# Sprint 0 – Safety and Data Integrity

**Stand:** 2026-07-12

## Implemented controls

### Apple Health credentials

- `apple_health_drive_sync.py` contains no credential default.
- `GOG_KEYRING_PASSWORD` is read from the process environment or the protected local file `~/.hermes/secrets/gog_keyring.env`.
- Missing credentials fail closed before invoking `gog`.
- Secret values must never appear in Git, logs, command output or reports.

### Atomic Apple Health imports

- One database transaction covers cleanup of a failed previous attempt, all normalized records and the final successful import marker.
- Any unexpected failure rolls back the complete file import.
- The error marker is written in a separate transaction and remains retryable.
- Files with `status='error'` are retried; only `status='imported'` is treated as complete.
- Already imported files can still be moved out of the inbox into the processed archive.
- Retry count and last-attempt timestamp are stored in `apple_health_import_files`.

### Laboratory warning safety

Automatic laboratory warnings require all of the following:

1. `validierungsstatus='validiert'`;
2. `verified_against_original=1`;
3. `reference_range_source='scanned_original'`;
4. a parseable comparison operator/value;
5. a unit and at least one original-report reference boundary.

Hard-coded CRP or D-dimer thresholds are not used. `<`, `<=`, `>`, `>=` and exact values retain their semantics. If an out-of-range state cannot be proven conservatively, no automatic warning is emitted.

The dashboard wording is intentionally non-reassuring:

> Keine automatischen Hinweise erkannt – dies schließt medizinische Risiken nicht aus.

Automatic notices support review and physician preparation; they are not diagnoses and never authorize medication or anticoagulation changes.

Doctor reports use the same validated/original-verified laboratory boundary and require a unit plus document-specific reference boundary. The former fixed laboratory KPI traffic lights and composite “Health Index” were removed. Reports do not automatically classify medical risk or produce green/all-clear statuses.

### GOG consumers

All versioned GOG callers—including Apple Health sync, doctor report upload, morning briefing and weekly encrypted backup—load the keyring credential from the runtime environment or protected secret file and fail closed when it is missing or empty.

### Reproducible schema

`database/schema.sql` now contains the complete current productive DDL without patient data, including Apple Health, medication, nutrition, symptom, report and review tables plus indexes. `database/schema_manifest.json` pins the complete ordered table/column structure as a data-free SHA-256 regression snapshot. Import migrations remain backward compatible with older runtime databases.

## Verification

Run from the repository root:

```bash
python3 -m pytest tests/test_sprint0_safety.py -q
python3 -m py_compile scripts/health/apple_health_drive_sync.py scripts/health/apple_health_import.py scripts/health/health_dashboard_v3.py
```

Before production deployment, create a consistent SQLite backup, deploy only the reviewed scripts, run the schema migration, regenerate the dashboard and verify the served HTML over localhost and Tailnet.