Boundaries
Roadmap
Capability expands aggressively while live transmission stays blocked until identity, security, clinical content, operations, and authorized network evidence are complete. Every milestone ships its own state machine, permission checks, audit records, and test evidence.
#Milestones
| Milestone | Focus | Status |
|---|---|---|
| M0 | Independent-design foundation, threat model, domain and contract inventories | Implemented locally |
| M1 | Standard non-controlled synthetic draft and one-time read-only review — the current state | Implemented locally |
| M2 | Tenant, identity, and workforce administration; explicit permissions; privilege-separated database roles; local identity-provider fixture | Not implemented |
| M3 | Full lifecycle simulation — approval recorded as a simulation, review queues, prescription diffing | Not implemented |
| M4 | Durable transport simulator behind the provider-neutral port: leases, fencing, retries, dead-letter, reconciliation, renewals, refills, change requests, cancellations | Not implemented |
| M5a | Reusable clinical content — templates, favourites, order sets, compound formulations | Requires licensed content |
| M5b | Developer SDKs, CLI, webhook delivery, example applications | Not implemented |
| M6 | Prescription-monitoring provider boundary | Requires external authorization |
| M7 | Standards adapter and network certification readiness | Requires certification |
| M8 | Governed production pilot and scale | Requires certification |
#Delivery principles
- Vertical slices, not layersEach milestone delivers through API, domain, database, audit, evidence, review, tests, documentation, and operations together — never a disconnected layer.
- The simulator always precedes the adapterNo environment setting alone can turn a simulated capability into a production one. That is a structural property, not a policy statement.
- Constraints migrate forward, never weakenA capability that a lockdown constraint rejects lands only with a migration that replaces the constraint with an equally explicit successor, in the same change as the code and tests exercising it.
- Deletion is not a domain operationIdentity and clinical rows deactivate or transition. History and evidence remain intact.
- Every milestone carries entry and exit evidenceIncomplete external facts stay in the dependency register. They are never invented in code.
#What each new capability must ship with
This is the definition of done applied uniformly, and it is why capability expands more slowly here than in a typical prototype:
- An explicit state machine with allowed and forbidden transitions, both tested.
- A permission check with an explicit scope, and hostile tests for the denial cases.
- Immutable audit and evidence records committing in the same transaction as the change.
- Idempotency and concurrency semantics, with two-connection tests where a race is possible.
- Tenant-isolation tests, including cross-tenant assembly attempts.
- Contract updates — OpenAPI, event schemas, examples — verified in CI.
- Documentation carrying the correct capability label, and no unsupported assurance claim.
#The transport boundary
Every future network interaction passes through one provider-neutral port. Until an authorized adapter exists, that port is implemented only by explicitly named in-process simulators — an always-success adapter, a scenario-driven adapter, and a chaos adapter for failure injection.
No production package is named after a specific network operator or its message operations unless the repository holds authorized public specifications supporting that terminology. Live transport arrives only as a separately reviewed adapter behind the certification gates, in the same change that revises the architectural no-egress rule.
Building the engine, evidence model, and developer surface correctly is the expensive and differentiating work. Network connectivity is a gated integration that can only be earned once — and earning it against a system whose invariants are already proven is a materially better position than retrofitting them afterwards.