A single system with four layers that share one hash-chained ledger: the sovereign rails that move money, the compliance gate that authorizes it, the ophthalmology-first clinical record that originates it, and the practice economy that surrounds it.
Vendors, banks, and clearinghouses are swappable beneath it. The gate and the ledger are not.
Four layers, verified-green in tested code at HEAD. No real dollar or PHI has crossed into production — that waits on named human and legal gates.
A hash-chained WORM double-entry ledger with fork, orphan, and cycle detection sits at the center. Beneath it, swappable executors: Column direct, M&T batch-wire, and FedNow pacs.008 messages built certification-ready — with Modern Treasury deliberately demoted to a removable adapter. An 835 reconciliation waterfall allocates every remittance in conserving integer cents (pool, fee, reserve, residual), and an advance pool keeps FBO separation. Two money loops are structurally separated so payer advances never touch patient or retail money.
One deterministic gate decides whether any money instruction may fire, evaluating six conditions in conjunction — including live OIG-LEIE and NPPES screening, a credentialing composite behind a warn-to-enforce lever, a pre-payout 276/277 duplicate-claim check, NCCI validation, signature immutability, and scrubber clearance. A single failed condition halts the instruction. A kill-switch and a database-level halt sit above everything. This gate is the constitution of the system and is not swappable.
| Condition | What it checks | Source |
|---|---|---|
| 1Ledger balanced | Double-entry postings reconcile to zero | WORM ledger |
| 2Scrubber clearance | Claim passes clearinghouse scrubbing | Scrubber |
| 3Coding valid | NCCI edits and code pairs validated | NCCI |
| 4Signature immutable | Signed exam field is tamper-evident | Clinical record |
| 5276/277 dup-claim | Pre-payout duplicate-claim inquiry is clear | 276/277 |
| 6Provider screened | Live OIG-LEIE + NPPES; credentialing composite (warn→enforce) | OIG-LEIE · NPPES |
An exam cockpit for eye care with device ingestion (Zeiss and HL7) under a “device fills, clinician wins” merge rule; diagnostic visualization for topography and perimetry that renders measured data only; CDS engines that are advisory by invariant; prior authorization across the real CRD-to-DTR-to-PAS chain; MIPS calculators, an MPI golden record, e-Rx, and interoperability across FHIR, C-CDA, Connie HIE, Blue Button, and UDAP/TEFCA.
“Device fills, clinician wins.”
An RCM cockpit with denial intelligence, appeals, rate-negotiation analytics, and found-money recovery; optical retail with virtual try-on, WooCommerce sync, and POS-ready frame logic; patient engagement with reminders and reputation; a HealthKey patient insurance wallet; and multi-clearinghouse routing with shteg.ai as clearinghouse of record. The economy the loop was built to keep inside the practice.
Executors, banks, clearinghouses, and third-party services all sit behind interfaces and can be replaced by configuration — that is deliberate, so no single vendor can hold the practice hostage. What does not move is the six-condition settlement gate and the hash-chained WORM ledger. That separation is the difference between renting infrastructure and owning it.
Own the core; rent the rest. That is the line between infrastructure you control and infrastructure that controls you.
Encounter (Clinical) → Code (Compliance) → Claim (Economy / Clearinghouse) → Remittance (Rails) → Payout (Rails). The four layers are not separate products; they are one continuous rail with a single ledger underneath.
one system · one ledger · one day.
Fail closed, everywhere.
Propose, never dispose.
The gate is fixed; vendors are swappable.
Honest status registers.
The four layers are real, test-verified code at HEAD. What is gated is the crossing into production reality: no real dollar has moved and no real PHI has flowed, because those wait on named human and legal gates — bank sponsorship and a penny test, BAAs and credentialing, a money-transmission opinion, and clinical go-live with client zero. We keep the register honest so you always know which claim you are reading.
No real dollar has moved. No real PHI has flowed.
What is real: the architecture — hash-chained ledger, settlement gate, and reconciliation waterfall, tested in code at HEAD — the Type-2 organizational NPI and registered HIPAA clearinghouse identity, and the doctrine. We register capability as capability, never as traction.
Six primitives compose the loop. Everything above is an assembly of these — the ledger and the gate are fixed; the rest are interfaces you can wire or swap.
WORM double-entry in integer cents, with fork and cycle detection.
The six-condition authorizer of every money instruction.
Column direct, M&T batch-wire, FedNow pacs.008 behind one interface.
835 allocation: pool → fee → reserve → residual, conserving.
Ophthalmology-first exam record that originates the encounter.
Type-2 org NPI; 837/835 routing with shteg.ai as clearinghouse of record.
Go a level deeper than this page: the settlement architecture, the exact six conditions the gate evaluates in conjunction, the 835 reconciliation waterfall in integer cents, and the typed refusals an unconfigured integration returns instead of a simulated success. The curl beside this returns a disposition, never a fabricated pass.
# Evaluate the six-condition settlement gate for an encounter.
# Money is always integer cents; the gate never fabricates a pass.
curl -X POST https://api.shteg.ai/api/settlement/gate/enc_7Q2X \
-H "Authorization: Bearer $SHTEG_SESSION" \
-H "x-correlation-id: cid_9f31"
# 200 OK — a disposition, not a simulated success:
# {
# "code": "GATE_EVALUATED",
# "passed": false,
# "status": "halted",
# "firstFailed": "provider_screened"
# }