Establish independent Nightingale patient product foundation

.appledeploy.example

@@ -40,7 +40,7 @@ HUMMINGBIRD_SCHEME=Hummingbird
 NIGHTINGALE_NAME="Zephyrus-Nightingale"
 NIGHTINGALE_APP_ID=
 NIGHTINGALE_BUNDLE_ID=net.acumenus.nightingale
-NIGHTINGALE_DIR=hummingbird/iosPatientApp
+NIGHTINGALE_DIR=nightingale/iosApp
 NIGHTINGALE_XCODEPROJ=Nightingale.xcodeproj
 NIGHTINGALE_SCHEME=Nightingale
 

.gitleaks.toml

@@ -85,22 +85,15 @@ paths = [
 regexes = ['''^drgcp-[a-z0-9-]{26,65}$''']
 
 [[allowlists]]
-# Nightingale patient-journey devlog: the generic API-key rule captures the
-# English phrase "notification/delivery" out of a prose sentence, because the
-# word "API" appears inside its keyword window:
-#
-#   "... concrete identifiers or API paths, notification/delivery
-#    overstatement, offline PHI/queue/stale-current behavior ..."
-#
-# There is no credential here — the captured value is two ordinary words and a
-# slash. Scoped to the exact devlog and that exact phrase; the two SHA-256
-# evidence digests recorded elsewhere in the same file, and every other value
-# in it, remain scanned.
-#
-# The history scan walks all refs, so this fires from any branch for as long as
-# codex/nightingale-patient-product exists. The allowlist therefore has to live
-# on main rather than only on the branch that introduced the file.
-description = "Nightingale devlog prose false positive (notification/delivery)"
+# Historical devlog prose used the adjacent words "API paths, notification",
+# which the generic-api-key rule parsed as a key/value pair and captured the
+# ordinary phrase "notification/delivery". Keep the history exception
+# AND-scoped to the two exact documents and exact captured phrase so no
+# credential-shaped value is exempted.
+description = "Devlog API-path prose false positives"
 condition = "AND"
-paths = ['''^docs/devlog/DEVLOG-nightingale-patient-product-2026-07-26\.md$''']
+paths = [
+  '''^docs/devlog/DEVLOG-nightingale-patient-product-2026-07-26\.md$''',
+  '''^docs/DEVLOG-browser-chain-decouple-2026-07-27\.md$''',
+]
 regexes = ['''^notification/delivery$''']

app/Console/Commands/HummingbirdDraftReferencePatientProjectionsCommand.php

@@ -2,7 +2,7 @@
 
 namespace App\Console\Commands;
 
-use App\Services\Patient\Demo\NightingaleReferenceProjectionDraftProvisioner;
+use App\Services\Patient\Demo\HummingbirdPatientReferenceProjectionDraftProvisioner;
 use Illuminate\Console\Command;
 use Throwable;
 
@@ -17,16 +17,16 @@ class HummingbirdDraftReferencePatientProjectionsCommand extends Command
 
     protected $description = 'Preview or create non-visible draft projections for the pending Hummingbird reference patient';
 
-    public function handle(NightingaleReferenceProjectionDraftProvisioner $provisioner): int
+    public function handle(HummingbirdPatientReferenceProjectionDraftProvisioner $provisioner): int
     {
         if ($this->option('commit')
             && ! hash_equals(
-                NightingaleReferenceProjectionDraftProvisioner::CONFIRMATION,
+                HummingbirdPatientReferenceProjectionDraftProvisioner::CONFIRMATION,
                 (string) $this->option('confirm-draft-only'),
             )) {
             $this->error(
                 '--commit requires --confirm-draft-only='
-                .NightingaleReferenceProjectionDraftProvisioner::CONFIRMATION,
+                .HummingbirdPatientReferenceProjectionDraftProvisioner::CONFIRMATION,
             );
 
             return self::INVALID;

app/Console/Commands/HummingbirdProvisionReferencePatientIdentityCommand.php

@@ -2,7 +2,7 @@
 
 namespace App\Console\Commands;
 
