Changelog

Shipped the three-tier Enterprise Deployment architecture: cloud (multi-tenant GCP), dedicated (single-tenant VPC, dedicated Postgres/K8s, Cloud KMS CMEK key control), and sovereign (self-hosted air-gapped on-premise Kubernetes via Helm charts with local Dex IdP SSO, MinIO S3 WORM storage, and local Ollama/OpenLLM model inference). Exposed via GET /api/platform/deployment-matrix.

Landed POST /api/ai/translate supporting real-time clinical notes and patient communication translation across 11 languages (Spanish, Mandarin, Cantonese, Vietnamese, Arabic, Tagalog, Korean, Russian, French, Haitian Creole, Portuguese) with strict medical terminology grounding, patient-friendly explanation, and clinician review gates.

Integrated automated provider exclusion screening against federal OIG-LEIE and NPPES registries directly into the deterministic six-condition settlement gate. A provider flagged on an exclusion list halts the instruction with a typed refusal before money can move.

Engineered native ISO 20022 pain.001 credit transfer generation and pain.002 / camt.053 return webhook parsers for direct Straight-Through Processing (STP) against Column Bank and FedNow instant payment rails.

The settlement ledger (SettlementLedgerEntry) is append-only and hash-chained per clinic: entryHash = SHA-256(canonical(entry) + previousHash), with previousHash pointing at the prior entry or GENESIS for a clinic's first. Appends take a per-clinic advisory lock so the chain cannot fork, and there is no update or delete path — corrections are compensating entries. verifyChain re-walks a clinic's chain and reports HASH_MISMATCH, PREV_MISMATCH, FORK, ORPHAN or CYCLE; it backs /api/admin/bank-audit, which returns its result verbatim rather than defaulting to verified. Deliberately a self-recomputable hash chain, not a KMS signature — Cloud KMS signs the Settlement Instruction, not the ledger hash.

The Claim and Remittance money fields were migrated off floating-point dollars onto conserving integer cents. This removes float drift from the claim-to-remittance path so the reconciliation waterfall can preserve the cent total exactly.

ProviderWallet balances converted from float dollars to drift-safe integer cents. Establishes the integer-cent boundary for wallet reads and writes so no rounding can accumulate across postings.

Added GET /api/op-note/[id] so a saved operative note rehydrates its modal on a fresh session rather than only within the authoring tab. Scoped to your organization; returns a typed refusal rather than a fabricated record when the note is absent.

Wired the authorization flows that govern clinic and provider onboarding — who may enroll an entity and what each role may do once enrolled. Authorization stays scoped; the onboarding path fails closed rather than defaulting a caller into access it was not granted.

Four deterministic boundaries for the agent rail, each proposing but never disposing on the clinical or money path:

• T1 — deterministic triage-ticket generation (the same inputs produce the same ticket).
• T2 — an eligibility-before-billing gate, so billing cannot proceed ahead of an eligibility check.
• T3 — a referral external-disclosure consent boundary, so an outbound referral requires recorded consent before disclosure.
• T4 — act-on-classification claim resubmission, deriving the resubmission action deterministically from the denial classification.

Landed the imaging device-grading engine over DICOM: the grading engine itself, a fail-close posture when an imaging dependency is unconfigured, and authenticated event ingestion so device events cannot be injected unauthenticated. Grades are proposed for human disposition, never auto-applied to a chart.

Encoded the Software-as-a-Medical-Device boundary in code: model outputs are framed as screening and triage signals for a clinician to dispose, explicitly not a diagnosis. The boundary keeps the product on the honest side of its regulatory line rather than implying diagnostic authority.