Safety boundary

No clinical authority

OCR Ops may not diagnose, prescribe, recommend treatment, or create clinical medication data.

Required invariants

1. New jobs are demo-only until an approved Python extraction adapter exists.
2. Context observations remain explicitly non-diagnostic.
3. A review records actor, time, decision, and reason.
4. Rejected decisions never reach Core.
5. Confirmed Core receipts are correlation-bound and identifier-only.
6. The Core worker identity remains server-only.

Private deployment model

The service has no application login screen. It is intended to run only behind private infrastructure controls. Consumers must still include actor fields in state-changing API requests, because traceability remains mandatory even when user authentication is outside this subsystem.

Future extraction adapters

The default Python LockedExtractionEngine refuses to process real evidence. A future model team must provide an approved adapter through the domain-owned ExtractionEngine port. That adapter receives an opaque evidence reference, not browser-provided bytes, and must preserve explicit provenance on its review packet.