QA Evidence Ledger

SCRIMED release evidence, fail-closed controls, and operator-token gates stay visible and buyer-safe.

This ledger records what has passed, what intentionally fails closed, which limitations are contained, and the one remaining authenticated QA gate that requires a fresh short-lived AAL2 operator session.

Download QA Brief Inspect QA API Capture Run Packet Download Activation Plan Execution Readiness Run Control Launch Kit Human Run Packet Completion Bridge Claim Guard Activation Seal Proof Promotion Buyer Proof Release Execution Console AAL2 Evidence Package Pilot Evidence

Statusqa-evidence-ledger-active

Evidence entries20

Passed4

Fail closed1

Manual gates2

Capture pathmanual-aal2-run-evidence-packet-ready

Activationmanual-aal2-qa-evidence-activation-plan-ready

Persistencetenant-scoped-aal2-manual-qa-evidence-ledger

Executionready-for-human-run-not-code-bypass

Run controloperator-control-ready-human-aal2-required

Launch kitready-for-human-launch-not-code-execution

Launch phases9

Human run packetdispatch-template-ready

Run packet controls7

Run packet stops3

Completion bridgewaiting-for-human-aal2-run

Bridge hard stops2

Claim guardactivation-ready-until-retained-packet-proof

Claim blocks16

Activation sealunsealed-human-aal2-required

Seal hard stops4

Proof promotionpending-retained-packet

Promotion rules5

Proof blocked9

Buyer releaselocked-retained-packet-required

Execution consoleoperator-aal2-run-required

AAL2 packageprotected-aal2-synthetic-qa-evidence-package-ready

Console stops8

Release stops10

Data boundarysynthetic only

Current boundary

SCRIMED verifies release health, protected-route containment, token-policy readiness, and no-secret evidence capture today; remaining authenticated QA evidence requires deliberate short-lived AAL2 operator runs against synthetic targets.

SCRIMED QA Evidence Ledger records synthetic-only release, smoke, token-policy, fail-closed, and operator-gate evidence. It is not a clinical validation report, security certification, legal opinion, SOC report, HIPAA attestation, or authorization for live healthcare execution.

envproduction

refmain

sha7bf596c25bed

AAL2 evidence package

The first protected synthetic QA run now has a buyer-safe evidence dossier and go/no-go posture.

SCRIMED AAL2 Synthetic QA Run Evidence records the first protected human-reviewed AAL2 synthetic QA evidence posture. It does not bypass human AAL2, store credentials, store PHI, touch production systems, trigger live patient workflows, perform autonomous clinical action, certify HIPAA/SOC/FDA/security status, guarantee reimbursement, approve connectors, approve buyer proof release, or authorize live clinical care.

Open Evidence Package Download Evidence Brief Protected Workspace

status

protected-aal2-synthetic-qa-evidence-package-ready

Records required test categories, boundary checks, retained packet visibility, and release posture.

protected route

/api/pilot-workspaces/{workspaceSlug}/qa-evidence/aal2-run-evidence

Reads tenant-governed packet and audit state without storing secrets or touching production systems.

release rule

NO-GO until gates pass

Buyer proof release remains blocked until retained packet evidence, audit signals, and release criteria pass.

Manual QA execution console

Human AAL2 execution now flows through one protected operator command lane.

SCRIMED Manual QA Execution Console coordinates human AAL2 synthetic QA execution, retained no-secret evidence capture, and Buyer Proof Release checks. It does not execute passkey ceremonies, mint or store tokens, store PHI, run unattended authenticated CI, certify security or compliance, authorize live clinical care, guarantee reimbursement, approve production connectors, or create public release authority.

Open Execution Console Download Console Brief Protected Workspace

state

operator-aal2-run-required

SCRIMED has a protected operator console for human AAL2 synthetic QA execution, but no buyer proof or production authority exists until retained no-secret packet evidence and Buyer Proof Release pass.

protected route

/api/pilot-workspaces/{workspaceSlug}/qa-evidence/manual-execution-console

Reads retained packet and audit visibility before buyer proof is released.

next action

Buyer Proof Release state: locked-retained-packet-required.

Buyer diligence and claims governance

Activation plan

Human AAL2 QA runs now have a no-secret sequence from workflow dispatch to Buyer Diligence export.

The QA Evidence Activation Plan is a no-secret operator runbook for governed synthetic AAL2 QA only. It does not store or reveal bearer tokens, execute passkey ceremonies, authorize PHI processing, certify compliance, or grant live clinical authority.

status

manual-aal2-qa-evidence-activation-plan-ready

Human AAL2 session plus short-lived token plus explicit synthetic target plus no-secret evidence persistence.

route

/api/qa-evidence/activation-plan

Never paste bearer tokens, refresh tokens, passwords, API keys, PHI, patient identifiers, payer member identifiers, artifact URLs, signed approvals, legal opinions, security reports, reimbursement determinations, source contracts, production credentials, or clinical records into QA evidence fields.

completion

6 criteria

Authenticated QA evidence remains pending until a human operator performs the AAL2 run; code must not bypass this with committed credentials or long-lived secrets.

ready-for-human-aal2-run

Sales Demo Session QA activation

Adds tenant-scoped evidence that SCRIMED can create and audit a governed synthetic buyer demo session under human AAL2 control.

.github/workflows/sales-demo-session-qa-smoke.yml

Target input: intake_id
Preflight: scripts/sales-demo-session-qa-token-preflight.mjs
Smoke: scripts/sales-demo-session-qa-smoke.mjs
Temporary secret: SCRIMED_SALES_QA_BEARER_TOKEN
Persistence: /api/pilot-workspaces/{workspaceSlug}/qa-evidence/manual-run-packets
Next: Run the manual workflow once a fresh AAL2 tenant-admin token and safe synthetic intake target are available.

ready-for-human-aal2-run

Authority Reference QA activation

Adds tenant-scoped evidence that SCRIMED can record and audit no-PHI authority-reference readiness metadata under human AAL2 control.

