Lifecycle, program, automation, documentation, and governance surfaces.
WorkspaceSynorthopic / platform map
Orthopaedic lifecycle operations
Close the operational loop around implanted hardware without inventing a clinical decision.
A staff-first exception and automation layer for lifecycle evidence, documentation, access, coordination, and governance. Existing product routes remain intact; this manifest only composes them.
- Composition
- Manifest, not UI fork
- Review model
- Automatic preparation · one final human review
- Modules
- 6 bounded contracts
Concept0Documented boundary only
Synthetic demo1Fictional or de-identified fixtures
Implemented5Tested code path; no live-system claim
Sandbox or higher0No higher state without dated external evidence
Shared architecture
One shell around independent engines
01 · sourcesFHIR · HL7 · documents · PACS metadata
→02 · normalizeIdentity, provenance, and evidence contracts
→03 · headless coreLifecycle and operations rule engines
→04 · reviewed outputCited exception · reviewed handoff
Capability composition
Module ledger
Role-aware presentation
Same engine state, different decisions
Exceptions, cited evidence, planning readiness, and the final clinical boundary.
Workflow metrics are not imaging interpretations or treatment recommendations.Bounded preparation completes before a final human decision surface.
The manifest exposes no clinical write capability.
Connection truth
Code, connection, and authorization are separate states
This ledger covers the public repository only. Implemented means a tested local code path—not a sandbox result, customer connection, clinical validation, or production authorization.
Implemented12Tested local code paths
Concept8Documented boundaries only
Sandbox or higher0Dated external proof required
Live customer connections0No configuration-inferred status
External writes0Production authorization required
Device identityImplemented
AccessGUDID device identity lookup
A patient-free, credential-free, read-only AccessGUDID lookup is implemented; registry identity does not prove patient use.
- Standard
- NLM AccessGUDID Device Lookup API
- Version
- API v3
- Current runtime
- Public read-only
- Direction
- Read
Current boundary
A public registry match can enrich device identity; it cannot establish that the device was implanted in a patient or support a clinical decision.
Local evidence
- Conservative device-identifier normalization
- Bounded same-origin proxy with one credential-free upstream GET
- Exact returned-identifier verification
- Timeout, redirect, content-type, and byte limits
Still required
- mapping and conformance
- positive control canary
- monitoring and rollback
CommunicationsConcept
Administrative reminder calendar
A calendar adapter boundary is documented; no customer calendar is connected and no reminder is created.
- Standard
- Customer-approved calendar API
- Version
- Customer-specific
- Current runtime
- Not connected
- Direction
- Write
Current boundary
No calendar transport, customer identity mapping, reminder creation, patient contact, or appointment booking is implemented.
Local evidence
- Human-reviewed reminder intent contract
Still required
- customer registration
- customer endpoint configuration
- least privilege authorization
- mapping and conformance
- positive control canary
- privacy security approval
- clinical operational approval
- monitoring and rollback
PayerConcept
Claim status exchange
A claim-status adapter boundary is documented; no payer or clearinghouse status exchange is implemented.
- Standard
- X12 276/277 or approved clearinghouse API
- Version
- Customer-licensed implementation guide
- Current runtime
- Not connected
- Direction
- Request / response
Current boundary
No clearinghouse or payer endpoint is connected; synthetic status labels are not payer responses.
Local evidence
- Claim-status handoff contract
Still required
- customer registration
- customer endpoint configuration
- least privilege authorization
- mapping and conformance
- positive control canary
- data completeness study
- privacy security approval
- clinical operational approval
- monitoring and rollback
PayerConcept
Coder-approved claim handoff
A claim-handoff boundary is documented; Synorthopic performs zero claim or clearinghouse submissions.
- Standard
- X12 837 or customer billing-system contract
- Version
- Customer-licensed implementation guide
- Current runtime
- Not connected
- Direction
- Write
Current boundary
No claim creation, charge posting, clearinghouse submission, correction, or account adjustment is implemented.
Local evidence
- Evidence-ID-only coding handoff
Still required
- customer registration
- customer endpoint configuration
- least privilege authorization
- mapping and conformance
- positive control canary
- privacy security approval
- clinical operational approval
- monitoring and rollback
Device identityImplemented
Customer implant catalog
A fingerprinted patient-free catalog contract is implemented; no customer catalog is loaded or verified in this release.
- Standard
- Synorthopic customer catalog artifact
- Version
- v1
- Current runtime
- Local exchange only
- Direction
- Local exchange
Current boundary
The public release includes only a fictional example; no customer catalog is loaded or approved.
Local evidence
- Strict catalog schema validation
- Exact identifier matching
- Artifact fingerprint inspection
- No patient data in catalog records
Still required
- customer registration
- mapping and conformance
- positive control canary
- privacy security approval
- clinical operational approval
- monitoring and rollback
ImagingConcept
DICOMweb planning handoff
A DICOMweb planning-handoff boundary is documented; no PACS or planning system is connected.
