Fixed in the latest commit:

Added a Prerequisites section to the README, clearly stating that Kaggle API credentials are required for live dataset downloads.
Bundled a sample CSV (demo/sample.csv) so the demo now works out-of-the-box without any credentials. When credentials are absent, Demo() imports the bundled sample CSV and prints step-by-step instructions for obtaining a Kaggle API key.
With credentials configured, Demo() imports the full uciml/iris dataset from Kaggle as before.
Both states are covered — the importer never fails silently anymore.

IPM package 0.5.0 — install and dashboard fixes.

• Dashboard now matches the live demo: Decision feed & cases / Human review tabs, decision-detail dialog with embedded Flow replay and vector neighbors, calmer polling with a 10s test-action cooldown.
• Admin: anonymous usage analytics and a password-protected admin page.
• IPM install: dashboard files now land in the IRIS CSP directory (${cspdir}) and the /csp/paymentguard web app has its Path set, so zpm "install paymentguard" serves the dashboard correctly. README documents the IPM-client and enable -community prerequisites.
• UTF-8 BOM on the HTML pages so they render correctly even when CSP labels static files ISO-8859-1.

Judge quick path update, 5 November: the hosted viewer now starts with direct read-only links to the completed synthetic refund and retained cited LIVE session1566. Optional fresh LIVE controls no longer overlap the case counters. The README and this description place the judge route first. No new model call, native runtime change, package archive rebuild or budget increase was needed. Viewer/source commit: https://github.com/rafaorlando3/proof-before-pay/commit/dd44d3b182dd0253ab721df986b147a46758ec87 .
Judge access update, 5 November: open https://review.pbp49.78-17-93-244.sslip.io/pbp/ui/ and sign in with the private Viewer name and Access password for this demonstration. No installation, IRIS account, model key or wallet is needed. If the invitation did not include access details, ask the contest organizers or the project owner privately: https://community.intersystems.com/user/rafaelorlando-mendes . Do not use an Open Exchange password or post credentials publicly. First inspect retained session 1566 (five tools, cited policy and intact seal, no payment effect); a fresh fixed-scenario request is optional and only available when the inline status permits. Reading retained examples makes no model call. Current step-by-step instructions: https://github.com/rafaorlando3/proof-before-pay#judge-path .
Beta.4 packages the reviewed Gemini 3.5 Flash-Lite fixed-scenario profile, medium reasoning and a 4096 output bound. The provider project, key, transport, cost ceiling, quotas and earlier uncertain reservations are preserved.
The first valid cited LIVE qualification completed on the VPS in session 1566: three normal HTTP200 tool/decision turns, five real tools, three integrity-checked local AI Hub RAG/FastEmbed/IRIS Vector Search passages and a returned chunk cited inside an intact decision seal. The amount-conflict proposal went to human review. Six persisted native headers link Intake, Process, Agent, Witness and Workflow. No retry, JSON repair, permit, receipt or financial effect occurred. This is one integration qualification, not a general quality advantage or awarded bonus.
After final review, the existing bounded public route was explicitly enabled. Fresh requests remain subject to native readiness, provider capacity, the preserved cumulative US$5 ceiling, fifteen HTTP requests and five decisions per provider day, three normal HTTP turns per case, and the existing pacing. A failed attempt disables further admission or leaves it blocked for reconciliation, while retained examples remain available. Reading a retained case makes no model call. No second operator qualification case was executed.
Native source load, export and archive installation of beta.4 passed in an isolated initialized VPS copy: 47 classes, seven Embedded Python imports, 34 installed assets and 15 Runtime/dependent method bodies matched. Keys were blank, network disabled and Production/LIVE/RAG off by default. The exact public beta.4 archive (296 source files equal Git9b2ee09) was then installed natively offline in that copy. This is not a fresh vendor bootstrap or a native registry network fetch. Older beta/r6 artifacts and uncertain holds remain preserved.
Package source: https://github.com/rafaorlando3/proof-before-pay/commit/9b2ee09328f22486ead606b0442d4d9cb345dc9e
Valid LIVE evidence: https://github.com/rafaorlando3/proof-before-pay/blob/main/docs/validation/live-gemini35lite-1566-20261105.json
Explicit public enable: https://github.com/rafaorlando3/proof-before-pay/blob/main/docs/validation/live-bounded-public-enabled-20261105.json
Public archive/native evidence: https://github.com/rafaorlando3/proof-before-pay/blob/main/docs/validation/IPM-beta4-public-artifact-20261105.json

