Canonical spine specification

Study

Identity: one stable clinical undertaking. Owner: Study Operations.

Field	Type	Cardinality	Rule
id	StudyId	1	never derived from study number
identifiers	Identifier	1..n	unique by issuer + scheme + value
officialTitle	NonEmptyText	1	correction does not change identity
sponsorId	OrganizationId	1	responsibility, not merely funding
kind	StudyKind	1	interventional, observational, expanded access
state	StudyState	1	high-level conduct only
currentVersion	StudyVersionRef	0..1	must reference an approved version
countryIds	StudyCountryId	0..n	membership, not embedded country attributes

Commands: AdoptStudyVersion, IncludeStudyCountry, SuspendStudyConduct, CloseStudy.

Refuses: unapproved version; duplicate country participation; mutation after archive; closure from a non-conduct state.

StudySite

Identity: participation of one Facility in one Study. Owner: Study Operations, with activation decided by Site Startup.

Field	Type	Cardinality	Rule
studyId	StudyId	1	immutable
studyCountryId	StudyCountryId	1	must belong to same Study
facilityId	FacilityId	1	real-world site identity lives outside Study
investigatorOrganizationId	OrganizationId	1	contracting/operating organization
siteNumber	SiteNumber	0..1	display identifier, not primary identity
state	SiteState	1	candidate → selected → startup → active → closed
governingVersionId	StudyVersionId	0..1	required before activation
readinessDecision	SiteReadinessDecision	0..1	retained decision with criteria and evidence

Activation requires an approved governing version, a positive readiness decision, every mandatory criterion satisfied, and evidence for evidence-bearing criteria. “Active” and “open for enrollment” are intentionally distinct.

Participant

Identity: a subject within one Study. Owner: Participant Conduct.

Field	Type	Cardinality	Rule
studyId	StudyId	1	immutable
studySiteId	StudySiteId	1	changes require an explicit transfer decision
subjectNumber	SubjectNumber	1	unique within governed study/site numbering scope
state	ParticipantState	1	projection of accepted decisions, not the evidence itself
effectiveConsent	ConsentDecision	0..1	scope and protocol version are explicit
eligibility	EligibilityDecision	0..1	criterion-level results retained
enrolledUnderVersionId	StudyVersionId	0..1	immutable after enrollment
armId	StudyArmId	0..1	access subject to blinding policy

EnrollParticipant succeeds only when consent is effective, eligibility is positive under the same protocol version, the site is permitted to enroll, and the participant has not already reached a terminal disposition.

SubjectVisit

Identity: one actual encounter occurrence for a participant. Owner: Clinical Data for captured visits; an eCOA or external source may publish an equivalent occurrence.

Required fields: participant, encounter definition, occurrence index, planned window, actual start, actual end, status, reason when missed/cancelled, and source. Repeats and unscheduled visits receive their own identity. A late visit changes window classification, never the planned definition.

DataPoint

Identity: one item occurrence within a form/event/casebook. Owner: Clinical Data.

The current value is a typed union: text, integer, decimal with unit, partial date, coded value, or boolean. Each accepted correction increments revision and retains actor, clinical occurrence time, reason, previous value, and next value. Verification applies to a revision and is invalidated by a subsequent change. Lock refuses while queries remain open.

MonitoringVisit

Identity: one planned monitoring engagement with a Study Site. Owner: Monitoring.

planned → confirmed → in-progress → report-draft → completed, with cancellation possible before completion. Completion requires issued report evidence. An open critical finding blocks completion unless a governed exception policy explicitly permits it.

EssentialRecord

Identity: one regulated record instance fulfilling an expected artifact in a precise filing scope. Owner: Essential Records.

It references an ArtifactDefinition and a DocumentVersion; it is neither of them. Filing scope is a discriminated value: exactly one of study, country, or site. Finalization requires content, accepted quality review, correct classification, and declared finality. A replacement supersedes; it does not overwrite.

Behaviour signature

All aggregate behaviour follows the same semantic shape:

type Decision<State, Event, Refusal> =
  | { accepted: true; state: State; event: Event }
  | { accepted: false; refusal: Refusal };

An accepted action produces a new valid state and one named fact. A refusal is a typed clinical or operational explanation—not an HTTP code, exception string, or UI notification.