Partner Services security, errors and reconciliation

The laboratory-only Control Plane presents four separate sections: Explore Services, My Connections, Program Configuration and Activity. Read failures are unavailable evidence, not zero activity or successful requests. Source contracts, disposable persistence, genuine hosted identity, partner acceptance and publication are independent evidence classes.

Laboratory administrators may request/nominate and propose assignments; active operations/support staff have scoped metadata reads only. A program-only Health Company workspace is denied. The server validates the bearer identity, confirmed account and canonical laboratory staff/tenant scope; browser roles grant nothing.

The operator-assisted handoff and finance contracts remain private, not client-exported routes. Owner/commercial operator proof is mandatory for supplied snapshots. Contact details, signed terms, partner business identity and all economics are excluded from laboratory and public projections.

Existing command refusals include lab_partner_services_not_installed, core_authority_not_installed, scope_or_transition_refused and authority_contract_mismatch. Staged authority errors include not_authorised, bound_exceeded, idempotency_conflict, transition_refused, version_conflict, evidence_required, program_scope_mismatch, capability_not_connected and approval_prerequisites_missing.

The pure compatibility/packet contracts may refuse evidence_scope_or_version_mismatch, specimen_device_incompatible, method_geography_not_serviceable, operator_legal_partner_proof_required and signature_custody_unavailable. These are internal source diagnostics, not new Partner API response bodies or published vendor endpoints.

401/403 means identity or authority is refused; never retry with elevated credentials. Missing authority is unavailable, not an empty successful ledger. Malformed/currently refreshing reads suppress readiness. A wrong environment or another laboratory’s Program is denied even when a provider name matches.

Public source descriptions cannot identify private contact people, backend coordinates, credentials or partner agreements. Test-signed tokens in disposable loopback acceptance do not prove hosted sign-in or operational operator grants.

For a request replay, preserve the same idempotency key and payload. On version_conflict, re-read the actual scoped row and require a new deliberate decision; never fabricate prior state. Evidence events retain real actor, server-derived from_state, to_state and incremented version.

A timeout or uncertain human handoff is reconciliation, not authorization to send again or claim success. No delivery mechanism exists in this source. Suspension and revocation preserve historical events and create one child revocation event only for an actual changed row.

OpenLoop B2B account introductions are not patient/provider lead incentives or clinical order commissions. Eligibility needs independently verified executed terms, qualified conversion, handoff, counterparty acceptance and separate legal/AKS/fee-splitting approval. There is no default percentage.

Manual finance snapshots may describe calculated/invoiced/paid evidence only after complete verified terms and review; the source model performs no calculation, invoice, payout or revenue recognition. Unsigned/expired terms, duplicate business attribution or same-person terms/legal signoff fail closed.