OPRP implementation status and verification
Recorded October 5, 2026 for prototype 0.1.0-dev.11. The first runnable foundation now includes bounded refresh recovery, pending-request lifecycle and a durable scoped change feed, constrained authority/status lifecycle, planned requester rotation, independent full backup/restore, coordinated live two-Host handoff, and optional encrypted notification subscriptions, six more clinical resource types with immutable history/deletion, locally packaged TypeScript/Python/.NET SDKs, selected stronger clinical validation, stable read sessions, durable SDK mirrors, field/security-label visibility, authenticated negative conformance, versioned R4 profiles, offline dependency locking, finite local terminology and durable intake/migration validation. It has not been published, independently audited, or used with real patient data. No milestone is marked production-complete.
Working slice
The HTTPS demonstration begins with synthetic@patients.example, retrieves WebFinger metadata, verifies a post-quantum signed address-to-Host delegation under a domain-constrained authority, and exchanges signed, encrypted application bodies in both directions. It exercises preauthorized issuance without a patient session, conditional approval, limited FHIR reads/writes, bounded refresh, and revocation.
The reference Host persists authorization/lifecycle, approval tasks, refresh recovery receipts, replay entries, clinical mutations, operation receipts, change events/cursor state, and selected audits in SQLite. The SDK includes a durable single-worker queue and a token-state persistence hook. Independently configured development authorities certify Host and application/person keys. Authority policies constrain identity kind, namespace, roles and lifetime; signed status and local revocation/issuer disablement can persist independently. Their creation is synthetic; no real organization or domain enrollment service exists.
Requirement traceability
The identifiers below track the agreed requirements; they do not introduce new product scope.
| ID / requirement | Implemented evidence | Remaining acceptance work |
|---|---|---|
| R01 Patient-selected Host and open ecosystem | Local reference Host; explicit independently chosen roots; no Convey lookup dependency. | Deployable Host, reachable-device guidance, public governance and license policy. |
| R02 Email-shaped address and DNS discovery | discovery.ts, discovery tests, HTTPS demo with WebFinger and signed delegation. |
Enrollment, root distribution/revocation, normalization, privacy, aliases and reuse; a first signed monotonic migration publication is implemented. |
| R03 Post-quantum protection both directions | envelope.ts, Node/Python round trips, tamper tests. |
Reviewed composition, forward-secrecy design, complete serialization vectors, lifecycle and streaming. |
| R04 Host-issued scoped tokens and conditional approval | Approval tasks, expiry/cancellation/trusted denial, key binding, quotas and pending-policy reevaluation. | Actual approval delivery/authentication integration, comprehensive abuse defense, capabilities and audit coverage. |
| R05 Explicit requested duration and bounded renewal | Capped periods, short JWTs, rotating refresh, same-ID recovery, persisted-state/Host restart tests. | Cross-process coordination, secure storage adapters, refinement of refresh families and external review. Explicit replacement is implemented. |
| R06 Representatives, parents and POA | Separate person keys, signed actor assertions, scoped reference authority, withdrawal tests. | Verified evidence, activation conditions, custody/conflict/minor rules, national policy profiles. |
| R07 FHIR records and narrow permissions | Legacy Patient/labs plus Condition, AllergyIntolerance, MedicationStatement, Encounter, Procedure and Immunization; separate scopes, generic read/search/create/update/delete/vread/history, metadata-only mutation receipts and actor attribution; Host-owned label clearance, field projection and incomplete-write protection. | Full FHIR/US Core validation, general Patient/Observation operations, terminology and comprehensive label obligations, FHIR Provenance mapping, streaming and attachments. |
| R08 Durable outage writes and safe retries | queue.ts, atomic receipts, lost-response plus Host/client restart tests, conflict and revoked-queue tests. |
Multiple workers, explicit dependency graphs, user conflict resolution, receipt expiry, crash fault injection. |
| R09 Resumable permission-filtered changes | Atomic events, scoped consistent snapshots, private cursors, paging, visible-history retention/gap recovery, visibility generation invalidation and restart tests. | Broader policy/obligation profiles, scalable filtering, broader FHIR resources and larger streaming baselines; stable paged snapshots, durable mirrors and six-type deletion markers are implemented. Migration requires a new destination baseline/cursor. |
| R10 Export, backup, restore and Host transfer | Separate export scope, signed full narrow-profile archive, encrypted independent recovery after source shutdown/expiry, atomic import, preserved IDs/versions/unknown fields/receipts, duplicate-safe destination retries, owner integration boundary, durable source fencing, signed ready/release/activation, monotonic discovery publication and queue route/new-authorization continuity. | General FHIR/attachments/history, incremental/resumable archives, public owner admission/management APIs, aliases, distributed fencing and rollback-resistant recovery. |
| R11 Subscriptions and outbound notifications | Grant-bound topic/expiry registration; signed encrypted callback challenge; conservative public destination policy and DNS socket pinning; atomic coalesced outbox, leased retries, durable receiver deduplication/inbox, current authority checks and scoped feed/snapshot catch-up. | General FHIR topic/backport mapping, destination-policy review, resolver deadlines, scaled scheduling, jitter/backpressure, receipt cleanup, fuller audits and real client mirrors. |
