From 94bac41290dbf6537e8715e13d70067997ee6c87 Mon Sep 17 00:00:00 2001 From: sudoshi Date: Thu, 6 Aug 2026 20:14:12 -0400 Subject: [PATCH] docs(nightingale): record production cohort verification --- ...investor-demo-patient-cohort-2026-08-06.md | 135 ++++++++++++++++++ .../README.md | 29 +++- ...investor-demo-patient-cohort-2026-07-27.md | 117 ++++++++++----- 3 files changed, 243 insertions(+), 38 deletions(-) create mode 100644 docs/devlog/DEVLOG-nightingale-investor-demo-patient-cohort-2026-08-06.md diff --git a/docs/devlog/DEVLOG-nightingale-investor-demo-patient-cohort-2026-08-06.md b/docs/devlog/DEVLOG-nightingale-investor-demo-patient-cohort-2026-08-06.md new file mode 100644 index 00000000..4b5e610e --- /dev/null +++ b/docs/devlog/DEVLOG-nightingale-investor-demo-patient-cohort-2026-08-06.md @@ -0,0 +1,135 @@ +# Nightingale Five-Patient Investor-Demo Cohort Devlog + +**Execution date:** 2026-08-06 + +**Plan:** +[nightingale-investor-demo-patient-cohort-2026-07-27.md](../plans/nightingale-investor-demo-patient-cohort-2026-07-27.md) + +**Reusable evidence:** +[investor-demo-cohort-planning-2026-07-27](../evidence/nightingale/investor-demo-cohort-planning-2026-07-27/README.md) + +**Disposition:** production cohort complete; demo only; not clinically approved; public +WAN smoke should be repeated after the contemporaneous network outage clears + +## Outcome + +Five isolated Nightingale investor-demo accounts are provisioned in production against +five governed MS-DRG pathway bindings. Each account owns one synthetic principal, +identity link, operational encounter, access grant, and six released patient-safe +synthetic projections. The cohort passed live authentication, projection, cache-control, +cross-account isolation, kill-switch, restoration, idempotency, and post-proof credential +cleanup checks. + +The repository contains no demo password or token. Runtime credential entry used only the +provisioner's non-echoing prompt. Outputs retained here are cardinalities and non-secret +states only. + +## Release lineage + +| Gate | Evidence | +| --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | +| Foundation ownership | Protected-main PR #111 owns the activation/disclosure gates, 63 governance documents, privacy manifest, foundation configuration, and app-identity uniqueness check; none were duplicated. | +| Cohort implementation | PR #118 merged as `06e3d0b363f2ef553f857aa426f220ccff7fc8a4`. | +| Catalog-identity correction | PR #121 passed all 19 exact-head jobs and merged as `ce9202cc70245afd4c2df1c1ed6620709978753d`. | +| Main verdict | The exact merged main SHA passed the required CI verdict. | +| Deployment | Canonical `./deploy.sh --check` passed; confirmed canonical apply installed exact SHA `ce9202cc70245afd4c2df1c1ed6620709978753d`. | +| Migrations | None required or executed. | + +The catalog correction replaced a non-portable generated fixture UUID assertion with an +immutable dataset identity: dataset key, source CSV SHA-256, verification workbook +SHA-256, declared-baseline SHA-256, grouper version, all aggregate control totals, +inactive state, and zero clinical signoff. It still records the environment-local UUID +as provenance after the immutable evidence match succeeds. + +## Verification before production writes + +Local and exact-SHA CI evidence included: + +- 210 Patient feature tests and 3,580 assertions with no failures; +- focused catalog-drift, authentication, adoption, rotation, suspend, replay, and + cross-account tests; +- full repository Pint and secret scanning; +- canonical iOS simulator, Release, artifact-boundary, and transport checks from + `hummingbird/iosPatientApp`; +- canonical Android JVM, Release, API 35 emulator, artifact-boundary, and transport + checks from `hummingbird/androidPatientApp`; and +- seven unique iOS identifiers and two unique Android identifiers under the PR #111 + fail-closed uniqueness check. + +The production preview was read-only and proved an empty owned cohort, the single exact +inactive/unsigned catalog release, all five pathway/DRG bindings, unit 85, and the +pre-existing reference sample's readiness for in-place adoption as `demo1`. + +## Production apply and read-after-write proof + +The atomic apply returned exactly: + +| State | Count | +| -------------------------------- | ----: | +| Active synthetic principals | 5 | +| Identity links | 5 | +| Active encounter grants | 5 | +| Operational synthetic encounters | 5 | +| Released synthetic projections | 30 | +| Projection kinds per account | 6 | +| Accounts permitting clinical use | 0 | + +The account-to-pathway result was: + +| Handle | MS-DRG | Scenario | Stages | Milestones | +| ------- | ------ | ----------------------------------------------------------------------------------- | -----: | ---------: | +| `demo1` | `293` | Heart Failure and Shock without CC/MCC | 5 | 41 | +| `demo2` | `195` | Simple Pneumonia and Pleurisy without CC/MCC | 5 | 44 | +| `demo3` | `470` | Major Hip and Knee Joint Replacement or Reattachment of Lower Extremity without MCC | 5 | 49 | +| `demo4` | `399` | Appendix Procedures without CC/MCC | 5 | 36 | +| `demo5` | `807` | Vaginal Delivery without Sterilization or D&C without CC/MCC | 5 | 44 | + +Black-box production API verification checked all five logins and all six projections per +account. It observed 30 successful projection responses, 30 exact demo notices, and 55 +checked responses with `Cache-Control: no-store`. Every one of the 20 directed +cross-account pathway substitutions returned the same generic content-free 404 without +echoing the owner handle or encounter UUID. The append-only audit independently recorded +5 token issues, 5 encounter disclosures, 30 projection disclosures, and 20 matching +`projection_not_available` isolation denials with no grant disclosure. + +## Kill switch, recovery, and resting state + +The exact-confirmation suspend action disabled all five owned accounts and grants and +revoked their active session/token families. Database proof then showed five suspended +principals, zero active sessions, and zero tokens. Five live login attempts all returned +the same generic `401 invalid_credentials` response. + +The exact-confirmation re-apply restored all five accounts with the runtime-only password +and did not duplicate any owned row. Structural verification passed, and five live login +attempts returned bearer-token success. A final idempotent apply rotated the credential +hashes and revoked those test sessions and tokens. Final read-after-write state: + +- five active synthetic demo principals; +- five exact identity/encounter/grant relationships; +- 30 released synthetic projections; +- zero active sessions; +- zero access or refresh tokens; +- catalog state `inactive`; +- zero catalog clinical signoffs; and +- clinical use prohibited for every demo account and projection. + +## Deployment outage note + +The canonical deployment performed its source, exact-SHA, remote-checkout, dependency, +asset-build, release-sync, cache, service-restart, and HTTP-vhost stages successfully. +Its final public-DNS HTTPS probe could not connect during the acknowledged WAN outage. +Read-only checks over the documented internal production route proved the exact release +marker, active Apache/queue/Arena services, production-built assets through the Zephyrus +TLS vhost, required edge headers, sensitive-path denial, TRACE rejection, installed edge +contract, and Laravel storage permissions. No deployment script, production configuration, +DNS, SSH configuration, or application code was altered to bypass the outage. Repeat the +ordinary public-WAN smoke after connectivity returns; no cohort mutation is required. + +## Product-boundary confirmation + +- `hummingbird/iosPatientApp` is the canonical TestFlight patient app. +- `hummingbird/androidPatientApp` is its canonical Android counterpart. +- `nightingale/iosApp` and `nightingale/androidApp` remain superseded and untouched. +- PR #111 remains the sole owner of the previously salvaged foundation assets. +- The demo projection layer remains separate from raw draft pathway prose and from any + clinical approval, activation, pilot, or real-patient claim. diff --git a/docs/evidence/nightingale/investor-demo-cohort-planning-2026-07-27/README.md b/docs/evidence/nightingale/investor-demo-cohort-planning-2026-07-27/README.md index 74bc0e48..d5b450dc 100644 --- a/docs/evidence/nightingale/investor-demo-cohort-planning-2026-07-27/README.md +++ b/docs/evidence/nightingale/investor-demo-cohort-planning-2026-07-27/README.md @@ -2,6 +2,11 @@ **Observed:** 2026-07-27 +**Production execution addendum:** 2026-08-06 + +**Execution log:** +[DEVLOG-nightingale-investor-demo-patient-cohort-2026-08-06.md](../../../devlog/DEVLOG-nightingale-investor-demo-patient-cohort-2026-08-06.md) + **Database access:** PostgreSQL TLS session, repeatable-read read-only transaction **Mutation:** none @@ -118,10 +123,22 @@ authorization to provision. - App identity: the merged PR #111 uniqueness guard reports seven unique iOS identifiers and two unique Android identifiers in the reconciled checkout. -PR #118 passed all 19 required checks, merged through protected `main` as -`06e3d0b363f2ef553f857aa426f220ccff7fc8a4`, and is present in the canonically deployed -`main` release `a38044ca9f0df564b7de08cf915bdcc189a4d860`. The first production cohort preview -failed closed before