BACKEND
Platform services
backend/app/ separates API routes, audit, canonical schemas, events, exports, identity, products, provenance, rules, validation and work queues.
NHS Sovereign Federated Data Platform · 02 — Software & Deployment
An executable release, not a slide deck
Version 0.1.0 maps the architecture into a conventional open stack, an RTT reference product, versioned contracts, portable deployment files and repeatable tests.
Python 3.12Deterministic engine and platform services
FastAPITyped application and API boundary
PostgreSQLSource, canonical, task, audit and export state
AGPL-3.0+Inspectable network software and modification route
Reference product
Deterministic Referral-to-Treatment and waiting-list validation
The first product proves the full platform route with synthetic records: source preservation, canonical construction, fixed calculation, rule evaluation, idempotent work queue, audit, provenance and export.
Seed source data
Synthetic referral and pathway records enter through a declared source contract.
Validate identity
NHS Number structure is checked; unresolved identity prevents patient-specific action.
Build pathway
Canonical pathway state retains organisation, timestamps, schema version and source links.
Evaluate rules
The demonstration pathway calculates 119 waiting days and applies the fixed RTT validation rule.
Create evidence
One idempotent task, audit trail, provenance links and portability export are produced.
Software modules
The user interface contains no authoritative business logic
| Module | Implemented responsibility | Controlled boundary |
|---|---|---|
| API application | Loads validated settings, typed routes, middleware and database lifecycle. | Requests receive identity, organisation, access and correlation context. |
| Identity | NHS Number validation and explicit unresolved-identity state. | Unresolved identity blocks patient-specific product action. |
| Validation | Named information, warning, review and blocking results. | Invalid records remain preserved; failure is not silently discarded. |
| Canonical data | Stable operational schemas and temporal state linked to source evidence. | Products query governed entities rather than hidden duplicate stores. |
| RTT product | Fixed elapsed-day calculation, validation rule and pathway state. | Rule behaviour is versioned outside the interface. |
| Work queues | Deterministic task keys, ownership, status and idempotent creation. | Repeat execution cannot multiply the same live work item. |
| Audit & provenance | Links trigger, actor, purpose, input, rule, result and source record. | Displayed values and derived states remain traceable. |
| Export | Portable data, schemas, rules, counts, hashes and manifest evidence. | An export is not accepted until opened, validated and re-imported. |
Repository organisation
Executable assets mirror the architecture
PRODUCT
RTT package
products/rtt-validation/ contains its manifest, pipeline, rules and synthetic data instead of hiding behaviour in screen code.
SCHEMAS
Executable contracts
schemas/ contains canonical, pipeline, product and rule contracts that can be validated independently.
FRONTEND
Accessible application shell
Static HTML, CSS and JavaScript provide product views and work queues. Business rules remain in governed services.
MIGRATION
Exit evidence assets
Inventory, chain-of-custody, reconciliation and non-cooperative-exit templates make transition evidence part of the repository.
TESTS
Release contract
API, event, export, identity, release-contract and RTT tests bind the claims to fixed executable behaviour.
Containerised execution
One signed release, multiple controlled environments
The same source can run directly or through OCI containers. Application layers remain replaceable while databases, audit stores, exports and backups persist independently.
CORE PROFILE
Required services
- Nginx static interface and controlled API proxy
- FastAPI platform application
- PostgreSQL operational store
- Health, readiness and liveness checks
- External configuration and non-embedded secrets
OPTIONAL PROFILES
Controlled test services
- Synthetic FHIR R4 connector environment
- OpenID Connect identity test provider
- Containerised pytest runner
- Kubernetes and OpenShift reference deployment
- Alternative-hosting, backup, restore and rollback route
Testing contract
Acceptance requires behaviour and evidence
Fixed starting state
Input, environment, schemas, rules, pipeline and configuration are versioned before the test begins.
Exact expected result
Output, error, audit event and state transition are declared before execution.
Negative coverage
Missing, invalid, duplicate, contradictory, unauthorised and interrupted states are tested explicitly.
Repeatability
The same-state test is repeated and complete outputs are compared, not merely screenshots.
Retained evidence
Command, environment, versions, expected output, actual output and reviewer are retained.
No forced scale
A passing demonstrator does not authorise trust, regional or national deployment without the next evidence stage.