Skip to content

OpenMed v2.3.0

Latest
Latest

Choose a tag to compare

View all tags
@maziyarpanahi maziyarpanahi released this 04 Sep 16:17
v2.3.0
f7ebc7e
This commit was signed with the committer’s verified signature.
maziyarpanahi Maziyar Panahi
GPG key ID: 58C6DE3FED1C5846
Verified
Learn about vigilant mode.

OpenMed v2.3.0: Local-First Healthcare AI Across Python, JavaScript, Swift, and Android

OpenMed v2.3.0 expands the stable local-first healthcare AI SDK across privacy-safe agents and traces, bounded multimodal intake, clinical evidence, local training, cross-platform runtimes, deployment adapters, and release hardening without removing a public Python symbol.

This release adds deterministic asset manifests, streaming digests, media-type detection, typed abstention, document and email redaction, privacy-safe agent outcomes, trace sharding and recovery, clinical evidence tables, patient-record filtering, training reproducibility records, WebGPU and Android acceleration, iOS extensions, Electron and Tauri bridges, TensorRT and GGUF runtimes, search and batch adapters, self-hosted services, Kubernetes operations, and stable CLI and schema contracts.

The committed ancestry since v2.2.0 contains 253 commits and 652 changed files. Commit subjects reference 127 unique issue or pull-request identifiers, while GitHub-generated release notes associate 129 pull requests with the complete ancestry before the final commit. The static public Python inventory grows from 37,735 to 41,729 symbols with 3,994 additions, no removals or renamed symbols, no narrowed callable signatures, and no new deprecations. The REST contract remains compatible at 19 paths and 17 component schemas.

Install or upgrade after the immutable tag and tag-driven package workflows complete:

pip install --upgrade "openmed==2.3.0"
pip install --upgrade "openmed[hf,fhir]==2.3.0"
pip install --upgrade "openmed[mlx]==2.3.0"
npm install openmed@2.3.0

Swift Package Manager:

.package(url: "https://github.com/maziyarpanahi/openmed.git", from: "2.3.0")

Android through JitPack:

implementation("com.github.maziyarpanahi:openmed:v2.3.0")

Container and Helm after publication:

docker pull ghcr.io/maziyarpanahi/openmed:v2.3.0
helm upgrade --install openmed-service deploy/helm/openmed-service --set image.tag=v2.3.0

Release documentation after the tag is available: https://github.com/maziyarpanahi/openmed/blob/v2.3.0/docs/release/v2.3.0.md

Migration guide after the tag is available: https://github.com/maziyarpanahi/openmed/blob/v2.3.0/docs/migration/2.2-to-2.3.md

Full changelog: v2.2.0...v2.3.0

Highlights

  • Multimodal safety and provenance: Added bounded asset manifests, streaming SHA-256 digests, prefix-based media detection, typed abstention records, deterministic image/PDF/DICOM/audio profiles, archive and path-safety policies, and metadata-only inventories.
  • Document and message privacy: Added PDF reading-order reconstruction and fidelity-verified redaction, HTML source-offset extraction, EML and optional isolated MSG handling, RTF and fixed-width text intake, notebook-cell redaction, and privacy-safe export naming.
  • Agent, trace, and training contracts: Added closed agent outcomes, deterministic run summaries, monotonic timing, local trace discovery, streaming and parallel redaction, transactional recovery, structural-fidelity verification, training-schema adapters, teacher ensembles, federated-round records, and reproducibility verification.
  • Clinical evidence: Added deterministic evidence tables, scoped substance-use SDOH extraction, experiencer-aware patient-record span filtering, and non-throwing consent verification with assistive-use and qualified-review boundaries.
  • On-device and local runtimes: Added WebGPU with deterministic WASM fallback, Android QNN/NNAPI selection with CPU fallback, iOS Share and Action extensions, Electron and Tauri protection, TensorRT export, GGUF grounding, MLX optimization, and edge-SBC qualification.
  • npm redaction fixes: Replaced the unavailable default model with the public ClinicalE5 33M ONNX model, restored source offsets for Transformers.js token output, preserved decomposed accents and supplementary Unicode letters, and added content-free failures for unalignable tokens instead of silently incomplete redaction.
  • Integrations and deployment: Added opt-in OpenSearch, Elasticsearch, Spark, Beam, Airflow, LlamaIndex, PostgreSQL, dbt, warehouse remote-function, KServe, Triton, Kubernetes operator, HPA, self-hosted Compose, and local service adapters.
  • Release hardening: Added stable CLI and schema compatibility contracts, canonical uv and Pixi environments, package and image budgets, deterministic installation smoke checks, reviewed dependency locks, container digest policy, reproducible-lock checks, and removal of hosted model publication automation.

