Accessible transcript
Under the interface
Now, go one level lower. The target architecture separates record movement from authority. Juniper’s connector sends an exact source into quarantine, where an immutable digest becomes its identity. A deterministic worker proposes cited facts, but the review boundary stops them until Alex approves.
At delivery, two gates must agree. The recipient-bound consent grant answers who, what, why, and until when. The signed AION policy release answers whether this operation is permitted for this jurisdiction and policy version. Neither gate can create the other. Only a fresh decision at the commit boundary lets the Rust workflow seal one idempotent delivery, append its audit event, and issue tamper-evident receipt evidence.
Now pull back to the target topology. Alex’s browser, Juniper’s edge connector, and Harbor’s edge connector remain separate trust zones. The control plane coordinates identity, consent, policy verification, and workflow state; it does not make clinical judgments. The data plane holds quarantined artifacts, immutable manifests, and reviewed fact packages. The evidence plane carries signed policy releases, transactional outbox events, and runtime receipts.
Request metadata moves inward first. Source bytes never route to Harbor until both gates are current. The destination receives a minimal package; the audit path receives digests, never the raw veterinary record. Service identity, mutual TLS, managed keys, and clinic verification are production boundaries still to be implemented. The TLA+ model checks protocol interleavings; Rust types and database constraints must preserve those atomic boundaries.
Truth boundary: The browser prototype, checked models, and signed demonstration policy are working evidence. The Rust execution spine and clinic connectors are proposed production architecture, not a deployed network.