Verified-green
Hash-chained WORM double-entry ledgerAppend-only double-entry ledger with chain verification and fork/orphan/cycle detection; verified-green in the current build.
Verified-green
Six-condition settlement gate (sole money authorizer)Deterministic conjunction is the only path that authorizes an instruction; a single failed condition halts, and the disposition it returns carries no PHI. Tested code, not production money.
Verified-green
OIG-LEIE + NPPES screening inside the money pathLive provider-legitimacy screening is wired in as a gate condition; screening runs inside the settlement path, not as an afterthought.
Verified-green
835 reconciliation waterfallDeduplicated and cent-conserving across the full allocation waterfall — pool, fee, reserve, residual — in integer cents. Verified on test remittances.
Verified-green
Settlement console execution behind the gateThe console can execute only instructions the gate has already cleared. Sandbox executors only.
Verified-green
Swappable executors under the gateDirect-bank, batch-wire, FedNow message sets and hub delegation are implemented against published specifications behind a common interface, so any one executor is replaceable. Interfaces real; no live rail enabled.
Verified-green
Two structurally separated money loopsPayer-advance money never touches patient or retail money. The separation is enforced in code and covered by tests; further hardening is tracked internally.
Verified-green
Claim lifecycle endpointsSubmit, 837I generation, scrub, status, appeal and resubmit are implemented, with scrubber clearance and NCCI coding validation as gate inputs. Verified against test claims.
Verified-green
Pre-payout duplicate-claim verification276/277 duplicate-claim check runs before payout as a gate input alongside signature immutability and scrubber clearance.
Verified-green
Credentialing compositeComposite credentialing check with primary-source verification and sanctions screening, staged behind an enforcement lever. Provider roster maintained alongside it.
Verified-green
Eligibility (270/271)Returns typed eligibility results, and fails closed when the payer connector is unconfigured rather than guessing coverage.
Verified-green
EMR OAuth syncStandards-based EMR connection, authorization and scheduled pull are implemented, with per-tenant credentials sealed at rest. Vendor-specific connectors are enabled per practice.
Verified-green
Clinical cockpit (ophthalmology-first EMR)Exam cockpit, HL7 device ingestion on a 'device fills, clinician wins' merge rule, diagnostic visualization that renders measured data only, advisory-only CDS, prior authorization, MIPS calculators, master patient index and e-Rx.
Verified-green
Interoperability surfaceFHIR, C-CDA, health-information-exchange, Blue Button and UDAP/TEFCA surfaces are implemented, with SMART app launch scaffolded.
Verified-green
RCM cockpitDenial intelligence, propose-only appeal drafting, A/R aging, underpayment detection, rate intelligence, work queue and KPIs. Analytics on test data.
Verified-green
Counterparty verification + pool controlsACH micro-deposit counterparty verification, an advance pool with FBO separation, and inbound-receipt mirroring are implemented. Advance amounts are pinned at zero and every rail ships flag-off and fail-closed.
Verified-green
Fail-closed doctrine enforced in codeUnconfigured integrations return typed refusals without making a network call, an unrecognized money flag resolves to enforce rather than off, and independent halt controls sit above every executor.
Verified-green
Propose-never-dispose on clinical + money pathsAI/automation (interpreter billing codes, coding levels, appeal drafts, merge candidates) suggest; a human disposes. No auto-disposition on clinical or money paths.
Verified-green
All 10 guardrails & WORM attestations (G1–G10) signed and sealedAll 15 automated CI guardrail checks and all 4 operational attestation rails (G3 ambient-scribe consent, G4 Non-Device CDS & DIA exclusion, G8 HIPAA risk analysis + 11-instrument BAA register, G9 30-day 3-way reconciliation cadence) are signed and linked in an RFC 8785 SHA-256 WORM attestation chain.
Verified-green
Identity & payer enrollment blocking gate condition (enforce-enrollment)Promoted on Condition 6 of the settlement gate: PROVIDER_NOT_ENROLLED, PROVIDER_ENROLLMENT_UNVERIFIED, and COUNTERPARTY_IDENTITY_UNVERIFIED act as deterministic hard-blocking gate conditions when strict enrollment enforcement is active.
Verified-green
BSA/AML, OFAC SDN, structuring velocity & dual-control gate engineDeterministic integer-cents compliance gate enforcing OFAC SDN freshness, KYB micro-deposit + HMAC verification, $10,000 CTR dual-control officer signatures, $3,000–$9,999.99 SAR structuring detection, and FBO Agent-of-the-Payee two-loop separation.
Verified-green
IEC 62304 / ISO 14971 FMEA & Cures Act §3060(a) Non-Device CDS governanceMachine-verifiable IEC 62304 Class A/B/C surface classification, 8-hazard ISO 14971 FMEA risk-control traceability matrix (H-01 through H-08), and 4-criterion FD&C Act §520(o)(1)(E) Non-Device CDS verification.
Verified-green
HIPAA §164.308 Security Risk Analysis & 11-instrument BAA registerNIST SP 800-30 Rev. 1 Risk Analysis (SHTEG-RA-2026-001), 8 HIPAA §164.316 security policies (POL-SEC-001 through POL-SEC-008), and the 11-instrument CE↔BA and subcontractor BAA register are adopted, signed, and WORM-anchored.