.github/workflows/authority-reference-qa-smoke.yml

Target input: workspace_slug
Preflight: scripts/authority-artifact-reference-qa-token-preflight.mjs
Smoke: scripts/authority-artifact-reference-qa-smoke.mjs
Temporary secret: SCRIMED_BEARER_TOKEN
Persistence: /api/pilot-workspaces/{workspaceSlug}/qa-evidence/manual-run-packets
Next: Run the manual workflow once a fresh AAL2 tenant governance token and synthetic workspace target are available.

Execution readiness

SCRIMED can guide the human AAL2 run without claiming authenticated proof before evidence is retained.

SCRIMED Manual AAL2 QA Execution Readiness coordinates human-run authenticated synthetic QA. It does not mint bearer tokens, execute passkey ceremonies, store secrets, run unattended authenticated CI, process PHI, authorize clinical care, certify compliance, grant reimbursement certainty, approve production connectors, or claim authenticated proof before retained no-secret evidence exists.

Open Execution Readiness Download Execution Brief

ready-for-human-aal2-run-not-executed

Sales Demo Session QA activation

No authenticated sales-demo CI evidence can be claimed until a human runs the workflow with a fresh short-lived AAL2 token.

.github/workflows/sales-demo-session-qa-smoke.yml

Target: intake_id
Temporary secret: SCRIMED_SALES_QA_BEARER_TOKEN
Next: Run the manual workflow once a fresh AAL2 tenant-admin token and safe synthetic intake target are available.

ready-for-human-aal2-run-not-executed

Authority Reference QA activation

No authenticated authority-reference CI evidence can be claimed until a human runs the workflow with a fresh short-lived AAL2 token.

.github/workflows/authority-reference-qa-smoke.yml

Target: workspace_slug
Temporary secret: SCRIMED_BEARER_TOKEN
Next: Run the manual workflow once a fresh AAL2 tenant governance token and synthetic workspace target are available.

Run control

Operators now have workflow-specific dispatch inputs, command templates, and safe evidence payloads before touching a token.

SCRIMED Manual AAL2 QA Run Control creates a no-secret operator mission-control layer for human-run synthetic QA. It does not execute AAL2 ceremonies, mint tokens, store credentials, run unattended authenticated CI, process PHI, authorize clinical care, certify security or compliance, guarantee reimbursement, approve production connectors, or claim retained authenticated proof before protected no-secret evidence is persisted.

Open Run Control Download Run-Control Brief

ready-for-operator-control-human-aal2-required

Sales Demo Session QA activation

Do not promote this workflow into Buyer Diligence until the protected workspace shows a retained packet SHA-256 and append-only audit event.

.github/workflows/sales-demo-session-qa-smoke.yml

Temporary secret: SCRIMED_SALES_QA_BEARER_TOKEN
Evidence route: /api/qa-evidence/manual-run-packet
Persistence: /api/pilot-workspaces/{workspaceSlug}/qa-evidence/manual-run-packets
Abort conditions: 7

ready-for-operator-control-human-aal2-required

Authority Reference QA activation

Do not promote this workflow into Buyer Diligence until the protected workspace shows a retained packet SHA-256 and append-only audit event.

.github/workflows/authority-reference-qa-smoke.yml

Temporary secret: SCRIMED_BEARER_TOKEN
Evidence route: /api/qa-evidence/manual-run-packet
Persistence: /api/pilot-workspaces/{workspaceSlug}/qa-evidence/manual-run-packets
Abort conditions: 7

Launch kit

Operators now have one no-secret handoff before running the first human AAL2 workflow.

SCRIMED Manual AAL2 QA Launch Kit packages the human-run workflow handoff for synthetic QA only. It does not execute passkey ceremonies, mint tokens, store credentials, store PHI, run unattended authenticated CI, certify security or compliance, authorize live clinical care, guarantee reimbursement, approve production connectors, or claim retained authenticated QA proof before protected no-secret packet hashes are visible.

Open Launch Kit Download Launch Kit

prepare

Confirm human AAL2 session

Tenant-admin or pilot-lead operator

Pass: The operator has an approved tenant role and current AAL2 browser session.
Fail closed: The session is stale, shared, missing AAL2, or scoped to the wrong tenant.

prepare

Select exactly one synthetic target

Choose one synthetic sales intake ID or one synthetic protected workspace slug before dispatch.

Workflow owner

Pass: The target is explicit, synthetic, and contains no PHI, payer member data, or production data.
Fail closed: The target is missing, broad, production-linked, or contains regulated data.

prepare

Create temporary masked workflow secret

Place the short-lived AAL2 token only in the manual GitHub Actions secret required for the selected workflow.

Security owner and operator

Pass: The token is short-lived, masked, workflow-specific, and never pasted into source, docs, chat, or packets.
Fail closed: The token is long-lived, copied into evidence, or stored anywhere outside the temporary secret path.

execute-human-run

Run preflight and dispatch

Run the workflow-specific preflight, then dispatch the manual workflow with require_authenticated_path=true.

Release engineering

Pass: Preflight passes and the manual workflow completes against the explicit synthetic target.
Fail closed: Preflight fails, authenticated path is optional, the target changes, or the workflow is scheduled.

retain-evidence

Copy safe metadata only

Copy only the workflow run ID, run URL, execution timestamp, synthetic target ID, created safe object UUID, and packet audit event UUID.

TrustOS and tenant governance

Pass: No token, credential, PHI, artifact URL, source contract, clinical record, or approval artifact enters SCRIMED evidence.
Fail closed: Any evidence field contains secret-like material or regulated identifiers.

retain-evidence

Delete or rotate temporary secret

Delete or rotate the temporary GitHub Actions secret immediately after the workflow completes.