Multimodal intake and document protection

OpenMed 2.3 introduces a dependency-free, versioned asset manifest with bounded metadata, strict digest and media validation, deterministic serialization, and value-free rejection of unsafe paths, URLs, free text, and unknown fields. Streaming digest helpers preserve caller-owned stream positions, and prefix inspection recognizes PDF, PNG, JPEG, TIFF, DICOM, and WAV without trusting filename extensions.

Typed abstention records and deterministic image, PDF, DICOM, and audio profiles let applications reject malformed or unsupported assets before opening or decoding them. New archive-extraction, resource-path portability, file-sharding, artifact-inventory, and export-filename policies preserve counts, hashes, offsets, and provenance without retaining source values.

Document processing adds conservative multi-column PDF reading order, local burned-in PDF redaction with source-text removal verification and masked fidelity evidence, HTML visible-text extraction with source offsets, EML redaction, an explicitly isolated optional MSG bridge, RTF and fixed-width text intake, and privacy-safe notebook-cell handling. These paths remain bounded, local-first, and fail closed on malformed or unbounded input.

Agents, traces, and training

Agent runs gain a closed outcome vocabulary, deterministic summaries, monotonic timing records, consent verification results, bounded tool-call metadata, and content-free failure reasons. These records are designed for stable machine consumption without accepting arbitrary free-text reasons or source clinical values.

Trace tooling adds metadata-only store discovery, JSONL and structured tool-call redaction, secret detection, bounded streaming, deterministic multiprocess sharding, local inventories, transactional in-place replacement with verified backups, crash recovery, and structural-fidelity proof. Training adapters cover role-message, preference-pair, and columnar schemas while preserving non-content structure and emitting hashed diagnostics.

Local training adds an audited teacher-ensemble registry, federated-round lifecycle records, and reproducibility-hash recomputation and verification. These are additive evidence contracts and do not make training output clinically authoritative.

Clinical evidence and review boundaries

OpenMed 2.3 adds deterministic clinical evidence tables with source offsets, controlled assertion and review metadata, optional protected-value hashes, and value-free JSON and Markdown rendering. Scoped substance-use SDOH extraction and experiencer-aware patient-record filtering separate patient-eligible, family, other, hypothetical, negated, and refuted evidence with auditable reasons.

Consent receipt verification is immutable and non-throwing, with stable content-free outcome codes. Clinical evidence, SDOH extraction, record filtering, terminology mappings, and consent results remain assistive software requiring qualified review; they must not automatically trigger diagnosis, treatment, billing, data release, or publication.

Runtimes, integrations, and deployment

Browser support adds typed batched WebGPU token classification, an audited WGSL head, deterministic local WASM fallback, parity and recall gates, and a zero-upload privacy playground. Android gains QNN and NNAPI provider selection with deterministic CPU fallback and release-AAR size and cold-start budgets. Apple platforms gain reusable Share and Action extension modules for bounded local redaction. Electron and Tauri integrations preserve renderer isolation, bounded IPC, offline enforcement, and safe worker recovery.

The npm package exports DEFAULT_MODEL_ID as OpenMed/OpenMed-PII-ClinicalE5-Small-33M-v1-onnx-android and routes this model family through the root INT8 loader. extractPii() retains O tokens and reconstructs missing character offsets before BIO decoding. alignTokenOffsets() is available for custom pipelines. Final spans use JavaScript UTF-16 offsets, preserve decomposed accents and supplementary Unicode letters, and fail with a content-free error when tokens cannot be aligned. The real public model passed a synthetic local redaction smoke test with matching ESM and CommonJS results; this is functional evidence, not a clinical recall qualification.

