parallel sessions). |
| **Team of 12 agents** | .claude/agents/ | Per-layer specialists: backend, frontend, clinical-algorithms, db-architect, cloud-ops, qa-mutation, e2e-integration, security-samd, samd-audit-trace, docs-dhf, i18n-translations, mobile-native. |
| **Command + skill** | .claude/commands/, .claude/skills/ | samd-trace: impact analysis (§5.6) before declaring anything "fixed". |
| **Multi-agent workflow** | .claude/workflows/ | samd-review: diff review across risk dimensions with adversarial verification. |
| **Development protocol** | .agents/workflows/ | Agent-agnostic mirror of the stable process. |
| **Memory** | memory/MEMORY.md | The agent's persistent memory structure. |
| **Example RFCs** | docs/05_design_decisions/RFC-001..003 | Three real SaMD decisions already written (encryption at rest, JWT-only identity, external scheduler). |
| **Design History File** | docs/ | 40+ regulatory & process templates: ISO 14971, SaMD traceability, IEC 62304 plan, safety classification, SOUP, clinical evaluation/validation, post-market, IFU, user docs, privacy, runbooks. |
| **Working CI/CD** | .github/workflows/ | 15 workflows — 11 inheritable gates (CI, security via Trivy+Semgrep, mutation via Stryker, API fuzz via schemathesis, DAST via OWASP ZAP, SBOM, Postgres tier, OpenAPI contract-drift, project-state audit, stale PRs, deploy template) + 4 kit-maintenance (docs, quality gates, placeholder guard, release). Reference stack: React+TS / Python+FastAPI. |
| **Runnable skeleton** | app/ · frontend/ · tests/ | A minimal FastAPI + React/TS example wiring the hard rules (token-only identity, AES-256-GCM at rest, fail-safe, flat accessible UI). Runs with zero infra: pytest 16/16, vitest 5/5. Delete it when you bring your own app. |