Part 06Data & state

Version the facts, the reasoning and the human decision.

Praxis does not store “memory” as chat history. It owns explicit longitudinal, workflow, preference and outcome records linked to their sources and effective time.

State ownership

Four data classes; four different trust rules

Authoritative

Source clinical facts remain in EHR/claims/lab/pharmacy systems; Praxis stores identifiers and immutable copies/references.

Derived

Normalized state, features, summaries, embeddings and candidates are versioned and reproducible.

Operational

Workflow, approval and execution state is mutable through explicit transitions and append-only events.

Learning

Feedback, preferences and evaluation results are separately scoped, confidence-rated and expiring.

Boundary

Source systems remain authoritative. Praxis owns a replayable operational projection—and never silently turns inference or clinician behavior into a clinical fact.

Logical ER model

The minimum entities needed to replay “why did this happen?”

Key attributes shown

Identity + scope

tenant

id · name · policy_set_id · created_at

clinician

id · tenant_id · role · active · preferences_version

patient

id · tenant_id · source_identifiers · status

panel_membership

id · clinician_id · patient_id · effective_from/to · attribution_source

Events + longitudinal state

source_event

id · tenant/patient · source · type · occurred/received_at · payload_ref · hash

patient_state_version

id · patient_id · version · as_of · trigger_set · content_hash · status

longitudinal_feature

id · state_version · key/value/unit · baseline · delta · confidence · provenance

evidence_ref

id · source_event/document_version · page · section · chunk · effective_at

Reasoning + workflow

workflow_run

id · type · temporal_id · subject_ids · input_version · status · budget · timestamps

decision_candidate

id · patient/state_version · priority · confidence · risk · status · expires_at · versions

candidate_evidence

candidate_id · evidence_id · claim_id · support_type

agent_run

id · workflow_id · agent/model/prompt version · input/output hash · cost · status

Approval + outcomes

approval_decision

id · candidate_id · clinician_id · decision · edits · reason · decided_at

action_execution

id · candidate_id · action_type · owner · status · idempotency_key · result_ref

feedback_record

id · candidate/action · signal · reason_code · outcome · observed_at

evaluation_trace

id · trace/version · dataset_case · scores · guardrail_result · created_at

Relationship map

Clinical evidence flows forward; provenance flows back

Source event

Immutable input

Patient state version

Normalized truth view

DecisionCandidate

Versioned proposal

Human + action outcome

Accountable result

tenant 1 → N clinicians, patients and policy sets

clinician N ↔ N patients through effective-dated panel_membership

patient 1 → N source_events → N patient_state_versions

patient_state_version 1 → N longitudinal_features and DecisionCandidates

DecisionCandidate N ↔ N evidence_ref through candidate_evidence

DecisionCandidate 1 → N approval decisions → 0..N action executions

workflow_run 1 → N agent_runs; every output stamps all dependency versions

Bitemporal meaning

Record when the event happened and when Praxis learned it; later evidence may supersede earlier evidence without deleting history.

Immutable versions

PatientStateVersion and DecisionCandidate are append-only; a new version replaces active use, not historical truth.

Reproducibility stamp

State, source, agent, prompt, model, guideline and policy versions travel with every candidate and trace.

DecisionCandidate state machine

A recommendation cannot jump directly to execution

Generated

Typed output exists but is not visible.

Validated

Grounding, freshness and safety checks passed.

Queued

Visible to the clinician with named owner and expiry.

Approved / modified / dismissed

A named clinician records the decision and reason.

Executing

An idempotent action request is in progress.

Completed / failed / expired

Terminal outcome is recorded; stale work cannot execute.

Stale-state transition

A relevant new event marks a queued candidate invalid, blocks approval/execution and starts a new version from the affected step.

Idempotent execution

Action execution has a stable key derived from the approved candidate and action version; retries cannot duplicate the side effect.

Safe memory model

Learn the workflow without learning a clinician’s blind spot

Memory typeWhat it meansHow it may influence Praxis

Explicit preference

Communication style, queue ordering or workflow choice stated by the clinician.

May change presentation; expires or can be edited.

Operational constraint

Formulary, staffing, scheduling or prior-authorization limitation.

May change feasibility; must have source, owner and review date.

Clinical disagreement

A recommendation was rejected for a stated patient-specific reason.

Applies only to the scoped patient/context unless reviewed.

Observed pattern

Repeated behavior inferred from several decisions.

Low confidence by default; never silently changes clinical standards.

Outcome evidence

What happened after an approved, modified or dismissed recommendation.

Updates evaluation and prioritization, not guideline truth.

GLP-1 example

Repeated rejection does not become “never recommend GLP-1.” Praxis asks for the reason, scopes it, adds expiry and outcome evidence, and continues to surface guideline-supported care when clinically relevant.

State principle

If Praxis cannot name the source, effective time, version, owner and transition that produced a decision, that decision is not safe to execute.

Workflows Next: Safety, cost & evals