A deterministic six-condition gate authorizes every dollar, a hash-chained WORM ledger records it, and an unconfigured integration returns a typed refusal — never a simulated success.
Trust here is not a badge wall. The register below separates what is verified in the current build from what is gated on a named human or legal step.
Verified-green = tested in the current build. Gated = awaiting a named gate. Never blurred.
{
"code": "GATE_EVALUATED",
"passed": false,
"status": "halted",
"firstFailed": "provider_screened"
}The architecture is the security story.
Every posting lands in a write-once, hash-chained double-entry ledger — integer cents, fork/orphan/cycle detection — so the audit trail is assembled as events happen, not reconstructed after.
Authentication is enforced at the edge for every request, with step-up for sensitive actions and structural tenant isolation — engineered and tested, not yet a certified control set, and we say which.
Above the settlement gate sit independent halt controls: when something is wrong the system stops, it does not reconcile later.
As a registered HIPAA clearinghouse shteg.ai is a covered entity; where a BAA is not yet in place, the integration fails closed.
Five controls are tested code in the current build; five certifications wait on named audits, opinions, and programs. No certification below is presented as final — when a gate clears, the register moves.
No real dollar has moved. No real PHI has flowed.
What is real: the architecture — hash-chained ledger, settlement gate, and reconciliation waterfall, tested in the current build — the Type-2 organizational NPI and registered HIPAA clearinghouse identity, and the doctrine. We register capability as capability, never as traction.