-use App\Services\Patient\Demo\NightingaleReferenceIdentityProvisioner;
+use App\Services\Patient\Demo\HummingbirdPatientReferenceIdentityProvisioner;
 use Illuminate\Console\Command;
 use Throwable;
 
@@ -17,7 +17,7 @@ class HummingbirdProvisionReferencePatientIdentityCommand extends Command
 
     protected $description = 'Dry-run or idempotently bind the command-owned synthetic inpatient to Hummingbird Patient enrollment';
 
-    public function handle(NightingaleReferenceIdentityProvisioner $provisioner): int
+    public function handle(HummingbirdPatientReferenceIdentityProvisioner $provisioner): int
     {
         if ($this->option('show-secrets') && ! $this->option('commit')) {
             $this->error('--show-secrets requires --commit because enrollment material is generated only once.');

app/Http/Controllers/Api/Patient/MessagingController.php

@@ -61,10 +61,10 @@ public function store(CreateMessageThreadRequest $request, string $encounterUuid
             $principal = $request->user();
             $input = $request->validated();
             $result = match ($input['topic_code'] ?? null) {
-                'care_preference' => (bool) config('nightingale.features.care_preferences')
+                'care_preference' => (bool) config('hummingbird-patient.features.care_preferences')
                     ? $this->carePreferences->submit($request, $principal, $encounterUuid, $input)
                     : $this->messaging->createThread($request, $principal, $encounterUuid, $input),
-                'patient_goal' => (bool) config('nightingale.features.patient_goals')
+                'patient_goal' => (bool) config('hummingbird-patient.features.patient_goals')
                     ? $this->patientGoals->submit($request, $principal, $encounterUuid, $input)
                     : $this->messaging->createThread($request, $principal, $encounterUuid, $input),
                 default => $this->messaging->createThread($request, $principal, $encounterUuid, $input),

app/Http/Middleware/EnsureNightingaleEnabled.php → app/Http/Middleware/EnsureHummingbirdPatientEnabled.php

@@ -8,13 +8,13 @@
 use Illuminate\Http\Request;
 use Symfony\Component\HttpFoundation\Response;
 
-class EnsureNightingaleEnabled
+class EnsureHummingbirdPatientEnabled
 {
     public function __construct(private readonly PatientHmac $hmac) {}
 
     public function handle(Request $request, Closure $next): Response
     {
-        if (! config('nightingale.enabled', false)) {
+        if (! config('hummingbird-patient.enabled', false)) {
             return $this->notFound();
         }
 

app/Http/Middleware/EnsureNightingaleFeatureEnabled.php → app/Http/Middleware/EnsureHummingbirdPatientFeatureEnabled.php

@@ -7,11 +7,11 @@
 use Illuminate\Http\Request;
 use Symfony\Component\HttpFoundation\Response;
 
-class EnsureNightingaleFeatureEnabled
+class EnsureHummingbirdPatientFeatureEnabled
 {
     public function handle(Request $request, Closure $next, string $feature): Response
     {
-        if (! config("nightingale.features.{$feature}", false)) {
+        if (! config("hummingbird-patient.features.{$feature}", false)) {
             return $this->notFound();
         }
 

app/Http/Middleware/EnsurePatientStaffMessagingEnabled.php

@@ -11,10 +11,10 @@ class EnsurePatientStaffMessagingEnabled
 {
     public function handle(Request $request, Closure $next): Response
     {
-        if (! (bool) config('nightingale.enabled', false)
-            || ! (bool) config('nightingale.features.messaging', false)
-            || ! (bool) config('nightingale.staff_messaging.enabled', false)
-            || config('nightingale.staff_messaging.governance_status') !== 'approved'
+        if (! (bool) config('hummingbird-patient.enabled', false)
+            || ! (bool) config('hummingbird-patient.features.messaging', false)
+            || ! (bool) config('hummingbird-patient.staff_messaging.enabled', false)
+            || config('hummingbird-patient.staff_messaging.governance_status') !== 'approved'
         ) {
             return $this->notFound();
         }