any account write because the implementation had pinned a generated +PR #118 passed all 19 required checks and merged through protected `main` as +`06e3d0b363f2ef553f857aa426f220ccff7fc8a4`. The first production cohort preview failed +closed before any account write because the implementation had pinned a generated fixture release UUID. No cohort principal, credential, grant, encounter, projection, -session, or token was created. A semantic catalog-identity correction is now the only -code gate before the production preview/apply/verify/suspend-and-reapply sequence. +session, or token was created by that attempt. + +PR #121 replaced the UUID pin with the evidence-defined identity above, passed all 19 +exact-head checks, and merged as `ce9202cc70245afd4c2df1c1ed6620709978753d`. +The corrected provisioner was deployed through the canonical release path. Production +preview, apply, verify, five-account live reads, 20 directed isolation denials, suspend, +five disabled-account login denials, re-apply, restored logins, and final session/token +cleanup all passed. The final resting state is five active synthetic principals, five +identity links, five grants, five operational encounters, 30 released synthetic +projections, zero active sessions, and zero tokens. The catalog remains inactive, has +zero clinical signoffs, and was not modified or activated. + +No retained evidence contains the shared password, its hash, bearer or refresh tokens, +session secrets, patient source identifiers, or raw catalog prose. Full redacted +cardinalities, deployment proof, and outage disposition are in the paired execution log. diff --git a/docs/plans/nightingale-investor-demo-patient-cohort-2026-07-27.md b/docs/plans/nightingale-investor-demo-patient-cohort-2026-07-27.md index c0f44d2b..13ba9438 100644 --- a/docs/plans/nightingale-investor-demo-patient-cohort-2026-07-27.md +++ b/docs/plans/nightingale-investor-demo-patient-cohort-2026-07-27.md @@ -2,8 +2,12 @@ **Date:** 2026-07-27 -**Status:** implementation released; production provisioning gated on catalog-identity -correction and final operational proof +**Status:** production cohort provisioned, isolated, kill-switch rehearsed, restored, and +verified; public-WAN smoke recheck remains an outage-recovery observation, not a cohort +correctness gate + +**Execution log:** +[DEVLOG-nightingale-investor-demo-patient-cohort-2026-08-06.md](../devlog/DEVLOG-nightingale-investor-demo-patient-cohort-2026-08-06.md) **Scope:** five synthetic Nightingale demo accounts, five isolated inpatient scenarios, five exact MS-DRG bindings, safe in-place adoption of the existing reference sample, and @@ -450,36 +454,27 @@ present in the subsequently deployed `main` commit in addition to email-shaped identifiers; and - backend, iOS, and Android tests for alias boundaries and token-route compatibility. -| Work section | Status | Current evidence | -| ---------------------------------------------------------------------------------------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------------- | -| Code-owned five-member scenario and exact DRG manifest | Complete | Five exact pathway keys, codebook titles, stage counts, and milestone counts are pinned in code and tests. | -| Patient-safe projection generation and catalog-content separation | Complete | Six synthetic projections per account; persistent notice and raw catalog-prose exclusion are asserted. | -| Exact alias authentication and account-isolation boundary | Complete | Email compatibility plus exact aliases; all 20 directed cross-account substitutions return generic denial. | -| Atomic PostgreSQL preview/apply/verify/suspend implementation | Complete | Serializable/advisory-locked apply, read-only preview/verify, rotation, suspend, and re-apply pass within 208 Patient tests/3,569 assertions. | -| Runtime-secret and command safety | Complete | Hidden prompt only, no password/secret/credential CLI option, exact distinct confirmations, one-way hashing, and redacted results. | -| Existing reference sample adopted as `demo1` | Complete | Primary identity and encounter are preserved; changed lifecycle, contact data, or pre-existing linkage fails before cohort writes. | -| Canonical iOS exact-alias implementation and simulator regression | Complete | 67 unit tests, nine UI journeys, Release build, artifact boundary, and transport check pass in `hummingbird/iosPatientApp`. | -| Canonical Android exact-alias implementation and JVM regression | Complete | Debug/release unit, lint, build, artifact-boundary, and transport checks pass in `hummingbird/androidPatientApp`. | -| Canonical Android API 35 connected-emulator regression | Complete | All 16 tests pass at 1080×2400/420 