Sprint 3.3 · M8 Continuity Network · Multi-Tenant

1. 🎯 Sprint Summary

2. 🚦 Pre-Sprint Gate Checklist

• Sprint 3.2 demo passed (M6 in main)
• Multi-tenancy strategy decided (single-DB row-scoped vs schema-per-tenant)
• Patient consent flow for data sharing legally reviewed (PDPA + cross-clinic)
• Group clinic shortlist confirmed · 3-5 clinics signed LOI for onboarding
• Audit trail extended for cross-tenant access (M9)
• Performance baseline: tenant-scoped query latency < 200ms p95
• Penetration test scope including tenant-isolation drafted

3. 📋 Prerequisites

4. 🧩 Module Scope

• Tenant Model: tenants table · scoped middleware · query global scope · admin tenant switcher
• Row-Scoped Migrations: Add tenant_id to all 50+ existing tables · backfill · indexed
• Patient Consent for Sharing: Granular toggle (encounters · allergies · Rx history · audio) · per-clinic recipient · revocable
• Cross-Clinic Record Fetch: Patient at Clinic B requests history from Clinic A · A receives consent verify · returns scoped bundle · audit both sides
• FHIR R4 Bundle Output: Standard interop format · Patient + Encounter + MedicationStatement + AllergyIntolerance resources
• Network Directory: List of MediEco clinics · contact · specialties · accept-referral status
• Tenant Admin Panel: Filament page · per-tenant config · branding · feature flags
• Pen-Test Pass: Tenant-isolation verified · cross-tenant data leak prevented

5. 🏗️ Multi-Tenancy Model

STRATEGY · Single-DB Row-Scoped (chosen)
Reasons:
  · Simplest ops (one DB, one backup line)
  · Easy cross-tenant analytics (with admin scope)
  · Migration path to schema-per-tenant later if scale demands

Layout:
  tenants (id, slug, name, type, plan, settings_json, ...)
  users (id, tenant_id, ...)         <- existing tables get tenant_id
  encounters (id, tenant_id, ...)
  ...all 50+ tables...

Middleware:
  · TenantScope global scope on all tenant-aware models
  · Auth resolves tenant from user · admin can switch
  · Cross-tenant fetch goes through explicit ConsentedFetch service · NEVER direct query

Audit:
  · Every cross-tenant access logged: requester · subject · resource · purpose · consent_ref

6. 📅 Day-by-Day Plan (10 Days)

7. 📦 Deliverables

8. 👥 Team Capacity

9. 🔔 Sprint Ceremonies

• Wed 29 Oct 9am — Sprint Planning + ADR walk (90 min)
• Daily 9am — Standup (15 min)
• Tue 4 Nov 4pm — Mid-sprint demo + cross-clinic fetch (45 min)
• Fri 7 Nov 2pm — Pen-test debrief (60 min)
• Tue 11 Nov 9am — Phase 3 Closeout Demo (90 min)
• Tue 11 Nov 11am — Sprint Retro + Phase 3 Retro (90 min)

10. 🩺 Doc Zam Sign-off Items

• Consent flow clinically + legally acceptable
• Cross-clinic data sharing scope clinically appropriate
• FHIR bundle clinically meaningful · receiving clinician test reads OK
• Network directory accurate · specialties verified
• Pen-test results acceptable · 0 high · ≤ 2 medium with mitigations
• Phase 3 closeout demo (11 Nov) — written sign-off · go-ahead for onboarding

11. 🎬 Phase 3 Closeout Demo — 11 Nov 9am (90 min)

12. 🛡️ Contingency