Skip to main content

Ghasi e-Prescribing Gateway Service — Service Readiness

Status: populated Owner: TBD Last updated: 2026-04-18 Companion: Service Template · 03 platform-services · 02 DDD

Readiness Gates by Phase​

Phase 1 — First-Party MVP (Ghasi EHR ↔ Pharmacy)​

All items must be ✅ before production pilot.

Documentation​

  • All 17 service docs populated (not stubs)
  • EPICS.md and USER_STORIES.md reviewed by product owner
  • API_CONTRACTS.md matches OpenAPI spec + FHIR CapabilityStatement
  • EVENT_SCHEMAS.md matches schema registry
  • Consumer integration guides (EHR and Pharmacy) published and reviewed

Code Quality​

  • ESLint zero errors; domain import restriction passes
  • TypeScript strict: zero errors
  • No hardcoded secrets; secrets scanning green
  • No debug statements in production code

Testing (Phase 1 exit criteria per PHASED_IMPLEMENTATION_PLAN.md)​

  • Unit coverage ≥ 90%
  • Integration coverage ≥ 85%
  • tenant-isolation.integration.spec.ts green (CI gate)
  • outbox.integration.spec.ts green (CI gate)
  • inbox.integration.spec.ts green (CI gate)
  • persona-enforcement.integration.spec.ts green
  • idempotency.integration.spec.ts green
  • etag-conflict.integration.spec.ts green
  • FHIR golden fixtures pass R4 StructureDefinition validation in CI (NFR-RX-004)
  • Pact consumer contracts green (orders-service, pharmacy-service)
  • Three-party E2E scenario passing in staging (AC-RX-006)

Security (HIPAA-equivalent audit critical)​

  • Persona enforcement tested (wrong persona = 403)
  • HIPAA audit event coverage verified for all MR/MD mutations
  • Subscription HMAC signing verified
  • RLS adversarial test green
  • Security reviewer sign-off (authentication, persona enforcement, PHI handling, audit)

Observability​

  • Distributed traces visible in Grafana (EHR → gateway → Pharmacy correlation)
  • All dashboards populated in staging
  • All alerts configured; runbooks linked
  • Subscription DLQ observable

Operations​

  • Canary deploy (5% traffic, 30 min hold) in staging
  • Rollback verified
  • On-call rotation assigned
  • Manual DLQ replay procedure documented and tested

Sign-off​

  • Tech lead sign-off
  • SRE sign-off
  • Security reviewer sign-off
  • Product owner sign-off

Phase 2 Exit Criteria (additional gates)​

  • Task/Directory depth (FR-RX-020/021) tested
  • Redis idempotency/rate-limit store deployed and tested (if scoped)
  • Load test at target throughput: p95 < 800 ms for MR create
  • HAPI FHIR validator deployed and golden fixtures passing (if scoped)
  • Cross-tenant fuzz regression test passing