Accessible narrative
Under the interface
The target architecture separates record movement from authority. Juniper’s connector sends an exact source into quarantine, where an immutable digest becomes its identity. A deterministic worker proposes cited facts, but the review boundary stops them until Alex approves.
At delivery, two gates must agree. The recipient-bound consent grant answers who, what, why, and until when. The signed AION policy release answers whether this operation is permitted for this jurisdiction and policy version. Neither gate can create the other.
Only a fresh decision at the commit boundary lets the proposed Rust workflow seal one idempotent delivery, append its audit event, and issue tamper-evident receipt evidence.
Alex’s browser, Juniper’s edge connector, and Harbor’s edge connector remain separate trust zones. The control plane coordinates identity, consent, policy verification, and workflow state; it does not make clinical judgments. The data plane holds quarantined artifacts, immutable manifests, and reviewed fact packages. The evidence plane carries signed policy releases, transactional outbox events, and runtime receipts.
Request metadata moves inward first. Source bytes never route to Harbor until both gates are current. The destination receives a minimal package; the audit path receives digests, never the raw veterinary record.
Service identity, mutual TLS, managed keys, and clinic verification are production boundaries still to be implemented. The TLA+ model checks protocol interleavings; Rust types and database constraints must preserve those atomic boundaries.
Truth boundary: This film describes the proposed production topology and the behavior modeled in the prototype. It does not represent a deployed clinic network or completed production security controls.