Loading Solutions

Preparing enterprise solutions...

Implementation blueprint

AI Care Concierge & Access Fabric

End-to-end specification: patient-to-provider navigation with offline-first UX, governed ranking, multimodal visits, sync integrity, payments lineage, and audit-grade observability—deployable as a program with explicit gates and no ambiguous handoffs.

Version 2026.04.06

Coverage index

Machine-readable manifest of every major blueprint section—use it to prove no topic was omitted from the program specification.

Section id	Title	Purpose
meta	Metadata	Versioned identity of this blueprint artifact.
sectionManifest	Coverage index	Self-index: enumerates every top-level blueprint key; kept in sync via unit test.
northStar	North star outcomes	Non-negotiable product outcomes for the program.
innovationPillars	Innovation pillars	Strategic differentiators vs marketplaces and maps-only UX.
assuranceFabricLayers	Assurance & evidence fabric	Six cross-cutting layers that operationalize the assurance mesh with mechanisms and audit artifacts.
principles	Design principles	Constraints every team applies when trade-offs appear.
systemComponents	System components	Bounded contexts, owners, and interface classes.
dataFlows	Data flows	Logical pipes, payloads, and contracts between components.
workflows	Workflows	End-to-end procedures with failure modes and mitigations.
adrs	Architecture decisions	Locked decisions with revisit triggers.
crossCuttingPhases	Cross-cutting phases	Program-wide gates parallel to feature delivery.
qualityGates	Quality gates	Release blockers for safety, privacy, fairness.
testStrategy	Test strategy	How confidence is built at each layer.
riskRegister	Risk register	Top risks with mitigation and residual posture.
opsRunbooks	Ops runbooks	Incident response playbooks tied to observability.
securityControls	Security controls	Control → implementation → audit evidence.
complianceArtifacts	Compliance artifacts	Recurring legal/clinical deliverables.
raciMatrix	RACI matrix	Accountability per workstream.
milestoneGraph	Milestone dependency graph	Topological order M0–M12.
milestoneDefinitionOfDone	Milestone definition of done	Binary acceptance per milestone.
dataEntities	Canonical data model	Entities, fields, and relations for persistence.
domainEvents	Domain events	Async integration and analytics spine.
apiSurface	API surface v1	Contract-first REST routes and auth model.
environments	Environment promotion	Path from dev to expanded production.
sloTargets	Numeric SLOs	Measurable reliability targets and windows.
roadmapPhaseLinks	Roadmap ↔ components	Maps program phases to system components and exits.
patientJourneyStates	Patient journey state machine	Explicit UX/analytics states S0–S12.
externalIntegrations	Integration catalog	Partner systems and readiness criteria.
aiMlGovernance	AI / ML governance	Prompt lifecycle, grounding, oversight, privacy.
incidentSeverities	Incident severity	SEV definitions and escalation.
businessContinuity	Business continuity	RPO/RTO per critical asset.
accessibilityMatrix	Accessibility	WCAG targets and validation per surface.
localizationMatrix	Localization	Locale rollout phases and owners.
kpiDefinitions	Operational KPIs	Formulas and sources for product/ops metrics.
featureFlagInventory	Feature flags	Named toggles, defaults, owners.
supportTiers	Support model	L1–L3 scope and escalation.
goLiveCutover	Go-live cutover	T-7 through T+7 gates.
changeManagement	Change management	Training deliverables and sign-offs.
dataRetention	Data retention	Per-entity schedules and end-of-life actions.
dsarWorkflow	DSAR workflow	Subject rights process with SLAs.
subprocessorRegister	Subprocessors	Transparency register for vendors.
cicdPipeline	CI/CD pipeline	Merge and deploy gates.
syntheticMonitoring	Synthetic monitoring	Probes and alert mapping.
horizonBets	Horizon bets	Deferred innovation with revisit rules.
pilotSuccessCriteria	Pilot success criteria	Go/no-go thresholds vs baseline.
governanceCadence	Governance cadence	Steering, architecture, clinical, security meetings.
externalDependencyGates	External dependency gates	Third-party blockers to milestones.
executiveNorthStarMetrics	Executive metrics	Board-level stable scorecard.
masterExecutionSequence	Master execution sequence	Ordered steps M0 through post-pilot.
vendorSecurityBaseline	Vendor security baseline	Evidence domains for subprocessors.
operationalReadiness	Operational readiness	T-24h through steady-state checklists.
stakeholderApprovals	Stakeholder approvals	Who signs which class of artifact.
programCompletionDefinition	Program completion	Binary definition of “fully implemented.”

North star outcomes

Time-to-appropriate-care decreases versus baseline search/maps; never optimize sponsored placement for clinical lists.
Same authenticated thread across offline → online without duplicate data entry.
Every ranked recommendation ships with a machine- and human-readable explanation bundle.
Visit → clinical record → payment artifacts share a single correlation ID for audits and patient clarity.

Innovation pillars

Strategic differentiators that separate a governed access fabric from generic health marketplaces or maps-first UX.

Continuity-native care graph

A single patient thread survives connectivity loss: intents, ranks, and bookings reconcile through an idempotent sync plane—not a “retry the form” pattern—so thin-data regions get parity with urban always-on UX.

Governed multimodal access

Voice-default telehealth with bandwidth-gated video upgrade, plus messaging/callback as first-class continuity states—encoded in the journey machine, not as ad-hoc fallbacks.

Explainable multi-criteria fit

Ranking is policy- and evidence-backed (distance, hours, language, scope, trust signals) with versioned bundles and optional Ghost-grade attestation—defensible to auditors and patients.

Agentic ops without agentic risk

MCP-exposed tools for staff (tickets, referrals, directory fixes) sit behind RBAC and audit; patient-facing agents cannot mutate clinical lists without policy-engine output.

Federated trust by jurisdiction

Region packs encode telehealth law, payment rails, escalation copy, and data residency—feature flags activate whole bundles so expansion is configuration + legal sign-off, not rewrites.

Assurance mesh — synthetic, human, and vendor-evidenced

No single control proves production readiness: synthetic probes show liveness, governance forums show decisions, vendor baselines show third-party posture. Together they form a mesh—weakness in one layer is compensated by evidence in others until remediated.

Assurance & evidence fabric

Operationalizes the “assurance mesh” pillar: six layers, each with mechanisms and concrete evidence artifacts—so readiness is multi-source and audit-grade, not a single gate or badge.

Identity, device & session assurance

Bind the patient thread to strong authentication and known devices without breaking offline continuity—so sync and PHI access are defensible under audit.

Mechanisms

Passkeys / WebAuthn or equivalent MFA; step-up before PHI surfaces; device posture signals where policy allows.
Short-lived tokens; refresh rotation; session binding to client install ID with fraud signals.
Offline session shells: encrypted local identity + deferred server reconciliation with conflict rules.

Evidence artifacts

Auth architecture diagram + threat model delta per release.
Pen-test scope including offline reconnection and token refresh.
Access review samples tied to role templates (RBAC).

Policy, consent & jurisdiction runtime

Every ranking, copy, and data path is governed by versioned bundles—telehealth, payments, retention—activated by region flags, not scattered conditionals.

Mechanisms

Policy engine emits versioned decisions consumed by ranker, UI, and APIs; bundles diffable and replayable on fixtures.
Consent receipts and purpose limitation wired to APIs; break-glass flows with dual control where required.
Jurisdiction packs: law, escalation language, payment rails, residency—activated atomically.

Evidence artifacts

Signed policy bundle changelog per pilot region.
ROPA/DPIA excerpts mapping processing to controls.
Fixture suite proving rank/UI/API alignment per bundle version.

AI explainability & human-in-the-loop

No opaque “best match”: outputs are paired with explanation bundles and escalation paths; staff agents cannot mutate clinical lists without policy output.

Mechanisms

Explanation bundle schema (features, weights snapshot, alternatives considered, disclaimers).
Human review queues for contested ranks; model/prompt registry with approval workflow.
Patient-facing vs staff tool boundaries (MCP/RBAC); kill switches per surface.

Evidence artifacts

Model card + prompt registry revision history.
Sampling protocol for human review of edge cases.
Incident playbooks for model drift / unsafe output.

Sync, correlation & financial lineage

Business outcomes (booked visit, payment artifact) are idempotent and traceable across offline queues and partner systems.

Mechanisms

Client ULIDs; server idempotency keys; outbox with dead-letter and replay.
End-to-end correlation ID from intent → appointment → payment record.
Conflict resolution rules per entity; poison payload quarantine.

Evidence artifacts

Chaos tests for duplicate submission and reconnect storms.
Reconciliation dashboards with unexplained gap alerts.
Sample audit trail export for finance + clinical reviewers.

Observability, synthetics & audit chains

Production is proven continuously: SLOs, traces, logs, and probes form an evidence chain—not a one-time checklist.

Mechanisms

RED metrics + trace IDs propagated through sync and rank paths.
Synthetic probes per critical journey; alert routing with severity taxonomy.
Structured audit logs for policy decisions and admin actions; retention aligned to legal hold.

Evidence artifacts

SLO dashboards with error budget policy.
Runbooks linked from alert routes; quarterly game-day results.
Log sampling for privacy review (no raw PHI in app logs).

Vendor, clinical & operational assurance

Third parties and clinical policies meet a single baseline before traffic; gaps are tracked as explicit gates, not tribal knowledge.

Mechanisms

Vendor security baseline mapped to SOC/ISO evidence; BAAs/DPAs before prod data.
Clinical policy sign-off for offline bounds and escalation copy.
Support tiers and operational readiness matrices timeboxed to launch.

Evidence artifacts

Subprocessor register + DPA filing dates.
Clinical advisor attestation on navigation vs diagnosis boundaries.
CAB records for prod promotions.

Design principles

Safety-bounded intelligence

Separate non-diagnostic navigation from regulated clinical acts; offline tiers never invent diagnoses or prescriptions—only policy-approved education, scheduling shells, and escalation.

Privacy by architecture

Minimize PHI on device; encrypt at rest; TTL on caches; regional residency; purpose-limited APIs; break-glass only with dual control where required.

Deterministic policy over opaque scores

Ranking weights and rules are versioned, diffable, replayable on fixtures, and overrideable by authorized humans with logged reasons.

Idempotent everything that crosses the sync boundary

Client-generated ULIDs for intents; server idempotency keys; outbox pattern; exactly-once semantics at the business outcome layer.

Program roadmap ↔ system components

Maps each delivery phase (aligned with the public solution roadmap) to owning components and an unambiguous exit deliverable.

Phase 0 — Discovery & governance

Roadmap phase ID: 0

Components

identity, admin-ops

Exit deliverable

Signed charter; jurisdiction packs; RACI; threat model kickoff

Phase 1 — Offline kernel & sync plane

Roadmap phase ID: 1

Components

client-shell, offline-store, sync-plane, observability

Exit deliverable

Device outbox + sync APIs + conflict rules + idempotency in CI

Phase 2 — Provider graph & directory APIs

Roadmap phase ID: 2

Components

provider-graph, admin-ops

Exit deliverable

PostGIS directory + verification workflow + read APIs with contracts

Phase 3 — Concierge brain & policy engine

Roadmap phase ID: 3

Components

policy-engine, concierge-brain, attestation

Exit deliverable

Rank + explain with no LLM bypass; eval harness; optional Ghost bundle

Phase 4 — Booking, payments, records

Roadmap phase ID: 4

Components

scheduling, payments, records-bridge

Exit deliverable

End-to-end correlation ID through visit, record stub, payment

Phase 5 — Scale & hardening

Roadmap phase ID: 5

Components

observability, identity, sync-plane

Exit deliverable

SLOs live; pen test remediated; DR drill; flag-driven rollout

RACI matrix

R = responsible (does work), A = accountable (single approver), C = consulted, I = informed.

Workstream	R	A	C	I
Program charter & budget	Product owner	Executive sponsor	Finance, Legal	All workstream leads
Clinical governance & policy content	Clinical informatics lead	CMO / clinical advisor	Legal, Product	AI lead, Data platform
Patient client & offline kernel	Mobile / web platform lead	Engineering manager (client)	Security, UX research	Product, SRE
Sync plane & APIs	Backend lead	Engineering manager (platform)	SRE, Security	Client lead, Integrations
Provider graph & directory	Data platform lead	Product owner (marketplace side)	Clinical ops (verification), Legal	Backend, Concierge
Policy engine & ranking	Backend + clinical informatics	Product owner	Clinical advisor, Legal	AI lead, Data
Concierge brain (LLM/RAG)	AI lead	CTO / VP Eng	Clinical governance, Security	Product, Policy
Scheduling & visits	Integrations lead	Product owner	Clinical ops, Partner success	Backend, Client
Payments & ledger	Backend + FinOps	CFO delegate / FinOps lead	Legal, Compliance	Product, Support
Security & IAM	Security architect	CISO / security lead	Legal, DPO	All teams
Observability & SRE	SRE lead	Engineering manager (platform)	Security	Product, Leadership
Admin / ops consoles	Internal tools PM + engineers	Head of operations	Clinical ops, Support	Product

Milestone dependency graph

Execute in topological order: each milestone unlocks downstream work. IDs reference program tracking (Jira/Linear).

M0Charter signed + RACI frozen
Owner: Executive sponsor
Depends on: —
Unlocks: M1, M2
M1Threat model v1 + data classification
Owner: Security architect
Depends on: M0
Unlocks: M3
M2OIDC tenant + dev/stage/prod projects
Owner: Security architect
Depends on: M0
Unlocks: M4, M5
M3Encrypted offline store + outbox PoC on device
Owner: Mobile / web platform lead
Depends on: M1, M2
Unlocks: M4
M4Sync API + idempotency + conflict rules in CI
Owner: Backend lead
Depends on: M3
Unlocks: M6, M7
M5Provider graph schema + PostGIS + seed import
Owner: Data platform lead
Depends on: M2
Unlocks: M6
M6Policy engine v1 + golden tests + explain JSON
Owner: Clinical informatics + backend
Depends on: M4, M5
Unlocks: M8
M7Directory read API contract tests green
Owner: Data platform lead
Depends on: M4, M5
Unlocks: M8
M8Concierge brain wired to policy output (no bypass)
Owner: AI lead
Depends on: M6, M7
Unlocks: M9
M9Scheduling adapter + slot lock + pilot booking
Owner: Integrations lead
Depends on: M8
Unlocks: M10
M10Payment rail + receipt ↔ visit correlation
Owner: FinOps + backend
Depends on: M9
Unlocks: M11
M11Pilot region feature-complete + SLO dashboards
Owner: Product owner + SRE
Depends on: M10
Unlocks: M12
M12Production hardening sign-off (pen test + DR drill)
Owner: CISO + SRE
Depends on: M11
Unlocks: — (program complete after M12)

Milestone definition of done

Binary acceptance per milestone—no “mostly done.” Aligns with M0–M12 in the dependency graph.

M0

Charter PDF signed
RACI rows assigned to named people
Budget band + headcount approved

M1

STRIDE threat model in repo
Data classification table published
Top 10 risks with owners

M2

OIDC dev/stage/prod apps
JWT validation in API template
Secret scan in CI

M3

Encrypted local DB demo
Outbox survives app kill
Unit tests for crypto init failure

M4

/v1/sync/mutations + contract tests
Idempotency replay test
409 conflict fixture covered

M5

PostGIS extension + spatial index
Seed import script
Organization/Location CRUD for admin

M6

Policy bundle v1 in CI
Golden file ranking tests
Explanation JSON schema validated

M7

GET /v1/directory/locations Pact or equivalent
Load test read path baseline

M8

Integration test: LLM cannot alter ranked IDs
RAG eval pass threshold
Kill switch for concierge

M9

Slot lock under concurrency test
Cancel flow
Appointment.Confirmed in event log

M10

Test mode PSP E2E
Webhook signature verification
correlation_id on receipt

M11

All SLO panels live
Pilot playbook + support macros
Feature flags per cohort

M12

External pen test remediated or accepted risks
DR restore drill report
On-call roster + runbook links

Patient journey state machine

Explicit states and transitions for product, analytics, and support—maps to domain events and UI routing.

