Skip to content

OpenMed v2.2.0

Latest
Latest

Choose a tag to compare

View all tags
@maziyarpanahi maziyarpanahi released this 21 Aug 14:44
v2.2.0
59d9cb0
This commit was signed with the committer’s verified signature.
maziyarpanahi Maziyar Panahi
GPG key ID: 58C6DE3FED1C5846
Verified
Learn about vigilant mode.

OpenMed v2.2.0 is here, completing the trustworthy clinical-data-exchange milestone across terminology grounding, document intake, FHIR, OMOP, structured privacy, MCP, service security, local model runtimes, Android local inference, and offline release evidence.

This release adds checksum-pinned terminology snapshots, ranked grounding and calibration, FHIR R4 patient summaries and clinical documents, local profile validation, FHIR-to-OMOP CDM 5.4 mapping, deterministic form and key/value extraction, cross-format offset projection, PDF table reconstruction, XLSX/PPTX/ODT intake, HL7 v2 and X12 837 privacy handling, and structured release-risk controls.

OpenMed 2.2 also adds native Maple clinical task support and Compass vision-language inference across Python and OpenMedKit, a four-part synthetic notebook gallery, service grounding and streaming de-identification routes, GraphQL, mTLS, HMAC replay protection, prompt-injection guards, MCP authorization boundaries, Android network-denial guarantees, and PHI-safe diagnostic descriptions.

The audited v2.1.0..v2.2.0 range contains 111 commits and 571 changed files, with 38 PRs associated through GitHub-generated release notes. The public Python inventory grows from 31,619 to 37,735 symbols with 6,116 additions, no removals or narrowed callable signatures, and no new deprecations. The REST contract grows additively from 17 to 19 paths and from 15 to 17 component schemas.

Install or upgrade after the tag-driven package workflows complete:

pip install --upgrade "openmed==2.2.0"
pip install --upgrade "openmed[hf,fhir]==2.2.0"
pip install --upgrade "openmed[mlx]==2.2.0"
npm install openmed@2.2.0

Swift Package Manager:

.package(url: "https://github.com/maziyarpanahi/openmed.git", from: "2.2.0")

Android through JitPack:

implementation("com.github.maziyarpanahi:openmed:v2.2.0")

Container:

docker pull ghcr.io/maziyarpanahi/openmed:v2.2.0

Release documentation: https://github.com/maziyarpanahi/openmed/blob/v2.2.0/docs/release/v2.2.0.md

Migration guide: https://github.com/maziyarpanahi/openmed/blob/v2.2.0/docs/migration/2.1-to-2.2.md

Full changelog: v2.1.0...v2.2.0

Highlights

  • Terminology and clinical grounding: Added checksum-pinned vocabulary snapshots, exact and ranked grounding, calibration, section context, caller-supplied Athena and crosswalk support, value-free provenance, and explicit terminology-conflict decisions.
  • FHIR and OMOP exchange: Added FHIR R4 patient-summary and clinical-document assembly, explicit R4/R5 conversion boundaries, local profile validation, Bundle reference-integrity reports, SDC privacy projection, OperationOutcome helpers, Bulk Data resume checkpoints, and FHIR-to-OMOP CDM 5.4 mapping.
  • Multimodal intake: Added deterministic clinical forms and key/value extraction, cross-format offset projection, PDF table reconstruction, XLSX/PPTX/ODT intake, HL7 v2 narrative handling, X12 837 redaction, and fail-closed MIME quarantine.
  • Structured privacy: Added k-anonymity, l-diversity, t-closeness, membership-inference self-tests, aggregate-only differential privacy, and qualified-review evidence for dataset-release decisions.
  • Service and integration boundaries: Added grounding and streaming de-identification routes, GraphQL, backpressure and batching, CPU INT8 classification, model-cache quotas, and opt-in database, orchestration, and stream-processing adapters.
  • Security and consent: Added mTLS, HMAC replay protection, prompt-injection guards, MCP protected-resource and authorization boundaries, consent receipts, upstream endpoint policy, and aggregate Part 11-oriented evidence.
  • On-device safety: Added Android network-denial guards, no INTERNET permission, opt-in typed aggregate logging, hashed entity descriptions, and explicit assistive-use documentation.
  • Local model runtimes: Added pinned Maple clinical task support and native Compass vision-language inference across Python and OpenMedKit, with external weights, checksum-bound artifacts, and human-review boundaries.
  • Validated examples: Added a four-part synthetic notebook gallery for redaction, batch processing, FHIR export, and multilingual evaluation, with offline execution and committed-output freshness checks.
  • Release conformance: Added hard-negative and multilingual traps, FHIR round-trip fixtures, timeline provenance, and a versioned synthetic v2.2 matrix with pinned FHIR, OMOP, and evidence hashes.