Security owner and operator

Pass: Secret disposal attestation is true before packet generation or persistence.
Fail closed: The temporary token remains available after the run.

retain-evidence

Persist no-secret packet

Generate the no-secret packet, then persist the same metadata through the protected Manual QA Evidence panel.

Tenant governance operator

Pass: The protected workspace shows packet SHA-256 and append-only audit visibility.
Fail closed: Packet persistence is attempted without AAL2 tenant governance authorization.

promote-proof

Check Proof Promotion

Open Proof Promotion and confirm buyer-diligence-ready status before citing retained authenticated QA evidence.

Sales engineering and trust reviewer

Pass: Proof Promotion allows only retained packet metadata and blocked production claims remain visible.
Fail closed: Buyer material references retained authenticated QA proof before packet hash visibility.

hard-stop

Keep production authority blocked

Keep live clinical care, PHI, payer submission, production connector, reimbursement, security-certification, and compliance claims blocked.

Clinical, legal, security, privacy, and compliance owners

Pass: Buyer proof remains limited to governed synthetic QA evidence.
Fail closed: Any stakeholder attempts to convert retained QA proof into live-care or production authorization.

Human run packet

The final dispatch packet keeps the first AAL2 run operator-controlled and proof-blocked.

SCRIMED QA Human Run Packet creates a no-secret dispatch packet for the approved human AAL2 synthetic QA run. It does not execute passkey ceremonies, mint or store tokens, persist packet hashes, process PHI, authorize live clinical care, certify security or compliance, guarantee reimbursement, approve production connectors, or claim retained authenticated QA proof before protected Manual QA Evidence is visible.

Open Human Run Packet Download Packet Brief

required-before-dispatch

Approved human operator

The operator role is tenant-admin or pilot-lead and the AAL2 browser session is fresh.

Tenant-admin or pilot-lead

Fail closed: The session is stale, shared, non-AAL2, or the role is not allowed.

required-before-dispatch

Single synthetic target

The packet names one synthetic target and one workspace slug before the run.

Workflow owner

Fail closed: The target is broad, production-linked, patient-linked, payer-member-linked, or ambiguous.

required-before-dispatch

Manual workflow only

The selected workflow remains manual and requires require_authenticated_path=true.

Release engineering

Fail closed: The workflow is scheduled, unattended, or allows the authenticated path to be optional.

required-after-run

No-secret evidence fields

Only workflow ID, run URL, timestamp, safe object UUIDs, packet hash, and audit UUID are copied.

TrustOS reviewer

Fail closed: Tokens, credentials, PHI, payer member data, legal artifacts, reports, contracts, or clinical records appear.

hard-stop

Protected packet visibility

Protected Manual QA Evidence shows packet SHA-256 and append-only audit event visibility.

Tenant governance operator

Fail closed: Only a public packet preview, operator assertion, screenshot, or chat statement exists.

hard-stop

Proof and claim gates

Completion Bridge, Activation Seal, Proof Promotion, Claim Guard, and Buyer Proof Release all preserve the retained-packet boundary.

Buyer diligence and claims governance

Fail closed: Any buyer, investor, sales, PR, or operator language claims retained proof or production authority too early.

hard-stop

Clinical authority blocked

The packet remains a governed synthetic QA dispatch artifact only.

Clinical, legal, privacy, security, compliance, and customer authority owners

Fail closed: The packet is used as clinical care, PHI, payer submission, reimbursement, certification, connector, or regional approval.

Completion bridge

After the human run, validate the no-secret packet before protected persistence.

SCRIMED QA Completion Bridge validates no-secret candidate metadata after a human AAL2 synthetic QA run and before protected persistence. It does not execute passkey ceremonies, mint or store tokens, persist evidence, store PHI, authorize live clinical care, certify security or compliance, guarantee reimbursement, approve production connectors, or allow buyer proof promotion before protected packet hashes are visible.

Open Completion Bridge Download Bridge Brief

required-before-bridge

Human AAL2 workflow run

One explicit synthetic workflow run ID, run URL, timestamp, target ID, created object UUID, and packet audit event UUID.

Tenant-admin or pilot-lead operator

Pass: The candidate payload references exactly one completed human-run synthetic workflow.
Fail closed: The run did not happen, was scheduled/unattended, used a broad target, or references regulated data.

validated-by-bridge

No-secret candidate validation

Safe metadata only, accepted attestations, valid GitHub Actions or SCRIMED Run Control URL, ISO timestamp, and UUID evidence object IDs.

TrustOS and release engineering

Pass: The public bridge returns ready-for-protected-persistence and a packet preview SHA-256.
Fail closed: The payload contains bearer/JWT-like material, PHI, payer member data, credentials, invalid attestations, or unsupported workflow kind.

protected-only

Protected packet persistence

AAL2 protected workspace session and POST to the tenant-scoped manual QA evidence route.

Tenant governance operator

Pass: The protected workspace returns a retained packet hash and append-only audit event.
Fail closed: The operator lacks AAL2 governance authorization or the protected write rejects the payload.

hard-stop

Proof Promotion decision

Visible retained packet SHA-256, workflow run ID, audit event reference, and blocked production claims.

Buyer diligence reviewer

Pass: Proof Promotion moves buyer language from activation-ready to retained no-secret QA evidence.
Fail closed: Buyer material claims authenticated proof before protected packet hash visibility.

hard-stop

Clinical and production authority

Separate signed customer/legal/security/privacy/clinical/regional/reimbursement/connector approvals.

Clinical, legal, privacy, security, reimbursement, and customer authority owners

Pass: Authority remains explicitly blocked unless external approvals exist.
Fail closed: Anyone treats QA completion evidence as PHI, live-care, payer, connector, security-certification, or reimbursement authorization.

Claim guard

Keep external and buyer language aligned with retained evidence, not ambition.