S0_ANONYMOUS

Anonymous browse

Marketing/education only; no PHI; may cache region for UX.

Transitions

→ S1_AUTHENTICATED — OIDC login successSystems: identity, client-shell

S1_AUTHENTICATED

Authenticated home

Known patient; preferences and saved geo ladder available.

Transitions

→ S2_INTENT_DRAFT — Start need flowSystems: client-shell

S2_INTENT_DRAFT

Intent drafting

Patient enters need, urgency, geo ladder, language—may be offline.

Transitions

→ S3_INTENT_SYNCING — Submit / queue for syncSystems: offline-store, sync-plane
→ S1_AUTHENTICATED — DiscardSystems: client-shell

S3_INTENT_SYNCING

Intent sync in flight

Outbox flush; conflict resolution; await server ack.

Transitions

→ S4_RANKING_READY — Intent.Submitted + Ranking.CompletedSystems: sync-plane, policy-engine
→ S2_INTENT_DRAFT — Hard conflict requiring user mergeSystems: sync-plane, client-shell

S4_RANKING_READY

Options presented

Ranked list + explanation; concierge NL allowed only with ranking context id.

Transitions

→ S5_SELECTION — User shortlists or asks follow-upSystems: concierge-brain, client-shell
→ S3_INTENT_SYNCING — Re-rank after material input changeSystems: policy-engine

S5_SELECTION

Facility / modality choice

Telehealth vs in-person vs callback selected.

Transitions

→ S6_SLOT_HOLD — Request slot / holdSystems: scheduling
→ S4_RANKING_READY — Back to listSystems: client-shell

S6_SLOT_HOLD

Slot held

Pessimistic lock active; countdown for confirm.

Transitions

→ S7_APPOINTMENT_CONFIRMED — Confirm bookingSystems: scheduling
→ S5_SELECTION — Hold expired / releaseSystems: scheduling, client-shell

S7_APPOINTMENT_CONFIRMED

Appointment confirmed

Appointment.Confirmed emitted; correlation_id live.

Transitions

→ S8_IN_VISIT — Join session or check-inSystems: scheduling, third-party SFU
→ S10_PAYMENT_PENDING — Prepay pathSystems: payments

S8_IN_VISIT

In visit

Active telehealth or in-person encounter window.

Transitions

→ S9_POST_VISIT — Clinician close / session endSystems: scheduling, records-bridge

S9_POST_VISIT

Post-visit wrap

VisitSummary stub or FHIR pointer; patient sees next steps.

Transitions

→ S10_PAYMENT_PENDING — Balance dueSystems: payments
→ S11_PAYMENT_SETTLED — Zero balance / sponsor coverSystems: payments
→ S1_AUTHENTICATED — Journey completeSystems: client-shell

S10_PAYMENT_PENDING

Payment pending

PSP authorize/capture in flight.

Transitions

→ S11_PAYMENT_SETTLED — Payment.CapturedSystems: payments
→ S9_POST_VISIT — Defer per policySystems: payments, admin-ops

S11_PAYMENT_SETTLED

Payment settled

Receipt tied to correlation_id; timeline complete.

Transitions

→ S12_ARCHIVED — Retention policy closeSystems: client-shell, observability
→ S2_INTENT_DRAFT — New need (same session)Systems: client-shell

S12_ARCHIVED

Archived thread

Read-only history; triggers data minimization per retention.

Transitions

→ S2_INTENT_DRAFT — Start new journeySystems: client-shell

System components

Each component has a named owner role, explicit interfaces, and implementation options—no ambiguous boxes.

Patient client (PWA and/or native)

client-shell

Capture intent, render degraded UX, queue actions, run on-device NLU where allowed, enforce step-up auth.

Interfaces: HTTPS + WebSocket · Background sync · Secure storage
Implementation options: Capacitor PWA · Expo/React Native · Swift/Kotlin for regulated builds
Owner: Mobile / web platform lead

Encrypted local store & outbox

offline-store

Persist drafts, intents, attachments metadata, and outbound queue with encryption and eviction policy.

Interfaces: SQLite / IndexedDB · File system for large blobs
Implementation options: SQLCipher · OPFS + WASM crypto
Owner: Client security engineer

Sync plane & conflict resolver

sync-plane

Merge client and server state; resolve conflicts per entity rules; backoff; dead-letter for poison payloads.

Interfaces: REST sync endpoints · gRPC optional · Webhook callbacks
Implementation options: Custom REST · ElectricSQL-style · Couch-like sync if justified
Owner: Backend lead

Identity & step-up (OIDC)

identity

Patient SSO, MFA where required, session binding to device, staff IdP separation.

Interfaces: OAuth2 / OIDC · FIDO2 optional
Implementation options: Auth0 · Clerk · Keycloak · Cloud IdP
Owner: Security architect

Provider graph service

provider-graph

Canonical organizations, locations, services, languages, credentials, geospatial index, capacity signals.

Interfaces: GraphQL or REST · PostGIS queries
Implementation options: Postgres + PostGIS · Neon · RDS
Owner: Data platform lead

Routing policy engine

policy-engine

Evaluate declarative rules + weighted objectives; emit explanation JSON; version policies.

Interfaces: Policy DSL (YAML/JSON) · Evaluation API
Implementation options: OPA · Custom evaluator with test harness
Owner: Clinical informatics + backend

Concierge brain (RAG + LLM)

concierge-brain

Natural-language interaction, retrieve approved content, never bypass policy outputs for clinical lists.

Interfaces: AI Gateway · Vector store · MCP tools
Implementation options: Vercel AI SDK + gateway · Private LLM for air-gapped
Owner: AI lead

Scheduling & visit orchestration

scheduling

Slots, telehealth links, resource assignment, waitlists, cancellation policies.

Interfaces: Calendar APIs · FHIR Appointment optional
Implementation options: Custom slot engine · Partner scheduling SaaS adapters
Owner: Product + integrations

Payments & ledger

payments

Authorize/capture/refund; receipt IDs; tie to visit; reconciliation exports.

Interfaces: PSP APIs · Mobile money APIs · FHIR ChargeItem optional
Implementation options: Stripe · Paystack · Flutterwave · Local rails
Owner: FinOps + backend

Clinical records bridge

records-bridge

Ingest/export summaries where integrated; never block navigation if EMR absent.

Interfaces: FHIR R4 · HL7 v2 via partner
Implementation options: HAPI FHIR · Partner Mirth
Owner: Integration engineer

Evidence / attestation (optional Ghost)

attestation

Sign ranking decisions and overrides for jurisdictions requiring cryptographic proof.

Interfaces: Export bundles · Public key registry
Implementation options: Ghost Evidence Log patterns · Detached JWS
Owner: Security + compliance

Observability stack

observability

Traces, metrics, logs with PHI redaction; SLO dashboards; audit log immutability.

Interfaces: OpenTelemetry · SIEM
Implementation options: Datadog · Grafana Cloud · Honeycomb
Owner: SRE

Admin & ops consoles

admin-ops

Facility onboarding, overrides, content governance, ticket hooks, feature flags.

Interfaces: Internal RBAC app · MCP tools for agents
Implementation options: Next.js admin · Retool for speed with guardrails
Owner: Internal tools PM

Data flows

Flow	From → To	Mode
Intent capture → outbox Structured intent, locale, geo ladder, urgency, session ID Contract: JSON schema v1; ULID keys	client-shell → offline-store	offline-queue
Outbox flush → sync API Batched mutations with vector clock or version Contract: HTTPS; idempotency-key header	offline-store → sync-plane	batch
Directory read for ranking Candidate locations + services filter Contract: Internal RPC; PII minimized	provider-graph → policy-engine	realtime
Ranking + NL explanation Ranked list + feature vector + policy version Contract: Explanation JSON schema	policy-engine → concierge-brain	realtime
Book slot Appointment request + correlation ID Contract: REST; optimistic UI with rollback	client-shell → scheduling	realtime
Payment authorize Amount, visit ref, metadata Contract: PCI scope minimized; tokenized	payments → PSP	realtime
Audit export Immutable audit stream Contract: WORM storage or hash-chained	observability → compliance store	batch

Canonical data model

Logical entities for persistence and APIs—map to tables/collections in your chosen store; relations drive foreign keys and event payloads.

PatientAccount

Authenticated end-user; ties to OIDC subject and regional profile.

Key fields

subject_id, region_pack_id, locale, created_at

Relations

Intent, Appointment, PaymentIntent, AuditRecord

Intent

Captured need + geo ladder + urgency; syncs from outbox.

Key fields

ulid, patient_id, payload_json, policy_version, sync_state

Relations

RankingResult, PatientAccount

Organization

Legal entity for facilities; verification status.

Key fields

id, name, verification_tier, jurisdiction_id

Relations

Location, ServiceOffering

Location

Physical or virtual site with geo + hours + languages.

Key fields

id, org_id, geom, facility_type, hours_json, languages[]

Relations

Organization, Appointment, CapacitySignal

ServiceOffering

What can be booked (modality, specialty, age band).

Key fields

id, location_id, taxonomy_code, telehealth_capable

Relations

Location, Slot

RankingResult

Immutable snapshot of scores + explanation for an Intent.

Key fields

id, intent_id, ranked_location_ids[], feature_vector_ref, policy_bundle_hash

Relations

Intent, Override

Override

Human ranking override with reason and optional attestation.

Key fields

id, ranking_result_id, actor_id, reason_code, signed_bundle_ref

Relations

RankingResult

Slot

Bookable time window with pessimistic lock token.

Key fields

id, location_id, start, end, lock_token, version

Relations

Appointment, ServiceOffering

Appointment

Confirmed or held visit; correlation spine for records and pay.

Key fields

id, patient_id, location_id, slot_id, correlation_id, status

Relations

VisitSummary, PaymentIntent, Slot

VisitSummary

Non-clinical stub or FHIR summary pointer post-visit.

Key fields

id, appointment_id, fhir_encounter_ref, status

Relations

Appointment

PaymentIntent

Authorize/capture state tied to visit correlation.

Key fields

id, correlation_id, psp_ref, amount, currency, status

Relations

Appointment

AuditRecord

Append-only admin and system actions for export.

Key fields

id, ts, actor, action, payload_hash, prev_hash

Relations

PatientAccount

PolicyBundle

Versioned weights + rules for replay and compliance.

Key fields

hash, version, effective_at, content_uri

Relations

RankingResult

Domain events

Event-driven hooks for analytics, async processing, and audit—implement via queue or log (Kafka, SQS, NATS).

Event	Schema summary	Producers → Consumers
Intent.Submitted	{ intent_ulid, patient_id, region, client_rev }	sync-plane → policy-engine, observability, audit
Ranking.Completed	{ intent_ulid, policy_hash, ranked_ids[], explain_ref }	policy-engine → concierge-brain, observability, attestation
Override.Applied	{ ranking_id, actor, reason_code, patient_notify }	admin-ops → audit, notification, attestation
Appointment.Confirmed	{ appointment_id, correlation_id, slot_id }	scheduling → records-bridge, payments, notification
Payment.Captured	{ payment_intent_id, correlation_id, psp_event_id }	payments → ledger export, patient timeline, audit
Sync.ConflictDetected	{ entity, client_rev, server_rev, resolution }	sync-plane → observability, support tooling

External integration catalog

Each integration has an owner and explicit readiness criteria before production traffic.

Identity provider (OIDC)

int-oidc

Patient and staff authentication, MFA, step-up.

Pattern: OAuth2/OIDC; separate clients for patient vs staff

Owner: Security architect

Readiness criteria

Tenant per env
Refresh rotation tested
Session revocation hook

EMR / FHIR endpoint

int-emr

Encounter summaries, appointment write-back where allowed.

Pattern: FHIR R4 or partner adapter; async queue for failures

Owner: Integration engineer

Readiness criteria

Sandbox credentials
Rate limits documented
Mapping table for Encounter

Payment service provider

int-psp

Card, wallet, mobile money per region.

Pattern: Server-side intents; webhooks signed; idempotent replay

Owner: FinOps + backend

Readiness criteria

Test + live keys separated
Webhook DLQ
Reconciliation export

Telehealth media (WebRTC SFU)

int-sfu

Voice/video sessions with bandwidth adaptation.

Pattern: Short-lived join tokens; no PHI in SFU metadata

Owner: Integrations lead

Readiness criteria

TURN/STUN for restrictive NATs
Session recording policy explicit

Maps / geocoding

int-maps

Geo ladder validation, travel time features for ranking.

Pattern: Server-side geocode cache; client displays static tiles where possible

Owner: Data platform lead

Readiness criteria

ToS compliant for region
Fallback when API down

SMS / push notifications

int-sms-push

Reminders, OTP, callback alerts.

Pattern: Template registry; opt-in; no clinical detail in SMS if policy forbids

Owner: Product + integrations

Readiness criteria

STOP handling
Delivery receipts in observability

Vector store (RAG)

int-vector

Approved content retrieval for concierge.

Pattern: Private VPC or vendor with BAA/DPA; chunk lineage

Owner: AI lead

Readiness criteria

Re-index pipeline
Tombstone on content revoke

API surface (v1)

Contract-first: publish OpenAPI from these routes; consumer-driven tests block breaking releases.

Method	Path	Purpose	Auth
POST	/v1/sync/mutations	Batch client mutations with idempotency	Bearer + device attestation optional
GET	/v1/sync/state	Server version vectors / cursors	Bearer
GET	/v1/directory/locations	Candidate locations near geo + filters	Bearer
POST	/v1/ranking/evaluate	Rank for intent snapshot	Bearer + policy bundle header
POST	/v1/concierge/message	NL turn; must include ranking context id	Bearer
POST	/v1/appointments	Create hold or confirm	Bearer + step-up if configured
DELETE	/v1/appointments/{id}	Cancel per policy	Bearer
POST	/v1/payments/intents	Start payment for correlation id	Bearer + step-up
POST	/v1/webhooks/psp	PSP event ingestion	mTLS or signed secret
POST	/v1/admin/overrides	Apply ranking override	Staff JWT + RBAC
GET	/v1/health	Liveness	none
GET	/v1/ready	Readiness (DB, queue)	none internal network

Environment promotion path

Local + PR preview

Developer machines; ephemeral Vercel/CI previews for UI and contract tests.

Promotion criteria

Lint + unit + contract tests green
No secrets in logs

Development

Shared unstable integration; synthetic PHI only.

Promotion criteria

Main branch merge
Migrations applied

Staging

Production-like config; anonymized or test patient data; PSP test mode.

Promotion criteria

E2E pass
Load smoke pass
Security scan no critical

Production (pilot region)

Live users; feature flags scoped; kill switches armed.

Promotion criteria

Change advisory
Rollback plan
SLO baselines set
On-call

Production (expanded)

Additional regions after pilot retrospective.

Promotion criteria

Pilot KPIs met
Legal sign-off per region
DR drill success

Numeric SLO targets

Tune per region after baseline; error budget policy gates feature work when burn is high.

