Signet · Intake
Lab feed intake
Lab results enter Signet through designed machine feeds. Unmatched messages are quarantined, not admitted. A checked CSV is the supervised fallback — not a live-feed claim, and no suppliers are named here.
- Sources Feeds + CSV HL7 / lab API, clinic events where scoped, CSV-only fallback.
- Admit Fail-closed Unmatched rows quarantine. No silent merge after release.
- Identity Opaque refs Every admitted record gets a signed receipt.
Intake binds what arrived to a screening and issues a durable receipt. It does not invent a patient record, narrative, or ranges. Device boundary and fail-closed Hold: Boundaries · Hold.
Posture
Bind, quarantine, lock source
- Results arrive by designed machine feeds, or by a checked CSV when the feed is unavailable.
- Every admitted row must bind to a patient and a screening. Duplicates are detected before admission.
- Anything that does not match is quarantined rather than admitted.
- Source is locked before release. A later change is shown for separate review — never merged silently into a released document.
Sources
Supported source patterns
- HL7 / laboratory API sources
- Clinic feed events, where that integration is scoped
- Manual CSV fallback under staff supervision — CSV only, never XLSX
CSV
CSV only — never spreadsheet workbooks
CSV only — never XLSX, XLS, XLSM, or any spreadsheet workbook. Spreadsheet files are refused at the door. They are not parsed, not converted, and not queued.
- Expected shape: RFC4180 text/csv, UTF-8, exact headers
- CRLF or quoted newlines; bare CR is refused
- .xlsx, .xls, .xlsm, .ods, or any non-CSV type: refuse immediately — do not open, convert, or hold anything from it
Validation
Fail-closed admission checks
Admission is fail-closed. The platform validates and routes source-authored facts only.
| Check | Admit | Hold / quarantine |
|---|---|---|
| Media type and extension | .csv or text/csv | xlsx, xls, xlsm, ods, binary workbook, unknown type |
| Encoding | UTF-8 without replacement characters | Malformed Unicode, undeclared encoding, replacement glyphs |
| Record shape | RFC4180; CRLF; quoted embedded newlines | Text after a closing quote; unsupported bare-CR records |
| Headers | Exact expected header set | Missing, extra, reordered, or renamed columns |
| Identity | One unambiguous case bound to one screening | Duplicate or ambiguous case — every colliding row is held |
| Binding | Patient and screening both resolve | Unmatched message quarantined, not admitted |
| Package completeness | Required markers present for the package | Incomplete test / incomplete package |
| Marker mapping | Test code maps to an approved marker | Mismatched or unmapped test code |
| Reference range | Source-authored range present and usable as copied text | Invalid or missing reference range — range is never derived in the browser |
| Critical flag | No copied laboratory flag on the fixed critical list | Critical laboratory flag present — leaves the automatic path |
| Policy | Required plausibility policy is signed | Required plausibility policy unsigned |
| Auto-release eligibility | Only an explicitly eligible all-normal source fixture | All other admitted cases remain clinician review unless the signed source says otherwise |
Holds
Intake trips holds; Hold owns the four cases
When Intake cannot admit cleanly, it trips a hold. The four fail-closed cases — incomplete, invalid, mismatched, critical — live on Hold, not here.
Refusals
What Intake refuses
- Spreadsheet workbooks — CSV only. Never XLSX.
- Unmapped messages — quarantined with a stable, value-free reason. Not guessed into the record.
- Silent overwrite under the same identifier, or silent merge of a post-lock source change into a released document.
- Patient identity in a URL — opaque references only.
- Inventing urgency or narrative, or treating Intake as diagnosis or triage; deriving reference ranges in the browser.
- Claiming a live laboratory feed or naming suppliers here. Critical path and SPECIMEN release sit on Hold and Compose.
Lineage
What you can prove later
Every admitted record carries a signed receipt. Operators answer “what arrived?” from the receipt, not from memory.
Delivery partners: write to the partner team.