HIPAA architecture scaffold (Bucket 1a)¶

Last 1 Enterprises LLC / LastVet
Status: Scaffold for Ryan review (2026-08-26). Not an attestation of HIPAA compliance.
Bucket: 1a foundation only. Buckets 1b (risk analysis) and 1c (policies) are not started.
Rule: Cite existing docs. Do not invent. Unclear items are TODO (Ryan).

Primary sources

Source	Role
`../security/POSTURE.md`	Canonical security index / narrative
`../../last.vet-api/docs/security/SECURITY_POSTURE_TOKEN_CUSTODY.md`	VA OAuth token custody (device-held)
`../../last.vet-api/docs/security/SECURITY_POSTURE_DATABASE_ACCESS.md`	Postgres RLS / PHI tables
`../../last.vet-api/docs/security/SECURITY_POSTURE_IMAGING_STORAGE.md`	AWS SSE-KMS imaging design (legacy path)
`../security/IMAGING_ENVELOPE_ENCRYPTION.md`	R940 MinIO envelope imaging (current path)
`../deployment/R940_ENVIRONMENT_TOPOLOGY.md`	Staging/prod hard walls on R940
`../architecture/R940_PLATFORM_ARCHITECTURE.md`	Tenant map, flat LAN, target VLANs
`../../last.vet-api/docs/api/CONSENT_AND_DOCUMENT_CATEGORIES.md`	Consent vs document categories
`../lastvet/LASTVET_BIBLE.md`	Product / coordination-layer intent
Live `qm list` / Tailscale (2026-08-26)	VM inventory cross-check
Muster notes (WD My Cloud rsync, R730xd, SonicWall/Netgate/Orbi)	Physical / backup inventory

ePHI posture note (from POSTURE.md): As of that document’s writing, no real veteran PHI has been admitted to production; environments hold synthetic sandbox data; VA production API access (case #00015000) remains pending. This scaffold still inventories systems that will handle ePHI when real veterans are admitted.

Section 1: Asset inventory¶

1.1 Physical / host¶

Asset Name	Type	Location	Handles ePHI	Owner	Notes
Dell PowerEdge R940 (`pve-r940`)	Hypervisor host	On-prem LAN `192.168.1.0/24`; Tailscale `pve-r940`	TODO (Ryan): host itself vs VMs only	Ryan / Last 1	Proxmox VE; all product VMs. Source: POSTURE.md §4, R940_PLATFORM_ARCHITECTURE.md
iDRAC (R940 OOB)	Out-of-band mgmt	Dedicated port (not bridged to prod VLANs, per platform doc)	N (mgmt plane; no app ePHI)	Ryan	Source: R940_PLATFORM_ARCHITECTURE.md network topology
WD My Cloud (interim backup NAS)	NAS	Same building as R940 (Muster)	TODO (Ryan): confirm whether dumps can contain ePHI once real PHI exists	Ryan	Muster: daily rsync of `/tank-bulk/backups/dump/`; NFS export limits chown. TODO (Ryan): confirm model string EX4100
Dell R730xd (incoming backup NAS)	NAS (planned)	TODO (Ryan): install site	TODO (Ryan)	Ryan	Muster: “Backup NAS (R730xd) supports business continuity”; 10 GbE SSD enclosure item also tracked
APC UPS / batteries	Power	On-prem	N	Ryan	Supporting infrastructure (not data plane)

1.2 LastVet R940 VMs (ePHI-capable when real veterans admitted)¶

Asset Name	Type	Location	Handles ePHI	Owner	Notes
`lastvet-api` (VMID 107)	App VM	LAN `192.168.1.90`; Tailscale `lastvet-api`	Y (API processes PHI / coordination data)	LastVet	Staging `:3000` + prod `:3001` systemd units. Source: R940_ENVIRONMENT_TOPOLOGY.md
`lastvet-db` (VMID 108)	Database VM	LAN `192.168.1.91`; Tailscale `lastvet-db`	Y (`lastvet_staging` / `lastvet_prod`)	LastVet	Postgres 18; RLS posture in SECURITY_POSTURE_DATABASE_ACCESS.md
`lastvet-imaging` (VMID 109)	Object store VM	LAN `192.168.1.92`; Tailscale `lastvet-imaging`	Y (imaging objects + envelopes)	LastVet	MinIO on ZFS-encrypted dataset; envelope encryption doc
`lastvet-edge` (VMID 110)	Ingress VM	LAN `192.168.1.89`; Tailscale `lastvet-edge`	TODO (Ryan): TLS terminate only vs any request logging of PHI	LastVet	Caddy + LE; Cox static IP path. Cloudflare DNS grey-cloud for API (not proxied). Source: POSTURE.md §4, §6
`observability` (VMID 111)	Observability	LAN `192.168.1.93`; Tailscale `observability`	TODO (Ryan): Loki audit-tier may hold API/Postgres logs with PHI identifiers	Platform	Prometheus/Grafana/Loki/Alertmanager. POSTURE.md §5 log aggregation