SCRIMED QA Claim Guard classifies buyer, investor, sales, and operator language for current manual AAL2 QA posture. It does not create authenticated QA proof, persist evidence, replace counsel, certify security or compliance, authorize PHI processing, authorize live clinical care, guarantee reimbursement, approve production connectors, or approve public claims without retained evidence and qualified review.

Open Claim Guard Download Claim Brief

safe-current-claim

Current-state language only

The claim describes synthetic, no-secret, activation-ready, fail-closed, or human-required workflow readiness.

QA Evidence Ledger, Launch Kit, Human Run Packet, Completion Bridge, public smoke, and fail-closed route checks.

SCRIMED has a governed no-secret synthetic QA readiness path with human AAL2 gates still explicit.

requires-retained-packet

Retained packet language requires packet hash

The claim says authenticated QA evidence is retained, completed, packet-backed, or buyer-diligence-ready.

Protected Manual QA Evidence packet SHA-256, audit event ID, workflow run ID, and Proof Promotion ready state.

SCRIMED has an activation-ready path; retained authenticated QA proof will be referenced only after protected packet hash visibility.

blocked-authority-claim

Clinical and production authority remain blocked

The claim implies live care, PHI processing, security/compliance certification, FDA approval, reimbursement certainty, production connector approval, payer submission, patient outreach, or autonomous clinical action.

Separate signed customer, legal, privacy, security, clinical, regional, reimbursement, connector, and production approvals.

SCRIMED is currently positioned for governed synthetic pilots and enterprise evaluation; production clinical authority remains separately gated.

needs-qualified-review

External-use claims need qualified review

The claim is for public website, PR, advertising, investor materials, case studies, legal documents, security questionnaires, or production go-live.

Qualified legal, privacy, security, clinical, marketing, finance, or customer approval depending on audience.

Use internal diligence language until the required external-use approval packet is retained.

Activation seal

Use the seal after protected persistence to keep buyer proof tied to retained packet evidence.

SCRIMED QA Activation Seal checks whether manual AAL2 synthetic QA evidence can be treated as buyer-diligence-ready. Public checks can validate no-secret candidate completeness only; actual sealing requires protected workspace packet visibility. This does not execute passkey ceremonies, store tokens, store PHI, replace counsel, certify security or compliance, authorize live clinical care, guarantee reimbursement, approve production connectors, or grant production clinical authority.

Open Activation Seal Download Seal Brief

unsealed-human-aal2-required

SCRIMED has a no-secret activation path, but the QA Activation Seal remains unsealed until protected packet evidence is visible.

Complete Launch Kit, validate dispatch through Human Run Packet, validate through Completion Bridge, persist protected no-secret metadata, confirm Proof Promotion, then run Claim Guard before buyer use.

Seal allowed: no

Buyer use: no
Required evidence: 10
Blocked claims: 14

hard-stop

Protected packet required

A retained packet SHA-256 visible from protected Manual QA Evidence.

Protected workspace packet list contains the packet hash.

Fail closed: Only a public preview hash or operator assertion is available.

hard-stop

Audit event required

Append-only packet audit event UUID from the protected workspace.

Audit event and packet metadata reference the same manual QA run.

Fail closed: The audit event is missing, synthetic target is ambiguous, or IDs do not match.

hard-stop

No secrets or PHI

Only workflow ID, run URL, timestamp, target ID, safe object UUID, packet hash, and audit UUID.

No token, credential, PHI, payer member data, source contract, URL artifact, report, or approval document is present.

Fail closed: Any field contains secret-like, PHI-like, credential-like, or regulated identifiers.

required

Proof Promotion decision required

Proof Promotion state ready-for-buyer-diligence.

Promotion allows only retained packet metadata and keeps production claims blocked.

Fail closed: Proof Promotion is pending, under review, or not visible.

required

Claim Guard required

Claim Guard confirms current language does not overclaim retained proof or production authority.

Buyer language stays bounded to synthetic QA evidence and retained packet metadata.

Fail closed: Language implies legal approval, certification, live clinical care, PHI authority, reimbursement certainty, or connector approval.

required

Human AAL2 provenance required

Operator attestation no-secrets-no-phi-aal2-human-run and token disposal attestation temporary-token-deleted-or-rotated.

The run was deliberate, human initiated, scoped, synthetic, and the temporary token was removed.

Fail closed: The workflow was unattended, scheduled, broad-targeted, or token disposal is not attested.

hard-stop

Clinical and production authority blocked

Separate external approvals for clinical, legal, privacy, security, reimbursement, regional, connector, and customer go-live authority.

Activation Seal remains limited to buyer diligence for governed synthetic QA.

Fail closed: Anyone treats QA evidence as clinical, PHI, payer, reimbursement, certification, connector, or production authorization.

Proof promotion

SCRIMED separates activation readiness from retained authenticated QA proof.

SCRIMED Manual QA Proof Promotion decides when retained no-secret human AAL2 QA packet metadata can be referenced in buyer diligence. It does not execute AAL2 workflows, store tokens, store PHI, certify security or compliance, authorize live clinical care, guarantee reimbursement, approve production connectors, or allow authenticated-proof claims before a protected packet hash is visible.

Open Proof Promotion Download Promotion Brief

pending-retained-packet

SCRIMED has an operator-ready manual AAL2 QA path, but retained authenticated QA proof is still pending.

Buyer-facing proof may reference activation readiness, Run Control, and fail-closed checks, but not retained authenticated QA proof.

Use /qa-run-control, complete one human AAL2 synthetic QA workflow, persist the no-secret packet, then promote after packet hash visibility.

Promotion allowed: no
Protected persistence: /api/pilot-workspaces/{workspaceSlug}/qa-evidence/manual-run-packets
Hard stops: 3

hard-stop

Retained packet hash required

Describe the workflow as activation-ready or operator-ready only.

Reference the retained packet hash and workflow run ID in buyer diligence.

