Add HealthOS bundle privacy foundation

.github/workflows/healthos-ci.yml

@@ -0,0 +1,21 @@
+name: HealthOS checks
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+
+jobs:
+  healthos:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-node@v4
+        with:
+          node-version: "20.x"
+          cache: npm
+      - run: npm ci
+      - run: npm run privacy:audit
+      - run: npm test
+      - run: npm run build

SECURITY.md

@@ -0,0 +1,23 @@
+# Security Policy
+
+## Health Data and PHI
+
+Do not attach real health records, raw exports, screenshots, PDFs, genetic files,
+database files, tokens, or other private health information to public issues,
+pull requests, discussions, or test fixtures.
+
+Use synthetic fixtures only. Good examples are Synthea-generated records,
+hand-authored fake lab results, and intentionally fake source names such as
+`ehr_export_a` or `wearable_export_a`.
+
+## Reporting Sensitive Data Exposure
+
+If private health data or credentials are found in the public repository:
+
+1. Stop sharing the affected branch, PR, or release.
+2. Remove the public artifact or repository history containing the exposure.
+3. Rotate any exposed credentials or tokens.
+4. Replace the example with synthetic data.
+5. Add a regression case to the privacy audit.
+
+Do not preserve sensitive line contents in issue comments, logs, or review notes.

docs/healthos-rfc.md

@@ -0,0 +1,34 @@
+# RFC: Validated Health Data Engine for OpenHealth
+
+## Proposal
+
+HealthOS should enter OpenHealth as a validated health-data engine, not as a
+parallel app. OpenHealth keeps the product surface: onboarding, auth, chat,
+model/provider setup, and community. HealthOS contributes a system-of-record
+layer for staged ingestion, validation, quarantine, source freshness,
+provenance, current views, synthetic fixtures, and source-cited summaries.
+
+## Licensing
+
+Code contributed to OpenHealth is expected to be AGPL-3.0-compatible.
+
+## Privacy Boundary
+
+No private runtime data, raw exports, generated health reports, real fixtures,
+credentials, local paths, personal provider labels, or personal clinical facts
+should be contributed. All examples must be synthetic.
+
+## First Integration Slice
+
+The first code slice adds a `HealthOS Bundle v1` import boundary using the
+existing `HealthData` table. It avoids a Prisma schema migration while giving
+OpenHealth a structured way to ingest validated HealthOS summaries.
+
+The bundle import route stores `type = "HEALTHOS_BUNDLE"` and chat context uses
+a concise source-aware summary instead of dumping raw JSON into prompts.
+
+## Follow-Up Work
+
+After maintainers accept this direction, future PRs can add a stdlib-only
+Python sidecar for the sanitized HealthOS core, then connector families one at
+a time using synthetic fixtures.