[abrichr]

Two frame gaps from the independent verification suite on OpenEMR (the Phase 0 measurement):

• attribution.record_key. OpenEMR's audit log names a patient (pid), but pnotes, lists and history_data rows are told apart by their own id. With record_key: pid, an audit entry names a row through that field, so another user's edit to a patient's note is concurrent, not unattributed collateral. Without it, the entry can't name the row.
• side_records. OpenEMR's New Patient path adds one history_data row beside each new chart, linked by pid. A frame.side_records entry (surface, link field, the declared record's surface and field, count) declares such rows part of the save. A missing or doubled side row refutes the frame (SPEC P4); a row linked to another chart is still collateral.

Tests: tests/test_frame_links.py covers both. test_frame_conditions.py is unchanged and passes.

Draft until the live OpenEMR Phase 0 run confirms the contract that uses it.

[abrichr]

AI review (adversarial)

Head d9e631ef3. Verdict: request changes. Three silent passes from the new record_key path, plus one weak spot in side records. The probes call judge_frame directly with in-memory fixtures, as the PR's tests do. The declared write is note id=10 of patient pid=1; attribution is audit_read with record_field=patient_id, record_key=pid, self bot.

Blocking

1. A note moved to another patient ends held. ref_of read record_key from after only. Before {id:11,pid:1}, after {id:11,pid:2}, with a nurse entry for patient 2: held.
2. Row ids and patient ids were mixed in moved. Row {id:5,pid:3} changes, a nurse entry names patient 3, and a bot entry names patient 5, which matches nothing in the read: held (refuted without the row-5 change).
3. A declared record without record_key added "None" to declared_keys. Any bot entry with no patient_id was then excused: held.

Should fix

4. False hold: any other user's entry for the target patient refutes a correct save, because other_on_target now matches by patient. On a busy chart this will flag correct saves. Limit it to entries that name the declared table or row, or document the limit.
5. A side record can be excused for an existing patient. If a new chart reuses an existing pid, a new history row for that pid is taken as part of the save: held.

Held up

A float, empty or missing patient_id, a stray row with no pid, a missing, doubled or misdirected side row, a re-pointed history row, a new chart with no pid, and an unread side surface all fail closed.

---

Fix pushed (45c8f5e82). This changes behaviour. Findings 1, 2, 3 and 5 are fixed, each with a regression test in tests/test_frame_links.py:

• a row whose record_key value changed names neither value, so it is unattributed collateral;
• moved compares record_key values when record_key is set;
• a declared record with no record_key value (or one that changed) makes the frame not_checked;
• a side-record link that is already in the baseline is no longer a new record's link.

Nothing changes when record_key and side_records are unset. Finding 4 is still open as a known limit. This PR needs a fresh adversarial review before it is armed.

[abrichr]

AI re-review, round 2 (adversarial)

Head 45c8f5e82. Verdict: request changes. Round-1 findings 1, 2, 3 and 5 are fixed. One new silent pass remains in side records, but only when link_field is not the record_key field (this PR's OpenEMR setup uses pid for both).

#	Round-1 finding	Now
1	Note refiled to another patient	refuted
2	Row ids and patient ids mixed in moved	refuted
3	Declared record without record_key	not_checked
4	Another user's entry for the target patient refutes a correct save	still open (known limit)
5	New chart reusing an existing pid	refuted

New

• Blocking (non-default config): with link_field=patient_row and of_field=id, a history row linked to the new chart but filed under patient 7 was part of the save. Its pid went into declared_keys, so the bot's log entry for patient 7 was excused: held.
• Should fix: a side row is checked by link only, so with that setup a row filed under an existing patient passes even without attribution.
• Limit: record_key is patient-level. A second bot log entry for the declared patient (say, a write to a table the frame doesn't read) is excused. A declared refile (a target's pid changes) is now not_checked.
• Held up: refs doesn't collide across surfaces. With record_key and side_records unset, a 4000-case random comparison with origin/main's judge_frame gave identical results.

---

Fix pushed (dc4cc3d6e, bf591b94d). This changes behaviour. The side-link pre-pass now stores each link's parent record_key value. A side row with a different value is not part of the save: it is an ordinary unexplained addition, and the missing side row refutes too. A side row with no record_key value at all (OpenEMR's contact row) is still its parent's. Regression test: test_a_side_row_filed_under_another_record_key_is_collateral. The same change is ported onto #1582.

[abrichr]

AI re-review, round 3 (adversarial)

Head bf591b94d. Verdict: request changes. The round-2 blocker is fixed, but the new parent rule brought back one silent pass, again only when link_field isn't the record_key field.

1. Blocking: an extra side row filed under another patient ends held when a colleague touched that patient. The parent rule rejects the row, it falls through to attribute(), and the nurse's entry makes it "other". It was refuted at 45c8f5e82 (as a doubled side row).
2. Should fix: with row-id links, a new chart that reuses an existing pid is excused (taken holds of_field values, not pid).

Held up: side rows with no pid, the default pid/pid link with int and string values, history plus contact on one surface, and a colleague's change not excusing the bot's own entry.

---

Fix pushed (95510abac). This changes behaviour.

• With record_key set, a side record must link by it on both sides (link_field and of_field both equal record_key). This is validated, so a side row's link and its record key are the same value, and a link already in the baseline is a taken record key. The parent-ref rule is gone, which closes both findings: such configs are refused.
• A separate reviewer found (in the frame: diff the whole database, with a reviewed allow-list #1582 port) that comparing moved records by record_key let a colleague's concurrent change excuse the bot's own entry for that patient. Only collateral records excuse entries now.

Regression tests: test_with_a_record_key_a_side_record_links_by_it and test_a_colleagues_change_never_excuses_the_bots_entry_for_that_patient.

[abrichr]

AI re-review, round 4 (adversarial)

Head 95510abac. Verdict: approve. The round-3 blocker is closed, and I found no silent pass in a config the validator accepts.

Confirmed fixes

• record_key: pid with link_field: patient_row or of_field: id is refused, in every combination.
• With the allowed pid/pid link, an extra history row for pid 7 is refuted, whether or not the bot logs pid 7. A doubled side row is refuted.
• A nurse edits pid 7, and the bot logs pid 7 for a table the frame doesn't read: refuted.
• "Only collateral excuses" adds no false holds. These all stay held: a nurse's edit to pid 7, a clean new chart, int against string pid, and a clean edit save. A new chart reusing pid 1 is refuted.

Should fix (docs)

1. An extra history row for pid 7 ends held when the bot logs only pid 2 and a nurse has any entry for pid 7. This PR has no event kinds, so a view is enough.
2. A colleague's entry for the patient being edited refutes the save, even when the colleague wrote elsewhere.
3. A bot write for the new chart to a table the frame doesn't read is excused (the read-set limit, which frame.database closes).

---

Docs added (c02399937) on record_key for items 1–3. Arming once CI is green.