No hash means no retained authenticated QA proof claim.

hard-stop

No-secret evidence only

Reject bearer tokens, refresh tokens, credentials, PHI, payer data, artifacts, URLs, legal opinions, and security reports.

Use only safe metadata fields and the packet SHA-256.

The token itself is never evidence.

active

Human AAL2 provenance required

Use Run Control and Manual QA Evidence capture under a fresh human AAL2 session.

State that the packet records a human-run synthetic QA workflow.

AAL2 provenance is not clinical, legal, reimbursement, or production authorization.

active

Buyer Diligence export after persistence

Keep Buyer Diligence language in pending activation posture.

Allow Buyer Diligence to include retained packet count, run ID, packet hash, and audit event reference.

Buyer proof is limited to governed synthetic QA evidence.

hard-stop

Clinical and production claims remain blocked

Do not imply live care, PHI processing, payer submission, or connector approval.

Continue blocking live clinical, PHI, payer, reimbursement, security-certification, and production-launch claims.

Retained QA proof improves diligence; it does not unlock production clinical execution.

Buyer proof release

Use one protected go/no-go gate before retained manual QA proof enters Buyer Diligence.

SCRIMED QA Buyer Proof Release decides whether protected buyer diligence may reference retained no-secret manual AAL2 synthetic QA evidence. Public checks validate candidate metadata only. Protected release requires tenant-governed AAL2 access, visible retained packet metadata, Proof Promotion, Activation Seal, Claim Guard, and unchanged clinical/PHI/security/reimbursement boundaries.

Open Buyer Proof Release Download Release Brief

locked-retained-packet-required

SCRIMED remains activation-ready; retained manual AAL2 QA proof cannot be used in buyer diligence until the protected release gate passes.

Complete the human AAL2 run, persist no-secret metadata, then verify Proof Promotion, Activation Seal, Claim Guard, and this release gate before Buyer Diligence export.

Buyer export: blocked

Protected route: /api/pilot-workspaces/{workspaceSlug}/qa-evidence/buyer-proof-release
Buyer packet: /api/pilot-workspaces/{workspaceSlug}/buyer-room/packet
Public claims: blocked

blocked

Retained protected packet visible

No protected packet SHA-256 is visible to the release gate.

Persist safe metadata through protected Manual QA Evidence after the human AAL2 run.

blocked

Proof Promotion permits buyer diligence

Proof Promotion state: pending-retained-packet.

Use /qa-run-control, complete one human AAL2 synthetic QA workflow, persist the no-secret packet, then promote after packet hash visibility.

blocked

Activation Seal allows buyer use

Activation Seal state: unsealed-human-aal2-required.

passed

Claim Guard keeps language bounded

Claim Guard state: requires-retained-packet.

Complete Launch Kit, validate dispatch through Human Run Packet, validate through Completion Bridge, persist protected metadata, then confirm Proof Promotion before using this claim.

passed

External authority remains separately gated

External distribution, public claims, live clinical care, PHI processing, reimbursement, certification, connector, and production authority remain false.

Route external-use claims through qualified release, legal, privacy, security, clinical, reimbursement, regional, connector, and customer go-live controls.

Evidence entries

Every check is tied to an artifact, route, limitation, and workaround.

passed

Public production smoke

Production smoke verified public HTML, product console proof-stack posture, readiness APIs, and protected-route fail-closed behavior on app.scrimedsolutions.com.

scripts/public-production-smoke.mjs

Owner: Release engineering
Recorded: 2026-06-18
Limitation: Does not authenticate or mutate tenant-admin records.
Workaround: Protected routes must return a fail-closed response without credentials; authenticated mutation evidence is isolated behind AAL2 operator-token QA.
Next: Run after each release and keep the product proof-stack assertion current.

passed

Local production build and smoke

TypeScript, ESLint, generated integrity, production build, and local production smoke passed using the bundled Node runtime when the managed shell omitted node/npm from PATH.

next build --webpack plus local production smoke

Owner: Engineering
Recorded: 2026-06-18
Limitation: The local Codex shell may not expose npm or node on PATH consistently.
Workaround: Use the bundled Node absolute path for local verification; GitHub Actions and Vercel continue to run standard Node 22 commands.
Next: Restore normal local package-manager PATH when convenient; keep absolute-Node fallback documented.

passed

Sales demo session token policy

Short-lived AAL2 JWT preflight, no-secret safe skip, policy self-test, explicit intake targeting, and manual-only GitHub workflow are implemented.

scripts/sales-demo-session-qa-token-preflight.mjs

Owner: Trust engineering
Recorded: 2026-06-18
Limitation: Static preflight decodes claims but does not verify JWT signature; protected SCRIMED APIs and Supabase Auth remain the verification authority.
Workaround: Preflight blocks weak token shape before network access; authenticated route verification still happens inside the protected API.
Next: Mint a fresh AAL2 operator token only for a deliberate manual QA workflow run.

manual-gate

First authenticated Sales Demo Session QA CI run

The runnable workflow, token preflight, smoke harness, and protected API path are present; the first live authenticated CI run still requires a fresh AAL2 operator session and explicit buyer-opportunity target.

.github/workflows/sales-demo-session-qa-smoke.yml

Owner: SCRIMED operator
Recorded: 2026-06-18
Limitation: No long-lived bearer token should be stored in repo, docs, runtime config, or unattended CI.
Workaround: Keep the workflow manual, store the token only as a temporary masked GitHub Actions secret, run against one explicit intake ID, then delete or rotate the secret immediately after evidence capture.
Next: Run the manual workflow once a fresh AAL2 token and safe synthetic intake target are available.

manual-gate

Authenticated Authority Reference QA run

The protected authority-reference QA script, renewal queue, packet audit path, and manual workflow wrapper are present; the first authenticated run still requires a fresh short-lived AAL2 tenant token.