Metric	Target	Window	Measurement
Sync mutation acknowledgment p95	< 800ms	30d rolling	Server-side histogram on /v1/sync/mutations
Ranking evaluate p99	< 2.5s	30d rolling	Trace span policy-engine + provider-graph read path
Appointment booking success rate	≥ 98.5%	7d rolling	Confirmed / (confirmed + failed excludes user cancel)
Payment authorization success rate	≥ 99%	7d rolling	Authorized / attempted (excludes insufficient funds)
Error budget burn for ranking SLO	< 2% monthly	Calendar month	SRE dashboard; freeze features if exceeded
Offline queue drain time p95 (after reconnect)	< 45s	30d rolling	Client telemetry + server ack timestamps

Workflows

Offline intent → online reconciliation

Trigger: User submits intent with no/low connectivity

Completion: Server acknowledges; patient sees single timeline entry

Step 1 — Patient
Enter need + geo ladder + language
Systems: client-shell, offline-store
Out: Local intent record PENDING_SYNC
Failure: Storage full; Crypto init fail — Mitigation: Evict non-critical cache; surface error with retry
Step 2 — System
Background sync when network available
Systems: sync-plane, identity
Out: SERVER_ACK with correlation ID
Failure: 401; 409 conflict; 5xx — Mitigation: Refresh token; merge rules; exponential backoff
Step 3 — System
Run policy + ranking on fresh directory snapshot
Systems: provider-graph, policy-engine, concierge-brain
Out: Ranked options + explanation
Failure: Stale directory; policy version skew — Mitigation: Version negotiation; refuse rank if unsafe

Voice-first telehealth session

Trigger: User selects telehealth option

Completion: Session ended; summary stub + payment state updated

Step 1 — System
Issue short-lived join token; bandwidth probe
Systems: scheduling, client-shell
Out: Join URL; mode=audio|video
Failure: Token leak window — Mitigation: Single-use; tight TTL
Step 2 — Patient + clinician
Audio default; upgrade to video if sustained bitrate
Systems: third-party WebRTC SFU
Out: Session metrics
Failure: Drop to messaging — Mitigation: Continue thread per policy
Step 3 — System
Attach session to visit ID; enqueue record summary
Systems: records-bridge, payments
Out: Visit record PENDING; Charge READY
Failure: EMR timeout — Mitigation: Queue + patient-visible pending state

In-person facility match (clinic / hospital / SNF)

Trigger: User needs physical site

Completion: Appointment or walk-in instructions issued

Step 1 — System
Filter by facility type, scope, hours, language
Systems: provider-graph, policy-engine
Out: Shortlist
Failure: Empty shortlist — Mitigation: Expand radius per policy; offer telehealth
Step 2 — Patient
Select slot or join waitlist
Systems: scheduling
Out: Hold or confirmed booking
Failure: Double booking — Mitigation: Pessimistic locking on slot

Human override of ranking

Trigger: Clinical ops disputes machine order

Completion: Override logged; patient notification if material

Step 1 — Authorized staff
Submit override with reason code
Systems: admin-ops, policy-engine
Out: OVERRIDE record
Failure: Missing reason — Mitigation: Block submit
Step 2 — System
Optional Ghost attestation of bundle
Systems: attestation, observability
Out: Signed export
Failure: Key rotation mid-flight — Mitigation: Key versioning

Architecture decisions (ADRs)

ADR-001

PWA vs native first

Offline storage, push, background sync, store policies vary by OS.

Options

PWA only
Native only
Hybrid (PWA + thin native)

Criteria

Offline reliability · Store compliance · Time-to-market · Team skills

Recommended: Hybrid: PWA for reach; native shells where push/background constraints require.

Revisit: After pilot NPS + crash metrics at week 12

ADR-002

FHIR depth vs pragmatic JSON

Full FHIR everywhere slows early delivery.

Options

FHIR-native
Pragmatic JSON with FHIR mapping layer
Partner-specific

Criteria

EMR roadmap · Regulator · Interop funding

Recommended: Pragmatic core APIs + map Organization/Location/Appointment/Encounter when integrated.

Revisit: When first hospital integration signed

ADR-003

Policy engine technology

Rules change weekly; must be testable.

Options

OPA
Custom TypeScript evaluator
ML-only ranker

Criteria

Auditability · Testability · Latency

Recommended: OPA or deterministic TS with golden tests; ML only for language, never sole ranker.

Revisit: If policy complexity exceeds X branches (define in program charter)

ADR-004

AI Gateway vs direct provider keys

Operational security and failover.

Options

AI Gateway OIDC
Direct keys
Private LLM

Criteria

Compliance · Cost · Latency

Recommended: AI Gateway default on Vercel; private LLM for air-gap.

Revisit: Each new region launch

Cross-cutting program phases

Program charter & RACI

Week 0–1

Acceptance criteria

Named executive sponsor; product owner; clinical advisor; DPO
RACI for every system component ID
Success metrics baselined with data sources

Entry: Budget band approved

Exit: Charter signed

Architecture baseline

Week 1–3

Acceptance criteria

C4 context + container diagrams checked in
Threat model v1 (STRIDE) with mitigations mapped to components
Data classification matrix (PHI / PII / public)

Entry: Charter

Exit: Architecture review passed

Contract-first APIs

Ongoing from week 2

Acceptance criteria

OpenAPI/JSON Schema for sync, directory read, ranking, booking
Consumer-driven contract tests in CI
Breaking change policy published

Entry: API owners named

Exit: First partner sandbox consuming read API

SLOs & error budget

Week 4+

Acceptance criteria

SLOs: sync p95, ranking p99, booking success rate, payment auth rate
Error budget policy tied to release cadence
Runbooks linked from alerts

Entry: Observability stack live

Exit: Monthly SLO review ritual scheduled

Release & feature flags

Ongoing

Acceptance criteria

Flags per region and cohort; kill switches for AI and ranking
Progressive delivery playbook
Rollback tested quarterly

Entry: CI/CD production path

Exit: Zero-downtime deploy verified

Quality gates

QG-Safety
Phases: 3, 4
- Red-team prompt suite
- Escalation copy for emergency symptoms
- Clinical sign-off on bounded offline behavior
QG-Privacy
Phases: 1, 4, 5
- DPIA updated
- Encryption verification
- PHI minimization audit on logs
QG-Fairness
Phases: 3
- Ranking fixtures cover language + rural + after-hours
- No paid placement in clinical list code path

Test strategy

Unit & property tests

Scope

Policy evaluator; Conflict resolver; Idempotency

Tooling

Vitest; fast-check

Contract tests

Scope

Sync API; Directory; Scheduling adapter mocks

Tooling

Pact or Postman + Newman in CI

E2E journeys

Scope

Offline submit → sync; Book telehealth; Pay receipt

Tooling

Playwright; Device farm for low bandwidth

Load & chaos

Scope

Sync storm; DB failover; PSP timeout

Tooling

k6; Chaos mesh / Toxiproxy

AI evals

Scope

RAG grounding; Refusal rates; Explanation schema validity

Tooling

Golden sets; LLM-as-judge only for non-clinical copy

AI / ML governance

Practices that keep models and prompts safe, auditable, and reversible—parallel to clinical governance.

Model & prompt lifecycle

Prompt / instruction registry
Version every system prompt; link to policy bundle hash; PR review + clinical sign-off for patient-facing changes.
Model promotion gates
Dev → staging → pilot → GA only after eval suite + safety regression + latency SLO check.
Rollback
One-click revert to prior model string and prompt version via feature flag.

Grounding & refusal

RAG-only clinical claims
No uncited clinical assertions in patient copy; schema validator rejects missing citations for regulated templates.
Emergency escalation
Fixed copy for red-flag symptoms; bypass LLM for emergency CTA where jurisdiction requires.

Human oversight

Review queue
Sampled conversations + 100% of flagged turns reviewed by clinical ops; SLA defined.
Override audit
Staff ranking overrides require reason code; exportable with attestation optional.

Privacy & data minimization

Log redaction
LLM traces strip PHI before export; retention TTL on prompts/responses.
Training boundary
Default: no patient data for model training; opt-in only with explicit consent artifact.

Risk register

Risk	L × I	Mitigation	Residual
Model hallucination leaks into clinical routing	medium / high	Policy engine is source of truth for lists; LLM only explains; schema validation; block on missing citations.	Low with dual control on policy changes
Sync conflicts corrupt bookings	medium / high	Pessimistic locks on slots; server wins on payment state; patient-visible rollback.	Low after contract tests
PSP outage blocks care	low / high	Secondary rail; pay-at-facility path; queue payments.	Medium until dual rail live
Regulatory interpretation drift	medium / medium	Jurisdiction packs; legal review each expansion; feature flags per region.	Medium; ongoing

Ops runbooks

Ranking spike in latency

Detection: p99 > threshold on policy-engine

Scale replicas
Enable directory read cache
Disable non-essential explanation depth via flag
Post-mortem within 48h

Comms: Status page + in-app banner if degraded

Sync backlog growth

Detection: Queue depth alert

Increase ingest workers
Rate-limit abusive clients
Inspect poison payloads

Comms: Internal only until user-visible delay > SLA

PSP webhook delay

Detection: Webhook age metric

Replay from idempotent store
Manual reconcile with finance

Comms: Support macros for patient assurance

Incident severity & business continuity

Severity matrix

Level	Definition	Response target	Escalation
SEV-1	Active PHI breach, widespread outage of booking/pay, or safety-critical wrong routing at scale.	On-call paged ≤ 15 min; war room ≤ 30 min	CISO + executive sponsor + legal
SEV-2	Partial outage (e.g. ranking down), PSP degradation, or data integrity risk without confirmed exfiltration.	On-call ≤ 30 min; mitigation ≤ 4h	Engineering manager + product owner
SEV-3	Single-region degradation, elevated errors below SLO, non-PHI incident.	Next business day fix path; mitigations same day	Team lead
SEV-4	Minor bugs, cosmetic issues, feature flags off by default.	Backlog prioritization	Product owner

RPO / RTO targets

Asset	RPO	RTO	Method
Primary transactional database (directory + appointments)	≤ 5 minutes	≤ 1 hour	Managed HA + PITR; tested restore quarterly
Sync / mutation queue	0 (durable queue)	≤ 30 minutes	Multi-AZ; replay from dead-letter after fix
Secrets & keys	N/A	≤ 15 minutes	KMS + automated rotation; break-glass procedure documented
AI Gateway / LLM routing	N/A	≤ 5 minutes (failover model string)	Gateway multi-provider; degrade to non-LLM copy where safe

Security controls

Authentication & session

Implementation

OIDC
Refresh rotation
Device binding optional
Step-up for payments

Evidence

Auth logs
Pen test section

Encryption

Implementation

TLS 1.2+
At-rest KMS
Client SQLCipher

Evidence

Config screenshots
Key rotation runbook

Authorization

Implementation

RBAC for admin
ABAC for facility-scoped data

Evidence

Policy tests
Access review quarterly

Supply chain

Implementation

SLSA-where-feasible
Dependency pinning
CVE SLA

Evidence

SBOM export
Renovate/Dependabot reports

Compliance artifacts

DPIA / ROPA entries — DPO + legal; Annual + on material change
Clinical safety case for offline tier — Clinical governance; Per release affecting prompts
Audit trail export sample — Regulator / sponsor; On request
Incident report template (PHI) — Security; Per incident

Accessibility

WCAG targets and validation hooks per surface—release gating for patient-critical paths.

Patient app (all journeys)

WCAG 2.1 AA minimum; AAA for critical health CTAs where feasible

axe-core in CI on critical routes
Manual keyboard pass each release
Screen reader spot-check on booking + pay

Telehealth embed

AA; captions policy if video; focus trap in modals

Vendor VPAT on file
Keyboard join/leave
Color contrast on in-call controls

Admin / ops console

Role-based flows tested with keyboard
Form error announcements

Offline / degraded mode

AA; text alternatives when maps/tiles fail

Explicit “working offline” status for assistive tech
No time-based-only cues

Localization matrix

Phased rollout; pilot aligns with high-impact languages for target geography.

Locale	Label	Script	Phase	Owner
en-GH	English (Ghana)	Latin	pilot	Content lead
ak	Twi (Akan)	Latin	pilot	Linguist vendor + content
ee	Eʋegbe (Ewe)	Latin	wave 2	Content lead
gaa	Ga	Latin	wave 2	Content lead
ha	Hausa	Latin	wave 2	Content lead
dag	Dagbanli	Latin	full	Content lead
nzi	Nzema	Latin	full	Content lead

KPI definitions

Unambiguous formulas so product, data, and exec reviews use one truth.

Time to appropriate care (TTAC)

Formula

median(minutes from Intent.Submitted to first confirmed Appointment or telehealth join)

Source: Event store + client timestamps · Direction: lower

Define “appropriate” via policy match flag on ranking result

Ranking explanation coverage

Formula

count(rankings with valid explain JSON) / count(rankings)

Source: policy-engine logs · Direction: higher

Target 100% for production traffic

Sync success rate

Formula

successful sync acks / sync attempts (excludes user offline abort)

Source: sync-plane metrics · Direction: higher

Segment by network class if available

Booking funnel conversion

Formula

S7_APPOINTMENT_CONFIRMED / S5_SELECTION sessions

Source: journey analytics · Direction: higher

Cohort by region + facility type

Payment completion rate

Formula

Payment.Captured / Payment intents created (excludes user cancel)

Source: payments + events · Direction: higher

Split prepay vs post-visit

Override rate

Formula

Override.Applied / Ranking.Completed

Source: audit + admin · Direction: lower

High rate triggers policy review, not automatic blame

Concierge containment

Formula

sessions resolved without human support / total sessions

Source: support tags + journey end state · Direction: higher

Define “resolved” in support playbook

Incident MTTR (SEV-1/2)

Formula

mean(time detect → mitigated) for SEV-1/2

Source: incident tool · Direction: lower

Track separately per domain (sync vs pay vs rank)

Feature flag inventory

Named flags with owners—no ad-hoc toggles in code without registration.

Key	Purpose	Default (prod)	Owner
ff_concierge_llm	Master kill switch for LLM turns (policy + static copy only)	on (pilot)	AI lead
ff_ranking_v2	Policy bundle version B for cohort experiments	off until M6 sign-off	Product owner
ff_video_telehealth	Allow video upgrade path (voice default)	on where SFU ready	Integrations lead
ff_prepay_required	Require payment hold before confirm	off unless region pack says on	Product owner
ff_ghost_attestation	Emit signed bundles on ranking + overrides	off until legal approves market	Security
ff_region_{code}	Per-region feature pack (one flag per pilot region)	off outside pilot	Product owner

Support model

L1 — Patient support

Password reset, navigation, “where is my appointment,” known outages

First response: ≤ 15 min during coverage hours

Escalation: L2 if payment stuck, sync failure after retry, clinical concern

L2 — Technical + clinical ops

Slot issues, PSP mismatches, directory corrections, override requests

First response: ≤ 2h business hours

Escalation: L3 engineering on-call for SEV-2+

L3 — Engineering on-call

Code defects, data integrity, security events, vendor outages

First response: Per incident severity matrix

Escalation: Executive + legal on SEV-1

Go-live cutover

Timeboxed gates from freeze to retrospective—hypercare window explicit.

T-7 days — freeze

Content freeze for pilot locales except P0 strings
Load test on staging with 1.5× expected pilot traffic
Chaos: kill one API pod; verify SLO
Legal + clinical sign-off on jurisdiction pack

T-1 day — readiness review

Rollback tag recorded in deploy system
On-call primary + secondary confirmed
Status page draft + comms owner
PSP live keys in prod vault; test transaction ≤ $1

T-0 cutover

Enable pilot region feature flags only
Smoke: login → intent → rank → book (synthetic test account)
Enable monitoring alerts; silence non-critical noise

T+1 day — hypercare

Hourly error budget check
Support standup twice daily
Hotfix process pre-approved for SEV-2+

T+7 days — retrospective

KPI dashboard vs baseline
Incident and feedback themes
Go / no-go for wave-2 locales

Change management

Training and sign-off by audience—launch is not only a deploy.

