# APR / America's Essential Hospitals project example

Version **1.1.1**, 2026-11-05. Browser-first ES modules, with the site's authenticated filesystem handler for persistence.

- [Open the explorer](https://stephenguerin.live/projects/apr/amercias-essential-hospitals/)
- [How this APR project site works](https://stephenguerin.live/projects/apr/amercias-essential-hospitals/how-it-works.html)
- [Project bead](https://stephenguerin.live/agents/2d902480-6bd8-4cbf-8fc8-03e37db08143/about.md)

## Research scope

The November 4 email describes a twelve-week APR contract starting November 16 to develop an evidence base for payment for essential services at safety-net hospitals, with a 20-page report reviewed in January. This site is a working example, not a commissioned study finding.

The explorer compares payment basis, risk allocation, equity adjustment and quality scope. Its hospital data and financial formulas are **synthetic and uncalibrated**. The dimensions interact and are not proven statistically independent. The original draft's precise budget, unsourced statistics and unsupported citation were removed from the public page. No Harvard affiliation or endorsement is implied by the editorial styling.

## APRIL activation

The bottom-corner illustrated avatar opens a keyboard-accessible dialog. A member supplies name and email, confirms APR affiliation and consents to records, then verifies their phone with the existing Twilio Verify service. That service currently supports US/Canadian numbers.

Phone ownership is verified; APR affiliation and name are self-reported, and email is not verified. A roster check is not implemented. The site's preexisting Twilio rate limits remain in force.

1. The browser calls the existing voice service's `login_start` and `login_check`.
2. The browser proves its device key through the existing phone gate and receives a secure HttpOnly sign-in cookie.
3. `POST api/register` requires that cookie and device proof; the server validates the voice session through `profile` and requires the same PRM identity.
4. The existing PRM card is reused. Unknown verified numbers already receive a Blake guest card from the voice service. Registration attaches/reuses a private person bead and deposits a registration record in Blake's private dock.
5. Member state is persisted under the project bead's owner-only `members/` collection. APR affiliation never grants owner/delegate privileges over the site.

## Continuity and write boundary

`api/history` returns only the authenticated member's own conversations and publication events, persisted as files in the person's `apr/apr-aeh/history/` directory. Browser storage is not the source of truth. Verifying the same phone on another device recovers that identity and history.

The first publication suggests `first-lastname`, with a numeric suffix on collision. A custom valid name can be selected. A synchronous directory reservation rechecks availability at publish time. `_owner.json` binds the directory to the verified PRM identity. Future publications may update that directory only; this release assigns one directory per member for this project.

Only scenario parameters and public notes are published. Phone numbers, emails, private history, account tokens, owner records and server modules are never served by this handler. Shared application code and other members' files cannot be edited through the publishing API. The earlier unverified sample directory is not accepted as a member-owned directory and is no longer served.

## Conversation and voice

Web chat calls the dedicated `voice.acequia.org/page/apr-aeh/chat` route with a verified phone session and the last five exchanges. Previous model answers are limited to 2,000 characters for the provider's request contract; the complete answers remain in private history. The [APR project catalog](../projects.json) initially contains this project. Voice-agent has installed membership-gated web chat and a dedicated APRIL telephone agent for **505-447-3474**, with four read-only call tools and no unrelated knowledge base. Only explicitly allowed public project sources enter APR context.

Provider failures return an explicit error; they do not produce a scripted policy answer or a success-shaped fallback. Web history is persisted after a real reply. Voice-call records are maintained by the voice service separately. Caller ID is not authorization to publish.

To enable another APR project, add its catalog entry, isolated voice page configuration and explicit member project grants. Eighteen voice tests, six live denial checks and a real provider response using an in-memory identity fixture passed. Real-member sign-in and telephone audio have not been tested; phone service/provider quotas still apply.

## Hosting

The existing served namespace at stephenguerin.live is live without a build step. [alliancepolicyresearch.acequia.org](https://alliancepolicyresearch.acequia.org/) is a Cloudflare persistent public origin, provisioned by domain-manager. Its explicit asset allowlist excludes private records, handlers and member ownership files. The APRIL widget recognizes `origin: "public-replica"` and links to the original member workspace instead of offering a broken cross-origin registration form. Member activation and writes remain on stephenguerin.live.

Replication is an explicit versioned release, not continuous synchronization. See the [deployment procedure](https://alliancepolicyresearch.acequia.org/DEPLOYMENT.md) and [snapshot manifest](https://alliancepolicyresearch.acequia.org/_deployment.json). The custom agent script carries `data-agent-in-page="APRIL"`, recognized by the site's sidebar scanner so it does not reinsert the unrestricted generic chat.

## Tests

Run from the workspace:

```powershell
node --test stephenguerin.live\projects\apr\amercias-essential-hospitals\test\members.test.mjs
```

Tests use isolated temporary directories and injected identity/provider adapters. They cover unauthenticated refusal, device proof, phone-session mismatch, input validation, suspended members, duplicate registration, person continuity, directory collisions/ownership, public asset allowlisting, script-safe scenario data, per-person history, and explicit provider failure. They do not send SMS or place calls.

## Release record

- **1.1.1:** Public catalog route; completed voice integration handoff; provider-compatible history bounds; activation form waits for original/replica identity lookup.
- **1.1.0:** APRIL corner avatar and guide; verified member activation; private PRM/person continuity; protected history and publishing; real scoped voice chat integration in the voice-agent lane.
- **1.0.0:** initial explorer. Its form accepted an unverified name/phone and its APRIL endpoint returned canned text. Those paths are removed; the previous completion report overstated registration and agent capabilities.

Maintained in the APR project bead. Changes are scoped to this application and its requested voice/domain integrations.