1.3 Other R940 VMs (mostly non-LastVet)¶

Asset Name	Type	Location	Handles ePHI	Owner	Notes
`agent-01` (VMID 100)	Operator / Cursor host	Tailscale `agent-01`	TODO (Ryan): repo clones / env files may transiently hold secrets; PHI copies?	Platform	Automation host
`inference-01` (VMID 101)	Shared GPU / Ollama	LAN `192.168.1.40`	N by policy (no PHI persisted)	Platform	POSTURE.md / R940_PLATFORM_ARCHITECTURE.md: no PHI storage on inference
`meridian-eval` (VMID 102)	Meridian eval	Tailscale `meridian-eval`	N (synthetic / eval fixtures per topology)	Meridian	Meridian M0: synthetic fixtures only until counsel sign-off (R940_ENVIRONMENT_TOPOLOGY.md)
`meridian-rag` (VMID 103)	Meridian Postgres+pgvector	Tailscale `meridian-rag`	N (eval/RAG index; not LastVet PHI)	Meridian	Separate tenant data plane
`sovereign-app` (VMID 104)	Sovereign / Odysseus	Tailscale `sovereign-app`	N (Ryan personal assistant; not LastVet)	Sovereign	Separate Bitwarden project
`sovereign-mem` (VMID 105)	Sovereign MemPalace DB	Tailscale `sovereign-mem`	N	Sovereign
`angel-local` (VMID 106)	Angel local lane	Tailscale `angel-local`	TODO (Ryan): Angel health product; confirm local lane PHI policy vs Cloudflare/Neon prod	Angel	Hybrid; prod corpus on Neon per platform doc
`n8n-r940` (VMID 112)	Automation	Tailscale `n8n-r940`	TODO (Ryan): workflow payloads	Platform	Marketing automation historically; confirm no LastVet PHI jobs
`sovereign-db-last1id` (VMID 113)	last1.id Postgres	Tailscale `100.102.4.113`	TODO (Ryan): identity DB may hold PII linked to health products	last1.id	Tier 2 IdP; not LastVet clinical store
`auth-last1id` (VMID 114)	last1.id app / GoTrue / MinIO	Tailscale `100.85.114.46`	TODO (Ryan): auth + profile photos	last1.id	Tier 2

1.4 Endpoints¶

Asset Name	Type	Location	Handles ePHI	Owner	Notes
Ryan Mac (`ryans-macbook-pro` / computerblue)	Workstation	Tailscale + LAN	TODO (Ryan): local clones, TestFlight, screenshots	Ryan	Tailscale name `ryans-macbook-pro` observed 2026-08-26
`agent-01`	See above	R940 VM	See above	Platform	Listed under VMs
iOS TestFlight / App Store clients	Mobile	Veteran devices	Y (device holds VA token + local UX; Keychain)	Veteran / LastVet	SECURITY_POSTURE_TOKEN_CUSTODY.md: token never on LastVet servers
Provider browsers (`provider.last.vet`)	Web client	Internet	Y when viewing consented PHI	Providers	Consent-gated
Robert device (`roberts-z-fold7`)	Mobile	Tailscale	TODO (Ryan): admin access scope	Robert	Observed on Tailscale mesh