- Standard
- DICOM PS3.18 DICOMweb
- Version
- Customer conformance statement required
- Current runtime
- Not connected
- Direction
- Request / response
Current boundary
No PACS connection, image retrieval, image interpretation, implant sizing, trajectory, approach, or surgical plan is implemented.
Local evidence
- Planning-source manifest contract
- Surgeon question contract
Still required
- customer registration
- customer endpoint configuration
- least privilege authorization
- mapping and conformance
- positive control canary
- data completeness study
- privacy security approval
- clinical operational approval
- monitoring and rollback
EHR readImplemented
Customer EHR chart navigation
A customer-private chart-navigation broker is implemented; no customer chart link is configured or live-verified.
- Standard
- Customer-approved chart-link broker
- Version
- Customer-specific
- Current runtime
- Not connected
- Direction
- Read
Current boundary
The broker contract is implemented, but no customer chart-link configuration or live navigation has been verified.
Local evidence
- Encrypted patient anchor at rest
- Human POST redirect
- Navigation audit event
Still required
- customer registration
- customer endpoint configuration
- least privilege authorization
- mapping and conformance
- positive control canary
- data completeness study
- privacy security approval
- clinical operational approval
- monitoring and rollback
EHR readConcept
Enterprise document repository
An enterprise-document adapter boundary is documented; no customer repository is connected.
- Standard
- Customer-approved document repository API
- Version
- Customer-specific
- Current runtime
- Not connected
- Direction
- Request / response
Current boundary
No SharePoint, Box, Drive, or other enterprise document tenant is connected.
Local evidence
- Document reference and attachment-manifest contracts
Still required
- customer registration
- customer endpoint configuration
- least privilege authorization
- mapping and conformance
- positive control canary
- privacy security approval
- clinical operational approval
- monitoring and rollback
Audit & observabilityImplemented
External immutable audit destination
An external audit-sink contract and patient-free probe are implemented; no customer sink is configured or verified.
- Standard
- Customer-controlled append-only audit sink
- Version
- v1 contract
- Current runtime
- Not connected
- Direction
- Write
Current boundary
The sink and probe interfaces are implemented, but no external destination, schedule, monitoring, or independent archive is loaded.
Local evidence
- Patient-free destination probe
- Monotonic export sequence
- HMAC cursor integrity
- Retry-safe export contract
Still required
- customer registration
- customer endpoint configuration
- least privilege authorization
- mapping and conformance
- positive control canary
- privacy security approval
- clinical operational approval
- monitoring and rollback
EHR writeImplemented
Human-approved FHIR administrative Task
A human-gated FHIR Task write contract is implemented and synthetic-tested; external EHR writes are disabled.
- Standard
- HL7 FHIR R4 Task customer profile
- Version
- FHIR 4.0.1; customer profile required
- Current runtime
- Synthetic only
- Direction
- Write
Current boundary
The write path is exercised only with synthetic transports; public and read-only deployments enable no EHR writes.
Local evidence
- Human approval capability gate
- Conditional create and idempotency
- Read-after-write verification
- Aggregate receipt only
Still required
- customer registration
- customer endpoint configuration
- least privilege authorization
- mapping and conformance
- positive control canary
- privacy security approval
- clinical operational approval
- monitoring and rollback
EHR readImplemented
FHIR Bulk Data cohort discovery
A resumable FHIR Bulk Data client is implemented and synthetic-tested; no customer export is connected or verified.
- Standard
- HL7 FHIR Bulk Data Access
- Version
- STU 2.0.0 / FHIR R4
- Current runtime
- Synthetic only
- Direction
- Read
Current boundary
Only synthetic Group and NDJSON transports are verified; no customer Bulk Data endpoint or cohort has been used.
Local evidence
- Group export discovery
- Manifest allowlisting and HMAC binding
- Bounded NDJSON processing
- Encrypted resumable checkpoints
- Pause on patient-read failure
Still required
- customer registration
- customer endpoint configuration
- least privilege authorization
- mapping and conformance
- positive control canary
- data completeness study
- privacy security approval
- clinical operational approval
- monitoring and rollback
EHR readImplemented
HL7 event ingestion
An allowlisted HL7 event consumer is implemented for synthetic traffic; no hospital feed is connected or verified.
- Standard
- Customer-profiled HL7 v2 event feed
- Version
- Customer-specific
- Current runtime
- Synthetic only
- Direction
- Read
Current boundary
The hosted route accepts only explicitly attested synthetic traffic; no hospital HL7 feed or production interface is connected.
Local evidence
- Signed webhook validation
- Tenant partitioning
- Replay and duplicate suppression
- Encrypted synthetic payload handling
- Dead-letter and retry contracts
Still required
- customer registration
- customer endpoint configuration
- least privilege authorization
- mapping and conformance
- positive control canary
- data completeness study
- privacy security approval
- clinical operational approval
- monitoring and rollback
CodingImplemented
Synorthopic human coding review handoff
A de-identified evidence-linked coding handoff is implemented; a qualified human selects every final code.