app/Http/Middleware/HandleInertiaRequests.php

@@ -117,10 +117,10 @@ public function share(Request $request): array
                 'home_hospital' => (bool) config('home_hospital.enabled'),
                 // The staff workspace is visible only when the whole patient
                 // messaging chain and its independent governance gate are live.
-                'patient_communications' => (bool) config('nightingale.enabled', false)
-                    && (bool) config('nightingale.features.messaging', false)
-                    && (bool) config('nightingale.staff_messaging.enabled', false)
-                    && config('nightingale.staff_messaging.governance_status') === 'approved',
+                'patient_communications' => (bool) config('hummingbird-patient.enabled', false)
+                    && (bool) config('hummingbird-patient.features.messaging', false)
+                    && (bool) config('hummingbird-patient.staff_messaging.enabled', false)
+                    && config('hummingbird-patient.staff_messaging.governance_status') === 'approved',
             ],
             'workflow' => $request->session()->get('workflow'),
             'flash' => [

app/Nightingale/Activation/NightingaleActivationDisposition.php

@@ -0,0 +1,15 @@
+<?php
+
+namespace App\Nightingale\Activation;
+
+/**
+ * Route-free result of evaluating the five independent activation gates.
+ *
+ * ContinueToOperationSpecificReleaseEvaluation is deliberately weaker than
+ * access, authorization, disclosure, pilot approval, or production readiness.
+ */
+enum NightingaleActivationDisposition: string
+{
+    case Hold = 'hold';
+    case ContinueToOperationSpecificReleaseEvaluation = 'continue_to_operation_specific_release_evaluation';
+}

app/Nightingale/Activation/NightingaleActivationGate.php

@@ -0,0 +1,32 @@
+<?php
+
+namespace App\Nightingale\Activation;
+
+/**
+ * Keeps approval, content, feature, enrollment, and source deployment
+ * independent and conjunctive.
+ *
+ * This pure gate accepts no identifiers or records and has no route, container
+ * binding, configuration reader, source query, audit writer, or native caller.
+ */
+final class NightingaleActivationGate
+{
+    public function evaluate(
+        NightingaleClinicalApprovalState $clinicalApproval,
+        NightingaleContentReleaseState $contentRelease,
+        NightingaleFeatureActivationState $featureActivation,
+        NightingalePilotEnrollmentState $pilotEnrollment,
+        NightingaleSourceConnectorState $sourceConnector,
+    ): NightingaleActivationDisposition {
+        if (! $clinicalApproval->permitsFurtherEvaluation()
+            || ! $contentRelease->permitsFurtherEvaluation()
+            || ! $featureActivation->permitsFurtherEvaluation()
+            || ! $pilotEnrollment->permitsFurtherEvaluation()
+            || ! $sourceConnector->permitsFurtherEvaluation()
+        ) {
+            return NightingaleActivationDisposition::Hold;
+        }
+
+        return NightingaleActivationDisposition::ContinueToOperationSpecificReleaseEvaluation;
+    }
+}

app/Nightingale/Activation/NightingaleClinicalApprovalState.php

@@ -0,0 +1,21 @@
+<?php
+
+namespace App\Nightingale\Activation;
+
+/**
+ * Institution-owned clinical approval prerequisite.
+ *
+ * Recorded may be emitted only by a future adapter that validates an exact,
+ * current, in-scope approval record. It is not inferred from source data,
+ * pathway verification, clinician use, or another activation prerequisite.
+ */
+enum NightingaleClinicalApprovalState: string
+{
+    case Absent = 'absent';
+    case Recorded = 'recorded';
+
+    public function permitsFurtherEvaluation(): bool
+    {
+        return $this === self::Recorded;
+    }
+}