.github/workflows/authority-reference-qa-smoke.yml

Owner: SCRIMED operator
Recorded: 2026-06-21
Limitation: No long-lived bearer token should be stored in source, runtime config, docs, or unattended CI.
Workaround: Run the manual workflow with a temporary masked GitHub Actions secret, capture only the workflow run ID, created authority reference ID, packet audit event ID, and packet hash, then delete or rotate the secret.
Next: Run the authority-reference QA workflow once a fresh AAL2 token is available, then persist the safe metadata through the Manual QA Evidence panel in authority-reference mode.

workaround-active

Manual AAL2 QA evidence activation plan

A no-secret activation plan now gives operators workflow-specific target inputs, token preflight paths, safe evidence fields, prohibited content, persistence route, Buyer Diligence impact, and retained boundaries before any AAL2 run.

/api/qa-evidence/activation-plan

Owner: Release engineering
Recorded: 2026-06-21
Limitation: The activation plan coordinates the human run; it does not mint tokens, execute passkey ceremonies, or create authenticated proof by itself.
Workaround: Use the plan as the mandatory bridge between manual GitHub workflow execution, secret disposal, protected Manual QA Evidence persistence, and Buyer Diligence export.
Next: Run each manual AAL2 QA workflow from the plan, persist only safe metadata, then export Buyer Diligence after packet hashes appear.

workaround-active

Manual AAL2 QA run control

A no-secret run-control layer gives operators workflow-specific dispatch inputs, preflight command templates, smoke command templates, safe evidence payloads, abort conditions, and buyer-proof promotion rules before any human AAL2 token is used.

/api/qa-evidence/run-control

Owner: Release engineering and TrustOS
Recorded: 2026-06-21
Limitation: Run Control prepares the first authenticated synthetic QA run; it still does not execute passkey ceremonies, mint tokens, store credentials, or claim retained authenticated evidence.
Workaround: Use Run Control as the mandatory mission brief before the human workflow dispatch, then persist only safe packet metadata after token disposal.
Next: Use /qa-run-control during the first Sales Demo Session QA or Authority Reference QA human AAL2 run, then persist the packet hash through Manual QA Evidence.

workaround-active

Manual AAL2 QA launch kit

A no-secret Launch Kit now packages the approved human AAL2 handoff with workflow dispatch inputs, command templates, safe-copy fields, secret-disposal checks, packet persistence steps, and Proof Promotion checks before any buyer proof claim.

/api/qa-evidence/launch-kit

Owner: Release engineering, TrustOS, security, and tenant governance
Recorded: 2026-06-22
Limitation: The Launch Kit does not execute passkey ceremonies, mint tokens, store credentials, run the workflow, persist packet hashes, or authorize clinical, PHI, reimbursement, security-certification, connector, or production claims.
Workaround: Use the Launch Kit as the final operator handoff before the human run so the only remaining gate is the out-of-band short-lived AAL2 workflow execution and protected packet persistence.
Next: Have an approved operator use /qa-launch-kit, complete one human AAL2 workflow, persist only safe metadata, then confirm /qa-proof-promotion before exporting Buyer Diligence.

workaround-active

Manual AAL2 QA human run packet

A no-secret Human Run Packet now converts Launch Kit readiness into a bounded dispatch artifact with operator role, synthetic target, AAL2/no-code-bypass attestation, proof-blocked attestation, post-run route chain, controls, hard stops, and blocked claims.

/api/qa-evidence/human-run-packet

Owner: Release engineering, TrustOS, security, tenant governance, and Buyer Diligence
Recorded: 2026-06-22
Limitation: The Human Run Packet still does not execute passkey ceremonies, mint tokens, run workflows, persist packet hashes, authorize production data, or claim retained authenticated proof.
Workaround: Use the packet to make the first human AAL2 run deterministic and auditable while protected Manual QA Evidence remains the only source of retained proof.
Next: Have an approved tenant-admin or pilot-lead use /qa-human-run-packet for exactly one synthetic workflow, validate through /qa-completion-bridge, persist protected metadata, then confirm /qa-activation-seal, /qa-proof-promotion, and /qa-claim-guard.

workaround-active

Manual AAL2 QA execution console

A protected Manual QA Execution Console now unifies human AAL2 run readiness, manual workflow dispatch, no-secret metadata capture, retained packet visibility, audit signals, and Buyer Proof Release readiness in one operator lane.

/api/qa-evidence/manual-execution-console

Owner: Release engineering, TrustOS, tenant governance, security, and Buyer Diligence
Recorded: 2026-06-22
Limitation: The console coordinates execution but does not mint tokens, execute passkey ceremonies, run authenticated CI unattended, store secrets, process PHI, create retained packets by itself, or authorize production healthcare activity.
Workaround: Use the public route for the no-secret runbook and the protected workspace panel to read retained packet and audit visibility before any Buyer Diligence proof language is released.
Next: Use /pilot-workspace/access#manual-qa-execution-console during the first human AAL2 synthetic QA workflow, persist safe metadata through Manual QA Evidence, then refresh Buyer Proof Release.

workaround-active

Protected AAL2 synthetic QA run evidence package

A dated buyer-safe evidence package now maps the first protected AAL2 synthetic QA run to required categories, retained packet visibility, audit signals, boundary checks, remaining blockers, and a go/no-go release recommendation.

/api/qa-evidence/aal2-run-evidence

Owner: Release engineering, TrustOS, tenant governance, security, and Buyer Diligence
Recorded: 2026-06-22
Limitation: The package truthfully records current evidence posture; it does not itself execute the human AAL2 workflow, create retained packet hashes, or approve buyer proof release.
Workaround: Use the package as the formal NO-GO/GO evidence summary around the protected Manual QA Execution Console and Buyer Proof Release gate.
Next: Complete one approved human AAL2 synthetic workflow, persist no-secret metadata, attach reviewer notes for all required QA categories, then rerun the protected AAL2 evidence package before release.

workaround-active

Manual AAL2 QA completion bridge

A no-secret Completion Bridge now validates candidate post-run QA metadata, generates a packet preview hash, and keeps buyer proof blocked until protected packet persistence and Proof Promotion succeed.

