docs(webchart): live teatea runbook findings + import zip_code fix#306
Conversation
Executed the teatea trial runbook end-to-end as System Owner. Two outcomes: - Client registration (runbook §§2-3) is MIE-gated: the login_trusts registry is behind the superuser-only JWT screen; WebChart "superuser" is neither the SuperUser role nor the Manage Login Trusts ACL (both set, still gated) but an MIE-issued session unlock; RFC 7591 is off; Application-Entities is DICOM not OAuth. Recorded the finding + sharpened MIE ask in the runbook §3 and the #254 answer log; §5 live evaluation is blocked behind it. - Seed contract verified live: teatea's Chart Data CSV API requires patients.zip_code (12345/12345-6789) on every row (the cause of the first validate run's 451 issues); partition MR + all patients.* columns validate. generate-webchart-import.ts now emits a synthetic demo ZIP. Docs + generator tooling only; no runtime, schema, dependency, PHI, or Outcome Status change (ADR-008). Typecheck green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: de6c43e84c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| > `?f=admin&subfunc=login_trusts`). Please either **(1)** grant my System Owner account SMART/FHIR | ||
| > app-registration access — the MIE-issued Super User unlock password + the FHIR App Editor — or | ||
| > **(2)** register this SMART **Backend Services** client for me: |
There was a problem hiding this comment.
If the owner sends this template as directed, it asks MIE to disclose a privileged master/unlock credential that this same runbook says is reserved for MIE's internal accounts. That grants substantially broader access than the required SMART client registration and creates an avoidable credential-sharing risk; request vendor-side registration or a supported least-privilege delegated app-registration role instead.
Useful? React with 👍 / 👎.
| - **2026-07-16 (teatea trial — live owner walkthrough; runbook §§1–5 executed).** Ran the teatea | ||
| runbook end-to-end as System Owner. Findings: |
There was a problem hiding this comment.
The answer log says §§1–5 were executed end-to-end, but the same entry states that §3's auth probe and §5's live evaluation are blocked, while the journal says the actual upload was also deferred. Readers using this log as the integration source of truth could therefore treat pagination, FHIR representation, and evaluation as live-validated when they remain pending; describe this as a walkthrough with only §1 and §4 validation completed.
Useful? React with 👍 / 👎.
1 participant
Ran the teatea trial runbook (
docs/WEBCHART_TEATEA_RUNBOOK_2026-07-16.md) end-to-end as System Owner in the live instance. This records what we learned and fixes the one code issue it surfaced.Findings
Client registration (§§2–3) is MIE-gated — proven, not assumed.
login_truststable, behind the superuser-only JWT / Login-Trusts screen (?f=admin&s=jwt,?f=admin&subfunc=login_trusts→ "Super user access required").Manage Login TrustsACL — both were set on the account and the screen still gated. Superuser is an MIE-issued session unlock (master password) held by MIE's internal accounts./register+/oauth/registerreturn the login HTML; noregistration_endpoint). The Application-Entities editor is DICOM, not an OAuth registry.mieweb/docssources reached the same conclusion.Seed contract verified live (§4) — generator fixed.
patients.zip_code(12345/12345-6789) on every row — the sole cause of the first Validate run's 451 issues. PartitionMRand allpatients.*columns validate.scripts/generate-webchart-import.tsnow emits a synthetic demo ZIP. Typecheck green.Scope
Docs + generator tooling only. No runtime, schema, dependency, PHI, or Outcome Status change (ADR-008). The synthetic upload +
pnpm evaluate:webchart-liveare intentionally deferred until MIE unblocks registration (no point seeding a population we can't yet read over FHIR).Owner step
Send MIE the ask in
docs/WEBCHART_TEATEA_RUNBOOK_2026-07-16.md§3 "MIE ask" (registerworkwell-backendwith our hosted JWKS, or grant superuser + the FHIR App Editor).🤖 Generated with Claude Code