| R12 SDKs across platforms | Locally built/installed TypeScript tarball, Python wheel and .NET NuGet package; independent clients with persistent trust, grant/refresh, generic clinical operations, paged reads, durable mirrors, callback/queue recovery and backup helpers; shared packaged-consumer scenarios. | Native reviewed .NET provider, generated serialization/fuzzing conformance, secure platform key stores, cross-process coordination, full importer-helper parity, Swift/Kotlin and public package/licensing release. |
| R13 Operator-owned at-rest security and assessment | Responsibility documented; database intentionally simple. | Security assessment framework, key custody, encrypted storage/recovery, incident exercises. |
| R14 Extensive public documentation | Versioned Markdown, schema, HTTP description and executable quickstart sources. | Website integration/build, public releases, search, API generation, registrations and licenses. |
Verification evidence
Verified on macOS arm64 using Node 24.19.0 / OpenSSL 3.5.7 and Python 3.12.14 with pqcrypto 0.3.4 and cryptography 46.0.5:
| Check | Observed result |
|---|---|
| Strict TypeScript typecheck | Passed. |
| Node test suite | 125 tests passed, no failures or skipped cases. |
| HTTPS synthetic demonstration | Passed discovery, automatic issuance, conditional approval, duplicate-safe writes, paged change catch-up, lost-refresh-response recovery and revocation. |
| Independent Python/Node interop | Passed constrained authority/signed-status verification, both message directions, token acquisition, scoped snapshot/change polling, repeated refresh recovery and modified-ciphertext rejection. |
| Offline recovery demonstration | Passed backup encryption, source database removal and expiry, offline signature/status verification, destination admission/new authorization, duplicate-safe late retries and re-export evidence. |
| Two-Host HTTPS migration | Passed baseline/final protected transfer, source fencing, signed release, lost activation response recovery, generation-2 discovery, new destination authority, duplicate-safe queue continuation and signed handoff re-export. |
| Two-endpoint HTTPS subscriptions | Passed callback challenge, encrypted minimal hints, lost-ack retry and receiver restart, duplicate-safe pull task, authorized catch-up, retention-gap snapshot and revocation before transport. |
| SDK packaging and shared conformance | Local .tgz/wheel/.nupkg built and installed in fresh consumers; TypeScript declarations checked; Python/.NET shared encrypted clinical, refresh, queue, callback, backup, paged history, mirrors/restart/gap/outage/deletion, field/label invalidation, 12 envelope rejection cases, seven authenticated malformed-page rejection cases, terminal validation rejection/order preservation and revocation scenarios passed. |
| External clinical conformance | Pinned HL7 6.10.4 accepted six OPRP and five selected US Core 9.0.0 examples, rejected six contained-resource cases and a missing-performed US Procedure; Host preflight/retry and local package loading passed with HTTP disabled and 22 fully locked package trees. Six finite-local-terminology cases accepted; three invalid/unavailable/binding cases rejected. Durable intake/migration worker restart through activated custody passed. Structural-only reports retain disabled terminology and warnings. |
| Cache installation | Verified staged installation from the local locked bundle and refusal of an altered installed cache. |
| Persistent developer Hosts | Two verified HTTPS services, source restart with retained record/grant/receipt, opaque health and live snapshot passed. |
| Documentation check | Repository links, schemas, six profile/examples and 22 dependency trees checked; the generated website has complete route/asset/anchor validation. |
The tests include identity/envelope integrity, discovery constraints, scope/patient boundaries, requested-duration caps, refresh serialization/reuse and restart recovery, persistence failure before refresh transmission, approval expiry/cancellation/denial/quotas/policy change, representative withdrawal, lost mutation response/restart, queue ordering/conflicts/revocation, consistent snapshots, immutable paged events, hidden-event filtering/retention, cursor tampering/gaps/context/expiry, feed restart and token refresh. New tests additionally cover issuer limits, signed status forgery/staleness/rollback/equivocation, persistent key revocation/issuer disablement, same-key renewal, dual-key rotation/restart/retry, retired refresh credentials, backup tampering and wrong keys, export authorization, unknown-field/receipt preservation, import collision rollback and write-only disclosure. Fourteen migration cases additionally cover normal Host/provider restarts, exact retry receipts, transaction fences from a second database connection, cancellation before release, immutable release, admission/identity/signature/receipt integrity, atomic activation/capture failure, missing baseline content, generation conflicts, expired plans, representative withdrawal/continuation, queue route persistence/patient isolation and old credential expiry. Fourteen subscription cases additionally check scoped registration/lifetime/quotas, callback proof/key binding, atomic visible-change scheduling, retries after Host/receiver restart, concurrent writes/inbox completion, JWT versus grant lifetime, representative withdrawal/rotation, stale status, URL/network constraints, cancellation/challenge expiry/preparation races, retention recovery, actual Host release, shared