Flag the patient_id PHI dispute and a stale readiness row

Three corrections, none of which resolve a question that belongs to counsel.

- PHI Architecture: the bullets accurately describe an architecture that
  excludes direct identifiers, but they do not establish that Signal is
  PHI-free and were being read that way. An internal account number is one
  of HIPAA's 18 identifiers. context/current-state.md said the opposite
  outright. Both now carry a matching DISPUTED flag pointing at each other,
  with instructions to build to the more restrictive reading until Clyde
  Mathes replies. Deliberately not resolved here.
- Attorney rows named Bittinger/Nixon. The bundle went to Clyde Mathes
  ~2026-07-23.
- Readiness table: it reads 13/13 and "100% pilot-ready" as of 2026-06-16,
  but the row "Demo login / controlled access working: PASS" is contradicted
  by the CLERK LOGIN thread dated 2026-07-07 recording that sign-in fails.
  Added a warning not to quote the percentage externally until that row is
  re-tested. Re-counting a table doesn't help when a row has gone stale.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011bZhDfpTgToFvDX1CDE8oh

CLAUDE.md

@@ -31,6 +31,17 @@ and stays predictable.
   quantity, payer — NOTHING else
 - All logs use hashed patient_id, never raw
 
+**DISPUTED, awaiting counsel (flagged 2026-07-26).** The bullets above describe an
+architecture that excludes direct identifiers, and that is accurate. They do NOT
+establish that Signal is therefore PHI-free, and must not be read that way. An
+internal account number is one of HIPAA's 18 identifiers, so `patient_id` itself
+may be PHI. The attorney bundle sent to Clyde Mathes ~2026-07-23 asks this exact
+question and the answer governs. Until it returns, build to the more restrictive
+reading: treat `patient_id` as potentially PHI. Cross-reference:
+`context/current-state.md` Stack section carries the matching flag.
+Never state externally that Signal is HIPAA compliant, holds no PHI, or needs no
+BAA; see the NEVER-CLAIM list in `docs/build-plans/03-game-center-token-layer.md:51`.
+
 ## Current Stack (Updated 2026-06-22)
 
 - Backend: Railway (Python/FastAPI) — live at <https://signal-api-production-91c2.up.railway.app>
@@ -79,6 +90,16 @@ Whitepaper: `/Users/sttil-solutions/Documents/Obsidian_Vault/STTIL-Vault/Project
 
 ### Checklist Status (as of 2026-06-16) — 100% pilot-ready (13/13)
 
+> **STALE ROW WARNING, flagged 2026-07-26.** This table is dated 2026-06-16 and has
+> not been re-verified since. The row "Demo login / controlled access working: PASS"
+> is **contradicted** by the CLERK LOGIN open thread in `context/current-state.md`
+> dated 2026-07-07, which records that Kisa cannot sign in to signal-ui-xi.vercel.app
+> and that this gates the P6 click-through. Both cannot be true. Until the Clerk bug
+> is resolved or the row is re-tested, **do not quote 13/13 or "100% pilot-ready"
+> to anyone external.** The file's own instruction below says to re-count before
+> quoting a percentage; re-counting is not enough if a row is stale, so re-test the
+> login row specifically.
+
 | Checklist Item | Status |
 |---|---|
 | App hosted behind stable URL | PASS — <https://signal-ui-xi.vercel.app> (deployed 2026-05-29) |
@@ -132,8 +153,8 @@ This checklist tracks compliance gates separately from build readiness. Update i
 | Privacy Policy published at stable public URL | PASS — privacy-policy.md written 2026-06-07; Privacy.jsx deployed to <https://signal-ui-xi.vercel.app/privacy> |
 | FDA CDS exemption memo written and attorney-reviewed | NOT DONE |
 | Supabase plan tier confirmed (Pro vs Team) and PHI posture documented | PASS — Pro plan confirmed 2026-06-10 ($25/mo). HIPAA available as paid add-on on Team ($599/mo) — deferred to post-funding per Real PHI gate. Pro is correct posture for pilot. |
-| Pilot LOI reviewed by attorney | PARTIAL — template ready; Bittinger/Nixon review pending |
-| NDA template reviewed by attorney | PARTIAL — template ready; Bittinger/Nixon review pending |
+| Pilot LOI reviewed by attorney | PARTIAL — template ready; **with Clyde Mathes, bundle sent ~2026-07-23, reply expected within days** (corrected 2026-07-26; the prior "Bittinger/Nixon review pending" note was stale) |
+| NDA template reviewed by attorney | PARTIAL — template ready; **with Clyde Mathes, same bundle, sent ~2026-07-23** (corrected 2026-07-26) |
 | Pilot LOI executed with supplier | NOT DONE |
 | NDA executed with supplier | NOT DONE |
 | Minimum necessary field documentation written (why each of 5 fields is required) | PASS — documented in docs/compliance/data-handling.md 2026-06-07 |