• Published as an IPM package: zpm "install iris-lab-triage-agent" (requires the AI Hub EAP build 154 image, since the code uses the %AI classes)
• Added module.xml with unit tests runnable via zpm "iris-lab-triage-agent test"
• README: demo video, IPM install section and Community Idea DPI-I-689 link
• Removed stale comments about features that are not part of the MVP

Initial evaluation release for IRIS Community AI Hub 2027.1.0AI.109.0.
CSV/JSON inventory imports, inventory-derived CPSC retrieval, versioned advisory feeds and opt-in recurring audits. Genuine manual and scheduled native AI Hub investigations are documented. Existing inventory systems retain action authority.
API-key-free retrieval and a separately labelled recorded AI course are available. EAP and derived images are not distributed. Public IPM registry publication and installation will be checked after approval.

Initial Release

Initial Release

Incidents
When a partner's dates are valid read either way (11/05 could be November 5 or May 11), the dry run now says which reading OcuTalon chose, and why: "All 50 dates are valid whether read month first or day first. Read month first, they match the day each order arrived." The line shows on the incident card and in the notices on the simulated phone, Telegram and the simulated mailbox.
When nothing in the data settles the reading, OcuTalon explains the cause and doesn't propose the repair.
In our checks with Claude Haiku 5.5, 5 of 5 runs of the demo incident with dates that read both ways proposed the repair with month-first evidence.
Settings
Admins (the OcuTalonAdmin role) get a Settings page from the header. Check thresholds, such as the disk and journal free space that counts as a problem, and Demo mode can be changed there. Each save is recorded in the IRIS audit log and applies within a minute, without a restart.
The other sections (Models, Budgets, Channels, Daily digest and Time zone) say so until later releases fill them in.
After you save Demo mode, reload the chat page after a minute to see the change.
Docs
The README links the community idea OcuTalon implements, and shows each screenshot once.

Requires the InterSystems IRIS for Health AI Hub Early Access image, build 154 (build 109 also works; see the README). Upgrading from 1.0.0 keeps your conversations, reminders, watches, approval requests, settings and Telegram pairing. The online demo runs 1.0.1.

Initial Release

Initial Release

Initial Release

Initial Release

Initial Release

Initial Release

Native AI Hub review and evidence-based investigation

This update connects Armada Battery’s operation receipts to an InterSystems IRIS interoperability workflow using AI Hub.

Added

• Agent review that evaluates rule accuracy and observed results separately.
• Deeper investigation when evidence is incomplete or contradictory.
• Read-only evidence probes and deterministic checks for the final disposition.
• Inspectable case histories, including model responses and supporting evidence.
• Persistent recovery states for interrupted reviews.
• Per-operator access controls and review-count limits.

Improved

• Duplicate requests return their existing records.
• Interrupted cases remain visible for investigation.
• Phone and desktop case views expose review status and recovery actions.
• Documentation distinguishes synthetic tests from connected IRIS demonstrations.

Fixed

• Non-ASCII access keys causing sign-in errors.
• Expired sessions leaving previous case details visible.
• Late responses restoring information from an expired session.
• Blocked browser storage interfering with logout.
• Malformed request origins causing server errors.

Verification

The latest application check passed 86 Python tests and 13 UI tests, plus phone and desktop browser checks and four HTTP checks against the installed application.

Earlier native qualification covered lifecycle recovery, duplicate completion, usage limits, container restart, and connected AI Hub review. Evidence and measurement boundaries are included in the repository.

Compatibility and scope

The agent workflow was tested with IRIS AI Hub EAP build 109. It requires the EAP setup documented in the repository; the earlier listing’s IRIS compatibility check does not establish AI Hub compatibility.

This remains an experimental release. Broader management workflows and production deployment require further qualification.