delivery leases and durable receiver pins. Nine expanded-resource cases add all six resource profiles, independent permissions, versions/history, wrong-patient and unsupported content rejection, deletion markers and old-version reads, metadata-only writes, full restore with late receipt recovery, queue restart, new subscription topics and live migration after a baseline deletion. The packaged Python/.NET scenario additionally verifies independent clinical/refresh/backup/receiver/queue/trust behavior. Seven additional cases cover strict field/calendar/choice/invariant rejection, immutable paged search/history beyond 100 entries, continuation context/current authority, Host restart, mirror staging restart, concurrent baseline writes, tombstone application, gaps, narrowed grants, persistence failures, explicit stale reads, expiration, tampering, quotas and serialized budgets. Seven visibility cases add field masking, default denial, current/historical label checks, visible-only counts/retention/callbacks, epoch invalidation, filtered write/export/import protection and policy restart persistence. Three negative cases add signed malformed envelopes and authenticated malformed baseline/feed safety. Shared Python/.NET consumers reject twelve envelope mutations and seven malformed pages with durable cache clearing and normal recovery; the compiled TypeScript mirror verifies projection, loss and regrant. Eight external-integration cases add profile consistency, semantic digest binding, expiry, transactional rejection/retry, report shape, worker failure/deadline, full archive/classification preflight and gated migration readiness/expired-approval recovery. Fifteen durable-validation cases add dependency/content tampering, local terminology membership/value-set failures, persistent ownership/configuration binding, deduplication/expiry, tool retry/unsupported targets, lease takeover/stale completion, quotas, ordered rejection and atomic restore/migration recovery. A fresh cache-bundle installation and altered-cache refusal are also verified. Real-engine evidence is recorded separately in external clinical validation. A 90-day grant calculation is tested; sustained 90-day operation with credential renewal is not.
The network demo uses verified HTTPS on loopback with generated synthetic keys and a temporary certificate. Its success is not an Internet deployment test. Interop uses independently implemented native primitives and codecs but is a small generated scenario set, not external vendor conformance or an audit. Schema syntax checks do not prove schema completeness or agreement with every handwritten validator.
Milestone position and next work
Milestone 0 documents are present and evolving. Milestone 1 has a working cryptographic/trust/discovery prototype with independent runtime exchange. Milestone 2 has the synthetic authorization workflow, lifecycle and bounded recovery. Milestone 3 has atomic receipts/events, conflicts, a first durable queue and scoped snapshot/feed recovery. Milestone 4 now has portable full archives, independent recovery and a coordinated live handoff for the reference profile. Remaining acceptance criteria keep milestones open.
The next implementation sequence is:
- Complete the public developer site, approved Git repository/license and versioned SDK release. Dev11 supplies injectable SQLite-compatible storage, persistent two-Host developer services, health/snapshot tooling and the generated documentation site; production operations remain open. Dev10 completes locked offline dependencies, finite local terminology and durable intake/migration validation; broader licensed vocabularies remain open.
- Extend synchronization with dependency/receipt retention, cache/tombstone cleanup, secure persistence and broader fault injection; add reviewed native .NET cryptography.
- Extend portable archives with general FHIR/attachments, histories, incremental and resumable transfer; integrate owner admission, status/renewal workers, approval delivery, complete audit coverage and cross-process token coordination.
- Complete broader FHIR/US Core/provenance and SDK coverage, including a reviewed native .NET provider and secure platform key integration; strengthen subscription operations and add custody disaster-recovery, distributed fencing and alias handling.
- Integrate the versioned documentation into the actual www.convey.care source after its deployment path is available.
Cryptographic construction review and forward-secrecy decisions gate a production security profile, rather than blocking the reversible synthetic experiments that establish interfaces. Convey's EMR follows demonstrated protocol and interoperability readiness, as agreed.
Visibility profile update
The Host advertises visibility_profile: "oprp-visibility-1". Visibility and cache invalidation defines trusted grant policy, exact security labels, SUBSETTED field projections, write/export protection and required baseline/change visibility_epoch. Changed visibility invalidates prior cursors and clears SDK mirrors before a new baseline; disconnected clients cannot learn unknown permission changes. Negative conformance records authenticated rejection tests. Host policy and approval delivery remain local integration choices.
External clinical validation update
The external clinical validation guide supplies six versioned R4 profiles and selected US Core 9.0.0 targets. The durable validation guide adds full offline dependency locking, finite local terminology and restartable intake/migration jobs. Setup requires Java and a verified dependency-cache copy. Structural-only mode advertises disabled terminology; local mode rejects unavailable systems and does not include broad licensed clinical vocabularies. Host authorization and conditional patient approval remain separate.