- Standard
- Synorthopic evidence-ID-only coding handoff
- Version
- orthoscrub.synoptic-coding-handoff.v1
- Current runtime
- Local exchange only
- Direction
- Local exchange
Current boundary
The handoff is a local de-identified artifact; no coding system, EHR charge router, or billing system is connected.
Local evidence
- Evidence-ID-only serialization
- Documentation-gap separation
- Human final-code authority
- No licensed descriptors
Still required
- customer registration
- mapping and conformance
- positive control canary
- privacy security approval
- clinical operational approval
- licensed content authorization
- monitoring and rollback
PayerConcept
Eligibility and benefits exchange
An eligibility adapter boundary is documented; no clearinghouse or payer eligibility connection is implemented.
- Standard
- X12 270/271 or approved eligibility API
- Version
- Customer-licensed implementation guide
- Current runtime
- Not connected
- Direction
- Request / response
Current boundary
No eligibility request is transmitted and no displayed synthetic benefit state is a coverage verification or guarantee.
Local evidence
- Eligibility request and response domain contract
Still required
- customer registration
- customer endpoint configuration
- least privilege authorization
- mapping and conformance
- positive control canary
- data completeness study
- privacy security approval
- clinical operational approval
- monitoring and rollback
PayerConcept
Prior-authorization evidence exchange
Prior-authorization packet preparation is local; no payer transport, policy service, submission, or response integration is implemented.
- Standard
- Da Vinci CRD/DTR/PAS/CDex or X12 278
- Version
- PAS 2.2.1; customer-profiled companion guides
- Current runtime
- Not connected
- Direction
- Request / response
Current boundary
Local packet preparation does not implement payer policy retrieval, attestation, submission, response, or medical-necessity determination.
Local evidence
- Criterion-by-criterion evidence matrix
- Documentation-gap detection
- Attachment manifest
- Human submission gate
Still required
- customer registration
- customer endpoint configuration
- least privilege authorization
- mapping and conformance
- positive control canary
- privacy security approval
- clinical operational approval
- monitoring and rollback
EHR readImplemented
SMART Backend Services read
A least-privilege SMART Backend Services client is implemented and synthetic-tested; no customer connection is registered or verified.
- Standard
- SMART Backend Services + FHIR R4
- Version
- SMART App Launch 2.2.0
- Current runtime
- Synthetic only
- Direction
- Read
Current boundary
Only asymmetric synthetic transports are verified; no customer client registration, signing key, cohort, or live read exists.
Local evidence
- Private-key JWT assertion
- RS384 and ES384 signing profiles
- Exact scope allowlist
- Short-lived token validation
- Bounded patient and cohort reads
Still required
- customer registration
- customer endpoint configuration
- least privilege authorization
- mapping and conformance
- positive control canary
- data completeness study
- privacy security approval
- clinical operational approval
- monitoring and rollback
EHR readImplemented
SMART interactive chart-context read
A read-only SMART chart-context flow is implemented and synthetic-tested; no customer EHR is registered, connected, or verified.
- Standard
- SMART App Launch + FHIR R4
- Version
- SMART App Launch 2.2.0
- Current runtime
- Synthetic only
- Direction
- Read
Current boundary
The authorization and read path is synthetic-tested; no customer app registration, credentials, chart launch, or live FHIR read exists.
Local evidence
- Authorization Code with PKCE S256
- State, issuer, redirect, and replay checks
- Read-only scope enforcement
- Bounded token and FHIR response handling
Still required
- customer registration
- customer endpoint configuration
- least privilege authorization
- mapping and conformance
- positive control canary
- data completeness study
- privacy security approval
- clinical operational approval
- monitoring and rollback
CodingImplemented
Private SpineCPT candidate handoff
A patient-free private SpineCPT handoff contract is implemented; the licensed engine is not bundled, connected, or publicly verified.
- Standard
- Synorthopic SpineCPT private-provider contract
- Version
- lookup request/response v1
- Current runtime
- Local exchange only
- Direction
- Local exchange
Current boundary
No SpineCPT source, license key, terminology library, live service, or proprietary descriptor is present in this repository.
Local evidence
- Patient-free request schema
- Request-bound response validation
- Candidate and file-size limits
- Licensed-content rejection
- Human final-code authority
Still required
- customer registration
- mapping and conformance
- positive control canary
- privacy security approval
- clinical operational approval
- licensed content authorization
- monitoring and rollback
CommunicationsConcept
Workforce review notifications
A workforce-notification boundary is documented; no customer channel is connected and no message is sent.
- Standard
- Customer-approved messaging or email API
- Version
- Customer-specific
- Current runtime
- Not connected
- Direction
- Write
Current boundary
No Teams, Slack, email, SMS, voice, or other notification channel is connected; no patient outreach is permitted.
Local evidence
- Human-reviewed notification intent contract
Still required
- customer registration
- customer endpoint configuration
- least privilege authorization
- mapping and conformance
- positive control canary
- privacy security approval
- clinical operational approval
- monitoring and rollback
Identity & accessImplemented
Customer workforce OIDC
A tenant-bound workforce OIDC and server-side session contract is implemented; no customer identity provider is connected or live-verified.
