Authorization and diagnostic contour as universal infrastructure for executable-knowledge development and governance

Authors

1. Prozorov A.A., Director of Technology, RTLAB; Architect, Sbertech; ap@rtlab.ru;

Abstract

Objective: Runtime evidence and term traceability can reveal that executable behavior no longer joins cleanly to authorized semantics, but they do not by themselves authorize semantic change. This article defines a diagnostic and authorization contour that carries evidence triage into governed semantic-authority closure without creating a second source of truth.

Materials and methods: The article is methodological and uses bounded implementation evidence from Plane diagnostic artifacts, Workbench review surfaces, governed graph-update artifacts, authorized snapshot rebuilds, and closure-evidence artifacts. External standards ground the method in ontology and RDF graph models, graph validation, provenance, healthcare audit analogies, canonical digesting, schema-constrained artifacts, and lifecycle traceability governance.

Results: The method defines an artifact chain from the Runtime Evidence Report through Workbench triage, the Refinement Candidate, Diagnostic Classification Decision, Remediation Packet, Governed Graph Update Request, Governed Graph Update Payload, Semantic Mutation Validation, Semantic Mutation Approval, Authority Write Evidence, rebuilt authorized snapshot and compiled products, Runtime Closure Replay Evidence, Authority Closure Evidence, and Remediation Closure Decision.

Conclusion: The diagnostic contour converts runtime learning into controlled semantic refinement. Workbench prepares and reviews safe-reference artifacts, but the governed authority path writes the semantic authority, and authorized operators remain responsible for closure decisions.

Keywords: executable knowledge; diagnostic contour; semantic authority; governed graph update; remediation packet; closure evidence; Workbench; safe references; operator closure decision

Abbreviations and Terminology

Diagnostic Contour: A governed artifact lifecycle that starts with runtime evidence and ends with readiness evidence and an operator closure decision. It links observation, triage, classification, remediation, graph-update governance, rebuilt snapshots, replay, and closure.

Diagnostic Triage Workbench: An artifact-first operator workbench over Plane diagnostic artifacts. It imports evidence, persists workspaces, groups candidates, opens safe-reference detail drawers, records decisions, prepares graph-update requests, and projects lifecycle state. It is not a semantic-authority writer.

Safe reference: A digest-bound, schema-constrained reference to an artifact, term, evidence item, release, graph object, or review decision. A safe reference lets review surfaces open details without embedding raw graph payloads, raw PHI, waveform payloads, credentials, or mutation code.

Runtime Evidence Report: The normalized runtime-evidence artifact, represented as runtime_evidence_report.v1, that turns debug, audit, result, alert, metric, and replay captures into safe references suitable for diagnostic classification.

Refinement Candidate: The semantic_authority_refinement_candidate.v1 artifact that records a possible authority refinement suggested by evidence. It is a candidate for review, not an authorized semantic change.

Diagnostic Classification Decision: The diagnostic_classification_decision.v1 artifact that classifies the likely root class of a diagnostic finding, such as semantic-authority gap, runtime implementation defect, release or deployment mismatch, evidence capture gap, waiver, supersession, or non-semantic explanation.

Remediation Packet: The remediation_packet.v1 artifact that packages the selected decision, affected evidence, candidate refs, owner roles, proposed closure gates, closure tests, and current remediation status.

Governed Graph Update Request: The governed_graph_update_request.v1 artifact that requests authority-path graph work through safe references and digests. It does not carry raw graph payloads or perform a write.

Authority Write Evidence: The authority_write_evidence.v1 artifact that proves an approved governed graph-update payload was applied through the authority path and records before and after graph digests, approval refs, apply status, and safe refs.

Authority Closure Evidence: The authority_closure_evidence.v1 artifact that joins the remediation packet, request, approval, write evidence, rebuilt snapshot, registry, trace, compiled bundle, regression evidence, and runtime closure replay evidence into readiness proof.

Remediation Closure Decision: The remediation_closure_decision.v1 artifact that records the operator governance decision to close, keep open, waive, or supersede a remediation item after closure evidence is available.

