01 / request edgeNarrow clinical APIs
Permission, eligibility, consent, and cadence rules enter through reviewable request boundaries.
Django · Django REST FrameworkAlma00
A continuity signal crossing a system boundary
Alma
Clinical systems that had to earn adoption and survive inspection.
Alma is the proof that I can own long-running backend systems where privacy, auditability, adoption, and reliability are not separate requirements. They are the product boundary.
ConstraintHIPAA production
Adoption72% reassessmentsself-reported · internal metrics
Reliability20% fewer errorsself-reported · internal metrics
CurrentSpring Health integration
Privacy enters at the first boundary; each branch returns through an explicit audit gate before becoming an accountable outcome.
01
The consequential problem
The workflow lived longer than any request
Clinical state had to remain correct across time, actors, vendors, and changing requirements.
Reassessments, progress notes, appointment documents, consent, and external audits cross synchronous requests, background jobs, provider workflows, and third-party APIs. A small mistake could become a compliance problem long after the original code path ran.
The challenge was not merely shipping features. It was evolving the system without making clinical operations absorb the risk.
- Cadence and eligibility rules changed while work was already in flight.
- Backfills and reminders could not block provider-facing requests.
- External audit tokens and vendor APIs failed on their own timelines.
02
What I saw
Reliability was a product behavior
The safest implementation was the one operators could understand and reverse.
Feature flags, decomposed pull requests, explicit job state, and observable failure paths made the work reviewable before it became production pressure. That discipline also made adoption easier: clinicians did not have to become debuggers.
03
The decision that changed the system
Move consequence out of the request path
Decompose sensitive workflows into durable, observable, reversible stages.
Django and DRF handled clear request surfaces. Celery owned backfills, reminders, PDF generation, and vendor interactions. PostgreSQL and S3 carried durable state. Datadog made the failure path visible enough to intervene before operators felt it.
01Clinical event
Eligibility, cadence, consent, and prior state enter together.
02Durable workflows
Long-running work moves into explicit background stages.
03Audit boundary
Flags, permissions, and external audit state gate rollout.
04Operator trust
The result is traceable, observable, and safe to reverse.
04
System anatomy / rationale / surfaces
Production anatomy
Sensitive workflows became durable stages with explicit failure and recovery paths.
The architecture optimized for operational clarity: keep provider-facing requests narrow, move long-running work into observable jobs, preserve the clinical state transition, and make rollout reversible.
Decision anatomy / select a knot
Pressure did not decorate the architecture. It determined it.
Before / tension
Documents, reminders, backfills, and vendor calls can outlive a provider-facing request or fail on another company's timeline.
The knot / decision
Keep the clinical API narrow and move long-running work into durable, observable background stages.
After / consequence
The provider-facing path stays responsive while retry and failure state remain visible to engineering.
02 / workflowDurable background execution
Backfills, reminders, documents, and vendor interactions leave the synchronous request path.
Celery · Redis03 / stateDurable clinical records
Workflow state remains queryable and attributable across long-running operations.
PostgreSQL · S304 / operatorObservable rollout
Flags, metrics, and failure context make releases reviewable and reversible before clinical operations absorb the risk.
Datadog · feature flagsArchitecture rationale / pressure → choice → consequence
PressureDecisionWhy it mattered
Provider requests cannot wait on long-running workMove documents, reminders, vendors, and backfills into Celery
The clinical surface remains responsive while failure and retry state stays explicit.
Regulated changes need a narrow blast radiusShip decomposed changes behind reversible flags
Review, rollout, and rollback remain legible to engineering and operations.
A silent failure becomes an operator problemInstrument the failure path, not only throughput
The team can intervene before a clinician has to diagnose the backend.
Surface atlas
The architecture is only complete when every operator and client boundary has a legible surface.
Reassessments
Cadence, eligibility, and prior state coordinate a workflow that unfolds over time.
Progress notes
Provider-authored clinical records preserve permissions and audit context.
Document workflows
Generation, storage, delivery, and retry state remain durable and traceable.
Consent + audit
Sensitive boundaries enter early and remain visible through external integrations.
Third-party integrations
Authentication, data contracts, retry behavior, and audit context are designed for another company's independent timeline.
Application
Python · Django · Django REST Framework
Workflow + data
Celery · Redis · PostgreSQL · S3
Operations
Datadog · feature flags · vendor APIs · background jobs
Technology atlas / select a mark
The tools are evidence only when the choice is legible.
A curated record of where each system earned its place—not a wallpaper of configured integrations.
05
Authentic proof
Reassessments, notes, document workflows, reminders, consent, audit integrations, and observability were treated as one continuity problem.
06
What changed in my operating model
Production changed the meaning of velocity
Move quickly by making the failure mode smaller.
Alma taught me that care and speed are not opposites. A rollout can move continuously when each step is reviewable, measurable, and reversible. That operating instinct now shapes how I design trust boundaries for agent systems.
- Design for the backfill, not only the happy-path request.
- Treat observability as an operator interface.
- Make sensitive rollout state explicit before adding automation.