- Standard
- OpenID Connect Core 1.0 + Authorization Code with PKCE
- Version
- OIDC Core 1.0
- Current runtime
- Not connected
- Direction
- Request / response
Current boundary
The OIDC and session contracts are implemented, but no customer identity provider, client registration, login, or session lifecycle is mounted or verified.
Local evidence
- Authorization Code and PKCE S256
- Issuer, audience, nonce, state, and browser binding
- Encrypted one-time login transaction
- Server-side idle and absolute session expiry
- Actor revocation
Still required
- customer registration
- customer endpoint configuration
- least privilege authorization
- mapping and conformance
- positive control canary
- privacy security approval
- clinical operational approval
- monitoring and rollback
Automation truth
Models, deterministic checks, and action authority are separate states
This ledger records the public repository release. Implemented means tested code exists; it does not mean a model is enabled, customer data is allowed, performance is validated, or the software may act externally.
Generative boundaries4Untrusted proposal paths
Deterministic engines15Extractors, verifiers, rules, and policies
Enabled model calls0Public release truth
Customer data enabled0Requires customer proof
External actions0Production authorization required
Online learning0Prohibited by current policy
Orchestration policyImplemented
Customer review routing policy
A deterministic review-routing policy is implemented and locally tested; it does not make or record a clinical or administrative disposition.
- Contract
- orthoscrub.customer-review-agent-plan.v1
- Engine
- Repository deterministic code
- Identifier
- customer-review-agent
- Current runtime
- Local deterministic
- Release decision
- local deterministic only
- Test dataset
- customer-review-agent-synthetic-fixtures.v1
Human gate
An authorized human reviewer makes and records the final disposition outside this policy.
Inspect controls and operating envelope
Deterministic checks
- Exact contract and enum validation
- Fixed route selection
- Public registry facts remain untrusted
Abstains when
- Source conflict
- Evidence gap
- Unsupported identity state
Prohibited actions
- Recording a disposition
- Closing a chart
- Writing to an EHR
- Promoting public data into chart truth
Evaluation state
- Subgroups: not applicable
- Overrides: local test only
- Incidents: not established
- Rollback: Use the existing human review queue without the generated route.
Generative proposalImplemented
GuidedLoop source-field proposal model
An archived, de-identified proposal boundary is implemented; public model invocation is disabled and no proposal becomes a trusted field automatically.
- Contract
- guidedloop.source-compiler.v1
- Engine
- OpenAI API boundary
- Identifier
- gpt-5.6-luna deployment default
- Current runtime
- Research archive
- Release decision
- research archive only
- Test dataset
- guidedloop-deidentified-synthetic-fixtures.v2
Human gate
A human explicitly accepts each verified field before record creation.
Inspect controls and operating envelope
Deterministic checks
- Direct-identifier rejection before invocation
- API key plus explicit de-identified processing gate required
- Shared client bounds configuration, request and response bytes, redirects, content type, timeout, and failures
- Tool-free structured output
- Shared source-level instruction quarantine before candidate acceptance
- Exact quote and substring verification after response
Abstains when
- Direct identifier detected
- Unsupported field
- Missing exact quote
Prohibited actions
- Calculating dates not stated in source
- Clinical inference
- External tools or actions
- Processing directly identified text
Evaluation state
- Subgroups: not established
- Overrides: local test only
- Incidents: not established
- Rollback: Use the deterministic offline parser or manual GuidedLoop entry.
Deterministic verifierImplemented
GuidedLoop exact-quote verifier
A deterministic exact-quote verifier is implemented for the archived GuidedLoop workflow; it does not establish clinical truth.
- Contract
- guidedloop.source-compiler.v1
- Engine
- Repository deterministic code
- Identifier
- guided-loop-extraction-verifier
- Current runtime
- Research archive
- Release decision
- research archive only
- Test dataset
- guidedloop-deidentified-synthetic-fixtures.v1
Human gate
A human accepts a verified candidate before it becomes a lifecycle field.
Inspect controls and operating envelope
Deterministic checks
- Allowed field
- Verbatim quote
- Value substring
- Explicit date format
Abstains when
- Quote mismatch
- Value mismatch
- Ambiguous or calculated date
Prohibited actions
- Inferring a missing fact
- Creating a lifecycle record
- External action
Evaluation state
- Subgroups: not applicable
- Overrides: local test only
- Incidents: not established
- Rollback: Discard candidates and use manual GuidedLoop entry.
Scoring analysisImplemented
Hardware attribution shadow rules
A locked, evaluation-only hardware attribution ruleset is locally tested; it cannot change operational or patient state.
- Contract
- orthoscrub.orthopaedic-site-rules.v1
- Engine
- Repository deterministic code
- Identifier
- orthoscrub.orthopaedic-site-rules.v1
- Current runtime
- Research archive
- Release decision
- research archive only
- Test dataset
- hardware-attribution-shadow-synthetic-v1
Human gate
Results are available only for research review and never enter the operational queue.