dpi; tab changes reset shared content scroll to keep revision and urgent context visible. | -| PR #111 reconciliation without duplicate salvaged artifacts | Complete | Cohort is rebased directly on the protected-main #111 merge; all live/foundation config keys remain and only the default-off demo gate is added. | -| Successor PR, exact-SHA CI, protected-main merge, and canonical deployment | Complete | PR #118 passed all 19 required jobs, merged as `06e3d0b3`, and remains present in canonically deployed `main` `a38044ca`. | -| Portable, fail-closed catalog release identity | Active | First production preview made no writes and exposed a generated-fixture UUID pin; correction now requires dataset key, three hashes, and controls. | -| Production preview, atomic apply to unit 85, five live logins, read-after-write, and kill test | Pending | Production remains unchanged beyond the pre-existing inactive reference sample; the failed preview was read-only. | - -Remaining gates before production apply are: - -1. prove the semantic catalog-identity correction locally and in exact-SHA CI; -2. merge the correction through protected `main`; -3. deploy it through `./deploy.sh --check` and the confirmed canonical apply; -4. rerun production preview against the explicit synthetic-demo unit 85 and require the - observed production release UUID plus zero cohort counts; -5. perform one confirmed production apply using the non-echoing runtime prompt; -6. execute read-after-write verification and all five live logins without retaining - tokens or credential material; -7. rehearse suspension, prove all five credentials and grants are disabled, re-apply the - same runtime-only credential, and repeat final verification and live-login checks; -8. retain only redacted cardinality, isolation, lineage, and rollback evidence; and -9. keep the suspend command immediately available as the cohort kill switch. +| Work section | Status | Current evidence | +| ---------------------------------------------------------------------------------------------- | -------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | +| Code-owned five-member scenario and exact DRG manifest | Complete | Five exact pathway keys, codebook titles, stage counts, and milestone counts are pinned in code and tests. | +| Patient-safe projection generation and catalog-content separation | Complete | Six synthetic projections per account; persistent notice and raw catalog-prose exclusion are asserted. | +| Exact alias authentication and account-isolation boundary | Complete | Email compatibility plus exact aliases; all 20 directed cross-account substitutions return generic denial. | +| Atomic PostgreSQL preview/apply/verify/suspend implementation | Complete | Serializable/advisory-locked apply, read-only preview/verify, rotation, suspend, and re-apply pass within 210 Patient tests/3,580 assertions. | +| Runtime-secret and command safety | Complete | Hidden prompt only, no password/secret/credential CLI option, exact distinct confirmations, one-way hashing, and redacted results. | +| Existing reference sample adopted as `demo1` | Complete | Primary identity and encounter are preserved; changed lifecycle, contact data, or pre-existing linkage fails before cohort writes. | +| Canonical iOS exact-alias implementation and simulator regression | Complete | 67 unit tests, nine UI journeys, Release build, artifact boundary, and transport check pass in `hummingbird/iosPatientApp`. | +| Canonical Android exact-alias implementation and JVM regression | Complete | Debug/release unit, lint, build, artifact-boundary, and transport checks pass in `hummingbird/androidPatientApp`. | +| Canonical Android API 35 connected-emulator regression | Complete | All 16 tests pass at 1080×2400/420 dpi; tab changes reset shared content scroll to keep revision and urgent context visible. | +| PR #111 reconciliation without duplicate salvaged artifacts | Complete | Cohort is rebased directly on the protected-main #111 merge; all live/foundation config keys remain and only the default-off demo gate is added. | +| Successor PR, exact-SHA CI, protected-main merge, and canonical deployment | Complete | PR #118 merged as `06e3d0b3`; correction PR #121 passed all 19 jobs, merged as `ce9202cc`, and that exact SHA is deployed. | +| Portable, fail-closed catalog release identity | Complete | Dataset key, three evidence hashes, every aggregate/governance control, and environment-local UUID propagation pass locally, in CI, and production. | +| Production preview, atomic apply to unit 85, five live logins, read-after-write, and kill test | Complete | Zero-write preview, five-account apply, 30 projection reads, 20 isolation