[abrichr]

Draft, parked. Before review it needs two things: the live OpenEMR back-test (queued for the shared fixture slot), and approve signing with a registered approver key on the #1486 path instead of a typed name. The pagination engine fix moved to #1538; this branch drops it when #1538 merges.

openadapt-flow generate-parts builds the four parts of a workflow that are specific to one application at setup time. Each is admitted only by a check that does not depend on the generator. Healthy runs still make no model calls, and nothing in this PR calls a model. Design: packages/flow/docs/GENERATED_PARTS.md.

Generated, and how each is admitted

Part	Generated from	Admitted by
Read channel (generate/channel.py)	OpenAPI document, FHIR CapabilityStatement, or teach-time traffic	Channel test. It shows each demonstration's record exactly once and reads every page. Through a fault proxy it must read as unreadable, never as an empty or partial set: no auth, 401, 500, truncated body, not JSON, a failed next page
Record contract (generate/contract.py)	Before/after difference across 2-3 varied demonstrations: bound fields, constants, volatile fields, match keys, frame	The fault gate (#1445) on a test copy; each surviving fault class adds the check that kills it, until all are killed or reported
Identity (generate/identity_template.py)	A reviewed template (patient-identity/1: #1516's record check, never generated) plus a generated mapping of this system's fields and the task's parameters onto it	The demonstrations (each saved record reads back as typed) and a perturbation suite from the site's own records, with one case per slot only that slot can catch; adopted only if it does no worse than the site's hand-written adapter
Input types (generate/inputs.py)	Sample source documents: labels, dates and the source's date order, code tables (Massachusetts -> MA)	Round trip of every sample; an ambiguous date or an unknown code halts

• The floor (generate/baseline.py): every typed parameter is checked, the frame is on, nothing ignores or drops a written field, no collateral rule is off, and there is no attribution. Generation can add checks, never remove one.
• Never generated: the safety policy (profile, approvals, switch, consequential classification, gate order, attribution).
• Review: parts.review.md states every check in plain words, including what it can't catch. generate-parts approve needs a person at a terminal. It refuses an agent's name and any part that changed after generation, because the approval is bound to the manifest digest.
• Hostile content is data, with a test for each:
  • an "instruction" in an OpenAPI description;
  • untouched records filled with instructions and changed every round, which still can't hide the email check;
  • an instruction line in a referral document.
• Verifier fixes found by the channel test:
  • The FHIR read used to read only the first page. It now follows next links on the same origin, and a failed page, another origin, more than 50 pages, or a total larger than what was read all read as unreadable.
  • The REST read can follow records_next_path (new, optional; digests unchanged when unset).

Credit

FHIR/REST pagination also proposed by @yunusarda-sudo in #1511 (superseded by this PR).

Changelog entry (for the next openadapt-flow release)

• openadapt-flow generate-parts generates the app-specific parts of a workflow (read channel, record contract, identity mapping onto a reviewed template, input types) from two or three demonstrations, admits each by a check that doesn't depend on the generator, and records a person's approval of the plain-language review (#1520). FHIR reads follow every next page on the same origin, REST reads follow records_next_path, and a broken, cross-origin or short page reads as unreadable. FHIR/REST pagination also proposed by @yunusarda-sudo in #1511 (superseded by this PR).

Measured

Identity: a generated mapping onto the reviewed template, against #1516's hand-written adapters. #1516's people and its 676-item stream (223 true duplicates, 440 new patients) are rendered in each site shape. The mapping is generated from the site's rows and three demonstrations (benchmark/generated_parts/identity_mapping_backtest.py).

Site shape	Suite misses, of 580 (reference)	Adopted	Stream misses, of 223 (reference)	Stream false stops (reference)
#1516's rows	5 (5)	generated	24 (24)	2 (2)
OpenEMR REST rows	5 (5)	generated	24 (24)	2 (2)
FHIR Patient	5 (5)	generated	24 (24)	2 (2)
FHIR read by first list item only	30 (5)	reference	30 (24)	2 (2)

The generated mapping matches the hand-written adapters exactly on all three shapes. The fourth row loses the email and the prior name. The suite catches that where the demonstrations can't, and the adoption rule keeps the reference.

A rule calibrated on one site's records (the approach the template replaces): at every false-stop budget it missed 52-54 of 223 against the hand-built 24, with 0 false stops against 2. With 30 records, calibration can't learn which near-matches are one person. The frontier, and both adoption rules (--reference-identity, --reference-duplicate-check), are in the README.

Not in this PR

The live OpenEMR back-test is not in this PR; it waits for the fixture lease (autogen-backtest is in the queue). It will generate all four parts from three demonstrations on the fixture and run the fault gate on the generated and the hand-built contract with the same copy. It will report coverage per class, false stops, cost and time, review effort, and setup effort.

Tests

• New: test_generate_{contract,channel,inputs,identity,identity_mapping,parts_pipeline}.py (37 tests).
• 283 passed locally across those plus the verifier, FHIR, REST, deployment, verify-run, fault-gate, frame, provenance, intake and command-map suites.
• ruff and mypy clean on the changed modules; source-boundary check OK.

🤖 Generated with Claude Code