# Handoff: HealthManager Safe Status Marker Producer

This handoff is for a later HealthManager phase. Phase 6C does not change productive HealthManager code.

## Purpose

HealthManager may produce a single safe status marker for JARVIS. The marker contains coarse pipeline metadata only, so the JARVIS Dashboard can show Health as a safe read-only module without reading Health records.

## Canonical schema

JARVIS schema: `schemas/health-safe-status-marker.schema.json`.

Allowed JSON shape:

```json
{
  "schema_version": "1.0",
  "generated_at": "2026-01-01T00:00:00Z",
  "source": "healthmanager_safe_status",
  "pipeline_freshness": "fresh",
  "backup_freshness": "fresh",
  "review_count": 0,
  "source_reachable": "yes",
  "last_success_at": "2026-01-01T00:00:00Z",
  "status": "ok",
  "notes_category": "none"
}
```

`last_success_at` may be `null`.

## Allowed metadata

- Pipeline freshness enum: `fresh|stale|unknown`.
- Backup freshness enum: `fresh|stale|unknown`.
- Review count only, bounded `0..99`.
- Source reachable enum: `yes|no|unknown`.
- Last successful safe-marker pipeline timestamp.
- Overall status enum: `ok|attention|degraded|offline`.
- Notes category enum: `none|review_required|source_stale|source_offline|unknown`.

## Forbidden producer inputs

The producer must not read or derive the marker from Health content. Do not read:
- laboratory values
- diagnoses
- medications
- doctor reports
- PDF contents
- OCR contents
- report contents
- symptoms
- tracker/YAZIO/Apple Health raw data
- DB rows
- Health JSON/CSV raw data
- Drive links or Drive IDs
- local paths, filenames, document titles, patient details

The producer may use safe pipeline metadata such as job status, timestamp of the safe-status pipeline itself, backup status enum, and bounded review queue count if that count is available without reading record content.

## Atomic write protocol

Write atomically:
1. Render marker JSON to the same filesystem as the final marker.
2. Write to a temporary sibling file such as `health-safe-status-marker.json.tmp`.
3. Validate against the schema before publication.
4. Rename the `.tmp` file to the final configured marker path.
5. Never write examples with real Health data.

## JARVIS runtime contract

JARVIS reads the final marker only when:
- `HEALTH_ADAPTER_MODE=safe_marker`
- `HEALTH_SAFE_STATUS_MARKER_PATH` points to the marker
- `HEALTH_SAFE_STATUS_MAX_AGE_HOURS` defines the freshness cutoff, default `72`

JARVIS output must never expose the configured path or filename.