Initial release for the "AI Agents in Interoperability Workflows" contest.

• Triage of HL7 v2 ORU^R01 lab results on IRIS for Health Interoperability
• Deterministic critical-value rule runs before the AI Hub agent; the alert never waits for the LLM
• %AI.Agent (Gemini) decides RELEASE or HOLD_FOR_REVIEW for abnormal results, with a minimal sanitized payload and a validated JSON contract
• Human review through the Interoperability Workflow Inbox (Release / KeepOnHold)
• Every LLM call visible in Visual Trace with prompt version, tokens and latency (Community Idea DPI-I-689)
• REPLAY mode by default: runs without an API key
• 96 %UnitTest tests plus end-to-end scripts
• Built on AI Hub Early Access build 2026.3.0AI.154.0

Initial release: native IRIS AI Hub investigation, deterministic containment, Workflow review, vector precedents and partner-file intake. Verified on build 154U; see the source evidence guide and captioned demonstration.

MyOwn Portal 1.1.0

Release for the InterSystems Programming Contest "AI Agents in Interoperability Workflows". 1.0.3 was a compact administration portal for InterSystems IRIS and IRIS for Health; 1.1.0 adds an AI agent that works inside an interoperability production. The agent decides and proposes; a person confirms every change with their own credentials.

• Online demo: http://163.176.71.47:52774/myown/index.html (user demo, password demo; replay mode)
• Video: https://www.youtube.com/watch?v=q7SpKb9q8BE
• Developer Community article: to be added before release

What changed since 1.0.3

An AI agent inside an interoperability workflow

• New production MyOwn.Production.Main. Business Services turn health anomalies, failing tasks, serious log entries and role requests into events. Business Processes ask the AgentGateway operation for a decision, run the Gate and store the proposal. Every step leaves a message or an Event Log entry with the trace id.
• Two decision engines behind the gateway. The AI Hub engine (%AI.Agent with a read-only ToolSet, an allow-list authorization policy, an audit policy and its own deadline) runs on IRIS AI Hub builds. The Rules engine is always available. When AI Hub is missing, there is no key, the kill switch is on, the budget is spent or the provider fails, Rules decide, and the reason is recorded and shown (for example Rules (provider_timeout)).
• The agent's tools are read-only class queries (GetTaskRuns, GetMetricHistory), and the ToolSet excludes every tool whose name does not start with Get.

Guardrails: the agent never writes

• Validator. The model output must be one JSON object that matches schema v1: strict types, allow-listed fields and actions, bounded text, targets taken only from the candidates the server supplied. 92 hostile model outputs are in the adversarial test corpus.
• Gate. Kill switch, read-only mode, prohibited targets (for example the %All role), high-risk decisions downgraded to escalation, one open proposal per target and action, and cooldown. The token budget is enforced separately (MyOwn.Agent.Policy.Budget, called by the agent service); over budget, Rules decide.
• Human confirmation. A state change exists only as a proposal that expires. Confirming it revalidates everything: state, expiry, separation of duties (a requester cannot confirm their own request), prohibited targets, the target fingerprint (TARGET_CHANGED) and the confirming user's live permission. The change is then executed with that user's credentials, read back and audited (MyOwn/Agent/*).
• Untrusted text (log lines, task errors, justifications) reaches the model only inside delimiters, sanitized.

Replay mode

• MYOWN_AI_MODE=replay answers from real model decisions recorded earlier (Gemini gemini-3.8-flash and gemini-3.5-flash-lite), one fixture per scenario in aihub/fixtures/, each with its provider, model and recording date. It needs no key and no network, and the screen says "Replay of recorded real decisions". A scenario without a recording falls back to Rules (replay_missing); nothing is invented.

Demo mode and the demo user

• MYOWN_DEMO_MODE=1 makes the portal safe to expose. The demo account (role MyOwnDemo) can view the portal, run the scenarios and confirm or reject proposals; it has no IRIS administration privilege.
• Confirmations change only synthetic targets (demo tasks, users and roles) and end as simulated; IRIS itself is never changed. Routes that would change the real system are off for everyone. A reset task and a "Reset demo" button restore the synthetic state, and scenarios are rate-limited per client and session.
• The demo password is generated by scripts/New-DemoPassword.ps1 into the git-ignored .env (MYOWN_DEMO_USER_PASSWORD) and never printed. Without it the demo account stays disabled.

Custom inbound adapters

• TaskWatcher and LogWatcher use the portal's own adapters, MyOwn.Production.Adapter.TaskHistoryInbound and LogEntriesInbound (both Ens.InboundAdapter), with their settings in the production: TaskNamespace, HistoryRows, FailureThreshold, MinSeverity, MaxEntries.

Packaging and installation

• One IPM module, myown-portal. The AI Hub engine is part of it and is compiled only where the %AI package exists; elsewhere the portal runs on Rules. The registry package contains no test classes.
• Installing into a namespace without interoperability enables it first (MyOwn.Bootstrap). The agent production is set to start automatically and starts once the install finishes. Uninstalling stops it and removes the web applications and classes; roles, resources and data are kept.
• Docker for IRIS AI Hub build 2026.3.0AI.154.0. The image build sets the production to start at boot, so a new installation has no error in its Event Log. An incomplete installation never starts. The ports are published on 127.0.0.1 only by default.
• scripts/Test-All.ps1 runs every test suite, prints one table and exits with 1 when anything fails.

The portal itself (Overview with an Embedded Python health score and a Vector Search nearest-pattern match, Logs, users and roles through SysAdmin API v2, tasks, web applications, API explorer) is unchanged in purpose and still works without the agent.