Terminology, FHIR, and OMOP

OpenMed 2.2 introduces a local-first terminology workbench with checksum-pinned snapshots, ranked grounding, calibration, abstention, section context, caller-supplied Athena and crosswalk support, and privacy-safe provenance. Licensed terminology remains caller-supplied and is never bundled.

FHIR support now covers R4 patient summaries and clinical documents, explicit R4/R5 boundaries, local profile validation, Bundle reference-integrity reporting, SDC privacy projection, OperationOutcome helpers, and resumable Bulk Data checkpoints that retain digests rather than source records.

The FHIR-to-OMOP bridge targets OMOP CDM 5.4 and keeps vocabulary resolution caller-controlled. Generated mappings remain assistive evidence requiring downstream clinical and terminology review.

Document intake and structured privacy

Document processing adds deterministic clinical form and key/value extraction, cross-format offset projection, PDF table reconstruction, spreadsheet, presentation, and OpenDocument intake, HL7 v2 narrative extraction, X12 837 redaction, and fail-closed MIME quarantine.

Structured privacy adds k-anonymity, l-diversity, t-closeness, membership-inference self-tests, aggregate-only differential privacy, and qualified-review evidence for release decisions. These tools report risk and policy evidence; they do not guarantee that a dataset is anonymous or suitable for release.

Optional adapters cover Arrow Flight, SQLAlchemy, PostgreSQL PL/Python, executable UDFs, distributed SQL, Dataflow, Dagster, Ray, pandas-on-Spark, search ingest, and stream processors. External services, credentials, databases, and runtimes remain explicit trust boundaries.

Service, MCP, and security

The service gains additive POST /ground and POST /pii/deidentify/stream operations, GraphQL, backpressure, batching, load-test assets, model-cache quotas, CPU INT8 token classification, and additive Go and TypeScript client coverage.

Security work adds mTLS, HMAC replay protection, prompt-injection guards, MCP protected-resource and OAuth-style authorization boundaries, consent receipts, upstream endpoint policy, and aggregate Part 11-oriented audit evidence.

Core PHI processing remains local after explicitly required artifacts are available. Telemetry remains off by default, and audit evidence uses hashes, counts, offsets, thresholds, and provenance rather than raw identifiers or source clinical text.

Maple, Compass, and on-device runtimes

Python adds the MapleClinicalAssistant task API, MLX Maple export and runtime helpers, and the native openmed.mlx Compass vision-language runtime. OpenMedKit adds Maple request, response, parsing, and MLX runtime types plus native vision-language model loading and generation.

Model weights remain external and must be pinned and checksum-verified. Maple reasoning, entity, relation, and de-identification results and Compass image-grounded output remain assistive and require human review.

Android OpenMedKit retains its public method signatures while hardening local execution with no INTERNET permission, socket-denial tests, opt-in aggregate logging, and PHI-safe entity descriptions. EntityPrediction.description now emits label, Unicode-scalar offsets, confidence, and a SHA-256 digest instead of detected source text; applications that need a local preview must use the explicit text field and keep it out of logs, telemetry, crash reports, and remote diagnostics.

Compatibility and migration

The static Python API comparison against v2.1.0 records 6,116 additions, no removed or renamed public symbols, no narrowed callable signatures, and no newly deprecated symbols.

The v2.1 import openmed.clinical.grounding.SnapshotManifest retains its snapshot-cache meaning. The new vocabulary manifest is exported as VocabularySnapshotManifest, and openmed.clinical.exporters.omop.ConceptResolver remains a public type alias after the OMOP exporter became a package.

Swift adds Maple and Compass APIs without removing an existing OpenMedKit API. Android public method signatures remain compatible; the diagnostic description hardening is the only called-out behavioral migration.

Applications should refresh generated REST clients before adopting the new grounding or streaming routes and re-qualify terminology snapshots, FHIR profiles, OMOP mappings, structured-data policies, model artifacts, and device-specific acceptance tests before enabling new workflows.