denials, suspend, five denied logins, re-apply, and final cleanup passed. | + +All production-apply gates are closed. The exact-SHA correction was merged and deployed; +the zero-write preview reconciled the expected release and an empty cohort; the atomic +apply, read-after-write checks, five-account live proof, directed isolation matrix, +suspension, disabled-login proof, re-apply, restored-login proof, and final session/token +cleanup all passed. The suspend command remains the immediate cohort kill switch. ### 11.1 Production catalog-identity reconciliation (2026-08-05) @@ -510,3 +505,61 @@ aggregate and governance control above, and then propagates the observed UUID in account's immutable binding digest and product-owned preferences. Any fingerprint, control, state, binding, stage count, or milestone count mismatch still fails before the first cohort write. This reconciliation does not approve or activate the catalog. + +### 11.2 Production execution closure (2026-08-06) + +Protected-main PR #121 passed all 19 required exact-head checks and merged as +`ce9202cc70245afd4c2df1c1ed6620709978753d`. Main's exact-SHA verdict passed, and the +canonical deploy preflight verified the clean synchronized source, CI verdict, remote +checkout, and operator prerequisites. The confirmed canonical deployment installed that +exact release, built production assets, refreshed caches, and restarted Apache, the queue +worker, and Arena. A contemporaneous WAN outage prevented the script's final public-DNS +HTTPS request from connecting. Read-only verification over the documented internal path +then proved the exact `.release-commit`, all three active services, the Zephyrus HTTP +vhost, production Vite assets over its TLS vhost, required security headers, sensitive- +path denials, TRACE rejection, the installed edge-security contract, and writable +Laravel storage. No alternate deployment script, direct production pull, environment +change, DNS change, SSH configuration change, or migration was used. + +The production preview against explicit synthetic-demo unit 85 returned: + +- release UUID `019f8702-a824-7172-b1dc-ab3612d2f1e8`, state `inactive`, and clinical + signoff incomplete; +- exactly `demo1` through `demo5` ready for reconciliation; +- zero cohort principals, identity links, encounter grants, sessions, tokens, or + projections; and +- the existing reference sample ready for in-place `demo1` adoption. + +The confirmed apply used the non-echoing runtime prompt and transient provisioning gate. +It produced exactly five active synthetic principals, five identity links, five grants, +five operational encounters, and 30 released synthetic projections. `demo1` retained the +reference sample's identity and encounter lineage. The other four members converged to +their deterministic cohort-owned identities. Each account reconciled to its exact DRG, +five draft stages, and the expected milestone count. Credential material was neither +accepted as a command option nor emitted in output. + +Live black-box verification through the production TLS vhost proved: + +- five successful token exchanges and five one-encounter lists; +- all 30 owned projection reads, six kinds per account; +- the exact demo/non-clinical-use notice on all 30 projections; +- `Cache-Control: no-store` on all 55 successful and denied patient responses checked; +- all 20 directed cross-account pathway substitutions returning generic content-free + `404 not_found` responses without the target encounter handle or alias; and +- matching append-only audit totals of 5 token issues, 5 encounter disclosures, + 30 projection disclosures, and 20 isolation denials. + +The kill-switch rehearsal suspended all five owned principals, removed every active +session and token, and caused all five live login attempts to return the identical +generic credential denial. Re-apply restored the five accounts without duplicating a +principal, identity, encounter, grant, policy, projection, or binding. All five live +logins then succeeded. One final credential rotation revoked those verification sessions +and tokens. The production resting state is five active demo principals, five exact +one-to-one encounters, 30 projections, zero active sessions, and zero tokens. The +catalog remains inactive, unsigned, unchanged, and explicitly non-clinical. + +No retained evidence contains the shared password, a password hash, bearer token, +refresh token, session secret, patient source identifier, or raw catalog clinical prose. +No code or build action targeted the superseded `nightingale/iosApp` or +`nightingale/androidApp`; the canonical clients remain `hummingbird/iosPatientApp` and +`hummingbird/androidPatientApp`.