Source and setup — contest-49-wip

Latest verification report

Beta.3 packages the reviewed native source restoration/rebinding and Gemini 3.6 support, plus a dedicated demo guard that prevents JSON-repair calls after invalid model output. The bounded demo output default/upper limit is now 4096; reasoning level and cost reservation remain unchanged. This is not a promise that a future model response will fit.

Native source load, package export and archive installation passed on an isolated initialized VPS test copy: 47 application classes, seven Embedded Python imports, 34 installed files matching the candidate and ten changed Operation method bodies checked against source. Provider keys were blank, network was disabled, the pinned RFC8785 wheel was supplied offline, and no model or blockchain call occurred. Production remained stopped; LIVE and policy retrieval were disabled by default. This is not a new vendor bootstrap or a native public-registry fetch.

The public demo remains recorded. One real qualification observed five tools, including three verified local policy passages, but its JSON decision was truncated and refused. After the correction, one new 4096 qualification returned provider503 before content. No valid cited LIVE decision, online-demo bonus or measured quality gain is claimed. All uncertain reservations and the beta.1/beta.2/r6 historical evidence are retained.

Source: https://github.com/rafaorlando3/proof-before-pay/commit/953d96d
Native package evidence: https://github.com/rafaorlando3/proof-before-pay/blob/main/docs/validation/IPM-beta3-native-20261105.json
Current demo evidence: https://github.com/rafaorlando3/proof-before-pay/blob/main/docs/validation/live-output4096-20261105.json

Initial Release

Initial Release

Initial Release

Initial release: JSON examples and test data for WS/T 846-2024 hospital integration messages, with Java XML/JSON converters and Python generation scripts. Three representative JSON samples were parsed using InterSystems IRIS for Health 2026.2; this validates JSON parsing only, not an IRIS integration workflow.

Low-confidence decisions now reach a person in the BPL process too, whatever the action (before, only the first matching case of a switch ran). LookupContact matches a sender by domain only for company domains, not for gmail.com and other shared mail providers. An IMAP poll stops before its batch would pass the IRIS string limit, and the rest is read on the next poll. Reinstalling or upgrading with IPM keeps the contacts already there. New screenshots: the BPL diagram, and the trace of an email read over IMAP with the agent's verdict.

user _system and SYS login

Explore why a technically valid order is held with an interactive, clearly labeled synthetic walkthrough. Switch between an unsupported unit change and an effective approved amendment, select each investigation stage, or open the real workbench. Quick navigation supports ⌘K / Ctrl+K and complete case IDs; detail transitions respect reduced motion. Both technical articles are public and linked.
The unchanged native backend 0.2.0 passed two fresh public install silentshift checks, full native tests, recorded replay and five live local-model scenarios on official ARM64 build 154U. The frontend version is 0.2.1. The online-demo bonus is not claimed because the displayed EAP licence excludes demonstration use. Bug reports are drafts, not filed or accepted.

Initial Release

Trace each local AI Hub provider exchange in its business-case Visual Trace, with provider/model/prompt version, operation timing, available response tokens and safe HTTP errors. Add an explicitly labeled no-key recorded-provider example through the same queued operation, native agent and four read-only tools; deterministic policy keeps the critical synthetic order held. Package 44 classes and ten assets with IPM 0.10.10 requirements. Verified on official ARM64 2026.3.0AI.154.0 (154U): five live final routes passed; the corrected native suite and fresh-source replay passed. README includes reproducible commands and a fair Langfuse comparison. Native message-body screenshot is still pending administrator access; graph captures and metadata exports are available.

README: a link to the article on the Developer Community, and a precise note on which low-confidence decisions go to review. No code changes.

Beta.2 adds optional native policy retrieval with AI Hub RAG and IRIS Vector Search, observed-passage citation checks, and our SolanaMemo outbound adapter. The adapter was tested once on devnet with a sealed fail-closed decision: one Memo instruction, no transfer; disabled without explicit configuration.

Native source load, package export and archive installation passed in an isolated initialized licensed build154 lab: 47 application classes, seven embedded-Python package imports and 34 installed Python/assets/guide files matching the archive. This is not a fresh independent vendor installation. The operator guide and optional dependency lock now ship in the package. Normal installation starts no Production and leaves LIVE and policy retrieval disabled.

