CRM minimal change event
Fingerprint + revision + assessment reference. No name, diagnosis, feature, score, explanation, or raw profile.
Business flow · Option B
Profile changes reevaluate only reservations that are not confirmed
A minimal trusted CRM signal converges on the latest revision, clinics receive fair worker time, and the reservation transaction protects existing commitments. Raw profile data never crosses this boundary.
Trust and latest revision
Verify producer, signature, issuer, audience, hash, schema, replay window, and clinic scope. Merge duplicates and mark older jobs stale.
Clinic-fair dispatch
HELD before PROPOSED across clinics, with global and per-clinic concurrency, keyset pages, DB leases, and bounded work.
Fetch current assessment
Resolve the opaque reference at processing time over fixed-host HTTPS. Strict response size, schema, identity, timeout, and concurrency limits.
Atomic state decision
Lock current revision and reservation version. Apply only an eligible latest decision; allocation replacement and outbox write share one transaction.
Outbox and observability
Persist outcome class, minimal audit, and low-cardinality metrics. Never label metrics with tenant, clinic, patient, appointment, or event IDs.
PROPOSED · update
Supersede the current proposal with the latest valid candidate. No active allocation is released.
HELD · keep, replace, or return to proposal
Keep a valid hold; otherwise acquire the replacement before releasing the old allocation. If replacement is unavailable, fall back to `PROPOSED` without duplicate allocation.
CONFIRMED · skip
The customer commitment remains unchanged. A profile event cannot cancel, move, replace, or silently reinterpret it.
Technical failure · bounded recovery
Retry with jitter and elapsed-time caps. Expired leases are reclaimed; exhausted jobs require scoped preview and redrive. Newer revisions make older work stale.
Trust or privacy failure · stop and preserve
Quarantine an encrypted bounded envelope, stop unsafe ingress, preserve evidence, and investigate with security/privacy and CRM owners. Do not turn it into a normal retry.