Release and model evidence

OpenMed 2.2.0 is an SDK release and does not promote a model pointer. The committed PII/latest and PII/last_green pointers remain OpenMed/OpenMed-PII-SuperClinical-Small-44M-v1-mlx, and PII/canary remains unset.

Model promotion remains a separate fail-closed workflow requiring real staged golden and public SHIELD evidence, signed gates, and a final readiness decision of exactly READY. Missing model-candidate artifacts are not fabricated for this SDK release.

Local validation completed before the final commit

  • Python: The complete suite passed with 12,185 tests passed, 117 skipped, and 20 warnings.
  • Release-focused coverage: The focused v2.2 conformance, end-to-end golden, publication-workflow, provenance, size-budget, and import-budget suites passed.
  • Static API compatibility: The inventory grew from 31,619 to 37,735 public symbols with 6,116 additions, zero breaking changes, and zero new deprecations; migration-guide completeness passed.
  • REST/OpenAPI: Regeneration is clean at version 2.2.0, with 19 paths and 17 component schemas.
  • Documentation and notebooks: Strict multilingual MkDocs and exact Pages staging passed route, asset, LLM-feed, metadata, locale, brand, and byte-exact social-asset checks; all four synthetic gallery notebooks passed offline execution and committed-output freshness validation.
  • Python artifacts: Two isolated builds produced byte-identical wheel and source distributions. The wheel remains within the committed release-size budget. Both artifacts passed Twine and content inspection, include openmed/py.typed, and contain no bundled model binary or restricted vocabulary payload.
  • JavaScript: npm audits reported zero vulnerabilities; the web package passed build, typecheck, nine runtime tests, and 15-file dry-run packaging, while the private React Native bridge passed typecheck and four parity tests.
  • Swift and Apple platforms: Swift formatting, dependency resolution, build, and 81 package tests passed with 14 documented local-artifact skips and zero failures. Applicable iOS, watchOS, and visionOS compilation and parity checks passed.
  • Android: Debug and release AAR assembly, unit tests, consumer-rule verification, local-network-denial controls, version validation, and the 753-row catalog checks passed.
  • Helm and containers: Default and CI values passed Helm lint and rendering; hosted amd64 and arm64 container build and smoke checks passed, along with image SBOM validation.
  • Security and supply chain: Repository and license policy, action-reference validation, secret scanning, high-severity Bandit, pip-audit with no known or unreviewed vulnerabilities, CycloneDX 1.6 SBOM generation, publication-workflow tests, and provenance tests passed.
  • Version preflight: Every active Python, npm, Swift, Android, Helm, OpenAPI, README, website, and documentation surface resolves to 2.2.0 or v2.2.0, and the target tag was unused locally and on origin at validation time.

Privacy and clinical boundaries

OpenMed keeps local processing as the default, but no de-identification or structured privacy system can guarantee zero residual risk. Validate direct-identifier recall, critical leakage, span integrity, language and format coverage, policy behavior, quantized-model deltas, and device behavior against deployment-specific fixtures before production use.

Clinical extraction, grounding, mapping, and model-generated output are assistive software, not a medical device or a source of clinical ground truth. Outputs require qualified review and must not automatically trigger diagnosis, treatment, billing, data publication, or other clinical decisions.

Licensed vocabularies, real-patient records, DUA-gated corpora, UMLS, SNOMED CT, CPT, MIMIC, i2b2, and n2c2 assets are not bundled. Restricted integrations require caller-supplied rights, keys, snapshots, or out-of-process bridges.

Contributor and change inventory

GitHub-generated release notes associate 38 PRs with the complete release ancestry: #2228, #2230, #2237, #2239, #2241, #2243, #2244, #2245, #2541, #2543, #2548, #2549, #2550, #2551, #2678, #2679, #2680, #2681, #2682, #2685, #2686, #2687, #2688, #2689, #2690, #2691, #2692, #2693, #2694, #2695, #2696, #2698, #2699, #2700, #2885, #2886, #2887, and #2891.

The generated-note set is intentionally smaller than the complete 111-commit ancestry because maintainer integration batches preserve source contributor commits while presenting one reviewed integration PR per coherent subsystem.

What's Changed

New Contributors

Full Changelog: v2.1.0...v2.2.0

Contributors

maziyarpanahi, Mr-Neutr0n, and 2 other contributors
Assets 11
Loading