The bounded fixed-scenario fresh-decision integration remains paused after a provider timeout. Recorded examples remain available; no successful new LIVE generation or online-demo bonus is claimed. Uncertain reservations and all historical evidence are preserved.

Evidence: https://github.com/rafaorlando3/proof-before-pay/blob/main/docs/validation/IPM-beta2-native-20261103.json
Adapter: https://github.com/rafaorlando3/proof-before-pay/blob/main/docs/validation/solana-memo-devnet-20261103.json
Policy retrieval: https://github.com/rafaorlando3/proof-before-pay/blob/main/docs/validation/policy-rag-native-20261103.json

Initial release for the "AI Agents in Interoperability Workflows" contest.

• Triage of HL7 v2 ORU^R01 lab results on IRIS for Health Interoperability
• Deterministic critical-value rule runs before the AI Hub agent; the alert never waits for the LLM
• %AI.Agent (Gemini) decides RELEASE or HOLD_FOR_REVIEW for abnormal results, with a minimal sanitized payload and a validated JSON contract
• Human review through the Interoperability Workflow Inbox (Release / KeepOnHold)
• Every LLM call visible in Visual Trace with prompt version, tokens and latency (Community Idea DPI-I-689)
• REPLAY mode by default: runs without an API key
• 96 %UnitTest tests plus end-to-end scripts
• Built on AI Hub Early Access build 2026.3.0AI.154.0

Initial release: native IRIS AI Hub investigation, deterministic containment, Workflow review, vector precedents and partner-file intake. Verified on build 154U; see the source evidence guide and captioned demonstration.

MyOwn Portal 1.1.0

Release for the InterSystems Programming Contest "AI Agents in Interoperability Workflows". 1.0.3 was a compact administration portal for InterSystems IRIS and IRIS for Health; 1.1.0 adds an AI agent that works inside an interoperability production. The agent decides and proposes; a person confirms every change with their own credentials.

• Online demo: http://163.176.71.47:52774/myown/index.html (user demo, password demo; replay mode)
• Video: https://www.youtube.com/watch?v=q7SpKb9q8BE
• Developer Community article: to be added before release

What changed since 1.0.3

An AI agent inside an interoperability workflow

• New production MyOwn.Production.Main. Business Services turn health anomalies, failing tasks, serious log entries and role requests into events. Business Processes ask the AgentGateway operation for a decision, run the Gate and store the proposal. Every step leaves a message or an Event Log entry with the trace id.
• Two decision engines behind the gateway. The AI Hub engine (%AI.Agent with a read-only ToolSet, an allow-list authorization policy, an audit policy and its own deadline) runs on IRIS AI Hub builds. The Rules engine is always available. When AI Hub is missing, there is no key, the kill switch is on, the budget is spent or the provider fails, Rules decide, and the reason is recorded and shown (for example Rules (provider_timeout)).
• The agent's tools are read-only class queries (GetTaskRuns, GetMetricHistory), and the ToolSet excludes every tool whose name does not start with Get.

Guardrails: the agent never writes

• Validator. The model output must be one JSON object that matches schema v1: strict types, allow-listed fields and actions, bounded text, targets taken only from the candidates the server supplied. 92 hostile model outputs are in the adversarial test corpus.
• Gate. Kill switch, read-only mode, prohibited targets (for example the %All role), high-risk decisions downgraded to escalation, one open proposal per target and action, and cooldown. The token budget is enforced separately (MyOwn.Agent.Policy.Budget, called by the agent service); over budget, Rules decide.
• Human confirmation. A state change exists only as a proposal that expires. Confirming it revalidates everything: state, expiry, separation of duties (a requester cannot confirm their own request), prohibited targets, the target fingerprint (TARGET_CHANGED) and the confirming user's live permission. The change is then executed with that user's credentials, read back and audited (MyOwn/Agent/*).
• Untrusted text (log lines, task errors, justifications) reaches the model only inside delimiters, sanitized.

Replay mode

• MYOWN_AI_MODE=replay answers from real model decisions recorded earlier (Gemini gemini-3.8-flash and gemini-3.5-flash-lite), one fixture per scenario in aihub/fixtures/, each with its provider, model and recording date. It needs no key and no network, and the screen says "Replay of recorded real decisions". A scenario without a recording falls back to Rules (replay_missing); nothing is invented.

