By Super Washington BangaRetrospective
Med-Core v1.0Med-Core Sprint 01 — intake pipeline with PHI encryption
Retrospective on the first sprint of Med-Core: the PHI boundary, what the OAuth2/JWT flow taught us, and the three lessons that will shape Sprint 02.
What Worked
- Field-level PHI encryption at the ingestion boundary
- Writing the rate-limit test before the Redis integration
- Reviewing Terraform modules in the same PR as the app code
What Failed
- JWT scope validation lived in the client, not the request middleware
- First deployment to Azure Container Apps missed scale-to-zero
- PHI decryption keys were not rotated before the integration env went live
Key Lessons
- Encrypt at the boundary so the data plane never sees plaintext
- Authorization belongs in the request pipeline, never in the caller
- Deployment review must cover the infrastructure diff, not just code
What shipped
The intake pipeline runs end-to-end against synthetic payloads:
swb-cli generate journal --input intake-notes.txt
Field-level PHI encryption works at the boundary — nothing downstream in the data plane sees plaintext, and the rate-limit test passed before the Redis integration was wired in.
What broke
The first deployment to Azure Container Apps missed the scale-to-zero configuration, so the intake worker stayed hot overnight. Worse, JWT scope validation was enforced in the calling client instead of the request middleware — a client could mint scoped tokens the API never re-checked. Both were fixed in the same week, but only the container fix had a ticket.