Inspect controls and operating envelope
Deterministic checks
- Locked patterns
- Specificity ordering
- Exact laterality safeguards
Abstains when
- Ambiguous site
- Missing laterality
- Conflicting evidence
Prohibited actions
- Assigning a patient device
- Changing inventory
- Writing to an EHR
Evaluation state
- Subgroups: not established
- Overrides: local test only
- Incidents: not established
- Rollback: Disable shadow analysis; retain exact-site production safeguards.
Deterministic extractorImplemented
Hardware lifecycle language rules
Deterministic lifecycle-language rules are implemented and synthetic-tested; they do not infer treatment need or clinical state.
- Contract
- orthoscrub.hardware-lifecycle-language.v1
- Engine
- Repository deterministic code
- Identifier
- hardware-lifecycle-language
- Current runtime
- Synthetic fixture
- Release decision
- local demo only
- Test dataset
- hardware-lifecycle-language-synthetic-v1
Human gate
A reviewer sees the exact source quote before accepting lifecycle evidence.
Inspect controls and operating envelope
Deterministic checks
- Locked phrases
- Negation handling
- Explicit YYYY-MM-DD dates only
Abstains when
- Negated language
- Uncertain phrasing
- No explicit lifecycle statement
Prohibited actions
- Inferring intent
- Recommending removal
- Closing follow-up
Evaluation state
- Subgroups: not applicable
- Overrides: local test only
- Incidents: not established
- Rollback: Display the source without lifecycle-language flags.
Deterministic rulesetImplemented
Hardware review resolution rules
Fixed review-reason and next-evidence rules are implemented and synthetic-tested; final resolution remains human-owned.
- Contract
- orthoscrub.hardware-review-resolution.v1
- Engine
- Repository deterministic code
- Identifier
- hardware-review-resolution
- Current runtime
- Synthetic fixture
- Release decision
- local demo only
- Test dataset
- hardware-review-resolution-synthetic-v1
Human gate
A human reviewer selects and records the final resolution.
Inspect controls and operating envelope
Deterministic checks
- Closed reason enum
- Closed task enum
- Valid reason-task pairing
Abstains when
- Unsupported reason-task pair
- Invalid reconciliation contract
Prohibited actions
- Final disposition
- Chart closure
- EHR write
- Patient contact
Evaluation state
- Subgroups: not applicable
- Overrides: local test only
- Incidents: not established
- Rollback: Return the case to the unclassified human review queue.
Generative proposalImplemented
Hardware source-evidence proposal model
A bounded hardware proposal-provider contract is implemented; model invocation is disabled in the public release and every candidate requires deterministic and human review.
- Contract
- orthoscrub.hardware-reconciliation.v2
- Engine
- OpenAI API boundary
- Identifier
- gpt-5.6-terra deployment default
- Current runtime
- Not enabled
- Release decision
- disabled in public release
- Test dataset
- hardware-scrub-messy-synthetic-fixtures.v6
Human gate
A human reviews reverified candidates before any accepted review record exists.
Inspect controls and operating envelope
Deterministic checks
- Source, batch, quote, and candidate limits
- API key plus explicit de-identified processing gate required
- Shared client bounds configuration, request and response bytes, redirects, content type, timeout, and failures
- Tool-free structured output
- Shared source-level instruction quarantine before candidate acceptance
- Exact quote and value verification after response
Abstains when
- Missing source quote
- Unsupported field
- Source conflict
- Input over limit
Prohibited actions
- Creating a trusted fact
- Clinical recommendation
- Patient contact
- EHR or payer action
Evaluation state
- Subgroups: not established
- Overrides: local test only
- Incidents: not established
- Rollback: Use the deterministic offline extractor and manual evidence selection.
Deterministic verifierImplemented
Hardware source-evidence verifier
A deterministic exact-quote verifier is implemented and synthetic-tested; it verifies source correspondence, not clinical truth.
- Contract
- orthoscrub.hardware-reconciliation.v2
- Engine
- Repository deterministic code
- Identifier
- hardware-source-verifier
- Current runtime
- Synthetic fixture
- Release decision
- local demo only
- Test dataset
- hardware-scrub-messy-synthetic-fixtures.v5
Human gate
A reviewer selects among verified candidates and resolves conflicts.
Inspect controls and operating envelope
Deterministic checks
- Known source
- Allowed field
- Exact quote
- Exact value substring
- Bounded lengths
Abstains when
- Quote mismatch
- Value mismatch
- Unknown source
- Unsupported field
Prohibited actions
- Promoting patient-device association
- Clinical inference
- External action
Evaluation state
- Subgroups: not applicable
- Overrides: local test only
- Incidents: not established
- Rollback: Reject all candidates and require manual source review.
Deterministic rulesetImplemented
Implant identity matching rules
Patient-free identity consolidation and bounded lookup rules are locally tested; registry matches remain untrusted review evidence.
