Skip to content

v2.1.0 — the check-in release

Latest
Latest

Choose a tag to compare

View all tags
@aks129 aks129 released this 16 Oct 12:45
· 63 commits to main since this release
v2.1.0
342dd0f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

HealthClaw Guardrails 2.1.0 — the check-in release

2.1 makes the engine ready to answer a SMART Health Check-in request, and it
takes CareAgents from a synthetic sample to an invite-only beta with a
patient connect journey. The guardrails from 2.0 hold: Grade A, PHI-free
audit, step-up on writes, and labels only from r6/terminology.py.

The full change list is in CHANGELOG.md.

What 2.1 adds

  • A check-in export. A checkin export profile answers a SMART Health
    Check-in request with US Core records. Only a step-up token can reach it,
    and that token must be issued for this export's audience and for the
    exact item set the person agreed to. The token is used once, after the
    bundle is built and fits under 400,000 bytes.
  • Insurance cards, after consent. In the check-in export only, a
    Coverage keeps its member, group and plan IDs, and its payor is named from
    the stored Organization. An identifier labelled as an SSN, or written in
    separated SSN form, is still dropped. Patient identifiers keep the strict
    SSN screen. Race and ethnicity carry our own OMB labels, never upstream
    text.
  • Profile claims you can trust. Only allow-listed US Core and C4DIC
    profile claims leave the engine. Other claims are dropped. A record with no
    profile is answered "unavailable"; validating it and then adding the claim
    comes later.
  • Scoped step-up tokens. A token is refused outside its scope. An
    audience-bound token is refused by every gate that does not ask for that
    audience, and a gate that asks for an audience refuses a token without
    it.
  • Where a record came from. Each stored resource carries a code-only
    meta.tag saying how it arrived: portal, upload or sample. It never
    carries a clinic name (migration 0011_record_source).
  • "No known allergy" is a recorded entry. A coded absence is quoted as a
    dated entry, not a confirmed absence. Examples are SNOMED 716186003 and
    its descendants, the legacy 160244002, 260413007, and the LOINC absence
    answers. It is never inferred.
  • Proxied searches drop upstream paging links. A self link and a
    fullUrl come from the engine, never from the upstream server. A bare id
    is accepted for the patient search parameter.

CareAgents in 2.1

  • Invite-only beta: tester terms, personal invite links, a pause switch,
    re-consent, a daily cap and a feedback form.
  • A patient connect page, one assistant per person, and a hub that says
    whose each assistant is.
  • Text-first iMessage through a hosted line, with re-verification after 60
    days, or after 30 days of silence.
  • Model routing: easy turns go to Haiku and the rest to Sonnet, with an
    Opus advisor. Only approved hosts may serve while real records are open.
  • A SMART Health Check-in web wallet, behind CARE_CHECKIN_WALLET, which
    is off by default. It answers only from the synthetic test patient. The
    answer is encrypted in the browser, so CareAgents stores none of it.

Not in 2.1

  • The direct FHIR write gate is still a header
    (#214). The
    action rail is the real gate.
  • The check-in wallet is synthetic only. It is off in production until
    the owner turns it on for the Nov 3 connectathon. The relay from the
    wallet to the engine export is the next PR.
  • Validate-then-claim is deferred. Records with no profile are answered
    "unavailable".
  • Two SSN forms still get through on Coverage: a doubled space
    (666 77 8888) and a single separator (666-778888). This is tracked
    on FHI-53.
  • fullUrl uses the request host, not a configured public base
    (FHI-61).

Ratchets

Ratchet 2.0.0 2.1.0 Target
Post-commit audit call sites 86 23 0
Raw tenant-header reads 24 14 0
Imports out of routes.py 4 1 1
routes.py lines, a ceiling 3,750 3,738 shrinks

Upgrading from 2.0.0

  1. Run the Alembic migrations before the first request. 2.1 adds
    0011_record_source.
  2. Check GET /r6/ops/preflight.
  3. If you mint check-in tokens in production, confirm a shared nonce store
    (Redis). It is what keeps each token to a single use.
  4. CareAgents is deployed separately. Stage web and worker from the same
    tree, and leave CARE_CHECKIN_WALLET unset unless you mean to run the
    wallet.
Assets 2
Loading