Facility onboarding team

Directory verification SOP
How to fix hours/languages in admin
Escalation to L2

Sign-off: Head of clinical ops

Patient-facing support (L1)

Macro library for sync, pay, telehealth
When not to give clinical advice
Escalation tree

Sign-off: Support manager + clinical advisor

Engineering

Runbook links in repo
Feature flag ownership table
Deploy checklist

Sign-off: Engineering manager

Executives + sponsors

Weekly KPI one-pager template
Risk and dependency summary

Sign-off: Executive sponsor

Data retention & DSAR

Retention schedule

Entity	Retention	Basis	End action
PatientAccount profile	Life of account + 7y after closure (adjust per jurisdiction)	Healthcare / finance record rules + contract	Pseudonymize or delete; retain audit hash chain if required
Intent + RankingResult	3y from last activity unless longer required	Operational + dispute resolution	Delete payloads; retain aggregate metrics
Appointment + VisitSummary pointers	Match clinical record policy (often 7–10y)	Regulated health record	Archive to cold storage; strip from hot index
PaymentIntent + receipts	7–10y per tax / audit regime	Financial compliance	Retain immutable ledger; redact PII where law allows
LLM prompts/responses (if logged)	30–90d unless incident hold	Legitimate interest + minimization	Auto-purge job; PHI redaction before write
Client offline cache	TTL 30d rolling + user “clear data”	Consent + device policy	Secure wipe on logout or uninstall path
AuditRecord chain	7y minimum for regulated clients	Compliance + integrity	Export-only; no silent delete

DSAR / erasure workflow

1Intake & identity verificationSLA: Acknowledge ≤ 72h
Owner: DPO delegate + L2 support
Verify subject; scope request (access vs delete vs portability); ticket ID = correlation for audit.
2Data map querySLA: 5 business days
Owner: Data platform + backend
Query PatientAccount, Intent, Appointment, Payment, logs by subject id; exclude other patients.
3Legal / clinical hold checkSLA: 3 business days
Owner: Legal + clinical governance
Block deletion if mandatory retention or open litigation; document reason codes.
4Execute export or erasureSLA: 10 business days from approval
Owner: Engineering (scripted job)
Idempotent job; emit AuditRecord; notify patient; PSP tokens revoked if delete.
5Verification & closeSLA: 2 business days
Owner: DPO
Confirm completion; attach evidence to ticket; annual DSAR metrics review.

Subprocessor register

Transparency and DPA coverage for vendors that process personal or health data.

Processor	Purpose	Data	Region	DPA
Cloud host (e.g. AWS / GCP / Azure)	Compute, storage, networking	PHI potential, PII, logs	Region-locked per data residency pack	yes
Managed Postgres / Neon	Transactional DB	PHI, PII, directory	Same region as app	yes
OIDC IdP	Authentication	PII, auth metadata	BAA/DPA per vendor	yes
AI Gateway / LLM provider	Inference for concierge	Prompt text may include PHI if user typed it—minimize	Zero-retention tier or private endpoint required for PHI	yes
PSP	Payments	Payment metadata, limited PII	PCI scope minimized	yes
Telehealth SFU	Media	Metadata only if policy forbids content storage	No recording without explicit consent artifact	yes
Observability vendor	Logs, traces, metrics	May contain redacted PHI—must scrub	Log pipeline with redaction rules	yes
Maps / geocoding	Location features	Coarse location, no clinical text	Avoid sending free-text symptoms to maps API	already-covered

CI/CD pipeline gates

1 — On commit

Lint (ESLint + typecheck)
Unit tests
Secret scan (gitleaks or equivalent)

Merge / deploy rule: Any failure blocks PR merge to protected branches

2 — On PR

Contract tests vs provider mocks
Schema diff check for breaking API changes
axe a11y on critical routes

Merge / deploy rule: Contract failure blocks; a11y warnings escalate per policy

3 — Pre-deploy (staging)

E2E Playwright
Migration dry-run
Security scan (SAST + deps)

Merge / deploy rule: No promote to prod without green staging + CAB for prod

4 — Deploy

Blue/green or rolling; migrations backward-compatible
Post-deploy smoke (synthetic)
Auto-rollback if error rate spike

Merge / deploy rule: Manual approval for schema expand-contract phase 2

5 — Post-deploy

SLO burn check at 1h
Tag release + changelog
Update feature flag defaults doc

Merge / deploy rule: N/A — alerting only

Synthetic monitoring

Proactive probes complement SLOs; map failures to incident severity.

Check	Target	Frequency	Alert
API liveness	GET /v1/health	1 min	SEV-2 if > 5 min down
API readiness	GET /v1/ready	2 min	SEV-2 if DB unreachable
Auth journey	Synthetic OIDC login + token exchange	5 min	SEV-2
Directory read	GET /v1/directory/locations (test geo)	5 min	SEV-3
Ranking path	POST /v1/ranking/evaluate (fixture intent)	10 min	SEV-2
PSP webhook endpoint	HEAD or signed ping	15 min	SEV-3 until payment window

Horizon innovation bets

Next-generation options explicitly deferred until prerequisites and metrics justify investment—not scope creep for v1.

On-device ranking shadow mode

A quantized ranker on-device can pre-sort candidates offline; server only validates and explains—cutting sync round-trips.

Revisit when: After M8 stable + 90d of ranking latency metrics

Prerequisites

Ghost or equivalent attestation story
Battery/thermal budget on low-end devices

Cross-facility care graph (federated signals)

Opt-in anonymized outcome signals improve fair routing without centralizing PHI.

Revisit when: When 3+ large facilities sign data-use agreement

Prerequisites

Legal framework
Differential privacy or aggregation-only design

Agentic appointment negotiation

Bounded agents reschedule across calendars within policy—reduces no-shows.

Revisit when: Pilot no-show rate baseline + 6 months

Prerequisites

Human-in-the-loop cap
Facility opt-in per slot pool

Voice-native illiterate-first UX

STT + TTS with dialect packs outperform text-first for key cohorts.

Revisit when: After pilot locale voice evals

Prerequisites

Offline TTS fallback
Clinical safety copy frozen for voice

Public-sector interoperability hub

Single adapter to national health ID / claims rails unlocks scale in regulated markets.

Revisit when: MOH or payer MOU in writing

Prerequisites

Government API specs
Air-gapped option

Pilot success criteria

Go / no-go for scale uses these thresholds—baseline capture is mandatory before interpreting results.

TTAC improvement vs baseline

Threshold: ≥ 20% median reduction vs pre-pilot baseline (same geography cohort)

Measurement: KPI: Time to appropriate care

Baseline: Baseline measured 4–8 weeks pre-go-live with same instrumentation

Booking funnel health

Threshold: ≥ 95% of S5_SELECTION sessions either book or explicit exit (not abandoned error)

Measurement: Journey analytics + error tagging

Baseline: Abandon definition agreed in product analytics spec

Sync reliability

Threshold: ≥ 99% sync success rate on 2G/3G simulated cohort

Measurement: sync-plane metrics segmented by network class

Baseline: Device lab or field test cohort ≥ 200 sessions

Safety — no critical routing incidents

Threshold: Zero SEV-1 attributable to wrong routing in 30d pilot window

Measurement: Incident log + clinical review

Baseline: Critical = patient directed to clearly inappropriate care setting per policy

Payment integrity

Threshold: ≥ 99.5% payment intent correlation matches (receipt ↔ visit)

Measurement: FinOps reconciliation report

Baseline: Excludes user-initiated cancellations

Support load

Threshold: ≥ 70% L1 containment without escalation (non-SEV)

Measurement: Support tags + ticket linkage

Baseline: Macros and training complete before measurement

Governance cadence

Program steering (executive)

Weekly during pilot; biweekly steady state

Attendees

Sponsor, product owner, eng manager, clinical advisor, DPO delegate

Mandatory outputs

RAG status vs milestones
Top 3 risks
Budget / headcount variance

Technical architecture review

Biweekly until M8; monthly after

Attendees

CTO/lead architect, backend, client, SRE, security

Mandatory outputs

ADR decisions
API contract changes
Migration plan sign-off

Clinical safety & policy

Weekly during M3–M9; monthly after

Attendees

Clinical informatics, legal delegate, product, AI lead

Mandatory outputs

Policy bundle diff
Prompt change log
Override review sample

Security & compliance

Monthly + ad-hoc for SEV

Attendees

CISO delegate, DPO, SRE, security engineer

Mandatory outputs

Vulnerability SLA
Access review summary
DR/backup test status

Pilot readiness / go-live

Daily during T-7 to T+7; then weekly

Attendees

Product, SRE, support lead, clinical ops

Mandatory outputs

Go-live checklist
Incident summary
KPI delta vs pilot success criteria

External dependency gates

Third-party deliverables that block milestones—track in program RAID alongside engineering.

Party	Deliverable	Unblocks
Legal counsel	Jurisdiction pack signed (telehealth, payments, data residency)	M0 exit, production pilot region flags
PSP / mobile money partner	Production merchant account + webhook URL + test live transaction	M10, production payments
Pilot facility cohort	Directory verification + slot feed or manual admin commitment	M9 real bookings
EMR partner (if integrated)	Sandbox FHIR + rate limits + BAA	M4+ records-bridge beyond stub
Telehealth vendor	SFU contract + BAA + regional edge nodes if required	M9 video path + production traffic
Identity vendor	Prod tenant + MFA policy for step-up	M2, production auth

Executive north-star metrics

Board- and sponsor-level view—fewer, stable metrics than operational KPIs; reviewed on a fixed cadence.

Appropriate care velocity

Median TTAC for pilot cohort vs baseline; board-level “are we faster?”

Cadence: Weekly in pilot; monthly thereafter

Trust & transparency

Explanation coverage rate + override rate band (not zero—healthy tension)

Cadence: Monthly

Operational resilience

SLO attainment % + incident count by severity (rolling 30d)

Cadence: Monthly

Financial integrity

Payment correlation accuracy + reconciliation aging

Cadence: Weekly in pilot; monthly

Master execution sequence

Single ordered path from charter to post-pilot—aligns with milestone graph M0–M12 plus go-live and retrospective.

1
Sign charter; freeze RACI; name budget owner
Milestone: M0 · Owner: Executive sponsor
Depends on: —
2
Complete threat model v1 + data classification
Milestone: M1 · Owner: Security architect
Depends on: M0
3
Provision OIDC tenants (dev/stage/prod); CI secret scan
Milestone: M2 · Owner: Security architect
Depends on: M0
4
Ship encrypted offline store + outbox PoC on reference devices
Milestone: M3 · Owner: Mobile / web platform lead
Depends on: M1+M2
5
Implement sync API + idempotency + conflict rules + contract tests
Milestone: M4 · Owner: Backend lead
Depends on: M3
6
Load provider graph schema; PostGIS; seed + verification workflow
Milestone: M5 · Owner: Data platform lead
Depends on: M2
7
Policy engine v1 + golden tests + explain JSON schema
Milestone: M6 · Owner: Clinical informatics + backend
Depends on: M4+M5
8
Directory read API contract tests + load baseline
Milestone: M7 · Owner: Data platform lead
Depends on: M4+M5
9
Wire concierge to policy output; eval harness; kill switch
Milestone: M8 · Owner: AI lead
Depends on: M6+M7
10
Scheduling + slot lock + pilot booking with real facilities
Milestone: M9 · Owner: Integrations lead
Depends on: M8
11
Payment rail + receipt ↔ visit correlation + reconciliation
Milestone: M10 · Owner: FinOps + backend
Depends on: M9
12
SLO dashboards; support macros; pilot flags; hypercare plan
Milestone: M11 · Owner: Product+SRE
Depends on: M10
13
Pen test remediate; DR drill; on-call roster; M12 sign-off
Milestone: M12 · Owner: CISO+SRE
Depends on: M11
14
Execute go-live cutover (T-7..T+7); gate on pilot success criteria
Milestone: GO-LIVE · Owner: Product owner
Depends on: M12
15
T+7 retrospective; wave-2 locale decision; horizon bet review
Milestone: POST-PILOT · Owner: Executive sponsor
Depends on: GO-LIVE

Vendor security baseline

Minimum evidence to collect before each subprocessor touches production data—extends subprocessorRegister with audit-ready requirements.

Organizational

SOC 2 Type II or ISO 27001 report (or equivalent) within 12 months
Named security contact + incident notification SLA in contract
Subprocessor list if vendor further delegates processing

Data handling

DPA/BAA executed before prod PHI
Data residency and cross-border transfer mechanism documented
Encryption in transit (TLS 1.2+) and at rest stated

Access control

MFA for admin consoles; RBAC model described
Customer data access logging available for audit
Offboarding / key revocation process documented

AI / inference (if applicable)

Zero-retention or enterprise data handling policy for prompts
Model/version disclosure for patient-facing paths
Opt-out or regional disable path aligned with ff_concierge_llm

Availability & DR

Published or contractual uptime target
RPO/RTO or restore narrative for customer-visible outage
Status page or notification channel for major incidents

Operational readiness matrices

Timeboxed checklists from pre-launch engineering through steady state—complements goLiveCutover with SRE/support specifics.

T-24h — engineering

Deploy artifact hash recorded; rollback command tested once in staging
Feature flags default state verified in prod console
Database migration backward-compatible; expand-only if any doubt
Kill switches documented in runbook (concierge, ranking, pay)

T-24h — SRE / observability

Synthetic checks green in staging; prod probes armed but muted until T-0
Dashboard links pinned in war room doc
PagerDuty/Opsgenie rotation matches on-call roster
Log sampling rate verified; PHI scrub rules active

T-0 — launch hour

Smoke script executed post-deploy (auth → intent stub → health)
Synthetic prod probes unmuted
Support lead acknowledges “green” in steering channel

T+0..T+72h — hypercare

Error budget checked every 4h; narrative posted if burn high
Top 10 errors triaged daily; hotfix lane open
FinOps watches PSP dashboard for anomaly

Steady state (post T+7)

Weekly SLO review; monthly access review sample
Vendor SOC report calendar invites set
DR drill on calendar within 90 days

Stakeholder approvals

Explicit sign-off matrix: which role approves which artifact class, and when—removes ambiguity before gates and production promotion.

Artifact	Approver role	Timing
Program charter + budget	Executive sponsor	Before M1
Jurisdiction / telehealth / payments legal pack	General counsel or delegate	Before production pilot region
Clinical policy bundles + offline safety bounds	CMO / clinical advisor	Before M6 patient-facing rank
DPIA / ROPA update for new processing	DPO	Before prod PHI
Subprocessor DPAs / BAAs	DPO + procurement	Before each vendor prod cutover
Production deploy (CAB)	Engineering manager + SRE	Each prod promotion
Pilot go-live (business)	Product owner + executive sponsor	T-0 gate
Pilot success / scale decision	Executive sponsor + clinical + legal	T+7 retrospective
Pen test remediation sign-off	CISO delegate	M12
Vendor SOC report acceptance	Security architect	Annual + new vendor
Access review (sample)	IT + data owner	Monthly steady state
Steady-state handover	Executive sponsor → operations owner	Post pilot closeout

Definition: program completion

The solution is “fully implemented” for the pilot program when all of the following are true—no informal “we’re done.”

M0–M12 milestones marked complete per milestoneDefinitionOfDone with evidence links (docs, tickets, dashboards).
All externalDependencyGates for pilot region satisfied with DPA/BAA artifacts filed.
vendorSecurityBaseline evidence filed for every subprocessor in subprocessorRegister used in production.
operationalReadiness matrices (T-24h through steady state) signed by SRE lead + support lead.
Production pilot running under feature flags with no open SEV-1; SEV-2 remediated or time-boxed with owner.
Pilot success criteria met or explicit waiver signed by sponsor + clinical + legal with rationale.
DSAR workflow tested with dry-run; dataRetention jobs scheduled in production.
subprocessorRegister published to privacy page; subprocessors notified of launch date.
cicdPipeline enforced on default branch; last deploy tagged with changelog.
syntheticMonitoring green for 7 consecutive days in pilot region.
changeManagement sign-offs recorded for facilities, L1 support, engineering, executives.
Program steering minutes archived; handover to “steady state” owner with RACI update.

