Verified-green
Hash-chained WORM double-entry ledgerAppend-only double-entry ledger with chain verification and fork/orphan/cycle detection; verified-green at HEAD, sandbox only (no real dollar has moved).
Verified-green
Six-condition settlement gate (sole money authorizer)Deterministic conjunction is the only path that authorizes an instruction; a single failed condition halts. POST /api/settlement/gate/[encounterId] returns a PHI-free disposition. Tested code, not production money.
Verified-green
OIG-LEIE + NPPES screening inside the money pathLive provider-legitimacy screening wired as gate condition 6; screening runs in the settlement path, not as an afterthought.
Verified-green
835 reconciliation waterfallSHA-256 deduped, conserving integer-cent allocation pool -> fee -> reserve -> residual; posted via /api/settlement/era-post and /api/claims/era-post. Cent-conserving on test remittances.
Verified-green
Settlement console execution behind the gatePOST /api/settlement/console/[instructionId]/execute executes only gate-cleared instructions; instructions listed via /api/settlement/instructions/[encounterId]. Sandbox executors only.
Verified-green
Swappable executors under the gateColumn-direct, M&T batch-wire (proprietary batch format), FedNow pacs.008 (certification-ready messages + full inbound parser set), hub delegation; Modern Treasury demoted to a removable config-selected adapter. Interfaces real; no live rail enabled.
Verified-green
Two structurally separated money loopsPayer-advance money never touches patient/retail money (ADR-004) enforced by a code tripwire; separation is convention+tripwire today, not FK-impossible (tracked delta).
Verified-green
Claim lifecycle endpointsSubmit, 837I generation, scrub, status, appeal, resubmit under /api/claims/*; scrubber-clearance and NCCI coding validation present as gate inputs. Verified against test claims.
Verified-green
Pre-payout duplicate-claim verification276/277 duplicate-claim check runs before payout as a gate input alongside signature immutability and scrubber clearance.
Verified-green
Credentialing compositeComposite credentialing check behind a warn->enforce lever; provider roster via /api/providers. Enrollment is warn-only today (identity/enrollment gate condition is a known delta).
Verified-green
Eligibility (270/271)POST /api/eligibility/verify and GET /api/eligibility/roster return typed eligibility results; fail-closed when the payer connector is unconfigured.
Verified-green
EMR OAuth syncPOST /api/emr-sync/connections, GET /api/emr-sync/authorize, GET|POST /api/emr-sync/callback plus Nextech Practice+ and IntelleChart pull. Nextech Partner API provisioned/verified; IntelleChart SMART client code-complete pending registration.
Verified-green
Clinical cockpit (ophthalmology-first EMR)Exam cockpit, device ingestion (Zeiss/HL7 with 'device fills, clinician wins' merge), diagnostic visualization rendering measured data only, CDS engines advisory-only by invariant, prior-auth CRD->DTR->PAS, MIPS calculators, MPI golden record, e-Rx.
Verified-green
Interoperability surfaceFHIR, C-CDA, Connie HIE, Blue Button, UDAP/TEFCA endpoints present under /api/fhir, /api/cda, /api/interop, /api/smart; SMART app-launch scaffolding built.
Verified-green
RCM cockpitDenial intelligence, appeals (RAG-assisted, propose-only), AR aging, underpayments, rate-floor/rate intel, work queue, KPIs under /api/rcm/*. Analytics on test data.
Verified-green
Counterparty verification + pool controlsACH micro-deposit counterparty verification, advance pool with FBO separation, inbound-receipt mirroring implemented; advanceAmountCents=0 and rails ship flag-off/fail-closed.
Verified-green
Fail-closed doctrine enforced in codeUnconfigured integrations return typed refusals with zero network calls; a money flag with an unrecognized value resolves to enforce, never off; kill-switch and DB-halt chokepoints sit above every executor.
Verified-green
Propose-never-dispose on clinical + money pathsAI/automation (interpreter billing codes, coding levels, appeal drafts, merge candidates) suggest; a human disposes. No auto-disposition on clinical or money paths.