SS DRAFT - Attachment 7 - Draft SOO QUALITY ASSURANCE SURVEILLANCE PLAN.pdf

DRAFT DOCUMENT

QUALITY ASSURANCE SURVEILLANCE PLAN

STATEMENT OF OBJECTIVES

Software Development and Technical Support

1.0 Purpose

This section details the Government's specific surveillance methods and processes used to evaluate Contractor compliance. To ensure execution aligns with modern agile and high-performance computing best practices, traditional milestone-based document reviews are replaced with continuous integration validations, live demonstrations, and automated static code quality analysis.

This Quality Assurance Surveillance Plan (QASP) provides a systematic surveillance method to evaluate Contractor performance under the Software Development and Technical Services (SDTS) contract. The Contractor is responsible for management and quality control actions to meet the terms of the agreement; the Government is responsible for monitoring Contractor performance to ensure the mission to develop and maintain science enabling software infrastructure and HPC environments is achieved.

2.0 Performance Standards and Evaluation Framework

The Contractor's performance will be evaluated against the highly complex demands of the Modeling Systems Division (MSD), focusing on the Flexible Modeling System (FMS), the FMS Runtime Environment, data services, and the Model Diagnostics Taskforce Framework.

2.1 Agile Software Development and Model Integration Surveillance

● Standard: TStandard: The Contractor must facilitate the collaborative, modular development of FMS and component models (e.g., MOM6, FV3) using a capacity-based, agile sprint model. To ensure delivery is incremental and does not stall development, traditional document-heavy design reviews (e.g., Preliminary and Critical Design Reviews) are replaced by recurring agile ceremonies.

● Surveillance Method: The Government Contracting Officer's Representative (COR) and MSD Lead will evaluate performance through the following mechanisms:

a. Interactive Sprint Reviews: Direct observation of live, working software demonstrations at the end of every sprint cycle to verify that delivered features meet scientific requirements and end-user needs.

b. CI/CD Pipeline Validation: Objective verification that 100% of code integrated into the main repository passes the automated hierarchical testing pipeline (HSD) with zero regression failures. DRAFT

c. Definition of Done Verification: Prior to accepting a completed iteration, the Government Product Owner will audit the sprint backlog to confirm that every delivered user story meets 100% of the agreed-upon 'Definition of Done' criteria (including automated unit test coverage, documentation updates, and security scanning).

2.2 Software Quality and Technical Debt Control Surveillance

● Standard: The Contractor is contractually obligated to proactively manage and remediate “Technical Debt” (including code smells, unoptimized algorithms, outdated libraries, and security vulnerabilities) to prevent long-term codebase degradation. Sound software engineering principles and continuous refactoring must be integrated directly into the team’s sustainable development pace.

● Surveillance Method: The MSD Lead will perform monthly, objective health reviews utilizing automated static code analysis tools (such as SonarQube) integrated directly into the NOAA build pipeline. Surveillance will focus on:

a. Remediation Cost and Effort: Evaluating the estimated developer hours required to repay newly introduced technical debt against the Contractor's committed refactoring sprint capacity.

b. Quality Rating Consistency: Ensuring that automated scan metrics (maintainability, security, and reliability) do not slip below the established “Grade A” baseline, verifying that at least 15% of sprint capacity is spent on refactoring.

2.3 Requirements Traceability and Tool Alignment Surveillance

● Standard: To prevent unapproved “scope creep” and ensure federal funds align with organizational commitments, the Contractor must maintain absolute, bi-directional traceability across all software requirements.

● Surveillance Method: The Government Product Owner and COR will perform routine, random audits of the shared Application Lifecycle Management (ALM) tool. Verbal or unmapped developer tasks are strictly prohibited. The Government will verify that 100% of active sprint backlog tasks trace cleanly back to parent Epics, Releases, and strategic NOAA milestones, ensuring total data transparency across the integrated project team.

2.4 Data Services and Reproducibility Surveillance

● Standard: The Contractor must ensure metadata cataloging via the GFDL Curator and public dataset distribution via the GFDL Data Portal are fully operational, secure, and maintainable. Model execution via the FMS Runtime Environment (FRE) must achieve absolute scientific reproducibility.

● Surveillance Method: The Government will verify end-to-end data management from initial model configuration to archived datasets, performing quarterly audits of FRE workflows, scientific peer reviews, and metadata query accuracy to ensure scientific information is completely retrievable, verifiable, and secure. DRAFT

2.5 Responsiveness to Unpredictable Requirements

● Standard: The Contractor must execute rapid surge capacity to support scientific inquiries, physical facility emergencies, or security vulnerability threat remediation that is not well-defined or predictable in advance.

● Surveillance Method: The COR and Government Leads will evaluate resource allocation and Contractor agility quarterly. Surveillance will assess the Contractor's response times during emergency data center events, adherence to the 15-minute critical ticket acknowledgment SLA, and the ability to dynamically stand up surge sprint teams (CLIN 0002) within 2 business days of notification.

2.6 Personnel Management (Recruitment, Supervision, and Retention)

● Standard: The Contractor must actively recruit, thoroughly supervise, and aggressively retain highly specialized scientific and engineering staff. Contractor personnel must be seamlessly integrated into GFDL's collaborative blended workforce environment, maintaining high morale and institutional stability.

● Surveillance Method: The Government will evaluate the Contractor's personnel management through Monthly Progress Reports, staffing reports, and quarterly reviews.

Surveillance will focus on vacancy fill rates (verifying that vacant positions are filled within 30 calendar days), annual staff turnover metrics (target below 15%), and the quality of on-site supervisory oversight to ensure uninterrupted mission support.

2.7 Workforce Conduct, Compliance, and Safety

● Standard: Contractor personnel shall display a highly professional demeanor, comply with security processing and identification mandates, adhere to authorized telework agreements (including the mandatory 3 days/week on-site requirement), follow data center attire standards (including closed-toe shoes and ESD protection), and maintain 100% compliance with OSHA safety regulations and immediate mishap reporting protocols.

● Surveillance Method: The Government will monitor compliance through direct COR and TPOC observation, routine physical inspections of Computer Operations and mechanical areas, and facility badge swipe audits. Any safety infraction, unauthorized telework deviation, or conduct issue will be documented immediately; the Contractor must remediate the deficiency or provide a replacement candidate within 24 hours of notification. DRAFT