Reference architecture

sequenceDiagram
  autonumber
  participant SRC as Script source
PMS · eScript · kiosk
  participant ORCH as Orchestrator
  participant ENG as Reasoning engine
Claude · Gemini
  participant GATE as Symbolic safety gate
CQL · hard ceilings
  participant REV as Pharmacist
console / command centre
  participant DISP as Dispense + hardware
  participant GRAPH as Context graph + audit

  SRC->>ORCH: New script + patient history (PHI)
  Note over ORCH: normalize to FHIR R4 · pseudonymise (strip direct IDs)
  ORCH->>ENG: Clinical context: in-region (Vertex · VPC-SC)
  ENG->>ENG: Draft proposal · cite AMH / PBS
  ENG->>GATE: Proposal (advisory only)
  ORCH->>GATE: Script + patient facts (independent rule check)
  Note over GATE: Gate checks the script directly, not just the
LLM. Hard rules decide · LLM output never dispenses.
  alt Hard rule violated
    GATE-->>REV: HALT + full reasoning trace
    REV->>DISP: Hold · contact prescriber
    DISP-->>SRC: Write-back HOLD status (FHIR)
  else Within safe bounds
    GATE-->>REV: Recommendation + counselling note + trace
    REV->>DISP: Approve / modify
    DISP-->>SRC: Write-back status (FHIR)
  end
  REV-)GRAPH: Pharmacist action + outcome
  GATE-)GRAPH: Rules fired · model · citations
  Note over GRAPH: Every decision traced →
indemnity defence + network effect

sequenceDiagram
  autonumber
  participant APP as Patient app
  participant SUB as Submission API
my.qiri.ai · org url_token
  participant ORCH as Orchestrator
intake · screening
  participant REV as Pharmacist
review queue
  participant PUSH as Expo push

  APP->>SUB: Send eScript token + contact (no platform call yet)
  Note over SUB: status = submitted · the app polls the unguessable submission id
  alt Site mode: auto (default · straight-through)
    SUB->>ORCH: Intake + screen under the org admin's standing authority
    ORCH->>REV: Screened script drops into the review queue
  else Site mode: inbox
    SUB->>REV: Waits in the pharmacist Inbox
    REV->>ORCH: Manual Load under the pharmacist's own credential
    ORCH->>REV: Screened script drops into the review queue
  end
  Note over REV: Clinical decision is unchanged —
it passes the gate above. Pharmacist-in-the-loop holds.
  REV->>SUB: Stamp the decision back (approved / not approved)
  SUB-->>APP: Status poll surfaces the outcome (+ pay link when approved)
  SUB-)PUSH: Terminal decision → generic, drug-free notice
  PUSH-)APP: OS push, even with the app closed
  APP->>SUB: Pull the notifications inbox
  Note over SUB: notices are DERIVED on read from submissions + dispense orders:
no notices table to drift, only read/dismiss state is stored
  SUB-->>APP: Inbox feed + per-notice read/dismiss state