Architecture · HealthClaw
The boundary as HealthClaw 2.0 defines it, drawn with what exists on 2026-09-05. Every agent surface reaches the record through one kernel, which today resolves the tenant and checks the step-up grant at the sites that have adopted it; its audit call and redacted exit exist but no handler calls them yet. Route handlers still do the audit, redaction and upstream work themselves: the ratchets count 12 step-up call sites and 5 raw tenant reads outside the kernel (one of them the hook meant to read it), and 89 audit calls on the post-commit primitive the kernel is meant to replace. Reads leave through redaction: upstream display text is dropped and labels rebuilt from codes, names cut to initials, dates to the year, identifiers truncated (removed once #615 lands). An agent can propose an action; only a person can approve one, and the endpoint that executes needs a single-use credential only the internal approval mint issues; none of the agent's tools call it. Direct clinical FHIR writes do not pass that gate: they are still gated by a client-supplied header (#214, open), drawn dashed. The Telegram bot reaches the engine through the MCP server and is not drawn separately.