How to install

Docker with IRIS AI Hub build 154 (recommended for the agent)

Load and tag the build 154 image once per machine, copy .env.example to .env (set your own MYOWN_DEMO_PASSWORD, and a key, or MYOWN_AI_MODE=replay), then:

docker compose -f compose.yaml -f compose.aihub.yaml up --build -d

Open http://localhost:52774/myown/index.html. The README has the full steps, the memory needed (tested with WSL limited to 8 GB on a 16 GB machine) and how to verify the installation.

IPM

When 1.1.0 is published in the community registry, in the namespace where the portal should live:

zpm "install myown-portal"

Until then the registry has 1.0.3; to install 1.1.0 from a clone, zpm "load /path/to/Portal-Iris".

Known limitations

• Only the Gemini provider was used for real calls (gemini-3.8-flash and gemini-3.5-flash-lite, free tier). OpenAI, Anthropic and Bedrock go through the same %AI.Provider path but are untested.
• Gemini free-tier latency was 12 to 83 s per decision, against the portal's 20 s default deadline, so live decisions often fall back to Rules (provider_timeout). The provider also retries HTTP 429 and 503 on its own before reporting them. The online demo therefore uses replay mode.
• The S3 replay fixture comes from an earlier call with an equivalent, not identical, context (its header says so). The other scenarios use their exact context; S2, S4, S8 and S9 were recorded with gemini-3.5-flash-lite after gemini-3.8-flash timed out or answered 503 "high demand" on three re-recording attempts, and its S3 answer (ignore instead of a resume proposal) was not used.
• The IRIS edition of build 154 was not tested; only IRIS for Health.
• A viewer (MyOwnViewer) cannot file an access request: SysAdmin API v2 refuses it even its own account. The portal answers with a clear 403 and administrators file requests.
• The image build needs about 2.3 GB inside the Docker VM at its peak, and loading the image archive also needs memory; with other programs open, Windows can run low.
• The UI test suite needs Node.js; without it Test-All.ps1 skips that suite.
• The default _SYSTEM password in .env.example is a well-known local convenience value. Change it before exposing the portal.

Initial Release

Initial Release

Initial Release

Video demo on YouTube (1:38, no sound, English captions): https://youtu.be/ht88cOoM4Ng. The README links to it.

Runs on the AI Hub 2027.1.0AI.109.0 image (iris-community-2027.1.0AI.109.0-docker.tar.gz from the Early Access portal); the 2026.3.0AI builds are no longer there. No code changes: the unit tests, the nine-sample demo, a review in the Workflow Inbox and zpm "install iris-inbox-triage" from the community registry pass on 2027.1. The README notes say which AI Hub issues still reproduce on it.

Initial Release

Initial Release

Architecture diagram refreshed (Workflow Engine Human Review + Review Finalizer nodes), README updated with build-154 image load/retag steps and health self-check; IPM package publication enabled.

Add to satisfy missing IPM JSON-tooling dependencies observed in a clean installation.rpds-py
Document IPM's option to prevent stale package code when pip installs into a shared target directory. This option can upgrade dependencies shared with other applications, and old directories may still remain.-extra-pip-flags "--upgrade".dist-info
Use the same Python dependency list for Docker builds and IPM installations.
Add a packaging check for the required dependency.

Initial Release

Initial Release

Initial Release

Initial Release

Initial release of RouteGuard IRIS. Synthetic shipment exceptions flow through an IRIS Business Service, Process, and Operation. An AI Hub agent can recommend a route using a local Ollama model; policy guardrails and a durable audit record make each decision inspectable. Verified on AI Hub Community build 154. Setup and test evidence are in the README.

Initial Release

Improved functionality for iris.script and Docker image and changed %ZPM to %IPM class for the set up.

Initial Release

Many performance on feature updates. See GitHub releases page for the full change.

README: a fresh IPM has no registry, so the install steps now run zpm "enable -community" first.

• Install with IPM: zpm "install iris-inbox-triage" on an IRIS build with AI Hub. The README has the steps, including IPM itself, which the AI Hub image does not include.
• The folder service is enabled only where /data/inbox exists, so a production installed with IPM starts without errors.

ZPM package dependency isolation

• Moved upload-worker Python dependencies from the repository root to requirements/upload-worker.txt.
• Prevented IPM from automatically installing optional document-vectorization dependencies.
• Updated Docker Compose and upload-worker startup paths.
• Added public-package regression tests.
• Updated English and Chinese installation documentation.

This release does not change the medical audit business logic, vector model, or synthetic policy data.

• IMAP inbox: a custom inbound adapter in Embedded Python (imaplib and the email package). Messages are flagged as read only after the service accepted them.
• Review by a person on the Workflow Engine: emails the agent is unsure about become tasks for the Triage Reviewers role in the Workflow Inbox; the reviewer's Alert, Draft or Archive is recorded and routed.
• Precedents on IRIS Vector Search: an AI Hub knowledge base (search_precedents) indexes every decision; a reviewer's decision is re-indexed, and the agent follows it for the next similar email.
• Traceability of the agent (idea DPI-I-689): model and prompt version on every verdict and decision, every tool call audited, the vector search included.
• New sample (a stranger asking for bank details), scripts/review.sh, 24 unit tests.

Initial Release

Initial Release

Version 1.0.5 requires the pinned disposable demonstration service's exact response before recording or saving screencast QA evidence. QA stores only checked demonstration facts, and disposable IRIS CI verifies the real service response and cleanup.

The 1.0.4 private setup-state protections and local operator behavior are retained.

• Release and source download
• Source ZIP
• SHA256 checksums
• Installation instructions
• Historical v1.0.3 screencast (not a v1.0.5 recording)

Initial Release - This is my entry for "Community Bounty Program "Idea to Application" — Round 3" for Idea https://ideas.intersystems.com/ideas/DPI-I-882

Initial Release