Case #00015000 — IN REVIEW. NOT APPROVED. Ball in VA's court since 2026-06-19. Every artifact they requested has been delivered. Nothing outstanding on our side.
Patient Health demo 2026-06-15; VSH&E demo 2026-06-16; tier-breakout video delivered 2026-06-17..19 (Drive link → zip → Deloitte address after VA mail blocks)
Leavitt Partners; CARIN listing pending live FHIR connection
Patient Health API demo (Teams)
2026-06-15
See Self-correction row
Persistence matrix + architecture diagram
2026-06-15
Sent same day as self-correction
VSH&E demo (Teams)
2026-06-16
Tier-breakout video (requested by Angel)
2026-06-17..19
Delivered; Angel confirmed receipt 2026-06-19
Security / posture check-in email
2026-07-12
HIPAA-eligible AWS under executed BAA; encryption at rest and in transit; RLS; Wilson Sonsini pro bono on provider agreement; clinical safety layer; CESAMH review requested
Token custody posture (internal)
2026-07-23
docs/security/SECURITY_POSTURE_TOKEN_CUSTODY.md — iOS claim + planned web delta; veteran web client build parked until production access and CORS confirmation
"We appreciate the prompt reply. We will reach out if we need any more information or if anything changes."
2026-04-15
CARIN adherence confirmation sent
Leavitt Partners; CARIN listing pending live FHIR
2026-04-22
VSH&E sandbox granted
OAuth client 0oa1ap5991l14cLjw2p8
2026-05-13
Angel schedules demos
Two Teams sessions
2026-06-15
Patient Health API demo
Held
2026-06-15
Self-correction (unprompted, same day)
On the call stated VA clinical data is never stored. Codebase review found veteran-directed encrypted snapshot persistence. Corrected the record to VA with persistence matrix + architecture diagram. Nobody on the call had caught it.
2026-06-16
VSH&E demo
Held
2026-06-16
Angel follow-up
"Thank you for both of your extensive demos!" Requests short video showing tiers broken out separately
2026-06-17..19
Tier-breakout video delivered
Drive link → zip → Deloitte address after VA mail blocks
2026-06-19
Angel
"We were finally able to grab it successfully! Once it's reviewed, we will reach out if anything else is required."
2026-07-02
VA Facilities + VA Forms sandbox
Open data; no veteran auth
2026-07-12
Check-in on #00015000
Posture update (AWS BAA, encryption, RLS, Wilson Sonsini, CESAMH)
2026-07-13
Angel
"We appreciate the update sir! Everything on our end seems to be moving as intended within the review process so at this moment, we are good to go but if that changes at any point, we will reach out to further discuss."
PARKED — design in docs/security/SECURITY_POSTURE_TOKEN_CUSTODY.md; no build until #00015000 approved and browser-direct CORS confirmed with Lighthouse
Degraded-mode fallback (if production access denied or delayed)¶
Veteran-uploaded imaging and DD-214. No Lighthouse dependency.
VA-independent; buildable now.
Same path for veterans abroad who cannot clear ID.me.
Cross-reference: Gate 1 VA-independent slice — veteran-upload path (veteran_uploads; see docs/api/CONSENT_AND_DOCUMENT_CATEGORIES.md) and sandbox-only / explicit pilot decision in docs/planning/GATE_1_THRESHOLD.md.
Does not block Gate 0.5 exit or Gate 1 sandbox OS build — blocks production pilot with real VA Lighthouse data only.