[abrichr]

Closes #1505.

A frame with audit_read attribution excused any log entry the bot wrote for the saved patient, in any table. An extra insurance row, an allergy or a note for the new patient came out verified.

Change

audit_read attribution now needs two more keys:

• scope_field: the log-entry field that says what was written. For OpenEMR it is comments, which holds the statement base64-encoded, read with scope_encoding: base64 and a scope_pattern regex.
• writes: the tables the save writes for a declared record, for the New Patient save [patient_data, history_data]. The frame's author declares it; it is not derived from the effects. An entry can narrow a table to verbs, {table: history_data, ops: [insert]}, read from the pattern's op group, so a DELETE or UPDATE there is collateral. unknown is reserved for an entry that names no table.

A bot entry for a declared record in any other table is collateral. So is a bot entry whose table can't be read (an empty or unreadable statement). The outcome is reconciliation_required, and evidence.frame.collateral_scopes names the tables. Another user's entries are handled as before. An audit_read frame without scope_field and writes no longer loads; no shipped contract declares one.

This changes when VERIFIED is issued: it is issued less often, never more.

Tests

• tests/test_frame_conditions.py: an OpenEMR-shaped SQLite store with OpenEMR's column names and its base64 statement format, through verify-run:
  • a clean New Patient save verifies;
  • an insurance row for the new patient is refused;
  • an allergy, a note, or a delete in another table is refused;
  • with ops: [insert], a DELETE on history_data is refused;
  • writes: [unknown] and ops without an op group are refused;
  • an entry that names no table is refused;
  • another user's entry stays a concurrent edit;
  • the scope reader decodes and refuses bad input.
• Real-schema run (benchmark/frame_scope_1505/): the independent suite's 17 cases on its stand-in, the SQLite copy of the pinned OpenEMR fixture's own dump.

check	main	this branch
framed, faults missed	3 of 15	2 of 15
framed, false alarms	0 of 2	0 of 2

The case that changed is unrelated_table_insurance_new_patient. The two misses left are #1507 (wrong provider) and #1508 (missing history_data row).

pytest tests/test_frame_conditions.py tests/test_verify_run.py tests/test_verify_run_collateral_change.py tests/test_countersign.py: 152 passed after the review fixes (44 in test_frame_conditions.py).

Limits

• Not run live yet; that needs the shared fixture slot. On live OpenEMR, REST API writes are logged with no user and patient_id 0 (OpenEMR audit log names no user or patient for API writes: frame attribution can't excuse or see anything #1523), so the audit log names none of them; this fix covers what the log does name.
• writes is per table. Fields are compared one by one only for the records the frame reads.

🤖 Generated with Claude Code

[abrichr]

Coordinator safety review (AI-assisted). Approved, with small fixes.

1. Reserve unknown in the validator: listing it in writes would excuse every unscoped bot entry.
2. Check the SQL verb. Add an optional verb allow-list in writes (for example ops: [insert]). Today a DELETE or UPDATE on a listed table is excused.
3. Document in VERIFY_RUN.md that writes is set by the frame's author, not derived from the declared effects.
4. Rename the history_delete test case, which logs a DELETE on insurance_data.

[abrichr]

AI re-review (coordinator). All four items fixed in a3f9373. (1) FrameWrite rejects unknown as a table. (2) writes accepts {table, ops}, the validator requires an op group in scope_pattern when ops is set, and a DELETE on an insert-only table is collateral as history_data:delete (test). (3) VERIFY_RUN.md says writes is author-set, not derived from the effects. (4) The case is renamed insurance_delete. Note: audit_read now requires scope_field and writes, so existing audit_read frames fail validation until updated. That fails closed, as intended. Queuing for auto-merge.

[abrichr]

Superseded by #1860, which closes #1505 on main's redesigned attribution: an audit_read frame without frame.database never holds, and the whole-database diff (#1582) judges the bot's other writes for the saved record as rows. This PR's narrower fix, excusing bot entries only for declared tables (scope_field, writes), would have had to be rebuilt on main's record_key/table_field design. The evidence in benchmark/frame_scope_1505 stays on this branch; keeping it.