Make the retail webhook signature check fail closed and compare in constant time
validateSignature used to return true three ways without verifying anything: a null secret short-circuited, six of eleven provider types fell through default ->...
Render the chart as US Core FHIR R4
The JSON builder is hand-rolled rather than a Jackson ObjectMapper, and that is a scar rather than a preference. This platform ships a global Long->String seria...
Count new bug reports under the listing's own visibility rule
The badge and the list it opens are read side by side; a count computed under a different tenancy rule than the list is a bug report waiting to happen.
Count missed calls a member has not been shown
callResult is a free-form provider string, not an enum — the history tab matches the literal 'Missed', and upper() is what stops a provider that reports MISSED ...
Record whether an attendee has been told
The case this exists for is a webinar booked on somebody's behalf by somebody else: registration was recorded and nothing in the app ever told them. status coul...
Count assistant replies the member has not seen
Keyed by session GUID because that is what a tool window carries. ASSISTANT only: a member's own prompt is not news to them.
The healthcare engagement vocabulary
An appointment is the INTENT — a slot someone holds and may not keep — and the ENCOUNTER is the commitment: the visit that actually happened, the thing a note i...
Move availability from the webinar type onto the member
Availability was webinar_availability_slot: a dated (date, start, end) row owned by a WebinarType. A presenter who ran three kinds of session had to declare the...
Give an SMS conversation a read pointer
VoipConversation had no notion of read at all, so an SMS could be shown but never recorded as seen. Null means never looked, which counts all inbound — the hone...
Count social conversations as unread
Social sessions were excluded from the unread membership query by a hand-written type list, so a social conversation could never show a count anywhere. They are...
The Patient Records rights, and the access rights they are not
Twenty-three rights under ServiceType.EHR, and every one of them is a SECOND gate rather than the only one. Holding VIEW_CHART does not let a member open a char...
The repository layer, with a harness that proves it boots
Repositories for patients, encounters, scheduling, the chart, notes, questionnaires, coverage and claims. Every query leads with tenantId because on YugabyteDB ...
Insurance, claims, remittance and prior auth (SP14)
Coverage models ORDER, because a patient with two policies has a primary and a secondary and billing the wrong one first is a denial that costs a month and a re...
Questionnaires that produce coded data, not form answers (SP8)
Deliberately not the platform's lead form builder, and the reason is the whole design. A capture form's job is to collect answers. A clinical questionnaire's jo...
Patient identity, and chart documents on the EXISTING doc manager
The EHR gets no second document system and no second signature system. PATIENT_CHART is a new ImageAssocType keyed on the patient's logical id, so a chart is an...
Practice scheduling, waitlist and recall (SP6)
Availability stays as RULES. ScheduleBlock describes a provider's day and slots are computed for the window being viewed; pre-materialising five-minute slots fo...
Retire Sent to AI, and store the status by name
Removing SENT_TO_AI is not a one-line enum edit. It sat at ordinal 3, and system_bug.status was an ORDINAL column: dropping it shifts AWAITING_INFO onto 3, CANN...
Results, doses, procedures and the real medication list (SP7)
DiagnosticReport keeps the report AND its Observations, because results arrive as a report and are acted on as individual values and both views have to be true ...
Append-only clinical notes with amendment and cosign (SP7)
Identity is split from content from the first row. ClinicalNote is what other records point at — an order raised from the note, an amendment to it, a disclosure...
Prescriptions and orders with real loop closure (SP7)
MedicationRequest keys the drug to RxCUI and never to a vendor identifier. FDB's GCN_SEQNO, Medi-Span's GPI, MEDID, HICL_SEQNO are the vendor's moat, and keying...
Problem list, allergies and observations (SP7)
The three chart tables where a modelling mistake harms a patient rather than annoying a user. Condition carries TWO independent statuses because conflating the...
The terminology store (SP4)
Releases, concepts, the precomputed hierarchy closure, value set definitions and expansions, concept maps, and per-tenant licence entitlement. Releases are nev...
Two-phase transaction Bundle executor (SP3)
Phase 1 resolves every conditional reference and urn:uuid placeholder and touches nothing. Phase 2 writes and reads nothing. The split is the entire point. The...
A report is a bug or an enhancement
The distinction is not cosmetic — it decides what the AI session is asked to do. Pointing a session at logs hunting a fault that was never there wastes the whol...
The FHIR search compiler (SP3)
Compiles a search into one SQL statement over the typed index tables. Every rule below fails by returning the WRONG ROWS rather than by raising anything, which ...
Stop the bug list 500ing on every unfiltered load
PostgreSQL cannot infer a type for a null parameter inside a string expression: LOWER(CONCAT('%', :search, '%')) with a null :search guessed bytea, and the list...
