v3.1 agent deployment assurance¶

This pack is a bounded adoption artifact for permissioned OpenMed v3.1 agent workflows. It records the exact source revision, deployment-artifact digest, candidate-manifest digest, release-gate report digest, and a digest of the pack itself. It contains only closed identifiers, aggregate gate results, limitation codes, and SHA-256 digests; it does not accept prompts, tool arguments, clinical outputs, credentials, or reviewer identities.

OpenMed does not provide certification or make autonomous clinical decisions. This pack is technical evidence, not legal advice, HIPAA Expert Determination, CE marking, an auditor signature, or a replacement for site-specific clinical governance.

Generate a reproducible pack¶

Evaluate the governed aggregate evidence with the v3.1 agent release gates, then bind the result to the exact checked-out revision and deployment artifact:

from openmed.compliance.assurance.agent_workflows import (
    build_agent_assurance_pack,
)

pack = build_agent_assurance_pack(
    source_revision="<exact 40- or 64-character source revision>",
    artifact_digest="sha256:<deployment artifact or manifest digest>",
    gate_report=gate_report,
)

json_bytes = pack.to_json().encode("utf-8")
markdown_bytes = pack.to_markdown().encode("utf-8")
print(pack.pack_digest)

Generation is local-only and deterministic. The same exact revision, artifact digest, and canonical gate report produce byte-identical JSON and Markdown. pack_digest covers every pack field except itself. Store the JSON beside the immutable artifact and verify all four bindings before review:

source_revision identifies the reviewed source.
artifact_digest identifies the deployment artifact or immutable manifest.
candidate_digest and gate_report_digest bind the aggregate gate result.
pack_digest detects any change to the assurance pack.

Changing source, artifact, evidence, or limitations requires a newly generated pack. A prior pack does not transfer assurance to a different deployment.

Deployment profile¶

The generated profile declares local-first pack generation, explicitly permissioned tools, explicit enablement and approval for production writes, and assistive clinician review. The profile makes no assertion that a site has configured those controls correctly. Site configuration is an unvalidated limitation until the exact deployment is covered by passing evidence.

Claims and validation references¶

The pack has one closed claim slot for every published v3.1 gate. A slot is a validated_claim only when its corresponding result in the bound gate report passed. It then links to the published threshold contract and includes that gate's evidence digest. A failed or missing gate is emitted as an unvalidated_limitation, with no gate or evidence attached to the statement.

Pack claim	Required passing release gate
Authority boundary	`unauthorized_action_escape_rate`
Human-approval enforcement	`approval_bypass_rate`
Side-effect containment	`unsafe_side_effect_rate`
Deterministic replay	`replay_equivalence_rate`
Failure recovery	`recovery_correctness_rate`
Incident-evidence completeness	`evidence_completeness_rate`
Declared reference-server coverage	`reference_server_coverage_rate`
Workflow latency	`workflow_latency_p95_ms`
Clinician-review agreement	`clinician_review_agreement`

Passing one claim does not compensate for another failed claim. A READY decision requires all nine gates, but it remains limited to the candidate, profiles, slices, and limitation codes named by the bound evidence.

Threat and limitation summary¶

Threat	Pack treatment	Boundary
Authority escape	Gate-linked claim	Valid only for a passing unauthorized-action gate and its declared slices.
Approval bypass	Gate-linked claim	Valid only for a passing approval-bypass gate and the reviewed approval challenges.
Unsafe side effect	Gate-linked claim	Valid only for a passing unsafe-side-effect gate and the evaluated mutating attempts.
Non-equivalent replay	Gate-linked claim	Valid only for a passing replay gate and declared backends.
Incorrect recovery	Gate-linked claim	Valid only for a passing recovery gate and injected failures.
Out-of-distribution workflow	Unvalidated limitation	Benchmark slices do not establish site-specific safety.
Jurisdictional interpretation	Unvalidated limitation	Technical evidence is not a legal or regulatory conclusion.

Open dependency contracts remain separate evidence sources. In particular, the pack does not reimplement side-effect previews, tool inventories or catalog diffs, policy matrices, governance self-checks, adversarial suites, or reviewer handoff validation. Missing dependency evidence stays an unvalidated limitation rather than becoming an inferred claim.

Human-approval semantics¶

Consequential work proceeds through a proposal, a side-effect preview, an explicit approve/decline/escalate decision, execution or abstention, and a reviewer handoff. The pack stores content-free references for these states. Human-approval enforcement is a claim only when the bound approval_bypass_rate gate passed. Preview fidelity and handoff completeness are unvalidated limitations until their separate dependency evidence is bound.

An approval is not reusable when the candidate, action, policy, tool catalog, or preview binding changes. Missing or mismatched evidence requires decline, abstention, or escalation. It never authorizes execution.

Incident evidence checklist¶

Retain only controlled, content-free references in the pack:

exact source revision and artifact digest;
candidate-manifest and release-gate report digests;
policy and tool-catalog digests;
side-effect preview digest and approval-receipt reference;
workflow event, outcome, replay, and recovery references;
clinician-review and handoff references; and
known limitation codes.

Raw clinical content belongs only in the site's authorized clinical system. Do not copy it into the assurance pack, logs, issue reports, or release artifacts.

Jurisdiction-support matrix¶

Every row is deliberately an unvalidated limitation:

Jurisdiction	Technical support boundary	Status
Global baseline	Content-free technical evidence	Site governance and legal review required.
EU/EEA	Content-free technical evidence	Not CE marking or an EU AI Act conformity assessment.
United States	Content-free technical evidence	Not HIPAA Expert Determination or FDA clearance.
Other or multiple jurisdictions	Content-free technical evidence	Not evaluated; site governance and legal review required.

Change control¶

Pack version 3.1 introduces the deployment-assurance and clinician-review contract. Any schema, claim registry, threshold, approval state, review step, or jurisdiction row change requires a new pack version and regenerated digest. Release-gate thresholds remain owned by the v3.1 gate contract.

Use the clinician-review protocol for consequential workflow previews and handoffs.