- Contract
- orthoscrub.customer-implant-identity.v1
- Engine
- Repository deterministic code
- Identifier
- customer-implant-identity
- Current runtime
- Local deterministic
- Release decision
- local deterministic only
- Test dataset
- implant-identity-synthetic-fixtures.v1
Human gate
A reviewer decides whether any match is relevant to the supplied chart evidence.
Inspect controls and operating envelope
Deterministic checks
- Patient-free allowlist
- Exact identifier normalization
- Single bounded lookup
- Conflict preservation
Abstains when
- Conflicting chart identity
- Ambiguous catalog matches
- No safe exact lookup key
Prohibited actions
- Sending patient identifiers
- Inferring implantation
- Promoting registry data into chart truth
Evaluation state
- Subgroups: not established
- Overrides: local test only
- Incidents: not established
- Rollback: Disable enrichment and retain only the source-backed chart identity.
Deterministic rulesetImplemented
Implant lifecycle closure rules
Deterministic lifecycle program rules are implemented and synthetic-tested; closure and clinical decisions remain human-owned.
- Contract
- synorthopic.lifecycle-closure-program.v1
- Engine
- Repository deterministic code
- Identifier
- lifecycle-closure-program
- Current runtime
- Synthetic fixture
- Release decision
- local demo only
- Test dataset
- lifecycle-closure-synthetic-program-v1
Human gate
Only a human-selected, evidence-backed disposition may close an episode.
Inspect controls and operating envelope
Deterministic checks
- Closed state enums
- Disposition transition rules
- Identity-tier validation
Abstains when
- Missing human disposition
- Insufficient evidence
- Unsupported transition
Prohibited actions
- Removal recommendation
- Autonomous closure
- Patient contact
- EHR or payer write
Evaluation state
- Subgroups: not applicable
- Overrides: local test only
- Incidents: not established
- Rollback: Return the episode to needs-clinician-review without closure.
Deterministic rulesetImplemented
Limb Relay mobility packet rules
An archived deterministic mobility-packet ruleset is synthetic-tested; it does not create or change clinical instructions.
- Contract
- boast-mobility-2024-prototype / 2024-08
- Engine
- Repository deterministic code
- Identifier
- boast-mobility-2024-prototype
- Current runtime
- Research archive
- Release decision
- research archive only
- Test dataset
- limb-relay-synthetic-packets.v1
Human gate
A clinician reviews the packet against the original postoperative instructions.
Inspect controls and operating envelope
Deterministic checks
- Direct-identifier screening
- Allowed terminology
- Source field correspondence
Abstains when
- Direct identifier detected
- Conflicting instruction
- Unsupported terminology
Prohibited actions
- Generating clinical instructions
- Changing a care plan
- External communication
Evaluation state
- Subgroups: not established
- Overrides: local test only
- Incidents: not established
- Rollback: Use the original postoperative documents without a normalized packet.
Deterministic rulesetImplemented
Operations module assessment rules
Eight deterministic evidence-readiness modules are implemented and synthetic-tested; all downstream decisions and actions remain human-owned.
- Contract
- synorthopic.operations-module-assessment.v1
- Engine
- Repository deterministic code
- Identifier
- orthopedic-operations-modules
- Current runtime
- Synthetic fixture
- Release decision
- local demo only
- Test dataset
- operations-messy-simulation.v1
Human gate
The responsible operational user reviews each prepared output before any downstream action.
Inspect controls and operating envelope
Deterministic checks
- Known evidence types
- Fixed required-evidence maps
- Closed status enum
Abstains when
- Missing required evidence
- Disabled module
- Unsupported evidence type
Prohibited actions
- Clinical decision
- Final coding
- Coverage decision
- Imaging interpretation
- External write
Evaluation state
- Subgroups: not applicable
- Overrides: local test only
- Incidents: not established
- Rollback: Show the verified source checklist without module readiness assessment.
Deterministic extractorImplemented
Messy-source normalization rules
Deterministic messy-source normalization is implemented and synthetic-tested; ambiguity is quarantined rather than inferred away.
- Contract
- synorthopic.operations-source-normalization.v1
- Engine
- Repository deterministic code
- Identifier
- operations-source-normalization
- Current runtime
- Synthetic fixture
- Release decision
- local demo only
- Test dataset
- operations-messy-source-packet.v1
Human gate
Quarantined records and conflicts remain visible for human reconciliation.
Inspect controls and operating envelope
Deterministic checks
- Case binding
- Verification state
- Alias map
- Duplicate rules
- Length and record limits
Abstains when
- Wrong case
- Unverified record
- Conflicting duplicate
- Unknown evidence type
Prohibited actions
- Inventing missing evidence
- Resolving clinical conflict
- Using wrong-case records
Evaluation state
- Subgroups: not applicable
- Overrides: local test only
- Incidents: not established
- Rollback: Discard normalized output and review the original synthetic packet.
Orchestration policyImplemented
Supervised operations run policy
A deterministic supervised-run policy is implemented for synthetic data: preparation is automatic, one final human review remains, and no external action occurs.