/api/qa-evidence/completion-bridge

Owner: Release engineering, TrustOS, tenant governance, and Buyer Diligence
Recorded: 2026-06-22
Limitation: The bridge does not execute the human AAL2 run, store evidence, store tokens, create protected packet hashes, or authorize clinical, PHI, reimbursement, security-certification, connector, or production claims.
Workaround: Use the bridge immediately after the human Launch Kit workflow to reject unsafe candidate metadata before submitting the same no-secret payload through protected Manual QA Evidence persistence.
Next: After the approved operator completes one Launch Kit workflow, POST the no-secret candidate metadata to /api/qa-evidence/completion-bridge, persist only if the bridge returns ready-for-protected-persistence, then confirm /qa-proof-promotion before Buyer Diligence export.

workaround-active

Manual AAL2 QA claim guard

A no-secret Claim Guard now classifies buyer, investor, sales, PR, and operator language into current-safe, retained-packet-required, blocked-authority, or qualified-review states so claims do not outrun evidence.

/api/qa-evidence/claim-guard

Owner: TrustOS, legal, sales engineering, buyer diligence, and marketing governance
Recorded: 2026-06-22
Limitation: The Claim Guard provides current-state guidance only; it does not replace counsel, certify security or compliance, create retained QA proof, authorize PHI processing, authorize live clinical care, guarantee reimbursement, or approve production connectors.
Workaround: Use Claim Guard before Buyer Diligence, public materials, investor updates, sales language, PR, advertising, and operator summaries while protected packet proof and qualified approvals are pending.
Next: Route every QA-related buyer or external claim through /qa-claim-guard until a protected manual QA packet hash is retained and /qa-proof-promotion allows packet-backed language.

workaround-active

Manual AAL2 QA activation seal

A no-secret Activation Seal now distinguishes public candidate completeness from protected packet visibility and blocks packet-backed buyer proof language until retained QA evidence is visible.

/api/qa-evidence/activation-seal

Owner: TrustOS, release engineering, tenant governance, buyer diligence, and claims governance
Recorded: 2026-06-22
Limitation: The Activation Seal does not execute AAL2 workflows, create protected packet hashes, store tokens, store PHI, certify security or compliance, authorize live clinical care, guarantee reimbursement, approve production connectors, or create public release authority.
Workaround: Use Activation Seal after protected Manual QA Evidence persistence and before Buyer Diligence export so retained packet hash, audit event, Proof Promotion, Claim Guard, and blocked production-authority language are checked together.
Next: After the first human AAL2 workflow is persisted, verify /qa-activation-seal, /qa-proof-promotion, and /qa-claim-guard before using packet-backed buyer proof language.

workaround-active

Manual QA proof promotion gate

A retained-packet promotion gate now decides whether manual AAL2 synthetic QA evidence may be referenced in Buyer Diligence, requiring visible no-secret packet metadata before authenticated-proof language is allowed.

/api/qa-evidence/proof-promotion

Owner: Release engineering, TrustOS, and Buyer Diligence
Recorded: 2026-06-21
Limitation: Proof Promotion does not execute the human AAL2 run, create packet hashes, store credentials, or authorize clinical, PHI, reimbursement, security-certification, connector, or production claims.
Workaround: Use Proof Promotion to keep buyer-facing language in activation-ready posture until protected packet hashes are visible, then reference only safe workflow run metadata and packet SHA-256.
Next: After the first manual AAL2 workflow passes and the no-secret packet is persisted, confirm /qa-proof-promotion moves from pending to buyer-diligence-ready before exporting proof.

workaround-active

Manual QA buyer proof release gate

A protected Buyer Proof Release gate now consolidates retained Manual QA Evidence, Proof Promotion, Activation Seal, Claim Guard, and hard authority boundaries into one no-go/go decision before Buyer Diligence references retained QA proof.

/api/qa-evidence/buyer-proof-release

Owner: TrustOS, release engineering, tenant governance, buyer diligence, and claims governance
Recorded: 2026-06-22
Limitation: The release gate does not execute the human AAL2 run, create retained packets, store tokens, store PHI, authorize public distribution, certify security or compliance, authorize clinical care, guarantee reimbursement, approve connectors, or grant production authority.
Workaround: Use the public route for no-secret candidate validation, then require the protected workspace route to read retained packet and audit evidence before packet-backed Buyer Diligence language is allowed.
Next: After protected Manual QA Evidence persistence, run the protected Buyer Proof Release gate and export Buyer Diligence only if it returns ready-for-protected-buyer-diligence-export.

workaround-active

Manual AAL2 run evidence capture

A stateless evidence packet generator validates non-secret workflow run metadata, created evidence object ID, packet audit event ID, operator attestation, token-disposal attestation, and workflow kind after the manual QA workflow completes.

/api/qa-evidence/manual-run-packet

Owner: Release engineering
Recorded: 2026-06-18
Limitation: The packet generator does not execute the authenticated QA run by itself.
Workaround: Use it immediately after the manual workflow run to produce a sanitized packet, then persist the same non-secret run metadata through the protected tenant-scoped evidence route.
Next: After the first manual workflow pass for Sales Demo Session QA or Authority Reference QA, POST the non-secret run metadata to the packet route, then persist it through the workspace evidence route for buyer-room visibility.

workaround-active

Tenant-scoped manual QA evidence persistence

A protected AAL2 workspace route can persist sanitized manual QA evidence packets into tenant-scoped audit storage and surface the resulting packet/audit signal inside Buyer Pilot Rooms.