The invariant is used once and then applied throughout the article: derived artifacts and Workbench views are evidence and review surfaces, not semantic authority. Public manuscript text refers to companion papers by title rather than by internal series identifiers; those identifiers remain planning and authoring-basis metadata.

Introduction

The preceding traceability method makes a term-level gap visible: a runtime observation may match an authorized term trace, miss an authorized term, point to a stale bundle, expose an ambiguous reference, or show that evidence capture is incomplete. That visibility is necessary, but it is not sufficient. A missing or stale join does not say whether the ontology must change, a runtime implementation must be fixed, a release must be corrected, an evidence capture surface must be repaired, or a review decision must waive or supersede the item.

The central problem addressed here is the gap between evidence triage and governed semantic closure. If triage artifacts can become authority by convenience, the system fragments its semantic source of truth. If closure is not artifact-bound and replayable, reviewers cannot distinguish an actual semantic repair from a local workaround, stale deployment, or incomplete evidence capture. If human governance is bypassed, runtime learning becomes unreviewable mutation.

This article contributes a reusable diagnostic and authorization contour pattern. The pattern preserves one semantic authority while allowing runtime evidence to create reviewable candidates, classification decisions, remediation packets, governed graph-update requests, write evidence, rebuilt snapshots, closure evidence, and operator closure decisions. It does not claim clinical validation, product approval, autonomous remediation, or complete release-chain proof.

Companion Papers

The companion article End-to-end Codified-term Traceability for Debugging and Auditing Compiler and Executable Modules owns registry and trace artifacts, runtime evidence joins, Plane diagnostics, and the Workbench triage surface up to the point where a finding is classified and handed off. This article begins where that handoff becomes a governed refinement problem: how a triaged evidence item becomes a candidate, decision, remediation packet, governed graph-update request, authorized write, rebuilt snapshot, replayed closure signal, and operator closure decision.

The companion article Closed-loop Governance of Formalizable Knowledge in Clinical Information Systems owns the general method for preserving a single semantic authority in a closed governance loop. This article specializes that governance method for diagnostic-contour infrastructure and graph-update closure. Downstream articles Automatic closed-loop release of trusted executable analyzer modules from a trusted knowledge snapshot and Continuous chain of trust in the automatic closed-loop release of executable analyzer modules own release packaging, automated release operation, and trust-chain continuity after closure-ready evidence exists. Instant health assessment through an ECG example: interpreting mixed named terms and ECG oscillograms owns definition and use of the ECG-interpretation knowledge graph, not the generic contour itself.

Companion article	Owns	Does not own
End-to-end Codified-term Traceability for Debugging and Auditing Compiler and Executable Modules	Registry, trace, evidence joins, Plane diagnostic handoff, Workbench triage surface	Governed semantic mutation, authority write, closure evidence, operator closure decision
Closed-loop Governance of Formalizable Knowledge in Clinical Information Systems	General governance invariant and closed-loop truth-distillation method	Diagnostic-contour artifact mechanics
Automatic closed-loop release of trusted executable analyzer modules from a trusted knowledge snapshot; Continuous chain of trust in the automatic closed-loop release of executable analyzer modules	Release packaging, release automation, supply-chain and trust-chain continuity	The authority-refinement decision before release
Instant health assessment through an ECG example: interpreting mixed named terms and ECG oscillograms	Definition and use of the ECG-interpretation knowledge graph	Generic diagnostic and authorization contour infrastructure

Materials and Methods

The article is a methodological paper with bounded implementation evidence. The internal authoring basis consists of diagnostic-contour artifact specifications and schemas, Workbench microfrontend and microbackend specifications, Plane command and protocol surfaces, authorized snapshot and compiled bundle specifications, prior traceability and governance manuscripts, and the shared IHA terminology canon. These sources are used to describe what the current artifact contracts support; they are not public references.