- Contract
- synorthopic.operations-supervised-run-bundle.v1
- Engine
- Repository deterministic code
- Identifier
- operations-supervised-run
- Current runtime
- Synthetic fixture
- Release decision
- local demo only
- Test dataset
- operations-supervised-run-synthetic.v1
Human gate
One final human review is required after all automatic preparation stages complete.
Inspect controls and operating envelope
Deterministic checks
- Input contract compatibility
- Verified evidence only
- All eight modules present
- Fixed step order
Abstains when
- Contract mismatch
- Unverified evidence
- Missing module assessment
Prohibited actions
- Intermediate external action
- Automatic final approval
- EHR or payer write
Evaluation state
- Subgroups: not applicable
- Overrides: local test only
- Incidents: not established
- Rollback: Bypass automation and review each module assessment directly.
Deterministic rulesetImplemented
Revenue-cycle preparation rules
Deterministic revenue-cycle preparation is implemented and synthetic-tested; coding, medical necessity, coverage, and submission remain human and external-system responsibilities.
- Contract
- orthoscrub.revenue-cycle-packet.v1
- Engine
- Repository deterministic code
- Identifier
- revenue-cycle-preparation
- Current runtime
- Synthetic fixture
- Release decision
- local demo only
- Test dataset
- revenue-cycle-synthetic-fixtures.v1
Human gate
A qualified coder, biller, or clinician reviews the packet and owns every final decision and submission.
Inspect controls and operating envelope
Deterministic checks
- Evidence-ID citation
- Catalog allowlist
- Candidate and input limits
- Human authority markers
Abstains when
- Missing reviewed evidence
- Unsupported catalog candidate
- Unmet payer evidence
Prohibited actions
- Final coding
- Medical-necessity decision
- Claim or authorization submission
- EHR write
Evaluation state
- Subgroups: not applicable
- Overrides: local test only
- Incidents: not established
- Rollback: Export the reviewed evidence without generated coding or payer preparation.
Generative proposalImplemented
RevisionBoard source-evidence proposal model
An archived de-identified proposal-provider contract is implemented; public model invocation is disabled and outputs cannot become trusted facts automatically.
- Contract
- revisionboard.agent-proposal.v1
- Engine
- OpenAI API boundary
- Identifier
- gpt-5.6-sol deployment default
- Current runtime
- Research archive
- Release decision
- research archive only
- Test dataset
- revisionboard-agentic-synthetic-fixtures.v2
Human gate
A human acceptance request mechanically reverifies every selected fact.
Inspect controls and operating envelope
Deterministic checks
- Shared source-level instruction quarantine before fact or action-nomination acceptance
- Prompt checksum
- API key plus explicit de-identified processing gate required
- Shared client bounds configuration, request and response bytes, redirects, content type, timeout, and failures
- Tool-free structured output
- Post-response exact quote verification
Abstains when
- Prompt injection
- Missing exact quote
- Unsupported fact or action kind
- Input over limit
Prohibited actions
- Diagnosis
- Treatment recommendation
- Patient contact
- Tool use
- External action
Evaluation state
- Subgroups: not established
- Overrides: local test only
- Incidents: not established
- Rollback: Use deterministic research fixtures and manual source review.
Deterministic verifierImplemented
RevisionBoard exact-quote verifier
An archived deterministic source verifier is implemented; it verifies exact correspondence and does not establish clinical truth.
- Contract
- revisionboard.agent-proposal.v1
- Engine
- Repository deterministic code
- Identifier
- agentic-extraction-verifier
- Current runtime
- Research archive
- Release decision
- research archive only
- Test dataset
- revisionboard-agentic-synthetic-fixtures.v1
Human gate
Only a human-selected candidate may be reverified for acceptance.
Inspect controls and operating envelope
Deterministic checks
- Allowed kind
- Named source
- Exact quote
- Exact value
- Explicit observed date
Abstains when
- Quote mismatch
- Value mismatch
- Date mismatch
- Unsupported kind
Prohibited actions
- Inference
- Automatic action
- Clinical recommendation
Evaluation state
- Subgroups: not applicable
- Overrides: local test only
- Incidents: not established
- Rollback: Reject candidates and use manual research annotation.
Generative proposalImplemented
Specimen report proposal model
An archived specimen proposal-provider contract is implemented; public model invocation is disabled and no clinical interpretation is produced.
- Contract
- revisionboard.specimen-ledger.v1
- Engine
- OpenAI API boundary
- Identifier
- gpt-5.6-sol deployment default
- Current runtime
- Research archive
- Release decision
- research archive only
- Test dataset
- specimen-ledger-synthetic-fixtures.v2
Human gate
A human accepts each mechanically verified report event before ledger entry.
