Partner connections, introductions and existing accounts

The laboratory-only Control Plane presents four separate sections: Explore Services, My Connections, Program Configuration and Activity. Read failures are unavailable evidence, not zero activity or successful requests. Source contracts, disposable persistence, genuine hosted identity, partner acceptance and publication are independent evidence classes.

An authorized laboratory administrator selects providerKey, category and candidate capabilities within that provider’s registered set, with exact tenantId/environment and a fresh idempotencyKey. Optional business email is a business contact only; notes reject patient-identifying patterns. The request is internal creation, not sharing consent or delivery.

Same idempotency key and same normalized payload replay the existing row. Changed payload conflicts. A second key for the same open laboratory/provider/category/mode scope returns the existing request; creating a duplicate request does not produce a new business referral.

existing_account_nomination requires a business providerAccountRef. commercial_introduction forbids that reference. An unknown provider may only use the deliberate lab_nominated pathway with a nominated business name; it is not automatically entered into a public network.

An account reference supplied by the laboratory is not verified ownership or partner authorization. Operator review, partner decision and account evidence remain distinct. Nominations cannot advance to external_handoff_evidenced or earn an introduction claim.

The private packet design carries version, exact laboratory/environment/connection version, providerKey, mode, allowed capabilities, relevant active Program references, referralId, real operator scope, evidenceRef and preparation timestamp. It includes bounded business contact consent with expiry, verified agreement/sharing proof and a detached signature/key reference.

Packet preparation requires an authenticated private operator reader and a separately custody-reviewed signer; no live reader/signing or delivery wiring is provisioned. Unknown DOT identity, stale consent, mismatched Program scope and missing legal/partner evidence refuse preparation. Unknown fields and patient/clinical attachments are rejected by the closed contract.

The signed source packet remains packet_prepared, delivery=not_sent and persisted=false. Signing binds the packet bytes, not a network transmission. Routing notes describe manual review rather than invented email addresses, CRM, OAuth or vendor APIs.

Only independently supplied operator proof may support external_handoff_evidenced in the staged connection authority. A packet ID, timestamp or internal request cannot act as its own delivery proof. Missing authenticated agreement or sharing procedure keeps the handoff blocked pending manual legal and partner evidence.

Connection states are requested, operator_review, external_handoff_evidenced, partner_review, partner_decision, account_authorized, technical_validation, program_review, program_service_eligible, declined, expired, withdrawn, suspended and revoked. Each mutation uses expectedVersion and the locked previous state; the client cannot declare fromState.

Sandbox only permits requested/operator_review and closure states. Handoff/account/technical states require independent evidence and cannot be approved in Sandbox. Laboratory withdrawal is scoped and version-fenced; suspension/revocation appends a revocation event for each nonterminal assignment it actually changes, retaining history and unaffected connections.