Model runtimes add device-specific TensorRT export, local Q4_K_M GGUF grounding through caller-provided llama.cpp, expanded MLX architecture coverage and decoding performance, and explicit edge-SBC benchmark profiles. Model files and external runtimes remain caller-supplied, pinned, checksum-verified trust boundaries.

Opt-in integration contracts now cover OpenSearch, Elasticsearch, Spark, Beam, Airflow, LlamaIndex, PostgreSQL, dbt, BigQuery-compatible remote functions, KServe, Triton, a namespaced Kubernetes model operator, HPA guidance, a hardened self-hosted Compose bundle, and a loopback-only local redaction service. No external process, database, cluster, browser, credential, or telemetry path becomes mandatory for core local PHI processing.

Developer workflow and release hardening

The release adds deterministic openmed init scaffolding, local file redaction, stable JSON result envelopes, shell completion, CLI help drift checks, configuration and schema snapshots, integration capability discovery, offline installation diagnostics, and portable Agent Skills bundles and validation.

The canonical contributor workflow uses the committed uv lock, with Pixi and Nix paths for reproducible environments. Package, artifact, Android, Pages, and container budgets are explicit and blocking. Container digest policy, vulnerability scanning, SBOM generation, provenance tests, secret scanning, repository policy, license policy, immutable lock verification, and deterministic install checks remain part of the release boundary.

Hosted model conversion and publication automation was removed. Model conversion, evaluation, and publication are explicit local maintainer operations and remain separate from this SDK release.

Compatibility and migration

The static Python API comparison against v2.2.0 records 3,994 additions, no removed or renamed public symbols, no narrowed callable signatures, and no newly deprecated symbols. The REST contract remains at 19 paths and 17 component schemas.

Swift, Kotlin/Android, JavaScript, CLI, configuration, trace schemas, evidence records, model artifacts, browser contracts, and deployment surfaces expand. npm consumers retain the v2.2 required numeric offsets on TokenClassificationEntity, TokenClassificationPipeline, and model-loader output. The additive RawTokenClassificationEntity, RawTokenClassificationPipeline, and RawTransformersRuntime types accept offset-less runtime input; alignTokenOffsets() converts it to aligned entities. Model loaders preserve runtime metadata and resource disposal. Final OpenMedSpan offsets remain required. Treat alignment errors as failed scans, never as evidence of PII-free content. Applications should refresh generated clients and schema snapshots, explicitly handle new closed vocabularies, re-qualify enabled document formats and runtimes, and repeat privacy acceptance testing on the actual deployment platform.

See the complete migration checklist: https://github.com/maziyarpanahi/openmed/blob/v2.3.0/docs/migration/2.2-to-2.3.md

Release and model evidence

OpenMed 2.3.0 is an SDK release and does not promote a model pointer. The committed PII/latest and PII/last_green pointers both remain OpenMed/OpenMed-PII-SuperClinical-Small-44M-v1-mlx, and PII/canary remains unset.

No new model-candidate report is claimed for this SDK-only release. Any future change to canary, latest, or last_green still requires a real staged candidate, public SHIELD and golden evidence, signed extraction gates, and a final readiness decision of exactly READY.

