Verified-green
Hash-chained WORM double-entry ledgerAppend-only double-entry ledger with chain verification and fork/orphan/cycle detection; verified-green in the current build, sandbox only (no real dollar has moved).
Verified-green
Six-condition settlement gate (sole money authorizer)Deterministic conjunction is the only path that authorizes an instruction; a single failed condition halts, and the disposition it returns carries no PHI. Tested code, not production money.
Verified-green
OIG-LEIE + NPPES screening inside the money pathLive provider-legitimacy screening is wired in as a gate condition; screening runs inside the settlement path, not as an afterthought.
Verified-green
835 reconciliation waterfallDeduplicated and cent-conserving across the full allocation waterfall — pool, fee, reserve, residual — in integer cents. Verified on test remittances.
Verified-green
Settlement console execution behind the gateThe console can execute only instructions the gate has already cleared. Sandbox executors only.
Verified-green
Swappable executors under the gateDirect-bank, batch-wire, FedNow message sets and hub delegation are implemented against published specifications behind a common interface, so any one executor is replaceable. Interfaces real; no live rail enabled.
Verified-green
Two structurally separated money loopsPayer-advance money never touches patient or retail money. The separation is enforced in code and covered by tests; further hardening is tracked internally.
Verified-green
Claim lifecycle endpointsSubmit, 837I generation, scrub, status, appeal and resubmit are implemented, with scrubber clearance and NCCI coding validation as gate inputs. Verified against test claims.
Verified-green
Pre-payout duplicate-claim verification276/277 duplicate-claim check runs before payout as a gate input alongside signature immutability and scrubber clearance.
Verified-green
Credentialing compositeComposite credentialing check with primary-source verification and sanctions screening, staged behind an enforcement lever. Provider roster maintained alongside it.
Verified-green
Eligibility (270/271)Returns typed eligibility results, and fails closed when the payer connector is unconfigured rather than guessing coverage.
Verified-green
EMR OAuth syncStandards-based EMR connection, authorization and scheduled pull are implemented, with per-tenant credentials sealed at rest. Vendor-specific connectors are enabled per practice.
Verified-green
Clinical cockpit (ophthalmology-first EMR)Exam cockpit, HL7 device ingestion on a 'device fills, clinician wins' merge rule, diagnostic visualization that renders measured data only, advisory-only CDS, prior authorization, MIPS calculators, master patient index and e-Rx.
Verified-green
Interoperability surfaceFHIR, C-CDA, health-information-exchange, Blue Button and UDAP/TEFCA surfaces are implemented, with SMART app launch scaffolded.
Verified-green
RCM cockpitDenial intelligence, propose-only appeal drafting, A/R aging, underpayment detection, rate intelligence, work queue and KPIs. Analytics on test data.
Verified-green
Counterparty verification + pool controlsACH micro-deposit counterparty verification, an advance pool with FBO separation, and inbound-receipt mirroring are implemented. Advance amounts are pinned at zero and every rail ships flag-off and fail-closed.
Verified-green
Fail-closed doctrine enforced in codeUnconfigured integrations return typed refusals without making a network call, an unrecognized money flag resolves to enforce rather than off, and independent halt controls sit above every executor.
Verified-green
Propose-never-dispose on clinical + money pathsAI/automation (interpreter billing codes, coding levels, appeal drafts, merge candidates) suggest; a human disposes. No auto-disposition on clinical or money paths.