Contracts

Join types and invariants later agents must not redefine. Usage sketch: sketch.md. Package cut: ADR 0002.

Bodies stay unimplemented until a feature is requested.

Types

Type	Owner package	Fields
Account	identity	id, phone, email?, roles
Role	identity	PATIENT, CLINICIAN, IMAGING, LAB, ADMIN
Session	identity	opaque token after verify
PatientProfile	patient	accountId, displayName, nni?, idCardUri?
ClinicianProfile	clinician	accountId, specialty
Appointment	patient.appointment	id, patientId, clinicianId, slot, status, patientName, clinicianName
Encounter	clinician.encounter	id, appointmentId, notes
DiagnosticKind	diagnostics	IMAGING, LAB
DiagnosticOrder	diagnostics	id, encounterId?, patientId, kind, status, priority, patientName
DiagnosticResult	diagnostics	id, orderId, summary, artifactUri?
Consent	identity	accountId, purpose, grantedAt
Clinic	admin	name, timezone

email is optional. afia-web/delete-account.html accepts a phone or an email. privacy.html names phone.

Invariants

• One Account row per login. Admin does not create a second user table.
• A patient cannot write DiagnosticResult.
• Patient reads of results are projections from diagnostics.
• kind is the only imaging-versus-lab split on the write API.
• Admin HTTP stays under /api/v1/afia/admin. Only the ADMIN role shell in afia-app opens it.
• Validation happens at the HTTP DTO boundary. Domain types stay inside the package.
• A context does not call another context's controller.

CCF business rules (RG)

High-signal rules from the CCF §10.1 that apply to the first five modules (v1). Agents must not invent softer behaviour when implementing related flows. Full gap list: ccf-v1-gaps.md.

Id	Rule
RG-004	Verify consent before a sensitive operation.
RG-006	Keep patient and episode context on clinical actions.
RG-007	A prescription is identifiable, dated, and attached to the encounter / patient.
RG-009	A slot cannot be double-booked.
RG-011	Notification channels are configured (not ad-hoc silent drops).
RG-012	A teleconsultation closes only after the recording / compte-rendu step the product requires.

Facilitateur (paramédical actor in the CCF for modules 01–02) is not in the Role enum above. Treat it as an open product decision — do not invent a role, shell, or endpoints until an ADR says so.

HTTP envelope

Reserved shape, not implemented: { data, status, message, errors }. WP-00 adds ApiEnvelope when the first write endpoint lands.

Auth

docs/rationale.md still lists the identity model as open. The sketch uses OTP request and verify. WP-01 follows that sketch unless a later ADR replaces it.