External references provide conceptual grounding. OWL 2 and RDF 1.1 ground ontology-based authorized semantics and graph modeling [1,2]. SHACL grounds fail-closed validation of graph-shaped constraints [3]. PROV-O grounds provenance and lineage vocabulary [4]. FHIR Provenance and FHIR AuditEvent provide healthcare analogies for provenance-bearing records and structured audit context [5,6]. RFC 8785 and JSON Schema 2020-12 ground canonical digesting and schema-constrained evidence artifacts [7,8]. IEC 62304 and ISO 13485 ground lifecycle discipline and quality-system traceability governance [9,10]. The SPARQL 1.1 Graph Store HTTP Protocol grounds the terminology of HTTP graph-store operations used to describe add-only and replacement graph modes, without being treated as a governance standard [11].

The method separates three levels. The diagnostic level normalizes runtime evidence, proposes candidates, and classifies findings. The authorization level prepares request and payload artifacts, validates them, approves them, and applies them through the governed authority path. The closure level rebuilds the snapshot and compiled products, replays the original signal or waiver/supersession condition, produces closure evidence, and leaves final closure to human governance. Public references are external only; repo-local specifications remain authoring basis.

Diagnostic and Authorization Contour Overview

The diagnostic and authorization contours close the lifecycle of the authorized semantic space:

Figure 1. Lifecycle of the authorized semantic space. Twelve steps from the runtime evidence report to the operator closure decision; the same steps in detail are shown in Figure 2.

Runtime evidence supplies observations. Workbench makes those observations reviewable through safe references, grouping, lifecycle projection, and artifact inventory. Plane diagnostic artifacts preserve the candidate and classification record. The governed authority path validates, approves, and applies only approved graph-update payloads. Rebuild and replay artifacts prove that the resulting authorized snapshot and compiled products are aligned with the remediation question. The authorized operator then closes, keeps open, waives, or supersedes the item.

Closure evidence is readiness proof, not closure itself. Authority Closure Evidence may report status=ready_to_close when request, approval, write evidence, rebuilt snapshot, registry, trace, bundle, regression evidence, and runtime replay evidence join correctly. The Remediation Closure Decision remains a separate operator governance action.

Table 1: Artifact Responsibilities and Authority Boundaries

Table 1. Artifact responsibilities and authority boundaries

Artifact	Lifecycle stage	Producer	Consumer	Purpose	Authority boundary
Runtime Evidence Report	Evidence capture and normalization	Runtime evidence normalizer	Workbench, diagnostic classifier	Convert debug, audit, result, alert, metric, load-test, or replay captures into safe-reference evidence	Cannot authorize semantics, replace audit records, expose raw PHI or waveform payloads, or close remediation
Refinement Candidate	Candidate proposal	Plane diagnostic proposal stage, usually surfaced through Workbench	Reviewer, classifier, remediation drafting	Describe a possible authority refinement suggested by evidence	Cannot mutate graph authority, approve semantics, or prove clinical correctness
Diagnostic Classification Decision	Diagnostic classification	Human reviewer or governed classifier workflow	Remediation packet, downstream owner roles	Classify the finding and rationale against evidence refs, affected artifacts, target stage, and owner roles	Cannot write the triple store, create semantic authority, or close the remediation item
Remediation Packet	Remediation packaging	Reviewer or governed remediation drafting workflow	Graph-update request preparation, closure tracking	Package decision, candidate, evidence refs, closure gates, closure tests, and remediation status	Opens governed work, but is not an approved semantic change and cannot apply a graph update
Governed Graph Update Request	Request to authority path	Workbench-prepared or Plane-prepared request	Authority-path validator and approver	Request graph work by safe refs, base snapshot digest, target graph refs, rationale, and remediation refs	Cannot carry raw graph payloads, embedded SPARQL, credentials, or perform a write
Governed Graph Update Payload	Payload binding	Governed authority preparation workflow	Validator, approver, release/apply operator	Bind add-only or replacement graph payload refs, expected digests, base snapshot, and request refs	Cannot bypass validation, embed credentials, or become authority until approved and applied through the authority path
Semantic Mutation Validation	Pre-approval validation	Authority-path validator	Approver, remediation owner	Check request and payload match, graph allowlists, base snapshot digest, safe refs, schema conformance, and forbidden payload content	Cannot approve or apply mutation; failed validation blocks approval
Semantic Mutation Approval	Governance approval	Authorized approver role	Release/apply operator, write-evidence recorder	Record separation-of-duties approval for a validated payload and remediation context	Cannot write graph data or close the item by itself
Authority Write Evidence	Governed authority write	Authority apply path	Snapshot rebuild, closure-evidence verifier	Prove that an approved governed payload was applied and record before/after graph digests and apply status	Is write evidence only; it is not closure evidence and does not prove runtime closure
Rebuilt authorized snapshot, registry, trace, and bundle	Rebuild and compile	Authority rebuild and compiler surfaces	Closure replay, closure-evidence verifier, reviewers	Materialize the new authorized basis and compiled products after the write	Cannot retroactively validate stale runtime evidence or close remediation without replay/regression evidence
Runtime Closure Replay Evidence	Closure replay	Replay/regression workflow	Closure-evidence verifier, reviewer	Show that the original diagnostic signal disappears, is waived, is superseded, or still fails under new authority evidence	Cannot mutate semantics or replace the operator closure decision
Authority Closure Evidence	Closure readiness proof	Closure verifier	Human reviewer, remediation closure decision	Join request, approval, write evidence, rebuilt snapshot, registry, trace, bundle, regression evidence, and replay evidence	ready_to_close is readiness for review, not automatic closure
Remediation Closure Decision	Human closure	Authorized reviewer or governance board	Downstream status projections, release planning	Record close, keep-open, waiver, or supersession decision with evidence refs	Cannot rewrite source evidence, bypass release governance, or act as a graph mutation

