Reference Programs and fail-closed eligibility

Everything below describes engineering source contracts and isolated test evidence (disposable PostgreSQL, loopback PostgREST, test-signed tokens). Where a behavior is described as "designed", it exists in source and isolated tests only — not as a joined, persisted canonical R1 workflow. This is not an availability, certification or publication announcement.

Use the performer’s existing Program and a separately approved sender-specific client/grant. Never create a second Program model from a relationship. Bind exact sender and performer identities, relationship version, programId/programVersion, clientId/grantId, owner and sponsor organizations, environment and effective period.

Current independent bilateral consent
 → performer-owned / sender-sponsored Program version
 → sender-specific credential + explicit scoped grant
 → current reviewed clinical mapping and full fingerprints
 → specimen / collection / method / region / terms checks
 → installed technical and clinical authority
 → independently enabled execution gates
Any missing evidence → refuse, not a substitute default

1. Compare all tenant, laboratory, organization and environment identities, including owner/sponsor direction.
2. Require bilateral_approved, both approvals, independent approvers and current effective window.
3. Require current relationship and Program versions; active binding and unexpired current credential/grant.
4. Require destination native code and all result/webhook scopes within the exact grant.
5. Verify current mapping identity, full structural equivalence, reviewer/version/provenance and both fingerprints.
6. Check clinical authority, collection, specimen, method, container, volume and region; confirm reviewed commercial and technical references.
7. Require actual installed registry and canonical authority, plus separate Production prerequisites.

evaluateReferenceMenu separates sourceApproved, reasons, disabledReasons and orderability. Source-approved fixture facts can satisfy a pure decision but never switch runtime gates. The staged Program annex permits only draft_hold, paused or revoked; it does not persist approved_reviewed clinical authority.

• bilateral_consent_missing or relationship_not_effective: refresh consent, not grant scope.
• relationship_revision_stale or program_version_stale: obtain current authorized versions and review again.
• program_client_scope_mismatch or result_or_webhook_scope_exceeds_grant: correct exact client and grant; never reuse another sender’s key.
• mapping_draft_or_withdrawn or mapping_version_stale: hold; clinical review is required, not a name/alias match.
• native_registry_absent and reference_execution_disabled: configuration cannot clear these gates.

A and C may use one performer installation, but retain separate clients, grants, menus, result scopes and terms. A menu for a non-sender or wrong client/Program returns no rows. A previously authorized sender with a blocked entry receives only relationship/program identifiers and safe refusal diagnostics: no codes, specimen requirements, mapping metadata, prices or authority references.

• Performer cost is private. Exact authorized sender sees only its contracted price.
• Published network price requires explicit publication and visibility; patient/DTC prices are separate.
• No relationship creates wholesale settlement, referral commission or payment authority.

P2 tests cover persistence of draft bindings and redacted projections; they do not install real clinical reviewer authority. Production execution remains false. Current status must be read in the same tenant/environment; a read failure is missing evidence, never an authorization cache hit.