Loading Solutions

Preparing enterprise solutions...

Implementation blueprint

AI Care Concierge & Access Fabric

Version 2026.04.06

Coverage index

Machine-readable manifest of every major blueprint section—use it to prove no topic was omitted from the program specification.

Section id	Title	Purpose
meta	Metadata	Versioned identity of this blueprint artifact.
sectionManifest	Coverage index	Self-index: enumerates every top-level blueprint key; kept in sync via unit test.
northStar	North star outcomes	Non-negotiable product outcomes for the program.
innovationPillars	Innovation pillars	Strategic differentiators vs marketplaces and maps-only UX.
assuranceFabricLayers	Assurance & evidence fabric	Six cross-cutting layers that operationalize the assurance mesh with mechanisms and audit artifacts.
principles	Design principles	Constraints every team applies when trade-offs appear.
systemComponents	System components	Bounded contexts, owners, and interface classes.
dataFlows	Data flows	Logical pipes, payloads, and contracts between components.
workflows	Workflows	End-to-end procedures with failure modes and mitigations.
adrs	Architecture decisions	Locked decisions with revisit triggers.
crossCuttingPhases	Cross-cutting phases	Program-wide gates parallel to feature delivery.
qualityGates	Quality gates	Release blockers for safety, privacy, fairness.
testStrategy	Test strategy	How confidence is built at each layer.
riskRegister	Risk register	Top risks with mitigation and residual posture.
opsRunbooks	Ops runbooks	Incident response playbooks tied to observability.
securityControls	Security controls	Control → implementation → audit evidence.
complianceArtifacts	Compliance artifacts	Recurring legal/clinical deliverables.
raciMatrix	RACI matrix	Accountability per workstream.
milestoneGraph	Milestone dependency graph	Topological order M0–M12.
milestoneDefinitionOfDone	Milestone definition of done	Binary acceptance per milestone.
dataEntities	Canonical data model	Entities, fields, and relations for persistence.
domainEvents	Domain events	Async integration and analytics spine.
apiSurface	API surface v1	Contract-first REST routes and auth model.
environments	Environment promotion	Path from dev to expanded production.
sloTargets	Numeric SLOs	Measurable reliability targets and windows.
roadmapPhaseLinks	Roadmap ↔ components	Maps program phases to system components and exits.
patientJourneyStates	Patient journey state machine	Explicit UX/analytics states S0–S12.
externalIntegrations	Integration catalog	Partner systems and readiness criteria.
aiMlGovernance	AI / ML governance	Prompt lifecycle, grounding, oversight, privacy.
incidentSeverities	Incident severity	SEV definitions and escalation.
businessContinuity	Business continuity	RPO/RTO per critical asset.
accessibilityMatrix	Accessibility	WCAG targets and validation per surface.
localizationMatrix	Localization	Locale rollout phases and owners.
kpiDefinitions	Operational KPIs	Formulas and sources for product/ops metrics.
featureFlagInventory	Feature flags	Named toggles, defaults, owners.
supportTiers	Support model	L1–L3 scope and escalation.
goLiveCutover	Go-live cutover	T-7 through T+7 gates.
changeManagement	Change management	Training deliverables and sign-offs.
dataRetention	Data retention	Per-entity schedules and end-of-life actions.
dsarWorkflow	DSAR workflow	Subject rights process with SLAs.
subprocessorRegister	Subprocessors	Transparency register for vendors.
cicdPipeline	CI/CD pipeline	Merge and deploy gates.
syntheticMonitoring	Synthetic monitoring	Probes and alert mapping.
horizonBets	Horizon bets	Deferred innovation with revisit rules.
pilotSuccessCriteria	Pilot success criteria	Go/no-go thresholds vs baseline.
governanceCadence	Governance cadence	Steering, architecture, clinical, security meetings.
externalDependencyGates	External dependency gates	Third-party blockers to milestones.
executiveNorthStarMetrics	Executive metrics	Board-level stable scorecard.
masterExecutionSequence	Master execution sequence	Ordered steps M0 through post-pilot.
vendorSecurityBaseline	Vendor security baseline	Evidence domains for subprocessors.
operationalReadiness	Operational readiness	T-24h through steady-state checklists.
stakeholderApprovals	Stakeholder approvals	Who signs which class of artifact.
programCompletionDefinition	Program completion	Binary definition of “fully implemented.”

North star outcomes

Time-to-appropriate-care decreases versus baseline search/maps; never optimize sponsored placement for clinical lists.
Same authenticated thread across offline → online without duplicate data entry.
Every ranked recommendation ships with a machine- and human-readable explanation bundle.
Visit → clinical record → payment artifacts share a single correlation ID for audits and patient clarity.

Innovation pillars

Strategic differentiators that separate a governed access fabric from generic health marketplaces or maps-first UX.

Continuity-native care graph

Governed multimodal access

Voice-default telehealth with bandwidth-gated video upgrade, plus messaging/callback as first-class continuity states—encoded in the journey machine, not as ad-hoc fallbacks.

Explainable multi-criteria fit

Ranking is policy- and evidence-backed (distance, hours, language, scope, trust signals) with versioned bundles and optional Ghost-grade attestation—defensible to auditors and patients.

Agentic ops without agentic risk

MCP-exposed tools for staff (tickets, referrals, directory fixes) sit behind RBAC and audit; patient-facing agents cannot mutate clinical lists without policy-engine output.

Federated trust by jurisdiction

Region packs encode telehealth law, payment rails, escalation copy, and data residency—feature flags activate whole bundles so expansion is configuration + legal sign-off, not rewrites.

Assurance mesh — synthetic, human, and vendor-evidenced

Assurance & evidence fabric

Operationalizes the “assurance mesh” pillar: six layers, each with mechanisms and concrete evidence artifacts—so readiness is multi-source and audit-grade, not a single gate or badge.

Identity, device & session assurance

Bind the patient thread to strong authentication and known devices without breaking offline continuity—so sync and PHI access are defensible under audit.

Mechanisms

Passkeys / WebAuthn or equivalent MFA; step-up before PHI surfaces; device posture signals where policy allows.
Short-lived tokens; refresh rotation; session binding to client install ID with fraud signals.
Offline session shells: encrypted local identity + deferred server reconciliation with conflict rules.

Evidence artifacts

Auth architecture diagram + threat model delta per release.
Pen-test scope including offline reconnection and token refresh.
Access review samples tied to role templates (RBAC).

Policy, consent & jurisdiction runtime

Every ranking, copy, and data path is governed by versioned bundles—telehealth, payments, retention—activated by region flags, not scattered conditionals.

Mechanisms

Policy engine emits versioned decisions consumed by ranker, UI, and APIs; bundles diffable and replayable on fixtures.
Consent receipts and purpose limitation wired to APIs; break-glass flows with dual control where required.
Jurisdiction packs: law, escalation language, payment rails, residency—activated atomically.

Evidence artifacts

Signed policy bundle changelog per pilot region.
ROPA/DPIA excerpts mapping processing to controls.
Fixture suite proving rank/UI/API alignment per bundle version.

AI explainability & human-in-the-loop

No opaque “best match”: outputs are paired with explanation bundles and escalation paths; staff agents cannot mutate clinical lists without policy output.

Mechanisms

Explanation bundle schema (features, weights snapshot, alternatives considered, disclaimers).
Human review queues for contested ranks; model/prompt registry with approval workflow.
Patient-facing vs staff tool boundaries (MCP/RBAC); kill switches per surface.

Evidence artifacts

Model card + prompt registry revision history.
Sampling protocol for human review of edge cases.
Incident playbooks for model drift / unsafe output.

Sync, correlation & financial lineage

Business outcomes (booked visit, payment artifact) are idempotent and traceable across offline queues and partner systems.

Mechanisms

Client ULIDs; server idempotency keys; outbox with dead-letter and replay.
End-to-end correlation ID from intent → appointment → payment record.
Conflict resolution rules per entity; poison payload quarantine.

Evidence artifacts

Chaos tests for duplicate submission and reconnect storms.
Reconciliation dashboards with unexplained gap alerts.
Sample audit trail export for finance + clinical reviewers.

Observability, synthetics & audit chains

Production is proven continuously: SLOs, traces, logs, and probes form an evidence chain—not a one-time checklist.

Mechanisms

RED metrics + trace IDs propagated through sync and rank paths.
Synthetic probes per critical journey; alert routing with severity taxonomy.
Structured audit logs for policy decisions and admin actions; retention aligned to legal hold.

Evidence artifacts

SLO dashboards with error budget policy.
Runbooks linked from alert routes; quarterly game-day results.
Log sampling for privacy review (no raw PHI in app logs).

Vendor, clinical & operational assurance

Third parties and clinical policies meet a single baseline before traffic; gaps are tracked as explicit gates, not tribal knowledge.

Mechanisms

Vendor security baseline mapped to SOC/ISO evidence; BAAs/DPAs before prod data.
Clinical policy sign-off for offline bounds and escalation copy.
Support tiers and operational readiness matrices timeboxed to launch.

Evidence artifacts

Subprocessor register + DPA filing dates.
Clinical advisor attestation on navigation vs diagnosis boundaries.
CAB records for prod promotions.

Design principles

Safety-bounded intelligence

Separate non-diagnostic navigation from regulated clinical acts; offline tiers never invent diagnoses or prescriptions—only policy-approved education, scheduling shells, and escalation.

Privacy by architecture

Minimize PHI on device; encrypt at rest; TTL on caches; regional residency; purpose-limited APIs; break-glass only with dual control where required.

Deterministic policy over opaque scores

Ranking weights and rules are versioned, diffable, replayable on fixtures, and overrideable by authorized humans with logged reasons.

Idempotent everything that crosses the sync boundary

Client-generated ULIDs for intents; server idempotency keys; outbox pattern; exactly-once semantics at the business outcome layer.

Program roadmap ↔ system components

Maps each delivery phase (aligned with the public solution roadmap) to owning components and an unambiguous exit deliverable.

Phase 0 — Discovery & governance

Roadmap phase ID: 0

Components

identity, admin-ops

Exit deliverable

Signed charter; jurisdiction packs; RACI; threat model kickoff

Phase 1 — Offline kernel & sync plane

Roadmap phase ID: 1

Components

client-shell, offline-store, sync-plane, observability

Exit deliverable

Device outbox + sync APIs + conflict rules + idempotency in CI

Phase 2 — Provider graph & directory APIs

Roadmap phase ID: 2

Components

provider-graph, admin-ops

Exit deliverable

PostGIS directory + verification workflow + read APIs with contracts

Phase 3 — Concierge brain & policy engine

Roadmap phase ID: 3

Components

policy-engine, concierge-brain, attestation

Exit deliverable

Rank + explain with no LLM bypass; eval harness; optional Ghost bundle

Phase 4 — Booking, payments, records

Roadmap phase ID: 4

Components

scheduling, payments, records-bridge

Exit deliverable

End-to-end correlation ID through visit, record stub, payment

Phase 5 — Scale & hardening

Roadmap phase ID: 5

Components

observability, identity, sync-plane

Exit deliverable

SLOs live; pen test remediated; DR drill; flag-driven rollout

RACI matrix

R = responsible (does work), A = accountable (single approver), C = consulted, I = informed.

Workstream	R	A	C	I
Program charter & budget	Product owner	Executive sponsor	Finance, Legal	All workstream leads
Clinical governance & policy content	Clinical informatics lead	CMO / clinical advisor	Legal, Product	AI lead, Data platform
Patient client & offline kernel	Mobile / web platform lead	Engineering manager (client)	Security, UX research	Product, SRE
Sync plane & APIs	Backend lead	Engineering manager (platform)	SRE, Security	Client lead, Integrations
Provider graph & directory	Data platform lead	Product owner (marketplace side)	Clinical ops (verification), Legal	Backend, Concierge
Policy engine & ranking	Backend + clinical informatics	Product owner	Clinical advisor, Legal	AI lead, Data
Concierge brain (LLM/RAG)	AI lead	CTO / VP Eng	Clinical governance, Security	Product, Policy
Scheduling & visits	Integrations lead	Product owner	Clinical ops, Partner success	Backend, Client
Payments & ledger	Backend + FinOps	CFO delegate / FinOps lead	Legal, Compliance	Product, Support
Security & IAM	Security architect	CISO / security lead	Legal, DPO	All teams
Observability & SRE	SRE lead	Engineering manager (platform)	Security	Product, Leadership
Admin / ops consoles	Internal tools PM + engineers	Head of operations	Clinical ops, Support	Product

Milestone dependency graph

Execute in topological order: each milestone unlocks downstream work. IDs reference program tracking (Jira/Linear).

M0Charter signed + RACI frozen
Owner: Executive sponsor
Depends on: —
Unlocks: M1, M2
M1Threat model v1 + data classification
Owner: Security architect
Depends on: M0
Unlocks: M3
M2OIDC tenant + dev/stage/prod projects
Owner: Security architect
Depends on: M0
Unlocks: M4, M5
M3Encrypted offline store + outbox PoC on device
Owner: Mobile / web platform lead
Depends on: M1, M2
Unlocks: M4
M4Sync API + idempotency + conflict rules in CI
Owner: Backend lead
Depends on: M3
Unlocks: M6, M7
M5Provider graph schema + PostGIS + seed import
Owner: Data platform lead
Depends on: M2
Unlocks: M6
M6Policy engine v1 + golden tests + explain JSON
Owner: Clinical informatics + backend
Depends on: M4, M5
Unlocks: M8
M7Directory read API contract tests green
Owner: Data platform lead
Depends on: M4, M5
Unlocks: M8
M8Concierge brain wired to policy output (no bypass)
Owner: AI lead
Depends on: M6, M7
Unlocks: M9
M9Scheduling adapter + slot lock + pilot booking
Owner: Integrations lead
Depends on: M8
Unlocks: M10
M10Payment rail + receipt ↔ visit correlation
Owner: FinOps + backend
Depends on: M9
Unlocks: M11
M11Pilot region feature-complete + SLO dashboards
Owner: Product owner + SRE
Depends on: M10
Unlocks: M12
M12Production hardening sign-off (pen test + DR drill)
Owner: CISO + SRE
Depends on: M11
Unlocks: — (program complete after M12)

Milestone definition of done

Binary acceptance per milestone—no “mostly done.” Aligns with M0–M12 in the dependency graph.

M0

Charter PDF signed
RACI rows assigned to named people
Budget band + headcount approved

M1

STRIDE threat model in repo
Data classification table published
Top 10 risks with owners

M2

OIDC dev/stage/prod apps
JWT validation in API template
Secret scan in CI

M3

Encrypted local DB demo
Outbox survives app kill
Unit tests for crypto init failure

M4

/v1/sync/mutations + contract tests
Idempotency replay test
409 conflict fixture covered

M5

PostGIS extension + spatial index
Seed import script
Organization/Location CRUD for admin

M6

Policy bundle v1 in CI
Golden file ranking tests
Explanation JSON schema validated

M7

GET /v1/directory/locations Pact or equivalent
Load test read path baseline

M8

Integration test: LLM cannot alter ranked IDs
RAG eval pass threshold
Kill switch for concierge

M9

Slot lock under concurrency test
Cancel flow
Appointment.Confirmed in event log

M10

Test mode PSP E2E
Webhook signature verification
correlation_id on receipt

M11

All SLO panels live
Pilot playbook + support macros
Feature flags per cohort

M12

External pen test remediated or accepted risks
DR restore drill report
On-call roster + runbook links

Patient journey state machine

Explicit states and transitions for product, analytics, and support—maps to domain events and UI routing.

