feat(measure): the Maui sandbox routes the ACO's whole computable set, and a patient outside a measure's population is not a case (ADR-078) - #542
Merged
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ec9cb0bb78
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
added 4 commits
September 8, 2026 13:45
…, and a patient outside a measure's population is not a case (ADR-078) Owner decision 2026-09-08: every measure the pilot group sent us, working and visible on the sandbox. WORKWELL_OFFICIAL_MEASURES on both Maui workflows is now cms122,cms125,cms2,cms130,cms165,cms137, and the deploy's vendor step adds CMS137, the one pilot measure the build did not vendor. Evidence: cms2's flip gate over all 20,000 corpus patients (36/36 MADiE, 17,795 in the initial population, 5,413 actionable, 0 errors — docs/evidence/FLIP_GATE_2026-09-08_CMS2.md); cms137's banked gate; the cross-engine sweeps. cms130 and cms165 pin VSAC-completed sidecars that do not resolve locally, so a manual flip-gate.yml workflow now vendors with the secret, sweeps the roster and uploads the report. Routing six measures made ADR-043's recorded fan-out the worklist: an official outcome outside the initial population persisted as MISSING_DATA and opened a MEDIUM case, so 91–97 % of the sandbox's open cases were patients the measure does not concern. The pipeline now reads the executor's own inInitialPopulation:false and treats it as close-only — no case where none exists, an active one closed by the system under OUT_OF_POPULATION, audited, reopenable — and the CDS card surface applies the same rule off the persisted evidence. The authored engine never sets the flag, so an authored MISSING_DATA still opens a case. The two conditions the locked decision named — 305 surviving the final rule for cms137, profile-stamped real blood pressures for cms165 — now gate the PHI phase rather than the sandbox flip (LOCKED_DECISIONS §4A.2 SINCE).
…env array The flip comment sat inside a single-quoted jq string and its apostrophe ended the string; the deploy-helper shell test caught it before merge, which is what it exists for.
…the card surface reads every rate, and the store contract pins the flag Own review of the flip branch. CASE_RESOLVED now carries closedReason, so ~15,000 OUT_OF_POPULATION closures are not read as auto-resolves in the ledger; the CDS card filter reads every rate's initial population, the same reading the pipeline's inInitialPopulation takes on a multi-rate measure; the case-store contract pins open→closed-once→reopen on both floors; the gate workflow sets pipefail so tee cannot mask the CLI exit code; and two stale comments name the new closure path.
…, and rerun-to-verify closes such a case too Gemini review of the flip branch. The authored engine also sets inInitialPopulation (deriveInInitialPopulation emits it for every measure with a boolean Initial Population define), so ungated, an unenrolled audiogram subject would have stopped opening a case; the pipeline and rerun-to-verify now read the flag only where logicVersionFor says the official artifact ran, and tests pin the authored case on both paths. Rerun-to-verify closes an out-of-population case under OUT_OF_POPULATION as a system closure (closed_by NULL, reopenable), with a CASE_RESOLVED event. The gate workflow's routed default is the six-measure list, its verdict step fails the job on DO NOT FLIP while still uploading the report, the JSON evidence is asserted before upload, and the reproducibility check uses the job's working directory.
Taleef7
force-pushed
the
feat/maui-route-all-measures
branch
from
September 8, 2026 17:45
368545b to
e50f51e
Compare
added 2 commits
September 8, 2026 13:51
Codex review of #542: the upsert was gated on the active-case preload, so a transient failure of that read (caught, leaving the set empty) would have left every out-of-population case open for another night. planCaseUpsert is a no-op where no row exists, so the upsert is unconditional, like COMPLIANT; EXCLUDED stays gated because its no-case branch inserts.
…64/64 and 68/68, 9,257 and 6,837 in the initial population, 0 errors Both run through the credentialed flip-gate workflow (runs 34258656822 and 34258659692). The workflow now copies the gate JSON out of .flip-gate/ before upload: the artifact glob does not descend into a dot-directory, so the first two runs uploaded only the text report.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Owner decision (2026-09-08, ADR-078): the Maui sandbox routes every measure the pilot group sent us.
WORKWELL_OFFICIAL_MEASURESon both Maui workflows becomescms122,cms125,cms2,cms130,cms165,cms137, and the deploy's vendor step adds CMS137, the one pilotmeasure the build did not vendor. The flip is the workflow edit ADR-045 requires;
reconcile-maui-mieweb.ymlmatches, and
official-flip-config.test.tsreads both.Routing six measures made ADR-043's recorded fan-out the worklist: an official outcome outside the
initial population persisted as MISSING_DATA and opened a MEDIUM case, so 91–97 % of the sandbox's
16,581 open cases were patients the measure does not concern. A subject the OFFICIAL executor marks
inInitialPopulation: falseno longer opens a case (ADR-078 d2): the pipeline and rerun-to-verify treat itas close-only,
planCaseUpsertresolves an active case withclosed_reason='OUT_OF_POPULATION'(systemclosure, audited with its reason, reopenable), both stores pass the flag through, and the CDS card surface
skips subjects outside every rate's initial population. Gated on the executor's identity: the authored
engine sets the flag too, and an authored MISSING_DATA still opens a case.
Evidence for the flip
CROSS_ENGINE_2026-09-07_CMS2.md)FLIP_GATE_2026-09-08_CMS2.md)CROSS_ENGINE_2026-09-07_CMS130_CMS165.md)FLIP_GATE_2026-09-08_CMS130.md, credentialed run 34258656822)FLIP_GATE_2026-09-08_CMS165.md, credentialed run 34258659692)CROSS_ENGINE_2026-09-06_CMS137.md)FLIP_GATE_2026-09-07_CMS137.md)The two conditions the locked decision named — 305 surviving the final rule for cms137, and
profile-stamped real blood pressures for cms165 — now gate the PHI phase rather than the sandbox flip
(
LOCKED_DECISIONS.md§4A.2 SINCE note). cms165 runs on the sandbox because the corpus stamps everyprofile it retrieves and #539 stamps a blood pressure from its own codes; it must not be routed over
WebChart data until #533's ingest half is closed.
After merge
out-of-population cases under
OUT_OF_POPULATION, each audited. That run is the timing measurement;WORKWELL_RUN_CHUNK_SIZEand the anchor hour are the knobs if it does not fit.OFFICIAL_ROUTING_MISCONFIGURED(DEPLOY.md step 5) — a misconfigurationdoes not refuse at boot.
Reviews
Own code-reviewer (8 findings, fixed in
368545b2), Gemini 3.8 Flash via agy (7 findings, fixed ine50f51e7— including the authored-engine gate), Codex on the PR (2 threads, both resolved). Backendtypecheck clean; the case, card, pipeline, store-contract and flip-config suites pass (261); all 116
workflow run-blocks parse.