1.5 Network devices¶

Asset Name	Type	Location	Handles ePHI	Owner	Notes
Netgear Orbi RBR860	Consumer router / NAT	On-prem	N (transit)	Ryan	Interim Cox static IP path (Muster ingress notes)
Netgear JGS524Ev2 switch	L2 switch	On-prem	N	Ryan	R940 on port 11 (port 9 banned). Muster
SonicWall 3000-series	Firewall (gifted)	TODO (Ryan): in service or spare?	N if unused	Ryan	Gift inventory; licensing gap noted in Muster; Netgate intended
Netgate 5200	Firewall (target / arriving)	TODO (Ryan): install status	N (transit)	Ryan	Muster: September plan; later notes say arrived + install
Intel X710-T (R940 NIC)	Server NIC	R940	N	Ryan	Production uplink Port 1; BCM5720 uncabled (platform doc)
Cloudflare DNS	Authoritative DNS	External	N for API PHI path	Last 1	API hostnames grey-cloud / DNS-only. Marketing may be orange-cloud Pages
Cloudflare Tunnel (`cloudflared`)	Tunnel	`lastvet-edge` + product edges	TODO (Ryan): which hostnames still tunnel vs Cox direct	Platform	Used for some services (e.g. n8n, Angel inference Access). API intended Cox→Caddy
Tailscale mesh	Overlay VPN	All admin nodes	TODO (Ryan): admin access to PHI VMs over WireGuard	Ryan	MagicDNS `*.tailc3bbdc.ts.net`
Cox Business static IP `98.186.224.178`	Public ingress	ISP	N (transit)	Ryan	LastVet API path per Muster / POSTURE

1.6 External SaaS / cloud with ePHI exposure potential¶

Asset Name	Type	Location	Handles ePHI	Owner	Notes
AWS account `525382240840` (us-west-2)	Cloud (legacy)	AWS	Y if legacy imaging/RDS still hold PHI-class data	LastVet	Executed AWS BAA per SECURITY_POSTURE_IMAGING_STORAGE.md §3.4. ECS/RDS described as time-boxed rollback with frozen synthetic data (POSTURE.md). TODO (Ryan): confirm no real PHI remains in AWS; confirm imaging buckets empty or retired
AWS S3 imaging buckets (legacy)	Object storage	AWS	TODO (Ryan)	LastVet	Design: SSE-KMS. Runtime imaging moved to R940 MinIO envelope (IMAGING_ENVELOPE_ENCRYPTION.md).
Backblaze B2 (planned / partial)	Offsite backup	External	Y when PHI backups land	Platform	R940_PLATFORM_ARCHITECTURE.md: HIPAA-eligible BAA planned for offsite. POSTURE gap register references B2
Bitwarden Secrets Manager	Secrets	External	N (secrets, not clinical records)	Platform	Runtime secret authority
UptimeRobot	Monitoring	External	N (health URLs)	Platform	Synthetic checks
GitHub (`Last-1-Enterprises`, `thelast1org`)	Source control	External	TODO (Ryan): ensure no PHI in issues/artifacts	Platform
Neon (Angel prod)	Managed Postgres	External	TODO (Ryan): Angel-only; not LastVet	Angel	Platform doc
SendGrid / RealSend	Email	External	TODO (Ryan): transactional content may include PII	Platform	Separate track

Section 2: ePHI data-flow map¶

2.1 Intended / documented flows (cite sources)¶

A. VA clinical pull (two-data-plane)¶

Source: SECURITY_POSTURE_TOKEN_CUSTODY.md; POSTURE.md; Phase 1 invariants.

Veteran device (iOS)
  │  OAuth directly to VA Lighthouse (token stays in Keychain)
  │  FHIR / Service History APIs on device
  ▼
Parsed record items only ──POST──► lastvet-api ──► lastvet-db
                                   (no VA access/refresh token on server)

VA tokens: NEVER stored or proxied by LastVet servers (iOS claim).
Web veteran client: designed same property; build PARKED until VA prod access.

Status: Intended architecture. VA production access pending (#00015000). Sandbox/synthetic today.

TODO (Ryan): Confirm whether any server-side VA proxy exists in non-iOS paths today (doc says none for iOS).

B. Veteran uploads (imaging / vault)¶

Source: SECURITY_POSTURE_IMAGING_STORAGE.md (AWS design); IMAGING_ENVELOPE_ENCRYPTION.md (R940); R940_ENVIRONMENT_TOPOLOGY.md.

iOS / client
  │
  ├─ Imaging (current R940 path): POST multipart plaintext to API
  │     → lastvet-api encrypts (envelope) → MinIO on lastvet-imaging
  │     → wrapped DEK in Postgres `imaging_envelope`
  │
  └─ DD-214 / service_records vault: API writeEncryptedDocument
        → app-layer AES-256-GCM → storage on API/ZFS path (legacy EFS parity)

Legacy AWS path (documented, largely retired for traffic): client → S3 presigned multipart; SSE-KMS; API never saw upload bytes.