Workbench Triage

Workbench provides an artifact-first UX while Plane commands and diagnostic-contour artifacts are used. It persists a workspace, inventories imported artifacts, shows lifecycle state, groups evidence and authority candidates, opens safe-reference detail drawers, and records review decisions. Its role is to make the artifact chain reviewable for operators who need to move from a runtime signal toward a governed authority path.

The operator begins work by importing a Runtime Evidence Report. Workbench groups rows by evidence source, affected object, candidate kind, gap class, lifecycle stage, release context, and authority candidate. From a grouped row, the operator opens a safe-reference drawer. The drawer resolves evidence refs, candidate refs, snapshot refs, bundle refs, registry and trace refs, remediation refs, request refs, and closure refs as structured sections. The operator can propose authority refinement, inspect safe refs, classify a diagnostic decision, draft a remediation packet, prepare a governed graph-update request, verify closure evidence, and record a closure decision when authorized governance allows it.

The Workbench boundary is explicit. It does not write directly to the triple store, repair traces in the UI, expose raw PHI or waveform payloads, embed SPARQL, store credentials in artifacts, or auto-remediate. It may prepare or request authority-path work, but the governed authority path validates, approves, and applies semantic changes. Human-readable command and status prose is supplied from artifacts and compiled modules; the command identifiers remain machine-checkable stage names.

Diagnostic Classification And Remediation

Diagnostic classification distinguishes candidate explanations before any authority mutation is proposed. A runtime finding may reflect a semantic-authority gap, a runtime implementation bug, a release or deployment mismatch, an evidence capture gap, a waiver or supersession case, or a non-semantic explanation. Classification prevents every runtime anomaly from becoming ontology work and prevents every missing semantic join from being dismissed as an implementation defect.

The Diagnostic Classification Decision records evidence refs, affected artifacts, owner roles, target lifecycle stage, classification, rationale, reviewer identity where applicable, and decision timestamp. It is governed triage. It does not approve a semantic mutation and does not close remediation.

The Remediation Packet packages the selected decision, candidate refs, evidence refs, proposed owner path, closure gates, closure tests, and current status. A packet can require semantic-authority refinement, runtime implementation correction, release/deployment correction, evidence capture repair, waiver, or supersession. When it requires semantic work, it opens the governed graph-update path. It remains immutable evidence of the remediation intent and cannot itself become an approved semantic change.