Final local validation and hosted-check status

  • Source inventory: Local and remote heads match f7ebc7eaeb81b0a76f5fd5784830a63895662578; the working tree is clean and current origin/master (0e07ba71b7895255d8d14d4a25642e5cb37209d8) is an ancestor. All 19 inspected release surfaces resolve to 2.3.0 or v2.3.0; the target tag is unused locally and on origin.
  • Pull request: PR #3018 is open and non-draft. The approved NLTK exception, its target-isolation regression, and the release documentation are tracked, committed, and pushed on the final source head.
  • Hosted checks: Final audit on 2026-09-04 at 15:25 UTC for f7ebc7eaeb81b0a76f5fd5784830a63895662578: 44 checks passed, 3 expected conditional jobs were skipped, and none failed or remain pending. All seven Python unit jobs, Nix, Pages/browser tests, Android, OpenMedKit/iOS/watchOS/visionOS, amd64/arm64 container smoke, image SBOM, browser extension, and the image/lockfile vulnerability scan passed. Expected skips were Pages deployment, container manifest publication, and the unchanged-path CJK/Indic job.
  • Local Python: The complete suite passed on the final release head with 14,099 passed, 126 skipped, and 20 warnings in 391.38 seconds. The release/provenance/documentation suite previously passed 245 tests; 32 security-gate and publishing/provenance tests passed again after the waiver and target-isolation regression.
  • API compatibility: The static Python inventory grew from 37,735 to 41,729 symbols with 3,994 additions, zero breaking changes, and zero new deprecations. Migration-guide completeness passed. A strict TypeScript consumer regression verifies the preserved v2.2 numeric-offset contracts.
  • Documentation and Pages: Strict MkDocs, exact Pages staging, publication and brand validation, and generated OpenAPI checks passed. Both staged-manifest and byte-budget tests passed. The measured local artifact contains 449 files, 37,504,986 total bytes, 37,167,407 unique bytes, 337,579 duplicate bytes, and 57,041 bytes of unique headroom; no size ceiling was raised. Reviewed Linux light/dark snapshots remain unchanged, and final-head hosted Pages/browser validation passed.
  • Python artifacts and policy: Wheel and sdist rebuilt and passed Twine. Package content, Core Metadata 2.4, CycloneDX 1.6 SBOM (183 runtime dependencies), pip-audit, high-severity Bandit enforcement, repository/license policy, 185 Actions references, provenance tests, and the 577-package lock check passed. Scoped pre-commit and version preflight passed again.
  • Security limitation: The latest Trivy image report has zero HIGH-or-higher blockers. Fourteen obsolete Debian exceptions were removed instead of extending their expiry. The lockfile contains HIGH CVE-2026-81726 in nltk==3.10.3, with no fixed version. NLTK is present only through the optional agents, llamaindex, quickumls, and scrubadub dependency trees and is absent from the service image. OpenMed does not call the affected model-artifact APIs. The maintainer approved a seven-day exception restricted to this CVE, the nltk package, and the uv.lock target, expiring on 2026-09-11. The scanner threshold and fixed-version enforcement remain unchanged, and the exception cannot suppress a future finding that names a fixed version. Upstream advisory: GHSA-8mgp-746c-j5xp
  • JavaScript: The unscoped openmed package passed installation, zero-finding npm audit, all 30 tests, ESM/CommonJS builds and declarations, strict legacy-consumer type compilation, and an 18-file package dry run. Real Transformers.js 3.8.1 inference on synthetic text passed with ESM/CommonJS parity and successful resource disposal. The browser extension passed its build, typecheck, and end-to-end browser test.
  • Swift, Android, and containers: Swift formatting and Helm default/CI lint/render checks passed. All Apple platform and Android jobs, amd64/arm64 build/smoke, ARM64 latency, and image SBOM passed on the final head. Nix package and development-shell builds also passed.
  • Publishing configuration: The pypi and npm GitHub environments have their expected token secret names and no protection rules or branch restrictions. PyPI and npm both return HTTP 404 for version 2.3.0, so the version remains available. The same workflow's latest tag run, for v2.2.0 on 2026-08-21, succeeded in all six jobs: npm verification, Python build/attestation/verification, PyPI publication, npm publication, signed release evidence, and release SBOM. Credential values were neither read nor changed; their current validity is exercised only by the real tag-driven publication.
  • Publication trigger map: Merging to master triggers the production Pages deployment and the normal branch container build. Pushing the immutable v2.3.0 tag triggers Python provenance and PyPI publication, npm verification and publication with provenance, the GitHub release with distribution evidence and SBOMs, the multi-architecture GHCR image with provenance and follow-on signing, image SBOM generation, and Android release validation. The tag is the JitPack release coordinate. Maven Central upload is an optional Android path and will be skipped because its four signing/Sonatype secrets are not configured; this does not fail the tag workflow or affect the documented JitPack release.
  • Tag boundary: No tag, GitHub release, PyPI/npm/JitPack/GHCR publication, container manifest, documentation deployment, model promotion, or merge was performed.