TODO (Ryan): Confirm prod IMAGING_STORAGE_MODE and whether any clients still hit S3. Confirm iOS envelope merge/TestFlight status for compliance timeline.

C. Provider access to shared records¶

Source: CONSENT_AND_DOCUMENT_CATEGORIES.md; POSTURE.md (consent-gated downloads).

Provider (browser) → provider.last.vet → lastvet-api
  → consent_grants check (categories / active grant)
  → allow document / imaging download (envelope decrypt stream or legacy presigned GET)
  → audit at issuance / access events (see API audit tables)

Consent artifacts (consent_artifacts) are grant-tied. veteran_uploads / service_records require an active grant (category rules in CONSENT doc).

D. Grant-free secure links (`document_share`)¶

Source: CONSENT_AND_DOCUMENT_CATEGORIES.md §9.

Veteran creates secure link (OTP) for service_records (DD-214) only
  → recipient opens link (employer/VSO/school/landlord)
  → OTP + view session; no consent_grant required

Imaging types are excluded from grant-free share allowlist (POSTURE.md / imaging posture).

E. Coordination notes (LastVet-native)¶

Source: LASTVET_BIBLE.md; CONSENT doc (coordination_notes).

Providers write coordination notes in LastVet under grant; EHR remains system of record. Not a substitute for clinical charting.

F. Egress / third parties¶

Path	Documented?	Notes
AWS (legacy)	Yes	BAA executed; rollback net; no prod traffic per POSTURE
B2 offsite backups	Planned	BAA planned when PHI backups exist
Cloudflare	DNS-only on API	Not decrypting API TLS
Email (SendGrid/RealSend)	Partial	TODO (Ryan): which templates can carry ePHI
RealOutcomes / anonymized insights	Product docs / privacy policy	Opt-in de-identified; TODO (Ryan): confirm not in Phase 1 live path
Counsel / WSGR	Process	No PHI to counsel without BAA (Muster HL letter notes)

2.2 Mermaid (logical)¶

flowchart LR
  subgraph devices [Veteran and provider devices]
    iOS[Veteran iOS]
    Prov[Provider browser]
    VA[VA Lighthouse]
  end

  subgraph edge [Public edge]
    DNS[Cloudflare DNS grey-cloud]
    Caddy[lastvet-edge Caddy]
  end

  subgraph lastvet [LastVet R940 lane]
    API[lastvet-api]
    DB[(lastvet-db)]
    IMG[lastvet-imaging MinIO]
  end

  iOS -->|OAuth token stays on device| VA
  iOS -->|parsed record items / uploads| DNS --> Caddy --> API
  Prov -->|consent-gated reads| DNS
  API --> DB
  API --> IMG

Do not restate the full category matrix here. Authoritative: CONSENT_AND_DOCUMENT_CATEGORIES.md. Part 2 sheet vs ROI paths are called out in staging fixtures (R940_ENVIRONMENT_TOPOLOGY.md).

Section 3: Network diagram¶

3.1 Current physical / logical (implemented)¶

Source: POSTURE.md §4; R940_PLATFORM_ARCHITECTURE.md “Current state”; COX ingress Muster notes.

Internet
   │
   ├─ Cloudflare DNS (api.last.vet, api-staging.last.vet: DNS-only)
   │
   ▼
Cox static IP 98.186.224.178
   │
   ▼
Orbi RBR860 NAT / port-forward 80/443
   │
   ▼
Netgear JGS524Ev2 (R940 on port 11)
   │
   ▼
R940 X710-T Port 1 ── Proxmox bridge ── flat LAN 192.168.1.0/24
   │
   ├── lastvet-edge .89 (Caddy TLS terminate)
   │         └── lastvet-api .90 :3000/:3001
   ├── lastvet-db .91
   ├── lastvet-imaging .92
   ├── observability .93
   ├── inference-01 .40
   ├── other product VMs …
   └── WD My Cloud NAS (rsync backup target)

