The Firewall

Private health data (PHI) never leaves your box. Models flow down, receipts flow up, PHI crosses never.

This is the one rule the whole system is built around. It is not a privacy policy you have to trust — it's a structural property you can verify. Two sides, opposite invariants:

The two sides

LocalDiabetic (the vault, on your NAS)OpenDiabetic (the hive, the cloud/compute)
Records never leave the box.Cloud records never enter a person's vault.
Holds PHI at rest — the only place it lives.Holds open models, templates, non-PHI receipts.
Receives models flowing down.Receives receipts flowing up.

How it's enforced (not promised — built)

1. The reminder engine never reads a record

The Nudge emits only the generic reminder text you declared (e.g. "Time for your foot check"). The medical detail stays in the vault behind a pointer you follow on the box. PHI cannot leak to your phone because the engine never loads PHI in the first place.

2. The edge brain processes PHI in RAM only — never to disk

When the vault sends a note to the on-device model to organize, it exists only in memory for that one request. In the edge brain's code, the only file ever written is a non-PHI receipt ledger. Record content never reaches a disk write, so phi_persisted is structurally always false.

# the only write path in the edge brain
def _append_receipt(rec):       # rec = lengths + hashes + flags, NO content
    with open(LEDGER, "a") as f:
        f.write(json.dumps(rec) + "\n")
# record content is passed to the model in RAM and returned — never to any open(..., "w")

3. It organizes and educates — it never diagnoses

The on-device model is scoped to organize, summarize, and draft reminders. A request to diagnose is refused outright (HTTP 422). This keeps the system a filing cabinet, not a medical device.

4. Only non-PHI receipts can flow up

Every action mints a hash-chained receipt carrying lengths, durations, a model name, and honest flags (phi_touched, phi_persisted: false) — and no record content. These are safe to ship to the hive. The content is not.

Why it matters