{
  "title": "Authenticated routes and composed application",
  "scope": "Locally implemented and independently reviewed using synthetic/offline inputs; not an Epic-hosted demonstration",
  "evidence_sources": [
    {
      "original_relative_path": "review-epic-wiring/ACCEPTANCE-R3.json",
      "sha256": "a2ffdc350f2e245f31f3314380e97e24dcb5e96878eb937e77a16babaa29650c",
      "review_timestamp": "2026-10-06T18:02:31.363207+00:00",
      "timestamp_note": "Null means no review timestamp was recorded in this source.",
      "status": "ACCEPTED_BOUNDED_OFFLINE_EPIC_WEB_BOUNDARY_R3"
    },
    {
      "original_relative_path": "review-pal-composition/IMPORT-ACCEPTANCE-R3.json",
      "sha256": "23cc7e52d1bbe3380025006161070e529929bd8ea59da8aa79274e371d9e7af7",
      "review_timestamp": "2026-10-06T18:22:47.053031+00:00",
      "timestamp_note": "Null means no review timestamp was recorded in this source.",
      "status": "ACCEPTED_BOUNDED_ACTUAL_PAL_IMPORT_R3_ONLY"
    },
    {
      "original_relative_path": "review-deployed-composition/ACCEPTANCE.json",
      "sha256": "e95ced7ca85f7aea7abbaa9d92d4c2bc60223ce2040d95cf3c575fc9668cb00e",
      "review_timestamp": "2026-10-07T02:06:20.268068+00:00",
      "timestamp_note": "Null means no review timestamp was recorded in this source.",
      "status": "ACCEPTED_BOUNDED_LOCAL_COMPOSITION_OF_MEASURED_DEPLOYED_SUPPORT"
    }
  ],
  "substantiated_claims": [
    "Authenticated authorize/callback/complete/fetch/HOLD/acknowledge flow was exercised locally with scripted Epic responses.",
    "Actual composed PAL handler checked wrong-patient, cross-session, origin and logout/replay boundaries.",
    "Full module import used isolated synthetic authentication and stores."
  ],
  "limits": [
    "The review-deployed-composition folder describes local composition of measured support files; no live deployment was tested.",
    "No external Epic network calls; local flow is not real sandbox integration.",
    "These reports are historical bounded checks, not live attestation of this static presentation or latest cloud state.",
    "The reviewed application policy blocks iframe embedding; an embedded top-level window is distinct and requires validation.",
    "These older local HTTP checks predate the separately accepted chart-launch R3 mechanics (ehr-launch.json); real Epic context/runtime/hosting remain unverified."
  ],
  "excerpt_prepared_at_utc": "2026-10-07T22:08:07.500194+00:00",
  "excerpt_policy": "Curated claims and file hashes only. Original internal reports, tokens, private absolute paths and raw test logs are not copied.",
  "coordinator_update_at_utc": "2026-10-13T19:36:04.513154+00:00",
  "related_evidence": "ehr-launch.json"
}