S0_ANONYMOUS

Anonymous browse

Marketing/education only; no PHI; may cache region for UX.

Transitions

→ S1_AUTHENTICATED — OIDC login successSystems: identity, client-shell

S1_AUTHENTICATED

Authenticated home

Known patient; preferences and saved geo ladder available.

Transitions

→ S2_INTENT_DRAFT — Start need flowSystems: client-shell

S2_INTENT_DRAFT

Intent drafting

Patient enters need, urgency, geo ladder, language—may be offline.

Transitions

→ S3_INTENT_SYNCING — Submit / queue for syncSystems: offline-store, sync-plane
→ S1_AUTHENTICATED — DiscardSystems: client-shell

S3_INTENT_SYNCING

Intent sync in flight

Outbox flush; conflict resolution; await server ack.

Transitions

→ S4_RANKING_READY — Intent.Submitted + Ranking.CompletedSystems: sync-plane, policy-engine
→ S2_INTENT_DRAFT — Hard conflict requiring user mergeSystems: sync-plane, client-shell

S4_RANKING_READY

Options presented

Ranked list + explanation; concierge NL allowed only with ranking context id.

Transitions

→ S5_SELECTION — User shortlists or asks follow-upSystems: concierge-brain, client-shell
→ S3_INTENT_SYNCING — Re-rank after material input changeSystems: policy-engine

S5_SELECTION

Facility / modality choice

Telehealth vs in-person vs callback selected.

Transitions

→ S6_SLOT_HOLD — Request slot / holdSystems: scheduling
→ S4_RANKING_READY — Back to listSystems: client-shell

S6_SLOT_HOLD

Slot held

Pessimistic lock active; countdown for confirm.

Transitions

→ S7_APPOINTMENT_CONFIRMED — Confirm bookingSystems: scheduling
→ S5_SELECTION — Hold expired / releaseSystems: scheduling, client-shell

S7_APPOINTMENT_CONFIRMED

Appointment confirmed

Appointment.Confirmed emitted; correlation_id live.

Transitions

→ S8_IN_VISIT — Join session or check-inSystems: scheduling, third-party SFU
→ S10_PAYMENT_PENDING — Prepay pathSystems: payments

S8_IN_VISIT

In visit

Active telehealth or in-person encounter window.

Transitions

→ S9_POST_VISIT — Clinician close / session endSystems: scheduling, records-bridge

S9_POST_VISIT

Post-visit wrap

VisitSummary stub or FHIR pointer; patient sees next steps.

Transitions

→ S10_PAYMENT_PENDING — Balance dueSystems: payments
→ S11_PAYMENT_SETTLED — Zero balance / sponsor coverSystems: payments
→ S1_AUTHENTICATED — Journey completeSystems: client-shell

S10_PAYMENT_PENDING

Payment pending

PSP authorize/capture in flight.

Transitions

→ S11_PAYMENT_SETTLED — Payment.CapturedSystems: payments
→ S9_POST_VISIT — Defer per policySystems: payments, admin-ops

S11_PAYMENT_SETTLED

Payment settled

Receipt tied to correlation_id; timeline complete.

Transitions

→ S12_ARCHIVED — Retention policy closeSystems: client-shell, observability
→ S2_INTENT_DRAFT — New need (same session)Systems: client-shell

S12_ARCHIVED

Archived thread

Read-only history; triggers data minimization per retention.

Transitions

→ S2_INTENT_DRAFT — Start new journeySystems: client-shell

System components

Each component has a named owner role, explicit interfaces, and implementation options—no ambiguous boxes.

Patient client (PWA and/or native)

client-shell

Capture intent, render degraded UX, queue actions, run on-device NLU where allowed, enforce step-up auth.

Interfaces: HTTPS + WebSocket · Background sync · Secure storage
Implementation options: Capacitor PWA · Expo/React Native · Swift/Kotlin for regulated builds
Owner: Mobile / web platform lead

Encrypted local store & outbox

offline-store

Persist drafts, intents, attachments metadata, and outbound queue with encryption and eviction policy.

Interfaces: SQLite / IndexedDB · File system for large blobs
Implementation options: SQLCipher · OPFS + WASM crypto
Owner: Client security engineer

Sync plane & conflict resolver

sync-plane

Merge client and server state; resolve conflicts per entity rules; backoff; dead-letter for poison payloads.

Interfaces: REST sync endpoints · gRPC optional · Webhook callbacks
Implementation options: Custom REST · ElectricSQL-style · Couch-like sync if justified
Owner: Backend lead

Identity & step-up (OIDC)

identity

Patient SSO, MFA where required, session binding to device, staff IdP separation.

Interfaces: OAuth2 / OIDC · FIDO2 optional
Implementation options: Auth0 · Clerk · Keycloak · Cloud IdP
Owner: Security architect

Provider graph service

provider-graph

Canonical organizations, locations, services, languages, credentials, geospatial index, capacity signals.

Interfaces: GraphQL or REST · PostGIS queries
Implementation options: Postgres + PostGIS · Neon · RDS
Owner: Data platform lead

Routing policy engine

policy-engine

Evaluate declarative rules + weighted objectives; emit explanation JSON; version policies.

Interfaces: Policy DSL (YAML/JSON) · Evaluation API
Implementation options: OPA · Custom evaluator with test harness
Owner: Clinical informatics + backend

Concierge brain (RAG + LLM)

concierge-brain

Natural-language interaction, retrieve approved content, never bypass policy outputs for clinical lists.

Interfaces: AI Gateway · Vector store · MCP tools
Implementation options: Vercel AI SDK + gateway · Private LLM for air-gapped
Owner: AI lead

Scheduling & visit orchestration

scheduling

Slots, telehealth links, resource assignment, waitlists, cancellation policies.

Interfaces: Calendar APIs · FHIR Appointment optional
Implementation options: Custom slot engine · Partner scheduling SaaS adapters
Owner: Product + integrations

Payments & ledger

payments

Authorize/capture/refund; receipt IDs; tie to visit; reconciliation exports.

Interfaces: PSP APIs · Mobile money APIs · FHIR ChargeItem optional
Implementation options: Stripe · Paystack · Flutterwave · Local rails
Owner: FinOps + backend

Clinical records bridge

records-bridge

Ingest/export summaries where integrated; never block navigation if EMR absent.

Interfaces: FHIR R4 · HL7 v2 via partner
Implementation options: HAPI FHIR · Partner Mirth
Owner: Integration engineer

Evidence / attestation (optional Ghost)

attestation

Sign ranking decisions and overrides for jurisdictions requiring cryptographic proof.

Interfaces: Export bundles · Public key registry
Implementation options: Ghost Evidence Log patterns · Detached JWS
Owner: Security + compliance

Observability stack

observability

Traces, metrics, logs with PHI redaction; SLO dashboards; audit log immutability.

Interfaces: OpenTelemetry · SIEM
Implementation options: Datadog · Grafana Cloud · Honeycomb
Owner: SRE

Admin & ops consoles

admin-ops

Facility onboarding, overrides, content governance, ticket hooks, feature flags.

Interfaces: Internal RBAC app · MCP tools for agents
Implementation options: Next.js admin · Retool for speed with guardrails
Owner: Internal tools PM

Data flows

Flow	From → To	Mode
Intent capture → outbox Structured intent, locale, geo ladder, urgency, session ID Contract: JSON schema v1; ULID keys	client-shell → offline-store	offline-queue
Outbox flush → sync API Batched mutations with vector clock or version Contract: HTTPS; idempotency-key header	offline-store → sync-plane	batch
Directory read for ranking Candidate locations + services filter Contract: Internal RPC; PII minimized	provider-graph → policy-engine	realtime
Ranking + NL explanation Ranked list + feature vector + policy version Contract: Explanation JSON schema	policy-engine → concierge-brain	realtime
Book slot Appointment request + correlation ID Contract: REST; optimistic UI with rollback	client-shell → scheduling	realtime
Payment authorize Amount, visit ref, metadata Contract: PCI scope minimized; tokenized	payments → PSP	realtime
Audit export Immutable audit stream Contract: WORM storage or hash-chained	observability → compliance store	batch

Canonical data model

Logical entities for persistence and APIs—map to tables/collections in your chosen store; relations drive foreign keys and event payloads.

PatientAccount

Authenticated end-user; ties to OIDC subject and regional profile.

Key fields

subject_id, region_pack_id, locale, created_at

Relations

Intent, Appointment, PaymentIntent, AuditRecord

Intent

Captured need + geo ladder + urgency; syncs from outbox.

Key fields

ulid, patient_id, payload_json, policy_version, sync_state

Relations

RankingResult, PatientAccount

Organization

Legal entity for facilities; verification status.

Key fields

id, name, verification_tier, jurisdiction_id

Relations

Location, ServiceOffering

Location

Physical or virtual site with geo + hours + languages.

Key fields

id, org_id, geom, facility_type, hours_json, languages[]

Relations

Organization, Appointment, CapacitySignal

ServiceOffering

What can be booked (modality, specialty, age band).

Key fields

id, location_id, taxonomy_code, telehealth_capable

Relations

Location, Slot

RankingResult

Immutable snapshot of scores + explanation for an Intent.

Key fields

id, intent_id, ranked_location_ids[], feature_vector_ref, policy_bundle_hash

Relations

Intent, Override

Override

Human ranking override with reason and optional attestation.

Key fields

id, ranking_result_id, actor_id, reason_code, signed_bundle_ref

Relations

RankingResult

Slot

Bookable time window with pessimistic lock token.

Key fields

id, location_id, start, end, lock_token, version

Relations

Appointment, ServiceOffering

Appointment

Confirmed or held visit; correlation spine for records and pay.

Key fields

id, patient_id, location_id, slot_id, correlation_id, status

Relations

VisitSummary, PaymentIntent, Slot

VisitSummary

Non-clinical stub or FHIR summary pointer post-visit.

Key fields

id, appointment_id, fhir_encounter_ref, status

Relations

Appointment

PaymentIntent

Authorize/capture state tied to visit correlation.

Key fields

id, correlation_id, psp_ref, amount, currency, status

Relations

Appointment

AuditRecord

Append-only admin and system actions for export.

Key fields

id, ts, actor, action, payload_hash, prev_hash

Relations

PatientAccount

PolicyBundle

Versioned weights + rules for replay and compliance.

Key fields

hash, version, effective_at, content_uri

Relations

RankingResult

Domain events

Event-driven hooks for analytics, async processing, and audit—implement via queue or log (Kafka, SQS, NATS).

Event	Schema summary	Producers → Consumers
Intent.Submitted	{ intent_ulid, patient_id, region, client_rev }	sync-plane → policy-engine, observability, audit
Ranking.Completed	{ intent_ulid, policy_hash, ranked_ids[], explain_ref }	policy-engine → concierge-brain, observability, attestation
Override.Applied	{ ranking_id, actor, reason_code, patient_notify }	admin-ops → audit, notification, attestation
Appointment.Confirmed	{ appointment_id, correlation_id, slot_id }	scheduling → records-bridge, payments, notification
Payment.Captured	{ payment_intent_id, correlation_id, psp_event_id }	payments → ledger export, patient timeline, audit
Sync.ConflictDetected	{ entity, client_rev, server_rev, resolution }	sync-plane → observability, support tooling

External integration catalog

Each integration has an owner and explicit readiness criteria before production traffic.

Identity provider (OIDC)

int-oidc

Patient and staff authentication, MFA, step-up.

Pattern: OAuth2/OIDC; separate clients for patient vs staff

Owner: Security architect

Readiness criteria

Tenant per env
Refresh rotation tested
Session revocation hook

EMR / FHIR endpoint

int-emr

Encounter summaries, appointment write-back where allowed.

Pattern: FHIR R4 or partner adapter; async queue for failures

Owner: Integration engineer

Readiness criteria

Sandbox credentials
Rate limits documented
Mapping table for Encounter

Payment service provider

int-psp

Card, wallet, mobile money per region.

Pattern: Server-side intents; webhooks signed; idempotent replay

Owner: FinOps + backend

Readiness criteria

Test + live keys separated
Webhook DLQ
Reconciliation export

Telehealth media (WebRTC SFU)

int-sfu

Voice/video sessions with bandwidth adaptation.

Pattern: Short-lived join tokens; no PHI in SFU metadata

Owner: Integrations lead

Readiness criteria

TURN/STUN for restrictive NATs
Session recording policy explicit

Maps / geocoding

int-maps

Geo ladder validation, travel time features for ranking.

Pattern: Server-side geocode cache; client displays static tiles where possible

Owner: Data platform lead

Readiness criteria

ToS compliant for region
Fallback when API down

SMS / push notifications

int-sms-push

Reminders, OTP, callback alerts.

Pattern: Template registry; opt-in; no clinical detail in SMS if policy forbids

Owner: Product + integrations

Readiness criteria

STOP handling
Delivery receipts in observability

Vector store (RAG)

int-vector

Approved content retrieval for concierge.

Pattern: Private VPC or vendor with BAA/DPA; chunk lineage

Owner: AI lead

Readiness criteria

Re-index pipeline
Tombstone on content revoke

API surface (v1)

Contract-first: publish OpenAPI from these routes; consumer-driven tests block breaking releases.

Method	Path	Purpose	Auth
POST	/v1/sync/mutations	Batch client mutations with idempotency	Bearer + device attestation optional
GET	/v1/sync/state	Server version vectors / cursors	Bearer
GET	/v1/directory/locations	Candidate locations near geo + filters	Bearer
POST	/v1/ranking/evaluate	Rank for intent snapshot	Bearer + policy bundle header
POST	/v1/concierge/message	NL turn; must include ranking context id	Bearer
POST	/v1/appointments	Create hold or confirm	Bearer + step-up if configured
DELETE	/v1/appointments/{id}	Cancel per policy	Bearer
POST	/v1/payments/intents	Start payment for correlation id	Bearer + step-up
POST	/v1/webhooks/psp	PSP event ingestion	mTLS or signed secret
POST	/v1/admin/overrides	Apply ranking override	Staff JWT + RBAC
GET	/v1/health	Liveness	none
GET	/v1/ready	Readiness (DB, queue)	none internal network

Environment promotion path

Local + PR preview

Developer machines; ephemeral Vercel/CI previews for UI and contract tests.

Promotion criteria

Lint + unit + contract tests green
No secrets in logs

Development

Shared unstable integration; synthetic PHI only.

Promotion criteria

Main branch merge
Migrations applied

Staging

Production-like config; anonymized or test patient data; PSP test mode.

Promotion criteria

E2E pass
Load smoke pass
Security scan no critical

Production (pilot region)

Live users; feature flags scoped; kill switches armed.

Promotion criteria

Change advisory
Rollback plan
SLO baselines set
On-call

Production (expanded)

Additional regions after pilot retrospective.

Promotion criteria

Pilot KPIs met
Legal sign-off per region
DR drill success

Numeric SLO targets

Tune per region after baseline; error budget policy gates feature work when burn is high.

