# Health Safe Status Contract

HealthManager is treated as the highest-sensitivity JARVIS domain. The Jarvis dashboard may expose only status/freshness metadata. It must never expose medical content.

## Allowed ModuleSnapshot fields

- `module_id=health`
- `status`: `ok`, `degraded`, `offline`, or `attention`
- `title=HealthManager`
- `source_health`:
  - `reachable`
  - `stale`
  - `source_type`: `mock`, `disabled` via `static_config`, or `local_probe`
  - `contract_version`
  - `last_success_at`
  - `last_attempt_at` through the surrounding snapshot
  - `last_error_redacted`
- at most three KPIs:
  - Pipeline Status
  - Last report freshness category
  - Open review count
- safe attention item categories:
  - Health Pipeline stale
  - Report needs review
  - Backup/export stale
  - Health Source offline
- `primary_action` may only link to `/health` as `link_only`.

## Forbidden output

The Health contract forbids values, medical terms from source data, diagnoses, medication lists, clinician report text, PDF/OCR content, symptoms, nutrition/raw tracker data, Drive links, local paths, file names with patient details, database rows, and raw responses.

## Local probe policy

`local_probe` may inspect only filesystem metadata: directory existence, file count, extension count, size/mtime-derived freshness, and safe aggregate counts. It must not read file content, database rows, JSON body content, CSV rows, PDFs, OCR outputs, or report content.

## Phase 6B refinement: source inventory policy

### Permanently allowed KPIs

- Pipeline Freshness: `fresh`, `stale`, or `unknown` category only.
- Review Count: bounded integer only, without item titles or content.
- Backup Freshness: `fresh`, `stale`, or `unknown` category only.
- Source Reachable: `yes`, `no`, or `unknown` category only.

### Future gated KPIs

These are not allowed now. They require a dedicated safe summary API and separate approval:

- Import queue status as counts only.
- Report build status as a category only.
- Sync status as a category only.
- Pipeline step success/failure markers without source names or paths.

### Never allowed KPIs or labels

Inflammation markers, coagulation markers, cholesterol markers, medication names, diagnoses, findings, symptoms, report summaries, source document lists, appointment/clinician/patient details, concrete document names, and tracker-derived values are forbidden in the Jarvis contract.

### Allowed attention items

- Health Pipeline stale.
- Review required, count only.
- Backup or export freshness stale.
- Health source offline or unavailable.

Attention titles/messages must never include medical terms from source data, document names, paths, links, dates from source records, or report text.

### SourceHealth fields

Allowed: `reachable`, `stale`, `source_type`, `contract_version`, `last_success_at`, `last_attempt_at`, and redacted error category. Forbidden: raw exception text, local paths, filenames, source names, links, or data values.

### Links and UI scope

Legacy Health links remain blocked unless they are explicit localhost-only non-content dashboard links approved later. No Health detail page, report list, chart, table, PDF list, tracker view, or source-document view is part of this contract.

## Phase 6C safe marker extension

`source_type` may also be `safe_marker`. In that mode, JARVIS accepts only the strict Health Safe Status Marker schema and rejects unknown fields. The marker maps to at most three KPIs: `Pipeline Freshness`, `Backup Freshness`, and `Review Count`. Allowed attention titles are exactly enum-derived: `Health Source offline`, `Health Pipeline stale`, and `Health Review required`.

The adapter must never expose marker path, marker filename, Health runtime path, real data source names, document metadata, or medical content.