context/current-state.md

@@ -50,12 +50,13 @@ Insight Engine (July 4 deadline = tomorrow) is the active project. Key files:
 - CLERK LOGIN (2026-07-07): Kisa cannot sign in to signal-ui-xi.vercel.app. Observed by CC: the Clerk card shows an email-address-only form (no Google OAuth button) though Google OAuth is configured per stack notes. Gates the P6 click-through. Debug in progress.
 - CONVEX-SIGNAL SPIKE (2026-06-24): design ready (docs/convex-signal-spike-design-2026-06-24.md); separate repo signal-convex; Pi designed. Deps: Kisa's Convex BAA email; repo creation post-approval. Goal: prove Convex on the real product before any platform commitment.
 - DATA-PLATFORM DECISION (2026-06-24): NocoDB leads broke (no-PK, corrupted source). Options: repaired-NocoDB / Supabase / Neon / AWS / Convex. Leads = non-PHI. Informed by the Convex spike. Interim: capture works; 2 test rows un-deletable.
-- LEGAL BUNDLE (2026-07-07): READY TO SEND to Clyde Mathes (signal/pitch/legal/attorney-bundle-2026-07-07, 5 docx + sendable memo; rulings applied: Florida, arbitration, Arkisia Fenn signature; verified against the executed labABLE PDF). Open: LOI 8.4 Partner Concepts carve-out keep/drop, memo already asks counsel about its enforceability. Attorney reply gates the FDA memo ruling, AKS guidance, and any LOI/NDA execution with a pilot partner. (Stale READINESS MODEL thread pruned: P1-P6 complete per ACTIVE.)
+- LEGAL BUNDLE (2026-07-07): **SENT to Clyde Mathes ~2026-07-23 (confirmed by Kisa 2026-07-26); reply expected within days.** Was previously marked READY TO SEND (signal/pitch/legal/attorney-bundle-2026-07-07, 5 docx + sendable memo; rulings applied: Florida, arbitration, Arkisia Fenn signature; verified against the executed labABLE PDF). Open: LOI 8.4 Partner Concepts carve-out keep/drop, memo already asks counsel about its enforceability. Attorney reply gates the FDA memo ruling, AKS guidance, and any LOI/NDA execution with a pilot partner. (Stale READINESS MODEL thread pruned: P1-P6 complete per ACTIVE.)
 - labABLE: CRUSH brief SENT 2026-06-27. Watch for their reply; schedule the follow-up call (Mehul open to the proactive auditor-style play). Internal-only prep at Projects/labABLE-next-call-prep-INTERNAL-2026-06-25.md.
 
 ## Stack
 
-- Signal: PHI contained in `patient_id` (name, MRN, account #s) — tokenization via RAP-ID/CSP-ID (rotating anonymous ID, not static UUID). Real PHI currently BLOCKED/mock — no active exposure.
+- Signal: `patient_id` carries the supplier's internal identifier (MRN, account #). Tokenization via RAP-ID/CSP-ID (rotating anonymous ID, not static UUID). Real PHI currently BLOCKED/mock, no active exposure.
+- **DISPUTED, awaiting counsel (flagged 2026-07-26):** this file previously read "PHI contained in `patient_id`", while `signal/CLAUDE.md:25` states the architecture never stores patient names and that `patient_id` is the sole crosswalk key. Both cannot be true as written. An account number is one of HIPAA's 18 identifiers, and `Barrier-Log.md:16` notes a cipher of an MRN is still derived from identity. **Do not resolve this by picking a side.** The attorney bundle asks counsel this exact question and the answer governs. Until it returns, build to the more restrictive reading: treat `patient_id` as potentially PHI.
 - Signal-api: Railway (signal-api-production-91c2). Signal-ui: Vercel (signal-ui-xi.vercel.app). Supabase: itmospnregdyiatbbdwl (JWT key).
 - Clerk: production key on Vercel + Railway; frontend auth via clerk.sttilsolutions.com; Google OAuth configured.
 - Leads: website form -> n8n webhook (n8n.sttilsolutions.com/webhook/signal-cgm-lead) -> NocoDB (Signal base source corrupted, no-PK; capture works, cleanup blocked). Convex spike + platform decision pending.