@lssm-tech/lib.personal-health-spec
Strict contracts for a consent-controlled, non-clinical PersonalOS health ledger: connections, measurements, source provenance, quality quarantine, explainable associations, correction/export/deletion, minimized household sharing, and future EU/US qualification packs.
The package deliberately excludes diagnosis, treatment, emergency monitoring, raw provider payloads, credentials, and claims of regulatory qualification.
Additive vertical contracts
./consent-policy defines category-, operation-, purpose-, and provider-level grants plus partial or complete revocation../provider-sync defines encrypted host-custodied credential references, connection lifecycle, honest native/API connectivity classes, and durable page/cursor evidence. HealthKit and Health Connect are native SDK ports, not bundled native implementations../authorization-broker/client is the browser-safe begin/ticket/status surface; ./authorization-broker/host is deliberately unavailable under the browser export condition. The legacy host dispatch subpath is likewise browser-null in workspace and published resolution. The host surface separates strict browser input from trusted identity context, generates OAuth state and PKCE verifier material inside the broker, captures provider callbacks through a host-only ingress, atomically consumes expiring tickets, and durably persists a consent- and authority-bound pending dispatch before deleting transient secrets. Leased dispatches are acked, retried, or atomically superseded with a fresh revision-bound command; OAuth secrets are never reused. Browser tickets and status never contain credentials, verifiers, raw provider payloads, or OAuth codes../ledger defines append-only corrections, quality quarantine, explicit cross-provider overlap evidence that preserves both source records, ref-only goal links, export manifests, and deletion-propagation receipts. A receipt is complete only when every propagation target is deleted; pending, failed, and unsupported targets remain explicit non-complete states../sharing permits aggregate household summaries and trends only; raw measurements are structurally forbidden. Household revocation requests, authority receipts, local-invalidated receipts, and consumer acknowledgements bind the exact subject, actor, grant, member, categories, projection IDs, reason, and ordered timestamps../insights allowlists descriptive wellness metrics and exact units, binds copy to selected source records, exposes freshness and uncertainty, and structurally forbids clinical, causal, protected-trait, sharing, care, or autonomous-goal authority. User-requested urgent guidance is fixed EN/FR/ES copy and explicitly states that PersonalOS does not monitor emergencies../wellbeing-goal defines a human-controlled non-clinical experiment lifecycle. It binds an exact goal, provider fields, accepted baseline and observation records, target range, time window, mandatory stop conditions, consent, revisions, command digest, receipt, and interpretation. Collection and sharing pause on revocation or a verified safety guardrail; observed values never imply causality, diagnosis, treatment, or autonomous goal authority../operations provides one online connection command union for connect, consent-bound provider sync, and disconnect. Connect and disconnect require a human decision; scheduled sync may be policy-governed only with an explicit policy and an exact, unrevoked consent reference. All effects require a fully command-bound decision receipt.
Existing health integration contracts
The health/contracts, health/models, health/health.feature, health/health.capability and health/telemetry subpaths own the existing provider contract definitions. Integration-package import paths continue to forward here. This relocation preserves historical wire schemas, operation policy and registration order; it grants no permission to collect or execute provider payloads. The existing PersonalOS subject/consent and authorization surfaces remain separate and unchanged.
These retained legacy integration compatibility leaves preserve their original provider-facing schemas. They do not widen the newer PersonalOS consent, raw-data handling, minor-unit or non-advisory contract guarantees.