Inspect controls and operating envelope
Deterministic checks
- Shared source-level instruction quarantine before candidate acceptance
- API key plus explicit de-identified processing gate required
- Shared client bounds configuration, request and response bytes, redirects, content type, timeout, and failures
- Tool-free structured output
- Exact report-state and quote verification
Abstains when
- Prompt injection
- Uncertain mapping
- Missing exact quote
- Input over limit
Prohibited actions
- Clinical interpretation
- Diagnosis
- Treatment recommendation
- Action nomination
- External action
Evaluation state
- Subgroups: not established
- Overrides: local test only
- Incidents: not established
- Rollback: Use manual specimen ledger entry from the source report.
Deterministic verifierImplemented
Specimen report exact-quote verifier
An archived deterministic specimen verifier is implemented; it confirms source correspondence without interpreting clinical meaning.
- Contract
- revisionboard.specimen-ledger.v1
- Engine
- Repository deterministic code
- Identifier
- specimen-ledger-verifier
- Current runtime
- Research archive
- Release decision
- research archive only
- Test dataset
- specimen-ledger-synthetic-fixtures.v1
Human gate
A human accepts each verified event before it enters the deterministic ledger.
Inspect controls and operating envelope
Deterministic checks
- Allowed identifiers
- Exact quote
- Report-state match
- Observed-date match
- Value correspondence
Abstains when
- Specimen mismatch
- Quote mismatch
- State mismatch
- Date mismatch
Prohibited actions
- Clinical interpretation
- Ledger write without human acceptance
- External action
Evaluation state
- Subgroups: not applicable
- Overrides: local test only
- Incidents: not established
- Rollback: Reject the event and use manual specimen ledger entry.
Security architecture
Trust boundaries and activation gates
This repository control map separates active public demonstration flows from customer-controlled PHI paths. It is not a certification, compliance determination, or authorization to process patient data.
Current release decisionPublic synthetic boundary only
Customer PHI production authorization: No. Independent penetration test, customer backup restore, external audit archive, and customer risk acceptance are not complete in this release.
Trust boundaries13Public, customer, provider, and human authority
Modeled flows12Every flow is tied to at least one threat
Active public flows3Public or synthetic data only
Active PHI flows0Customer configuration cannot infer activation
Active external writes0Final human authority remains required
Activation blockers4Residual risks marked unacceptable
Inspect the data-flow map
- Public demonstration request and responseActive public
public data / synthetic clinical data / no external actionpublic-browserpublic-worker - Public synthetic case persistenceActive public
synthetic clinical data / operational no patient data / no external actionpublic-workerpublic-d1 - Patient-free public registry lookupActive public
public data / no external actionpublic-workerpublic-registries - Authenticated private reviewer sessionCustomer configuration required
customer phi / customer confidential non phi / no external actioncustomer-reviewercustomer-runtime - Customer workforce identity exchangeCustomer configuration required
credential material / customer confidential non phi / no external actioncustomer-runtimeworkforce-idp - Tenant-scoped customer workflow persistenceCustomer configuration required
customer phi / customer confidential non phi / no external actioncustomer-runtimecustomer-postgres - Least-privilege EHR readCustomer configuration required
customer phi / no external actioncustomer-runtimehospital-ehr - Human-authorized administrative EHR Task handoffCustomer configuration required
customer phi / customer confidential non phi / external actioncustomer-runtimehospital-ehr - Independent operational audit exportCustomer configuration required
operational no patient data / customer confidential non phi / external actioncustomer-runtimeexternal-audit - Patient-free private SpineCPT lookupImplemented, disabled
licensed reference data / customer confidential non phi / no external actioncustomer-runtimeprivate-spinecpt - Optional bounded model inferenceImplemented, disabled
customer phi / customer confidential non phi / no external actioncustomer-runtimemodel-provider - Accountable human review and final decisionCustomer configuration required
customer phi / customer confidential non phi / no external actionaccountable-humancustomer-runtime
Controls still required for activation
- Customer retention and deletion operationcustomer required
No customer-specific deletion exercise exists in the public repository.
- Customer backup and disaster recovery operationcustomer required
Repository release recovery does not prove customer PHI database recovery.
- Independent penetration test and remediation reviewexternal required
No independent penetration-test report is complete in this repository.
Residual risks that block activation
- Malicious chart text or model output attempts to bypass policyhigh residual risk
Untrusted text becomes an instruction, hides uncertainty, or initiates a forbidden action.
- Model-provider egress discloses or retains PHI outside approvalhigh residual risk
Sensitive context reaches an unapproved host, region, log, retention path, or subcontractor.
- Audit evidence is lost, reordered, replayed, or alteredhigh residual risk
The runtime cannot prove which actor, evidence, policy, or external action occurred.
- Customer records cannot be restored or deleted according to policyhigh residual risk
A backup is unusable, keys are unavailable, or retention diverges across systems.
Configuration over cloning
Brand, navigation, roles, copy, and module visibility live in a schema-checked manifest.
Engines stay headless
Evidence, rules, coding, and workflow state are tested without rendering React.
Adapters stay replaceable
EHR, payer, PACS, UDI, and messaging transports implement narrow ports.
Safety is explicit
Every module declares what it can prepare, who reviews it, and what it cannot do.