One patient thread, one longitudinal record. Every leg of the care loop writes to that record: that closed loop is the moat. Agents converse, capture, and draft; deterministic code and licensed humans decide anything clinical or financial.
Patient entry to follow-up, clockwise. The focal node is the price-shopper wedge; the red node is the fail-closed doctor-approval gate. Dashed spokes show every leg writing back to the single record.
Patient-initiated feeds land on the one record inside the GCP BAA store. The iOS HealthKit snapshot and the Function Health / lab upload are the new legs; raw values never cross the boundary outward, only pointers do. Function Health is patient-mediated upload, never credential scraping.
A non-PHI Cloudflare edge front door forwards into the PHI platform monorepo on Google Cloud (Cam is consolidating valinor-labs into it). Everything rests on the MSO compliance foundation.
The safety doctrine inherited from Plan B. The deeper a decision is into clinical or financial territory, the less an LLM gets the final say.
v1 goal: onboard real people within a week. The BAAs (OpenAI, GCP, SureScripts, Linq, PostHog) are all signed, so nothing is BAA-gated. Then the runway to the concierge demo (Aug 24) and the product freeze + fundraising pivot (Aug 28). Mint chips are v1 + the demo; checked chips are shipped or in place; the red-edged column is the freeze.
Work organized by owner track, not by time: everything in a row can proceed in parallel right now. The BAAs in the top row are all signed, so nothing is BAA-gated; checked chips are already shipped. The main hard hand-off: the backend agent engine gates the edge agent flag.
Every node above belongs to one of these. Full detail in docs/plans/2026-06-23-mso-master-plan.md.