The FHIR read path — read, vread, history and ETag (SP3)
Completes the round trip: a resource can now be written, read back, read at a specific revision, and have its history walked. The JSON is SERVED rather than as...
The FHIR write path — projection and atomic writer (SP3)
A resource write is not one row: it is the domain rows, the canonical JSON, up to eight kinds of search-index row, a reference link per reference, and a securit...
FHIR resource repositories, with the 40001-safe version claim
claimNextVersion is an UPDATE ... SET current_version_id = current_version_id + 1 and must be the FIRST statement of a write transaction. The obvious alternativ...
Add the AiDispatchRequest the pushed code already imports
SecurityService's SystemBugAiDispatchController and SystemBugAiDispatchService are on main and import **************** but the record itself was never committed...
The encounter spine (SP5)
The entity everything clinical hangs off — a note, an order, a diagnosis and a charge all point at the encounter they arose in. Planned and actual times are se...
The Patient entity and its US Core satellites (SP5)
A new entity rather than a reuse, and each rejection is concrete rather than stylistic. Not Member: GET /api/security/members/names returns every member of an o...
The disclosure ledger and patient restrictions (SP2)
DisclosureLedger is separate from phi_access_log on purpose. The access log records every READ, and most reads are a clinician opening a chart; deriving an acco...
Care relationships and break-glass, the facts behind the access basis (SP2)
PhiAccessBasis gained CARE_TEAM and BREAK_GLASS last commit; without these two tables those values are decorative. Nothing on the platform modelled a provider-p...
Record that Java field order does not control DDL key order
The composite-key assertion passed while ddl-auto actually built PRIMARY KEY (logical_id, resource_type, tenant_id) — Hibernate emits @EmbeddedId columns ALPHAB...
DS4P security labels, applied at write time (SP2)
The indexed projection of a resource's meta.security labels, and the thing that has to exist before the first clinical read path rather than after the first beh...
Extend the audit spine for clinical accounting (SP2)
Four fields the clinical read paths cannot work without, and none of which can be backfilled — each records something only knowable at the moment of access. pu...
The eight typed search-index tables (SP3)
Search runs over explicit typed tables, not JSONB with GIN. That is forced by the database, not chosen: Yugabyte's own docs state a GIN index cannot use more th...
FHIR resource versioning and the reference-link backbone (SP3)
Three tables that between them make read, vread, _history, ETag and every form of _include work. fhir_resource_current is a pointer, one row per resource forev...
The FHIR datatype layer and its discipline harness (SP3)
The foundation every clinical entity reuses, and the build gate that stops it drifting. Both land together on purpose: a harness written before there is anythin...
Guard the last four unenforced capabilities; the baseline is now empty
SOCIAL_MESSAGING, CANVA, MCP_GATEWAY and ANALYTICS_EXPORT were each declared outside the compliance boundary, bound to no ServiceType, and checked by nothing — ...
Rights, entities, repositories and DTOs
MANAGE_SYSTEM_BUGS is a PlatformRightType and must stay one: the dispatch it a tenant administrator can edit their own organization's security models. Screensh...
Add a global alias-uniqueness check
**************** scopes by provider, and that was right while an alias was only ever resolved as (security_provider_id, alias) — the pair behind a <alias>.<pare...
Add the Affiliate Sales Scoreboard widget rights
Five rights, 234-238, in the MARKETING group and hung off VIEW_REFERRAL_CODES: a leaderboard of referral numbers is tracking-code data, and a member who may not...
Ratchet that a blocked capability with no app has a call-site guard
Splitting an app from the capability inside it is what lets a clinic hold a phone system and a video room at all, but it moves the enforcement burden. PhiModule...
The five pre-existing verticals must ship available
Shipping all six children PLANNING was wrong for five of them. RETAIL, RENTAL, SERVICE, SUBSCRIPTION and PROCUREMENT are not new functionality — they are what C...
Every vertical names its own child app
requiredService becomes total now that each vertical has a child app under ServiceType.POS, which deletes the "null means POS alone is enough" special case and ...
Cascade feature enable/disable across the app tree
Enabling a child enables its parent; disabling a parent disables every child; disabling the last child disables the parent. Enabling a parent leaves children al...
Add PhiCapabilityGuard for call-time capability checks
PhiTenantGuard runs at feature-enable time and nowhere else — three call sites, all in FeatureService. Now that PhiModule is capability-grained, an app whose co...
Split PhiModule from app-grained to capability-grained
POS mapped to ECOMMERCE_SYNC (BLOCKED_NO_BAA) and the whole commerce surface hangs off POS, so an org with handlesPhi=true could not switch commerce on at all —...
Je, unaona nini kuhusu usafiri?
Kila kitu kinaingia kwenye tovuti yako mwenyewe. Anza kwenye mpango wa bure na usome ukurasa huu tena katika mwezi mmoja.