- Shipped
- August 27, 2026 at 7:54 AM UTC
- Author
- Kamo
- Commit
- 5ff6e0a
Everything built so far answers other people's queries: discovery, document query, document retrieve, the match-review queue, the accounting. A practice could be ASKED and could not ASK — and asking is the direction a clinician actually needs, because a new patient's history is at whichever practice they used to attend. ExchangeRequest has carried a direction column the whole time and only INBOUND ever wrote to it. An outbound query is an ACQUISITION, not a disclosure. The PHI travels toward us, so nothing here touches the disclosure ledger — recording it there would put a line in a patient's §164.528 accounting saying their record went somewhere it came FROM. Discovery reads demographics from OUR record, never from the caller. An endpoint that accepts typed-in names is a way to ask the network "do you have anybody called this", which is a different and much worse capability than "fetch my patient's history". Every step needs VIEW_CHART and a care relationship, discovery included: which practices hold records for someone is itself information about them. A retrieved document is filed UNRECONCILED and stays that way until a clinician says what they took from it. Another practice's summary is their assertion, not this practice's record; auto-merging one is how a resolved condition from 2019 becomes an active problem and a discontinued drug reappears on a list somebody prescribes against. Reconciling requires a note, because "reconciled" alone leaves the next reader unable to tell whether the outside history is in the chart or still only in the attachment. Failed queries are recorded as firmly as successful ones, in their own transaction. "We asked and they refused" is what somebody investigating a gap in a patient's history needs, and rolling the row back with the failure would erase exactly the case worth keeping. THE TRANSPORT IS A DELIBERATE SEAM. Under TEFCA a Participant authenticates with an X.509 certificate issued under the Common Agreement — obtained by signing the Participant agreement and completing QHIN onboarding, not by putting a string in a database. This platform has no encryption at rest for a secret of that kind and no QHIN relationship to obtain one from, so inventing a token column and calling it TEFCA would produce something that looks federated and connects to nothing. What ships is a transport that refuses every call with a sentence naming the missing onboarding, and 503 rather than an empty list — "no documents found" is a clinical fact a clinician may act on and "we could not ask" is not, and a system that answers both with an empty list teaches people to trust an absence that was never established. Retrieved documents get their own bucket and their own storage line, keyed tenant-first like the exports, because nothing deletes them and a practice that queries the network accumulates every summary it was ever sent. 16 tests over everything above the seam.