v1.9.0 — CareAgents Consumer App + Forms Rail End-to-End + Grade A (7/7)

This release makes the project usable by someone who has never opened a terminal. CareAgents — the hosted consumer experience — shipped end to end: sign up with a passkey, connect records through a connector marketplace, and spin up a guardrailed health agent you can reach on web, Telegram, or iMessage. Underneath it, the forms rail became the first real-world action to ship whole, and the conformance harness now grades seven guardrail properties — Grade A means 7/7.

CareAgents — the hosted consumer experience

• One minute to a guardrailed agent. Email code + WebAuthn passkey (biometric stays on-device), connect records, create an agent, chat. CareAgents' only data path is HealthClaw's HTTP API — it stores no PHI, only accounts, tenant pointers, and connection metadata.
• Connector marketplace — a pluggable registry over the sources HealthClaw already brokers: Fasten (verified providers), Apple Health via Open Wearables, sample records — with honest "coming soon" tiles for everything not yet wired.
• Three surfaces — web, Telegram, and iMessage (text your agent), all through the same guardrailed turn loop.
• Advisor registry — specialties ported from SmartHealthConnect as prompt-blocks over the guarded tool set: healthy-habits 📊, care-completion ✅, medication-refills 💊 (read-side only, and it says so), diet-exercise 🏃. Kids-health and research-monitor are listed but honestly deferred — one needs a caregiver identity model (#157), the other needs tools that don't exist yet.
• Versioned informed consent at the connect-real-records moment — enforced server-side (HTTP 428 without an explicit consent: true), CARIN-style plain-language copy, recorded per connection. Sample records skip it by design.
• Claude-subscription auth — run the agent loop on ANTHROPIC_OAUTH_TOKEN instead of a metered API key.

Forms rail — the first real action, end to end

$populate fills the canonical intake questionnaire from the patient's own record → structured per-item review (every medication and allergy confirmed individually; "no known allergies" is rejected server-side unless explicitly attested; the item list is re-derived from FHIR so a crafted request can't skip a row) → reviewed QuestionnaireResponse → provenance-stamped PDF persisted as a FHIR DocumentReference → signed, expiring download link. Fails loud — needs_review / provider_not_configured / stale_source_data — and only reports completed on a fully rendered, persisted, linked PDF.

Error fidelity — guardrail property seven

GET $conformance now grades whether failure paths tell the truth: unknown parameters and unsupported modifiers are rejected or flagged, never silently swallowed. Hardened across the stack — local search emits value-free corrections with truthful totals, backend OperationOutcomes survive both MCP transports through a PHI-safe sanitizer (thanks @ashish-b-work!), and a CI drift guard pins the sanitizer's token allowlist byte-identical across its Python and TypeScript copies.

MCP Apps — UIs the guardrails render

care_gaps tool results now carry _meta.ui.resourceUri pointing at an engine-served care-gaps view (text/html; profile=mcp-app), joining the wearables view. The page's only fetch target is the guarded $care-gaps operation — the embedded UI inherits redaction, audit, and tenant isolation by construction, because there is no other data path.

Security & honesty

• Hardening pass: fail-closed production config, authenticated tenant reads, MCP transport auth, Alembic migrations, PHI minimization; Fasten download hosts validated by parsed URL; CI workflow permissions tightened.
• Removed an advertised "summary-only mode" privacy control that wasn't implemented — with a test that keeps it from coming back. House rule: ship the mechanism, then the copy.
• SmartHealthConnect is archived. Its value was ported first (skills → CareAgents advisors, MCP-App views → engine-served pages); the Claude plugin skills remain installable, frozen at v1.2.0.

Honest scope limits

• CareAgents is a demo-grade beta surface — the FTC Health Breach Notification Rule posture (#168) and a self-serve disconnect/delete flow (#173) are open items gating a real-user beta.
• The medication-refills advisor cannot submit refill requests yet (#162); appointment booking is design-only (#163).
• The care-gaps MCP App requires the manually-deployed MCP server to be current (#155 tracks making that drift visible).

Upgrade notes

No breaking changes. New optional env for CareAgents: ANTHROPIC_OAUTH_TOKEN (Claude subscription) as an alternative to ANTHROPIC_API_KEY. New DB columns (ca_agents.advisor, ca_connections.consented_at/consent_version) are added idempotently at boot.

Tests: 1,495 Python + 170 Node, green. Conformance holds Grade A (7/7).