app/Nightingale/Activation/NightingaleContentReleaseState.php

@@ -0,0 +1,21 @@
+<?php
+
+namespace App\Nightingale\Activation;
+
+/**
+ * Patient-content release prerequisite.
+ *
+ * Released means only that a future content service validated an exact,
+ * audience-specific release. It does not imply clinical approval, feature
+ * activation, patient enrollment, connector deployment, or disclosure.
+ */
+enum NightingaleContentReleaseState: string
+{
+    case Unreleased = 'unreleased';
+    case Released = 'released';
+
+    public function permitsFurtherEvaluation(): bool
+    {
+        return $this === self::Released;
+    }
+}

app/Nightingale/Activation/NightingaleFeatureActivationState.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace App\Nightingale\Activation;
+
+/**
+ * Product feature-switch prerequisite.
+ *
+ * Enabled is an independently governed state and cannot substitute for any
+ * clinical, content, enrollment, source, identity, or authorization decision.
+ */
+enum NightingaleFeatureActivationState: string
+{
+    case Disabled = 'disabled';
+    case Enabled = 'enabled';
+
+    public function permitsFurtherEvaluation(): bool
+    {
+        return $this === self::Enabled;
+    }
+}

app/Nightingale/Activation/NightingalePilotEnrollmentState.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace App\Nightingale\Activation;
+
+/**
+ * Patient/cohort pilot-enrollment prerequisite.
+ *
+ * Enrolled may be emitted only after a future pilot service validates scope,
+ * expiry, exclusions, consent, support coverage, and withdrawal state.
+ */
+enum NightingalePilotEnrollmentState: string
+{
+    case NotEnrolled = 'not_enrolled';
+    case Enrolled = 'enrolled';
+
+    public function permitsFurtherEvaluation(): bool
+    {
+        return $this === self::Enrolled;
+    }
+}

app/Nightingale/Activation/NightingaleSourceConnectorState.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace App\Nightingale\Activation;
+
+/**
+ * Authoritative-source connector deployment prerequisite.
+ *
+ * Deployed may be emitted only after a future source boundary validates the
+ * approved adapter, facility scope, health, version, and rollback posture.
+ */
+enum NightingaleSourceConnectorState: string
+{
+    case Undeployed = 'undeployed';
+    case Deployed = 'deployed';
+
+    public function permitsFurtherEvaluation(): bool
+    {
+        return $this === self::Deployed;
+    }
+}

app/Nightingale/Disclosure/NightingaleDisclosureDisposition.php

@@ -0,0 +1,35 @@
+<?php
+
+namespace App\Nightingale\Disclosure;
+
+/**
+ * Publicly observable disposition of the route-free disclosure foundation.
+ *
+ * ContinueToGovernedProjectionEvaluation is not an authorization or release
+ * decision. A future operation must still pass source, field-release,
+ * freshness, language, correction, audit-before-disclosure, and
+ * serialization-boundary recheck gates.
+ */
+enum NightingaleDisclosureDisposition: string
+{
+    case WithholdNotFound = 'withhold_not_found';
+    case ContinueToGovernedProjectionEvaluation = 'continue_to_governed_projection_evaluation';
+
+    /**
+     * The complete public failure tuple. It intentionally has no message,
+     * internal reason, identifier, retry hint, redirect, or variable field.
+     *
+     * @return null|array{status: int, code: string, cache_control: string}
+     */
+    public function publicFailure(): ?array
+    {
+        return match ($this) {
+            self::WithholdNotFound => [
+                'status' => 404,
+                'code' => 'not_found',
+                'cache_control' => 'private, no-store, max-age=0',
+            ],
+            self::ContinueToGovernedProjectionEvaluation => null,
+        };
+    }
+}

app/Nightingale/Disclosure/NightingaleEncounterBindingState.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace App\Nightingale\Disclosure;
+
+/**
+ * Whether the requested opaque handle remains bound to the request-scoped
+ * current inpatient context at the disclosure boundary.
+ *
+ * No raw handle or encounter identifier crosses this domain seam.
+ */
+enum NightingaleEncounterBindingState: string
+{
+    case MatchesCurrentContext = 'matches_current_context';
+    case WrongEncounter = 'wrong_encounter';
+
+    public function permitsGovernedEvaluation(): bool
+    {
+        return $this === self::MatchesCurrentContext;
+    }
+}