Classification examples should stay generic. A missing authorized term may become a semantic-authority refinement. A stale bundle may become a release or deployment correction. A missing safe runtime reference may become an instrumentation fix. An ambiguous reference may require a clearer binding rather than a new term. A waived or superseded item may close only when closure evidence and an operator closure decision support that outcome.

Governed Graph Update Request, Payload, Validation, and Approval

The Governed Graph Update Request is the transition from remediation to the authority path. It carries safe references to the remediation packet, classification decision, affected graph target, base snapshot digest, proposed mode, rationale, owner roles, and expected validation checks. It is safe-reference based so that Workbench can prepare and review the request without embedding raw graph payloads or mutation code.

The Governed Graph Update Payload binds the concrete update material by digest and safe references. The method allows controlled add-only or replacement graph modes over an HTTP graph-store style surface [11], but the payload is never treated as authority merely because it exists. The payload must match the request, the target graph must be allowed, the base snapshot digest must match the expected authority state, and the artifact must pass schema validation [8].

Validation is fail-closed. It checks graph allowlists, base snapshot digest, request and payload match, artifact digests, safe refs only, no embedded credentials, no raw graph payload, no embedded SPARQL, and no unsafe runtime evidence embedded as authority material. Approval then records separation of duties among proposer, approver, and release/apply operator. The approval artifact is a governance record, not a graph write.

Authority Write Evidence and Rebuilt Snapshot

Authority Write Evidence proves that an approved governed payload was applied through the authority path. It records the approved request and payload refs, validation and approval refs, before and after graph digests, apply status, write timestamp, actor or role refs, and safe refs to the resulting authority state. It is not closure evidence. A successful write says that a governed mutation occurred; it does not say that the original diagnostic signal is resolved.

After the authority write, the system rebuilds the authorized snapshot and derived compiler products. The rebuilt set includes the authorized snapshot, the IR term registry, the IR term trace, the compiled bundle, and lineage or receipt evidence. Digest continuity is the central check: request and payload digests must join to write evidence; write evidence must join to the rebuilt snapshot; the rebuilt snapshot must join to registry and trace digests; registry and trace digests must join to the compiled bundle and receipt.

Failed, stale, or partial rebuilds block closure. A stale base snapshot, missing registry row, missing trace row, digest mismatch, or failed compilation means the remediation may have an approved write but lacks closure-ready evidence.

Closure Evidence and Operator Closure Decision

Closure begins after the authority write and rebuild, not before. Runtime closure replay asks whether the original diagnostic signal disappears, is waived, is superseded, or remains present under the new authority evidence. Regression evidence asks whether the relevant executable and diagnostic surfaces still satisfy the required checks. The closure verifier joins these proofs with the remediation packet, classification decision, governed request, payload, validation, approval, write evidence, rebuilt snapshot, registry, trace, compiled bundle, and release or deployment evidence where applicable.

Authority Closure Evidence records that join. status=ready_to_close means the evidence chain is ready for review. It does not automatically close the item. It cannot hide a failed replay, stale snapshot, unsafe payload ref, missing digest, or open regression failure behind a successful write.

The Remediation Closure Decision is the operator governance action after closure evidence. The decision can close the item, keep it open, waive it, or supersede it. The source remediation packet remains immutable evidence. Downstream systems may project the resulting state for release planning, audit review, or Workbench workspace summaries, but those projections do not rewrite the source evidence.

Worked Lifecycle Example

Consider a bounded cardio.flag.sinus_rhythm-style finding. Runtime evidence shows a flag-like observation that does not join cleanly to the expected authorized binding under the observed release context. The finding may be a semantic-authority gap, a release or deployment mismatch, a missing runtime safe reference, or an evidence capture gap. The example is methodological and does not validate the clinical adequacy of sinus-rhythm interpretation.

Workbench imports the Runtime Evidence Report and groups the row by affected flag, candidate kind, gap class, and release context. The operator opens the safe-reference drawer. The drawer shows the runtime ref for cardio.flag.sinus_rhythm, available audit/debug/result/alert/metric refs, bundle and snapshot refs, registry and trace refs if present, and the proposed authority-refinement candidate. If the bundle selected by deployment evidence contains the relevant registry and trace path but runtime evidence lacks a safe ref, classification trends toward evidence capture or implementation repair. If the selected bundle has no authorized term path for the observation, classification may trend toward semantic-authority refinement. If the expected path exists only in a different bundle, classification trends toward release or deployment mismatch.