/api/pilot-workspaces/{workspaceSlug}/qa-evidence/manual-run-packets

Owner: Trust engineering
Recorded: 2026-06-18
Limitation: Persistence is intentionally unavailable without a verified AAL2 tenant governance session and server-held runtime authorization.
Workaround: Keep the public packet generator stateless for no-secret packet creation; use the protected persistence route only after human AAL2 QA has completed.
Next: Run the first AAL2 Sales Demo Session QA workflow, persist the evidence packet, then export a Buyer Diligence Export with the manual QA evidence signal included.

fail-closed

Protected route fail-closed coverage

Unauthenticated protected APIs return 401 or dependency-safe 503 responses with data-boundary headers instead of silently mutating records.

scripts/public-production-smoke.mjs

Owner: TrustOS
Recorded: 2026-06-18
Limitation: Fail-closed evidence proves containment, not successful authenticated workflow execution.
Workaround: Pair fail-closed checks with manual AAL2 QA runs and packet-level audit evidence before customer-facing proof release.
Next: Add dated authenticated proof entries after the first short-lived-token QA workflow passes.

passed

Production runtime error watch

Production runtime logs were checked after deployment with no error or fatal events returned for the verification window.

Vercel production runtime logs

Owner: Operations
Recorded: 2026-06-18
Limitation: Current check is operator-run evidence, not a contractual 24/7 managed SOC or customer-specific alerting program.
Workaround: Keep public proof bounded to release verification and target-operating-model language until monitoring ownership, notification policy, and support agreements are approved.
Next: Add customer-specific alerting and incident response evidence before production customer deployment claims.

Known limitations

Limitations are either contained, manual-action required, or external-review required.

manual-action-required

First authenticated Sales Demo Session QA CI evidence is pending

SCRIMED has the workflow and token policy, but cannot claim an authenticated CI mutation run until a fresh AAL2 operator token is used deliberately.

Manual-only GitHub workflow, short-lived JWT preflight, explicit intake targeting, Run Control mission brief, Launch Kit handoff, Human Run Packet dispatch validation, protected Manual QA Execution Console, Completion Bridge candidate validation, Claim Guard overclaim prevention, Activation Seal final check, Proof Promotion gate, Buyer Proof Release gate, fail-closed public smoke, and no long-lived secret storage.
Use /pilot-workspace/access#manual-qa-execution-console, mint a fresh AAL2 token from the tenant-admin session, run the workflow once against a synthetic intake ID, archive only safe IDs, validate them through /qa-completion-bridge, persist the packet hash, delete or rotate the token secret, then use /qa-buyer-proof-release before buyer proof claims.

contained

Authority Reference QA retained AAL2 evidence is captured

SCRIMED has one protected authority-reference synthetic QA run retained as no-secret AAL2 evidence through Run Control. GitHub-hosted CI evidence remains optional until browser secret placement is available.

Run Control witness, short-lived JWT preflight, workspace targeting, protected authority-reference smoke, Manual QA Evidence persistence, packet SHA-256 retention, append-only audit event, Claim Guard, Activation Seal, Proof Promotion, Buyer Proof Release, fail-closed public smoke, and no long-lived secret storage.
Use the retained packet hash and audit event only for bounded buyer diligence. Re-run through GitHub Actions later if a separate CI-hosted evidence trail is required.

contained

First protected AAL2 synthetic category evidence is retained

The required buyer-proof QA categories now have one retained no-secret AAL2 packet, packet hash, and append-only audit signal. Category notes remain bounded to synthetic QA posture and do not create clinical validation, PHI authority, or live-care approval.

AAL2 Run Evidence Package, Manual QA Execution Console, Human Run Packet, Completion Bridge, Activation Seal, Proof Promotion, Claim Guard, Buyer Proof Release, synthetic-only headers, fail-closed protected routes, and no-secret packet validation.
Use the protected Buyer Proof Release output for buyer diligence, include only the workflow run ID, packet hash, audit event reference, synthetic boundary, and blocked authority language, and keep production authority gates closed.

contained

Managed local shell may omit npm/node from PATH

Local package scripts can fail even when the repository, CI, and Vercel build path are healthy.

Bundled Node absolute path verifies TypeScript, ESLint, generated integrity, Next build, and smoke scripts without changing the product.
Restore PATH in the local Codex shell when available; keep CI and Vercel on standard Node 22.

external-review-required

Live clinical execution remains intentionally blocked

SCRIMED remains sellable as a governed synthetic pilot and enterprise evaluation product, not live diagnosis, treatment, payer submission, or autonomous care execution.

Synthetic-only evidence, human-review boundaries, protected route fail-closed behavior, claims controls, and clinical/legal/privacy/security review gates.
Complete customer-specific identity, privacy, BAA, connector, audit, clinical validation, risk, and human operating controls before any production healthcare workflow.

AAL2 token policy

Authenticated QA is deliberately narrow, short-lived, and operator-controlled.

policy

short-lived-aal2-token-preflight-and-manual-ci-policy

manual workflow_dispatch only; token must be minted immediately before the run, masked as an Actions secret, and removed after the run

claims

aal=aal2, session_id, exp, iat

Maximum lifetime 3900s; minimum remaining 60s.

boundary

No long-lived secret

The Sales Demo Session QA harness is an AAL2 tenant-admin control that writes synthetic buyer-demo verification records only. It verifies session persistence and packet audit creation without storing PHI, patient identifiers, live clinical records, payer member identifiers, credentials, secrets, source contracts, autonomous clinical decisions, or production healthcare execution authorization.

Manual run packet

After the AAL2 workflow passes, SCRIMED can generate a no-secret evidence packet without storing credentials.

status

manual-aal2-run-evidence-packet-ready

The public route validates and returns a Markdown evidence packet without storing data. The protected workspace route persists the same sanitized metadata only after AAL2 tenant governance authorization and server-side storage controls.

route

No secrets, credentials, source contracts, or regulated healthcare files are accepted

Open Sales Operations