Admin overlay: Tailscale WireGuard mesh (all VMs + Mac + phones)
OOB: iDRAC dedicated port

Trust boundaries (current)

Boundary	Crossing	Control (documented)
Internet → LAN	Cox → Orbi → switch → R940	NAT; Caddy TLS; grey-cloud DNS
General LAN → LastVet VMs	Flat `192.168.1.0/24`	No VLAN isolation today (explicit gap)
Admin → hosts	Tailscale	SSH keys; passwordless sudo for `ryan`
Staging DB ↔ prod DB	Same `lastvet-db` host, separate DBs	Hard walls by DB/secrets/MinIO (not separate hosts)

3.2 Target state (Bucket 3 build; document only)¶

Source: R940_PLATFORM_ARCHITECTURE.md target VLAN plan; LASTVET_MIGRATION_PLAN.md VLAN section.

VLAN 40 LastVet staging ──╳── no L3 ──╳── VLAN 50 LastVet production
VLAN 20 Sovereign | 21 Angel local | 22 Meridian | 30 inference-01
VLAN 10 mgmt | VLAN 1 iDRAC

TODO (Ryan): Confirm switch VLAN IDs actually programmed; Netgate 5200 cutover date; whether “PHI zone” naming maps 1:1 to VLAN 50 only or includes staging VLAN 40.

3.3 Mermaid (current vs target)¶

flowchart TB
  subgraph current [Current: flat LAN]
    LAN[192.168.1.0/24 shared]
    LV1[lastvet-* VMs]
    OTH[other product VMs]
    LAN --- LV1
    LAN --- OTH
  end

  subgraph target [Target: segmented]
    V40[VLAN 40 staging]
    V50[VLAN 50 prod]
    V30[VLAN 30 inference]
    V40 -.->|deny| V50
    V40 --> V30
    V50 --> V30
  end

Section 4: TODO list for Ryan (actionable)¶

Confirm ePHI column for every TODO row in §1 (especially lastvet-edge logs, observability Loki, angel-local, n8n-r940, auth-last1id / sovereign-db-last1id, Mac/agent-01, Robert device).
Confirm NAS inventory: WD My Cloud model (EX4100?), what datasets are synced, whether backup dumps will contain ePHI at first real veteran, R730xd delivery/install plan.
Confirm network gear in service: SonicWall vs Orbi vs Netgate 5200 actual production path; cloudflared still required for which hostnames.
AWS residual risk: Are imaging S3 buckets / RDS empty of any veteran-class data? Keep or terminate BAA coverage narrative for auditors.
Imaging cutover truth: Prod/staging IMAGING_STORAGE_MODE; iOS envelope client shipped or not; any remaining S3 presigned clients.
VA production timeline: Case #00015000 status for when “synthetic only” claim ends (gates real ePHI admission).
Egress inventory: Email, support tools, analytics, Comp AI, status page: which can see ePHI identifiers.
Colo / Feb 2027 move: Update physical custody narrative (Muster colo BAA question) if still planned.
Owner column: Assign operational owners beyond “Ryan / LastVet” where someone else is accountable.
WSGR review packet: After TODOs filled, which excerpt of this file + POSTURE.md goes to privacy specialists with the provider agreement / BAA draft.
Approve Bucket 1b + 1c kickoff only after this file’s TODOs are closed or explicitly deferred with dates.
Muster: Ensure hipaa-security-rule-readiness-3-bucket-compliance-work-plan points at docs/compliance/HIPAA_ARCHITECTURE.md (item may need filing if missing from tracker).

Completeness (scaffold estimate)¶

Section	Estimated completeness	Why
§1 Asset inventory	~55%	VM list live-verified; ePHI flags need Ryan; NAS/network SaaS partial
§2 Data-flow map	~50%	Architecture cited; live VA/prod imaging client state unclear
§3 Network diagram	~60%	Current flat LAN well documented; target VLAN not implemented
Overall Bucket 1a scaffold	~55%	Usable skeleton; not audit-ready until TODOs closed

Next step: Ryan reviews this scaffold, fills §4 TODOs, then approves parallel kickoff of Bucket 1b (HIPAA_RISK_ANALYSIS.md) and Bucket 1c (HIPAA_POLICIES/).