The reviewer records a Diagnostic Classification Decision and drafts a Remediation Packet. For a semantic-authority refinement, the packet defines the candidate, owner roles, closure gates, expected rebuilt snapshot checks, registry and trace expectations, replay evidence expectations, and closure decision requirements. Workbench may prepare a Governed Graph Update Request from the packet, but the request enters the authority path for validation and approval.

The governed authority path validates the request and payload, records semantic mutation validation, records semantic mutation approval under separation of duties, applies the approved payload, and produces Authority Write Evidence. The snapshot is rebuilt, the registry and trace are regenerated, the compiled bundle is exported, and lineage evidence binds the new products. Runtime closure replay then tests whether the original signal disappears, is waived, is superseded, or still fails. Authority Closure Evidence joins the whole chain. An authorized operator then records the Remediation Closure Decision: close, keep open, waive, or supersede.

The example shows why this article does not duplicate the term-trace worked example. The trace article explains whether cardio.flag.sinus_rhythm joins to the compiled registry and trace. This article explains what happens after a trace or evidence join suggests governed action.

End-to-end Lifecycle Contour

Figure 2. End-to-end diagnostic and authorization contour. The contour moves from runtime evidence to operator closure decision while keeping Workbench as a preparation and review surface and the governed authority path as the only semantic-write path.

In Figure 2, the input is a Runtime Evidence Report produced from runtime observation surfaces and normalized into safe references. Workbench triage receives that report, groups the finding, and prepares the first reviewable artifact: a Refinement Candidate. The candidate is processed by diagnostic classification, which produces a Diagnostic Classification Decision rather than a graph change. That decision is packaged into a Remediation Packet, which becomes the handoff object for the governed authority path. The governed path receives the request and payload, validates and approves them, then applies only the approved authority update and emits Authority Write Evidence. The write evidence is not the end of the flow: it triggers a rebuilt authorized snapshot and regenerated registry, trace, and bundle, after which runtime closure replay checks the original signal under the rebuilt authority context. The result is Authority Closure Evidence, and only then can an authorized operator issue the Remediation Closure Decision.

Safe-reference Flow in the Operator Workbench

Figure 3. Operator actions using Workbench and safe references. Workbench keeps the operator inside artifact inventory, safe-reference inspection, classification, remediation drafting, and governed handoff, while boundary markers block raw payload exposure, direct triple-store mutation, and UI trace repair.

Figure 2 expands the Workbench part of the lifecycle. The operator begins work by importing an evidence artifact into a persistent workspace. Workbench indexes the artifact inventory and groups evidence by affected object, authority candidate, gap class, candidate kind, and release context. When the operator selects a grouped finding, Workbench opens the safe-reference drawer instead of exposing raw runtime or graph payloads. The drawer resolves evidence refs, lineage refs, registry and trace refs, bundle refs, release refs, candidate refs, and remediation refs into inspectable sections. The operator then classifies the diagnostic decision, drafts a remediation packet, and prepares a governed graph-update request. The output of this UX flow is not a semantic mutation; it is a governed handoff package. Boundary markers show that Workbench blocks raw payload display, direct triple-store mutation, and UI trace repair while still making the evidence chain reviewable.

Closure Evidence Chain After Authority Write

Figure 4. Closure evidence chain after authority write. Write evidence starts the closure proof, but rebuilt snapshot products, regression evidence, runtime replay, and operator governance are required before the remediation item can be closed, kept open, waived, or superseded.

Figure 3 starts after the authority path has already produced Authority Write Evidence. That evidence passes the approved write result into the rebuild step, where the authorized snapshot is regenerated. The rebuilt snapshot is then processed by the compiler surfaces that produce the IR Term Registry, IR Term Trace, and compiled bundle. The compiled bundle becomes the input for two evidence-producing checks: regression evidence checks that the relevant executable and diagnostic surfaces still satisfy required behavior, while Runtime Closure Replay Evidence checks the original diagnostic signal under the new authority context. These two evidence streams are joined into Authority Closure Evidence. The output is a readiness state for review, not an automatic closure. The final processing step is operator governance, which records the Remediation Closure Decision.