Demo mode and the demo user

• MYOWN_DEMO_MODE=1 makes the portal safe to expose. The demo account (role MyOwnDemo) can view the portal, run the scenarios and confirm or reject proposals; it has no IRIS administration privilege.
• Confirmations change only synthetic targets (demo tasks, users and roles) and end as simulated; IRIS itself is never changed. Routes that would change the real system are off for everyone. A reset task and a "Reset demo" button restore the synthetic state, and scenarios are rate-limited per client and session.
• The demo password is generated by scripts/New-DemoPassword.ps1 into the git-ignored .env (MYOWN_DEMO_USER_PASSWORD) and never printed. Without it the demo account stays disabled.

Custom inbound adapters

• TaskWatcher and LogWatcher use the portal's own adapters, MyOwn.Production.Adapter.TaskHistoryInbound and LogEntriesInbound (both Ens.InboundAdapter), with their settings in the production: TaskNamespace, HistoryRows, FailureThreshold, MinSeverity, MaxEntries.

Packaging and installation

• One IPM module, myown-portal. The AI Hub engine is part of it and is compiled only where the %AI package exists; elsewhere the portal runs on Rules. The registry package contains no test classes.
• Installing into a namespace without interoperability enables it first (MyOwn.Bootstrap). The agent production is set to start automatically and starts once the install finishes. Uninstalling stops it and removes the web applications and classes; roles, resources and data are kept.
• Docker for IRIS AI Hub build 2026.3.0AI.154.0. The image build sets the production to start at boot, so a new installation has no error in its Event Log. An incomplete installation never starts. The ports are published on 127.0.0.1 only by default.
• scripts/Test-All.ps1 runs every test suite, prints one table and exits with 1 when anything fails.

The portal itself (Overview with an Embedded Python health score and a Vector Search nearest-pattern match, Logs, users and roles through SysAdmin API v2, tasks, web applications, API explorer) is unchanged in purpose and still works without the agent.

How to install

Docker with IRIS AI Hub build 154 (recommended for the agent)

Load and tag the build 154 image once per machine, copy .env.example to .env (set your own MYOWN_DEMO_PASSWORD, and a key, or MYOWN_AI_MODE=replay), then:

docker compose -f compose.yaml -f compose.aihub.yaml up --build -d

Open http://localhost:52774/myown/index.html. The README has the full steps, the memory needed (tested with WSL limited to 8 GB on a 16 GB machine) and how to verify the installation.

IPM

When 1.1.0 is published in the community registry, in the namespace where the portal should live:

zpm "install myown-portal"

Until then the registry has 1.0.3; to install 1.1.0 from a clone, zpm "load /path/to/Portal-Iris".

Known limitations

• Only the Gemini provider was used for real calls (gemini-3.8-flash and gemini-3.5-flash-lite, free tier). OpenAI, Anthropic and Bedrock go through the same %AI.Provider path but are untested.
• Gemini free-tier latency was 12 to 83 s per decision, against the portal's 20 s default deadline, so live decisions often fall back to Rules (provider_timeout). The provider also retries HTTP 429 and 503 on its own before reporting them. The online demo therefore uses replay mode.
• The S3 replay fixture comes from an earlier call with an equivalent, not identical, context (its header says so). The other scenarios use their exact context; S2, S4, S8 and S9 were recorded with gemini-3.5-flash-lite after gemini-3.8-flash timed out or answered 503 "high demand" on three re-recording attempts, and its S3 answer (ignore instead of a resume proposal) was not used.
• The IRIS edition of build 154 was not tested; only IRIS for Health.
• A viewer (MyOwnViewer) cannot file an access request: SysAdmin API v2 refuses it even its own account. The portal answers with a clear 403 and administrators file requests.
• The image build needs about 2.3 GB inside the Docker VM at its peak, and loading the image archive also needs memory; with other programs open, Windows can run low.
• The UI test suite needs Node.js; without it Test-All.ps1 skips that suite.
• The default _SYSTEM password in .env.example is a well-known local convenience value. Change it before exposing the portal.