Metric	Target	Window	Measurement
Sync mutation acknowledgment p95	< 800ms	30d rolling	Server-side histogram on /v1/sync/mutations
Ranking evaluate p99	< 2.5s	30d rolling	Trace span policy-engine + provider-graph read path
Appointment booking success rate	≥ 98.5%	7d rolling	Confirmed / (confirmed + failed excludes user cancel)
Payment authorization success rate	≥ 99%	7d rolling	Authorized / attempted (excludes insufficient funds)
Error budget burn for ranking SLO	< 2% monthly	Calendar month	SRE dashboard; freeze features if exceeded
Offline queue drain time p95 (after reconnect)	< 45s	30d rolling	Client telemetry + server ack timestamps

Workflows

Offline intent → online reconciliation

Trigger: User submits intent with no/low connectivity

Completion: Server acknowledges; patient sees single timeline entry

Step 1 — Patient
Enter need + geo ladder + language
Systems: client-shell, offline-store
Out: Local intent record PENDING_SYNC
Failure: Storage full; Crypto init fail — Mitigation: Evict non-critical cache; surface error with retry
Step 2 — System
Background sync when network available
Systems: sync-plane, identity
Out: SERVER_ACK with correlation ID
Failure: 401; 409 conflict; 5xx — Mitigation: Refresh token; merge rules; exponential backoff
Step 3 — System
Run policy + ranking on fresh directory snapshot
Systems: provider-graph, policy-engine, concierge-brain
Out: Ranked options + explanation
Failure: Stale directory; policy version skew — Mitigation: Version negotiation; refuse rank if unsafe

Voice-first telehealth session

Trigger: User selects telehealth option

Completion: Session ended; summary stub + payment state updated

Step 1 — System
Issue short-lived join token; bandwidth probe
Systems: scheduling, client-shell
Out: Join URL; mode=audio|video
Failure: Token leak window — Mitigation: Single-use; tight TTL
Step 2 — Patient + clinician
Audio default; upgrade to video if sustained bitrate
Systems: third-party WebRTC SFU
Out: Session metrics
Failure: Drop to messaging — Mitigation: Continue thread per policy
Step 3 — System
Attach session to visit ID; enqueue record summary
Systems: records-bridge, payments
Out: Visit record PENDING; Charge READY
Failure: EMR timeout — Mitigation: Queue + patient-visible pending state

In-person facility match (clinic / hospital / SNF)

Trigger: User needs physical site

Completion: Appointment or walk-in instructions issued

Step 1 — System
Filter by facility type, scope, hours, language
Systems: provider-graph, policy-engine
Out: Shortlist
Failure: Empty shortlist — Mitigation: Expand radius per policy; offer telehealth
Step 2 — Patient
Select slot or join waitlist
Systems: scheduling
Out: Hold or confirmed booking
Failure: Double booking — Mitigation: Pessimistic locking on slot

Human override of ranking

Trigger: Clinical ops disputes machine order

Completion: Override logged; patient notification if material

Step 1 — Authorized staff
Submit override with reason code
Systems: admin-ops, policy-engine
Out: OVERRIDE record
Failure: Missing reason — Mitigation: Block submit
Step 2 — System
Optional Ghost attestation of bundle
Systems: attestation, observability
Out: Signed export
Failure: Key rotation mid-flight — Mitigation: Key versioning

Architecture decisions (ADRs)

ADR-001

PWA vs native first

Offline storage, push, background sync, store policies vary by OS.

Options

PWA only
Native only
Hybrid (PWA + thin native)

Criteria

Offline reliability · Store compliance · Time-to-market · Team skills

Recommended: Hybrid: PWA for reach; native shells where push/background constraints require.

Revisit: After pilot NPS + crash metrics at week 12

ADR-002

FHIR depth vs pragmatic JSON

Full FHIR everywhere slows early delivery.

Options

FHIR-native
Pragmatic JSON with FHIR mapping layer
Partner-specific

Criteria

EMR roadmap · Regulator · Interop funding

Recommended: Pragmatic core APIs + map Organization/Location/Appointment/Encounter when integrated.

Revisit: When first hospital integration signed

ADR-003

Policy engine technology

Rules change weekly; must be testable.

Options

OPA
Custom TypeScript evaluator
ML-only ranker

Criteria

Auditability · Testability · Latency

Recommended: OPA or deterministic TS with golden tests; ML only for language, never sole ranker.

Revisit: If policy complexity exceeds X branches (define in program charter)

ADR-004

AI Gateway vs direct provider keys

Operational security and failover.

Options

AI Gateway OIDC
Direct keys
Private LLM

Criteria

Compliance · Cost · Latency

Recommended: AI Gateway default on Vercel; private LLM for air-gap.

Revisit: Each new region launch

Cross-cutting program phases

Program charter & RACI

Week 0–1

Acceptance criteria

Named executive sponsor; product owner; clinical advisor; DPO
RACI for every system component ID
Success metrics baselined with data sources

Entry: Budget band approved

Exit: Charter signed

Architecture baseline

Week 1–3

Acceptance criteria

C4 context + container diagrams checked in
Threat model v1 (STRIDE) with mitigations mapped to components
Data classification matrix (PHI / PII / public)

Entry: Charter

Exit: Architecture review passed

Contract-first APIs

Ongoing from week 2

Acceptance criteria

OpenAPI/JSON Schema for sync, directory read, ranking, booking
Consumer-driven contract tests in CI
Breaking change policy published

Entry: API owners named

Exit: First partner sandbox consuming read API

SLOs & error budget

Week 4+

Acceptance criteria

SLOs: sync p95, ranking p99, booking success rate, payment auth rate
Error budget policy tied to release cadence
Runbooks linked from alerts

Entry: Observability stack live

Exit: Monthly SLO review ritual scheduled

Release & feature flags

Ongoing

Acceptance criteria

Flags per region and cohort; kill switches for AI and ranking
Progressive delivery playbook
Rollback tested quarterly

Entry: CI/CD production path

Exit: Zero-downtime deploy verified

Quality gates

QG-Safety
Phases: 3, 4
- Red-team prompt suite
- Escalation copy for emergency symptoms
- Clinical sign-off on bounded offline behavior
QG-Privacy
Phases: 1, 4, 5
- DPIA updated
- Encryption verification
- PHI minimization audit on logs
QG-Fairness
Phases: 3
- Ranking fixtures cover language + rural + after-hours
- No paid placement in clinical list code path

Test strategy

Unit & property tests

Scope

Policy evaluator; Conflict resolver; Idempotency

Tooling

Vitest; fast-check

Contract tests

Scope

Sync API; Directory; Scheduling adapter mocks

Tooling

Pact or Postman + Newman in CI

E2E journeys

Scope

Offline submit → sync; Book telehealth; Pay receipt

Tooling

Playwright; Device farm for low bandwidth

Load & chaos

Scope

Sync storm; DB failover; PSP timeout

Tooling

k6; Chaos mesh / Toxiproxy

AI evals

Scope

RAG grounding; Refusal rates; Explanation schema validity

Tooling

Golden sets; LLM-as-judge only for non-clinical copy

AI / ML governance

Practices that keep models and prompts safe, auditable, and reversible—parallel to clinical governance.

Model & prompt lifecycle

Prompt / instruction registry
Version every system prompt; link to policy bundle hash; PR review + clinical sign-off for patient-facing changes.
Model promotion gates
Dev → staging → pilot → GA only after eval suite + safety regression + latency SLO check.
Rollback
One-click revert to prior model string and prompt version via feature flag.

Grounding & refusal

RAG-only clinical claims
No uncited clinical assertions in patient copy; schema validator rejects missing citations for regulated templates.
Emergency escalation
Fixed copy for red-flag symptoms; bypass LLM for emergency CTA where jurisdiction requires.

Human oversight

Review queue
Sampled conversations + 100% of flagged turns reviewed by clinical ops; SLA defined.
Override audit
Staff ranking overrides require reason code; exportable with attestation optional.

Privacy & data minimization

Log redaction
LLM traces strip PHI before export; retention TTL on prompts/responses.
Training boundary
Default: no patient data for model training; opt-in only with explicit consent artifact.

Risk register

Risk	L × I	Mitigation	Residual
Model hallucination leaks into clinical routing	medium / high	Policy engine is source of truth for lists; LLM only explains; schema validation; block on missing citations.	Low with dual control on policy changes
Sync conflicts corrupt bookings	medium / high	Pessimistic locks on slots; server wins on payment state; patient-visible rollback.	Low after contract tests
PSP outage blocks care	low / high	Secondary rail; pay-at-facility path; queue payments.	Medium until dual rail live
Regulatory interpretation drift	medium / medium	Jurisdiction packs; legal review each expansion; feature flags per region.	Medium; ongoing

Ops runbooks

Ranking spike in latency

Detection: p99 > threshold on policy-engine

Scale replicas
Enable directory read cache
Disable non-essential explanation depth via flag
Post-mortem within 48h

Comms: Status page + in-app banner if degraded

Sync backlog growth

Detection: Queue depth alert

Increase ingest workers
Rate-limit abusive clients
Inspect poison payloads

Comms: Internal only until user-visible delay > SLA

PSP webhook delay

Detection: Webhook age metric

Replay from idempotent store
Manual reconcile with finance

Comms: Support macros for patient assurance

Incident severity & business continuity

Severity matrix

Level	Definition	Response target	Escalation
SEV-1	Active PHI breach, widespread outage of booking/pay, or safety-critical wrong routing at scale.	On-call paged ≤ 15 min; war room ≤ 30 min	CISO + executive sponsor + legal
SEV-2	Partial outage (e.g. ranking down), PSP degradation, or data integrity risk without confirmed exfiltration.	On-call ≤ 30 min; mitigation ≤ 4h	Engineering manager + product owner
SEV-3	Single-region degradation, elevated errors below SLO, non-PHI incident.	Next business day fix path; mitigations same day	Team lead
SEV-4	Minor bugs, cosmetic issues, feature flags off by default.	Backlog prioritization	Product owner

RPO / RTO targets

Asset	RPO	RTO	Method
Primary transactional database (directory + appointments)	≤ 5 minutes	≤ 1 hour	Managed HA + PITR; tested restore quarterly
Sync / mutation queue	0 (durable queue)	≤ 30 minutes	Multi-AZ; replay from dead-letter after fix
Secrets & keys	N/A	≤ 15 minutes	KMS + automated rotation; break-glass procedure documented
AI Gateway / LLM routing	N/A	≤ 5 minutes (failover model string)	Gateway multi-provider; degrade to non-LLM copy where safe

Security controls

Authentication & session

Implementation

OIDC
Refresh rotation
Device binding optional
Step-up for payments

Evidence

Auth logs
Pen test section

Encryption

Implementation

TLS 1.2+
At-rest KMS
Client SQLCipher

Evidence

Config screenshots
Key rotation runbook

Authorization

Implementation

RBAC for admin
ABAC for facility-scoped data

Evidence

Policy tests
Access review quarterly

Supply chain

Implementation

SLSA-where-feasible
Dependency pinning
CVE SLA

Evidence

SBOM export
Renovate/Dependabot reports

Compliance artifacts

DPIA / ROPA entries — DPO + legal; Annual + on material change
Clinical safety case for offline tier — Clinical governance; Per release affecting prompts
Audit trail export sample — Regulator / sponsor; On request
Incident report template (PHI) — Security; Per incident

Accessibility

WCAG targets and validation hooks per surface—release gating for patient-critical paths.

Patient app (all journeys)

WCAG 2.1 AA minimum; AAA for critical health CTAs where feasible

axe-core in CI on critical routes
Manual keyboard pass each release
Screen reader spot-check on booking + pay

Telehealth embed

AA; captions policy if video; focus trap in modals

Vendor VPAT on file
Keyboard join/leave
Color contrast on in-call controls

Admin / ops console

Role-based flows tested with keyboard
Form error announcements

Offline / degraded mode

AA; text alternatives when maps/tiles fail

Explicit “working offline” status for assistive tech
No time-based-only cues

Localization matrix

Phased rollout; pilot aligns with high-impact languages for target geography.

Locale	Label	Script	Phase	Owner
en-GH	English (Ghana)	Latin	pilot	Content lead
ak	Twi (Akan)	Latin	pilot	Linguist vendor + content
ee	Eʋegbe (Ewe)	Latin	wave 2	Content lead
gaa	Ga	Latin	wave 2	Content lead
ha	Hausa	Latin	wave 2	Content lead
dag	Dagbanli	Latin	full	Content lead
nzi	Nzema	Latin	full	Content lead

KPI definitions

Unambiguous formulas so product, data, and exec reviews use one truth.

Time to appropriate care (TTAC)

Formula

median(minutes from Intent.Submitted to first confirmed Appointment or telehealth join)

Source: Event store + client timestamps · Direction: lower

Define “appropriate” via policy match flag on ranking result

Ranking explanation coverage

Formula

count(rankings with valid explain JSON) / count(rankings)

Source: policy-engine logs · Direction: higher

Target 100% for production traffic

Sync success rate

Formula

successful sync acks / sync attempts (excludes user offline abort)

Source: sync-plane metrics · Direction: higher

Segment by network class if available

Booking funnel conversion

Formula

S7_APPOINTMENT_CONFIRMED / S5_SELECTION sessions

Source: journey analytics · Direction: higher

Cohort by region + facility type

Payment completion rate

Formula

Payment.Captured / Payment intents created (excludes user cancel)

Source: payments + events · Direction: higher

Split prepay vs post-visit

Override rate

Formula

Override.Applied / Ranking.Completed

Source: audit + admin · Direction: lower

High rate triggers policy review, not automatic blame

Concierge containment

Formula

sessions resolved without human support / total sessions

Source: support tags + journey end state · Direction: higher

Define “resolved” in support playbook

Incident MTTR (SEV-1/2)

Formula

mean(time detect → mitigated) for SEV-1/2

Source: incident tool · Direction: lower

Track separately per domain (sync vs pay vs rank)

Feature flag inventory

Named flags with owners—no ad-hoc toggles in code without registration.

Key	Purpose	Default (prod)	Owner
ff_concierge_llm	Master kill switch for LLM turns (policy + static copy only)	on (pilot)	AI lead
ff_ranking_v2	Policy bundle version B for cohort experiments	off until M6 sign-off	Product owner
ff_video_telehealth	Allow video upgrade path (voice default)	on where SFU ready	Integrations lead
ff_prepay_required	Require payment hold before confirm	off unless region pack says on	Product owner
ff_ghost_attestation	Emit signed bundles on ranking + overrides	off until legal approves market	Security
ff_region_{code}	Per-region feature pack (one flag per pilot region)	off outside pilot	Product owner

Support model

L1 — Patient support

Password reset, navigation, “where is my appointment,” known outages

First response: ≤ 15 min during coverage hours

Escalation: L2 if payment stuck, sync failure after retry, clinical concern

L2 — Technical + clinical ops

Slot issues, PSP mismatches, directory corrections, override requests

First response: ≤ 2h business hours

Escalation: L3 engineering on-call for SEV-2+

L3 — Engineering on-call

Code defects, data integrity, security events, vendor outages

First response: Per incident severity matrix

Escalation: Executive + legal on SEV-1

Go-live cutover

Timeboxed gates from freeze to retrospective—hypercare window explicit.

T-7 days — freeze

Content freeze for pilot locales except P0 strings
Load test on staging with 1.5× expected pilot traffic
Chaos: kill one API pod; verify SLO
Legal + clinical sign-off on jurisdiction pack

T-1 day — readiness review

Rollback tag recorded in deploy system
On-call primary + secondary confirmed
Status page draft + comms owner
PSP live keys in prod vault; test transaction ≤ $1

T-0 cutover

Enable pilot region feature flags only
Smoke: login → intent → rank → book (synthetic test account)
Enable monitoring alerts; silence non-critical noise

T+1 day — hypercare

Hourly error budget check
Support standup twice daily
Hotfix process pre-approved for SEV-2+

T+7 days — retrospective

KPI dashboard vs baseline
Incident and feedback themes
Go / no-go for wave-2 locales

Change management

Training and sign-off by audience—launch is not only a deploy.