Limitations and Non-claims

This article does not claim clinical efficacy, clinical safety, registration-grade validation, or product approval. The cardio.flag.sinus_rhythm example is a bounded lifecycle example, not clinical validation of sinus-rhythm interpretation.

The article does not claim that Workbench mutates the semantic authority. Workbench does not perform direct triple-store graph writes, repair traces in the UI, embed SPARQL, expose raw PHI or waveform payloads, store write credentials in artifacts, or auto-remediate a finding.

The article does not claim that schema validation, graph standards, or provenance standards alone provide governance. They support reproducible artifacts, validation, lineage, and audit analogy, but the governed authority path, separation of duties, closure evidence, and operator closure decision are part of the method. The article also does not claim release-chain or supply-chain proof; downstream release and trust-chain papers own those topics.

Conclusion

The authorization and diagnostic contour closes the gap between runtime evidence and governed semantic refinement. It turns a runtime learning signal into a sequence of safe-reference artifacts, classification records, remediation packets, governed graph-update requests, authority write evidence, rebuilt snapshot products, closure replay evidence, and operator closure decisions.

The contribution is infrastructure rather than clinical validation. The method preserves a single semantic authority while allowing runtime evidence to drive review. It keeps Workbench artifact-first and non-mutating, keeps graph updates in the governed authority path, and makes closure digest-bound, replayable, and explicitly human-governed.

Authoring Basis

The article draws on the internal documentation of the HealthOS project: the specifications, schemas, and registries that define authorized semantics and its compiled form, the runtime and tooling that produce execution evidence, and the companion manuscripts of the series, bound together by a shared terminology canon. These are working sources that ground the engineering decisions and keep terminology consistent across the series. They remain internal authoring basis rather than public references and are not cited as repository links in the text.

Conflict of Interest

The manuscript describes the implementation of a specific aspect of the HealthOS platform, namely: diagnostic and authorization contour from runtime evidence triage to governed semantic-authority closure.

Funding

The work was funded by RTLAB.

References

1. W3C OWL Working Group. OWL 2 Web Ontology Language Document Overview (Second Edition). W3C Recommendation; 2012. https://www.w3.org/TR/owl2-overview/
2. Cyganiak R, Wood D, Lanthaler M, editors. RDF 1.1 Concepts and Abstract Syntax. W3C Recommendation; 2014. https://www.w3.org/TR/rdf11-concepts/
3. Knublauch H, Kontokostas D, editors. Shapes Constraint Language (SHACL). W3C Recommendation; 2017. https://www.w3.org/TR/shacl/
4. Lebo T, Sahoo S, McGuinness D, editors. PROV-O: The PROV Ontology. W3C Recommendation; 2013. https://www.w3.org/TR/prov-o/
5. HL7 International. FHIR Resource Provenance (R4). https://hl7.org/fhir/R4/provenance.html
6. HL7 International. FHIR Resource AuditEvent (R4). https://hl7.org/fhir/R4/auditevent.html
7. Rundgren A, Jordan B, Erdtman S. JSON Canonicalization Scheme (JCS). RFC 8785; 2020. https://www.rfc-editor.org/rfc/rfc8785
8. JSON Schema authors. JSON Schema Draft 2020-12. https://json-schema.org/draft/2020-12
9. International Electrotechnical Commission. IEC 62304:2006/AMD 1:2015 Medical device software - Software life cycle processes. https://www.iso.org/standard/64686.html
10. International Organization for Standardization. ISO 13485:2016 Medical devices - Quality management systems - Requirements for regulatory purposes. https://www.iso.org/standard/59752.html
11. Chimezie Ogbuji, editor. SPARQL 1.1 Graph Store HTTP Protocol. W3C Recommendation; 2013. https://www.w3.org/TR/sparql11-http-rdf-update/