Privacy and clinical boundaries

OpenMed keeps local processing as the default, but no de-identification, structured privacy, or clinical evidence system can guarantee zero residual risk. Validate direct-identifier recall, critical leakage, span integrity, language and script coverage, format handling, policy behavior, quantized-model deltas, and device behavior on deployment-specific synthetic fixtures before production use.

Clinical extraction, evidence, filtering, mapping, and model-generated output are assistive software, not a medical device or a source of clinical ground truth. Outputs require qualified review and must not automatically trigger diagnosis, treatment, billing, data publication, or other clinical decisions.

Licensed vocabularies, real-patient records, DUA-gated corpora, UMLS, SNOMED CT, CPT, MIMIC, i2b2, and n2c2 assets are not bundled. Restricted integrations require caller-supplied rights, keys, snapshots, model weights, or out-of-process bridges.

Contributors and change inventory

GitHub-generated notes associate 129 pull requests with the complete release ancestry and identify 17 contributors: @janithcd, @maziyarpanahi, @AadityaAnand, @alberthammerich, @dpersek, @Hitesh-XS, @anudit, @DrVelvetFog, @mohamedhossammohamed, @PouyanJay, @Mr-Neutr0n, @Rahul-pamula, @wessim852, @krudo-taco, @aayushi-sing, @kkkhs, and @09Catho.

New contributors identified by GitHub-generated notes: @janithcd, @AadityaAnand, @Hitesh-XS, @anudit, @Rahul-pamula, @wessim852, @aayushi-sing, @kkkhs, and @09Catho.

Associated pull requests: #2697, #2907, #2896, #2898, #2909, #2675, #2912, #2910, #2902, #2903, #2913, #2901, #2897, #2900, #2906, #2908, #2904, #2905, #2899, #2914, #2214, #2309, #2310, #2314, #2311, #2317, #2318, #2325, #2319, #2320, #2329, #2328, #2330, #2327, #2464, #2332, #2493, #2431, #2436, #2334, #2333, #2331, #2335, #2336, #2337, #2494, #2919, #2491, #2445, #2497, #2447, #2498, #2480, #2487, #2486, #2921, #2927, #2492, #2500, #2602, #2667, #2502, #2580, #2455, #2883, #2461, #2254, #2930, #2933, #2928, #2932, #2929, #2931, #2616, #2508, #2255, #2257, #2503, #2489, #2506, #2505, #2259, #2258, #2504, #2507, #2277, #2633, #2946, #2962, #2268, #2252, #2437, #2452, #2454, #2893, #2935, #2936, #2937, #2938, #2939, #2940, #2941, #2942, #2943, #2944, #2945, #2947, #2965, #2890, #2967, #2988, #2634, #2972, #2915, #2969, #2882, #2881, #2917, #2916, #2892, #2884, #3015, #2985, #2984, #2970, #2963, #2983, #2987, and #2960.

The GitHub-generated PR set differs from the 127 identifiers extracted from commit subjects because generated release notes associate merged and preserved contributor work through GitHub metadata, while the subject audit counts only identifiers literally present in commit subjects.

Maintainer release sequence

  1. Merge PR #3018 only while its head is f7ebc7eaeb81b0a76f5fd5784830a63895662578 and its exact-head checks remain green.
  2. Reconfirm the merged master commit, all version surfaces, checks, and unused v2.3.0 tag.
  3. Create and push the immutable v2.3.0 tag only after maintainer approval.
  4. Observe the tag-driven PyPI, npm, provenance, SBOM, Android/JitPack, GHCR, and documentation workflows.
  5. Verify the published artifacts, registry metadata, multi-architecture image manifest, provenance, release assets, and live documentation against the immutable tag.

What's Changed

New Contributors

Full Changelog: v2.2.0...v2.3.0

Contributors

maziyarpanahi, anudit, and 15 other contributors
Assets 11
Loading