Facility onboarding team

Directory verification SOP
How to fix hours/languages in admin
Escalation to L2

Sign-off: Head of clinical ops

Patient-facing support (L1)

Macro library for sync, pay, telehealth
When not to give clinical advice
Escalation tree

Sign-off: Support manager + clinical advisor

Engineering

Runbook links in repo
Feature flag ownership table
Deploy checklist

Sign-off: Engineering manager

Executives + sponsors

Weekly KPI one-pager template
Risk and dependency summary

Sign-off: Executive sponsor

Data retention & DSAR

Retention schedule

Entity	Retention	Basis	End action
PatientAccount profile	Life of account + 7y after closure (adjust per jurisdiction)	Healthcare / finance record rules + contract	Pseudonymize or delete; retain audit hash chain if required
Intent + RankingResult	3y from last activity unless longer required	Operational + dispute resolution	Delete payloads; retain aggregate metrics
Appointment + VisitSummary pointers	Match clinical record policy (often 7–10y)	Regulated health record	Archive to cold storage; strip from hot index
PaymentIntent + receipts	7–10y per tax / audit regime	Financial compliance	Retain immutable ledger; redact PII where law allows
LLM prompts/responses (if logged)	30–90d unless incident hold	Legitimate interest + minimization	Auto-purge job; PHI redaction before write
Client offline cache	TTL 30d rolling + user “clear data”	Consent + device policy	Secure wipe on logout or uninstall path
AuditRecord chain	7y minimum for regulated clients	Compliance + integrity	Export-only; no silent delete

DSAR / erasure workflow

1Intake & identity verificationSLA: Acknowledge ≤ 72h
Owner: DPO delegate + L2 support
Verify subject; scope request (access vs delete vs portability); ticket ID = correlation for audit.
2Data map querySLA: 5 business days
Owner: Data platform + backend
Query PatientAccount, Intent, Appointment, Payment, logs by subject id; exclude other patients.
3Legal / clinical hold checkSLA: 3 business days
Owner: Legal + clinical governance
Block deletion if mandatory retention or open litigation; document reason codes.
4Execute export or erasureSLA: 10 business days from approval
Owner: Engineering (scripted job)
Idempotent job; emit AuditRecord; notify patient; PSP tokens revoked if delete.
5Verification & closeSLA: 2 business days
Owner: DPO
Confirm completion; attach evidence to ticket; annual DSAR metrics review.

Subprocessor register

Transparency and DPA coverage for vendors that process personal or health data.

Processor	Purpose	Data	Region	DPA
Cloud host (e.g. AWS / GCP / Azure)	Compute, storage, networking	PHI potential, PII, logs	Region-locked per data residency pack	yes
Managed Postgres / Neon	Transactional DB	PHI, PII, directory	Same region as app	yes
OIDC IdP	Authentication	PII, auth metadata	BAA/DPA per vendor	yes
AI Gateway / LLM provider	Inference for concierge	Prompt text may include PHI if user typed it—minimize	Zero-retention tier or private endpoint required for PHI	yes
PSP	Payments	Payment metadata, limited PII	PCI scope minimized	yes
Telehealth SFU	Media	Metadata only if policy forbids content storage	No recording without explicit consent artifact	yes
Observability vendor	Logs, traces, metrics	May contain redacted PHI—must scrub	Log pipeline with redaction rules	yes
Maps / geocoding	Location features	Coarse location, no clinical text	Avoid sending free-text symptoms to maps API	already-covered

CI/CD pipeline gates

1 — On commit

Lint (ESLint + typecheck)
Unit tests
Secret scan (gitleaks or equivalent)

Merge / deploy rule: Any failure blocks PR merge to protected branches

2 — On PR

Contract tests vs provider mocks
Schema diff check for breaking API changes
axe a11y on critical routes

Merge / deploy rule: Contract failure blocks; a11y warnings escalate per policy

3 — Pre-deploy (staging)

E2E Playwright
Migration dry-run
Security scan (SAST + deps)

Merge / deploy rule: No promote to prod without green staging + CAB for prod

4 — Deploy

Blue/green or rolling; migrations backward-compatible
Post-deploy smoke (synthetic)
Auto-rollback if error rate spike

Merge / deploy rule: Manual approval for schema expand-contract phase 2

5 — Post-deploy

SLO burn check at 1h
Tag release + changelog
Update feature flag defaults doc

Merge / deploy rule: N/A — alerting only

Synthetic monitoring

Proactive probes complement SLOs; map failures to incident severity.

Check	Target	Frequency	Alert
API liveness	GET /v1/health	1 min	SEV-2 if > 5 min down
API readiness	GET /v1/ready	2 min	SEV-2 if DB unreachable
Auth journey	Synthetic OIDC login + token exchange	5 min	SEV-2
Directory read	GET /v1/directory/locations (test geo)	5 min	SEV-3
Ranking path	POST /v1/ranking/evaluate (fixture intent)	10 min	SEV-2
PSP webhook endpoint	HEAD or signed ping	15 min	SEV-3 until payment window

Horizon innovation bets

Next-generation options explicitly deferred until prerequisites and metrics justify investment—not scope creep for v1.

On-device ranking shadow mode

A quantized ranker on-device can pre-sort candidates offline; server only validates and explains—cutting sync round-trips.

Revisit when: After M8 stable + 90d of ranking latency metrics

Prerequisites

Ghost or equivalent attestation story
Battery/thermal budget on low-end devices

Cross-facility care graph (federated signals)

Opt-in anonymized outcome signals improve fair routing without centralizing PHI.

Revisit when: When 3+ large facilities sign data-use agreement

Prerequisites

Legal framework
Differential privacy or aggregation-only design

Agentic appointment negotiation

Bounded agents reschedule across calendars within policy—reduces no-shows.

Revisit when: Pilot no-show rate baseline + 6 months

Prerequisites

Human-in-the-loop cap
Facility opt-in per slot pool

Voice-native illiterate-first UX

STT + TTS with dialect packs outperform text-first for key cohorts.

Revisit when: After pilot locale voice evals

Prerequisites

Offline TTS fallback
Clinical safety copy frozen for voice

Public-sector interoperability hub

Single adapter to national health ID / claims rails unlocks scale in regulated markets.

Revisit when: MOH or payer MOU in writing

Prerequisites

Government API specs
Air-gapped option

Pilot success criteria

Go / no-go for scale uses these thresholds—baseline capture is mandatory before interpreting results.

TTAC improvement vs baseline

Threshold: ≥ 20% median reduction vs pre-pilot baseline (same geography cohort)

Measurement: KPI: Time to appropriate care

Baseline: Baseline measured 4–8 weeks pre-go-live with same instrumentation

Booking funnel health

Threshold: ≥ 95% of S5_SELECTION sessions either book or explicit exit (not abandoned error)

Measurement: Journey analytics + error tagging

Baseline: Abandon definition agreed in product analytics spec

Sync reliability

Threshold: ≥ 99% sync success rate on 2G/3G simulated cohort

Measurement: sync-plane metrics segmented by network class

Baseline: Device lab or field test cohort ≥ 200 sessions

Safety — no critical routing incidents

Threshold: Zero SEV-1 attributable to wrong routing in 30d pilot window

Measurement: Incident log + clinical review

Baseline: Critical = patient directed to clearly inappropriate care setting per policy

Payment integrity

Threshold: ≥ 99.5% payment intent correlation matches (receipt ↔ visit)

Measurement: FinOps reconciliation report

Baseline: Excludes user-initiated cancellations

Support load

Threshold: ≥ 70% L1 containment without escalation (non-SEV)

Measurement: Support tags + ticket linkage

Baseline: Macros and training complete before measurement

Governance cadence

Program steering (executive)

Weekly during pilot; biweekly steady state

Attendees

Sponsor, product owner, eng manager, clinical advisor, DPO delegate

Mandatory outputs

RAG status vs milestones
Top 3 risks
Budget / headcount variance

Technical architecture review

Biweekly until M8; monthly after

Attendees

CTO/lead architect, backend, client, SRE, security

Mandatory outputs

ADR decisions
API contract changes
Migration plan sign-off

Clinical safety & policy

Weekly during M3–M9; monthly after

Attendees

Clinical informatics, legal delegate, product, AI lead

Mandatory outputs

Policy bundle diff
Prompt change log
Override review sample

Security & compliance

Monthly + ad-hoc for SEV

Attendees

CISO delegate, DPO, SRE, security engineer

Mandatory outputs

Vulnerability SLA
Access review summary
DR/backup test status

Pilot readiness / go-live

Daily during T-7 to T+7; then weekly

Attendees

Product, SRE, support lead, clinical ops

Mandatory outputs

Go-live checklist
Incident summary
KPI delta vs pilot success criteria

External dependency gates

Third-party deliverables that block milestones—track in program RAID alongside engineering.

Party	Deliverable	Unblocks
Legal counsel	Jurisdiction pack signed (telehealth, payments, data residency)	M0 exit, production pilot region flags
PSP / mobile money partner	Production merchant account + webhook URL + test live transaction	M10, production payments
Pilot facility cohort	Directory verification + slot feed or manual admin commitment	M9 real bookings
EMR partner (if integrated)	Sandbox FHIR + rate limits + BAA	M4+ records-bridge beyond stub
Telehealth vendor	SFU contract + BAA + regional edge nodes if required	M9 video path + production traffic
Identity vendor	Prod tenant + MFA policy for step-up	M2, production auth

Executive north-star metrics

Board- and sponsor-level view—fewer, stable metrics than operational KPIs; reviewed on a fixed cadence.

Appropriate care velocity

Median TTAC for pilot cohort vs baseline; board-level “are we faster?”

Cadence: Weekly in pilot; monthly thereafter

Trust & transparency

Explanation coverage rate + override rate band (not zero—healthy tension)

Cadence: Monthly

Operational resilience

SLO attainment % + incident count by severity (rolling 30d)

Cadence: Monthly

Financial integrity

Payment correlation accuracy + reconciliation aging

Cadence: Weekly in pilot; monthly

Master execution sequence

Single ordered path from charter to post-pilot—aligns with milestone graph M0–M12 plus go-live and retrospective.

1
Sign charter; freeze RACI; name budget owner
Milestone: M0 · Owner: Executive sponsor
Depends on: —
2
Complete threat model v1 + data classification
Milestone: M1 · Owner: Security architect
Depends on: M0
3
Provision OIDC tenants (dev/stage/prod); CI secret scan
Milestone: M2 · Owner: Security architect
Depends on: M0
4
Ship encrypted offline store + outbox PoC on reference devices
Milestone: M3 · Owner: Mobile / web platform lead
Depends on: M1+M2
5
Implement sync API + idempotency + conflict rules + contract tests
Milestone: M4 · Owner: Backend lead
Depends on: M3
6
Load provider graph schema; PostGIS; seed + verification workflow
Milestone: M5 · Owner: Data platform lead
Depends on: M2
7
Policy engine v1 + golden tests + explain JSON schema
Milestone: M6 · Owner: Clinical informatics + backend
Depends on: M4+M5
8
Directory read API contract tests + load baseline
Milestone: M7 · Owner: Data platform lead
Depends on: M4+M5
9
Wire concierge to policy output; eval harness; kill switch
Milestone: M8 · Owner: AI lead
Depends on: M6+M7
10
Scheduling + slot lock + pilot booking with real facilities
Milestone: M9 · Owner: Integrations lead
Depends on: M8
11
Payment rail + receipt ↔ visit correlation + reconciliation
Milestone: M10 · Owner: FinOps + backend
Depends on: M9
12
SLO dashboards; support macros; pilot flags; hypercare plan
Milestone: M11 · Owner: Product+SRE
Depends on: M10
13
Pen test remediate; DR drill; on-call roster; M12 sign-off
Milestone: M12 · Owner: CISO+SRE
Depends on: M11
14
Execute go-live cutover (T-7..T+7); gate on pilot success criteria
Milestone: GO-LIVE · Owner: Product owner
Depends on: M12
15
T+7 retrospective; wave-2 locale decision; horizon bet review
Milestone: POST-PILOT · Owner: Executive sponsor
Depends on: GO-LIVE

Vendor security baseline

Minimum evidence to collect before each subprocessor touches production data—extends subprocessorRegister with audit-ready requirements.

Organizational

SOC 2 Type II or ISO 27001 report (or equivalent) within 12 months
Named security contact + incident notification SLA in contract
Subprocessor list if vendor further delegates processing

Data handling

DPA/BAA executed before prod PHI
Data residency and cross-border transfer mechanism documented
Encryption in transit (TLS 1.2+) and at rest stated

Access control

MFA for admin consoles; RBAC model described
Customer data access logging available for audit
Offboarding / key revocation process documented

AI / inference (if applicable)

Zero-retention or enterprise data handling policy for prompts
Model/version disclosure for patient-facing paths
Opt-out or regional disable path aligned with ff_concierge_llm

Availability & DR

Published or contractual uptime target
RPO/RTO or restore narrative for customer-visible outage
Status page or notification channel for major incidents

Operational readiness matrices

Timeboxed checklists from pre-launch engineering through steady state—complements goLiveCutover with SRE/support specifics.

T-24h — engineering

Deploy artifact hash recorded; rollback command tested once in staging
Feature flags default state verified in prod console
Database migration backward-compatible; expand-only if any doubt
Kill switches documented in runbook (concierge, ranking, pay)

T-24h — SRE / observability

Synthetic checks green in staging; prod probes armed but muted until T-0
Dashboard links pinned in war room doc
PagerDuty/Opsgenie rotation matches on-call roster
Log sampling rate verified; PHI scrub rules active

T-0 — launch hour

Smoke script executed post-deploy (auth → intent stub → health)
Synthetic prod probes unmuted
Support lead acknowledges “green” in steering channel

T+0..T+72h — hypercare

Error budget checked every 4h; narrative posted if burn high
Top 10 errors triaged daily; hotfix lane open
FinOps watches PSP dashboard for anomaly

Steady state (post T+7)

Weekly SLO review; monthly access review sample
Vendor SOC report calendar invites set
DR drill on calendar within 90 days

Stakeholder approvals

Explicit sign-off matrix: which role approves which artifact class, and when—removes ambiguity before gates and production promotion.

Artifact	Approver role	Timing
Program charter + budget	Executive sponsor	Before M1
Jurisdiction / telehealth / payments legal pack	General counsel or delegate	Before production pilot region
Clinical policy bundles + offline safety bounds	CMO / clinical advisor	Before M6 patient-facing rank
DPIA / ROPA update for new processing	DPO	Before prod PHI
Subprocessor DPAs / BAAs	DPO + procurement	Before each vendor prod cutover
Production deploy (CAB)	Engineering manager + SRE	Each prod promotion
Pilot go-live (business)	Product owner + executive sponsor	T-0 gate
Pilot success / scale decision	Executive sponsor + clinical + legal	T+7 retrospective
Pen test remediation sign-off	CISO delegate	M12
Vendor SOC report acceptance	Security architect	Annual + new vendor
Access review (sample)	IT + data owner	Monthly steady state
Steady-state handover	Executive sponsor → operations owner	Post pilot closeout

Definition: program completion

The solution is “fully implemented” for the pilot program when all of the following are true—no informal “we’re done.”

M0–M12 milestones marked complete per milestoneDefinitionOfDone with evidence links (docs, tickets, dashboards).
All externalDependencyGates for pilot region satisfied with DPA/BAA artifacts filed.
vendorSecurityBaseline evidence filed for every subprocessor in subprocessorRegister used in production.
operationalReadiness matrices (T-24h through steady state) signed by SRE lead + support lead.
Production pilot running under feature flags with no open SEV-1; SEV-2 remediated or time-boxed with owner.
Pilot success criteria met or explicit waiver signed by sponsor + clinical + legal with rationale.
DSAR workflow tested with dry-run; dataRetention jobs scheduled in production.
subprocessorRegister published to privacy page; subprocessors notified of launch date.
cicdPipeline enforced on default branch; last deploy tagged with changelog.
syntheticMonitoring green for 7 consecutive days in pilot region.
changeManagement sign-offs recorded for facilities, L1 support, engineering, executives.
Program steering minutes archived; handover to “steady state” owner with RACI update.