Platform contracts with EDC and eTMF

Contract rule

A public contract is a purpose-limited owner statement, not an exported Aggregate snapshot. Every contract carries schema version, owner identity, source revision or asOf, privacy/blind handling, compatibility period and deprecation policy.

Products never read another owner’s internal state and never mutate another owner through a shared object reference.

Stable reference contracts

Contract	Publisher	Minimum meaning	Explicitly omitted
`WorkspaceReference`	Account & Environment	Workspace identity and current availability	Commercial plan, deployment topology
`StudyReference`	Study Registry	Study identity, Sponsor-aware protocol reference, approved labels, registry availability, source revision	Protocol design, EDC/eTMF state
`StudyCountryReference`	Study Registry	Study Country identity, Study, governed country, availability, source revision	Regulatory approval, product readiness
`StudySiteReference`	Study Registry	Study Site identity, Study Country, canonical Site, site number, availability, source revision	Activation, enrollment, EDC readiness
`OrganizationReference`	Party Registry	Identity and minimum purpose-approved names/identifiers	Access, Study responsibility
`PersonProfileReference`	Party Registry	Identity and purpose-approved display/professional fields	Account, credentials, contact data by default
`CurrentStudyPartyReference`	Clinical Coordination	Participation, Party, Responsibility, Scope and effective interval	Access Assignment or work ownership
`ContentRevisionReference`	Content	Item/revision IDs, digest, media type, current verification outcome and provenance reference	TMF classification or EDC import validity
`EvidenceReference`	Evidence & Audit	Evidence identity, subject fact/decision and privileged retrieval contract	Product decision meaning

Candidate reference contracts

DevelopmentProductReference and StudyInterventionReference remain Candidate until current EDC/eTMF scenarios promote their underlying concepts. They are not part of the stable Proposed Core contract surface.

Decision receipts

`AccessDecisionReceipt`

Contains decision ID, Principal, Product, Action, complete Resource Scope, evaluation time, allow/deny, stable reason, exact Role Revisions/Assignments considered and maximum validity time. A receipt is not reusable for another Action, Scope, target identity/revision or decision time. A mutating owner re-evaluates or validates freshness immediately before its transaction boundary; maximum validity is an upper bound, never permission to ignore Principal, Assignment or Role changes.

`EntitlementDecisionReceipt`

Contains Workspace, Software Product, entitled/not-entitled decision, retained entitlement identity and revision where present, trusted evaluation time and policy version. Infrastructure failure is not represented as not entitled.

Product enablement contract

Request

StudyProductEnablementRequested
  workspaceId
  studyProductEnablementId
  operationId
  studyReference
  product
  expectedEnablementRevision
  entitlementDecisionReceipt
  connectionContractRevision
  requestedBy / authorityDecision
  requestedAt

Product acknowledgement

ProductStudyRootAcknowledged
  workspaceId
  studyProductEnablementId
  operationId
  studyId
  product
  expectedEnablementRevision
  opaqueProductRootId
  productRootContractVersion
  connectionContractRevision
  acknowledgedByConnection
  acknowledgedAt

The product root is unique against the retained studyProductEnablementId. Platform validates coordination identity only. It cannot decide whether an EdcStudy or EtmfStudy is operationally ready.

eTMF seam

EtmfStudy references Platform Study and owns eTMF availability, filing configuration and every eTMF lifecycle. Filing Scope uses StudyId, StudyCountryId or StudySiteId as exact coordinates.

EDC seam

The same shape is a proposed target, not proof that EDC and eTMF roots share lifecycle. Before acceptance, EDC must define EdcStudy root creation, enable/disable acknowledgement, retained-data behavior and EDC Site Participation composition.

EDC composition rules

EdcStudy references StudyId; it is not a subclass or mutable child.
EdcSiteParticipation references StudySiteId and owns EDC enablement/readiness/conduct state.
EDC Subject is product-owned and never a Person Profile.
EDC import may pin an available Content Revision, but EDC owns parse, semantic validation, acceptance and Design publication.
EDC attestation/lock may use Platform actor/signature evidence shapes, but EDC owns statement, prerequisites, signed scope, invalidation and reopen semantics.
Platform Site/Study Site closure never silently closes Casebooks or changes clinical data.
EDC consumes correction facts by immutable IDs and monotonically increasing owner revision, never by matching title, country label or site number.

eTMF composition rules

EtmfStudy references StudyId; it is not a subclass or mutable child.
Filing Scope pins Platform Study/Country/Site coordinates.
TMF Document pins an available Content Revision but owns classification, metadata, document version, associations, finality and quality decisions.
Content availability does not imply TMF quality acceptance or completeness.
Study Milestone influences expectations only through an eTMF-owned, versioned applicability/due policy.
Electronic-signature evidence may be shared, but eTMF owns approval meaning and invalidation.
Disable/entitlement withdrawal preserves retained records; eTMF defines the inspection-mode action matrix.

Correction facts

Every correctable Platform contract publishes:

ownerAggregateId
priorOwnerRevision
resultingOwnerRevision
changed semantic fields with before/after values
effectiveTime and recordedTime
reason category
evidence reference
correlation/causation

Consumers reject revision regression, retain source revision checkpoints and surface gaps for reconciliation. A correction never instructs a product to rewrite its historical facts.

Delivery outcome contract

Outcome	Meaning	Permitted next action
Accepted	Target owner accepted the ordinary target command	Record one receipt; no replay effect
Target refused	Target reached an authoritative business decision	Review/change target state or source proposal; not blind retry
Retryable failure	No authoritative target decision obtained	Retry the identical pinned intent
Contract mismatch	Target cannot interpret exact revision safely	Redeliver under compatible contract or reconcile
Stale/duplicate	Target already applied same/newer owner meaning	Record idempotent/stale receipt
Divergent	Source and target checkpoints cannot be reconciled automatically	Named reconciliation decision

Forbidden contracts

Mutable cross-product Study object
Direct product table access
Generic “object changed” payload without owner fact meaning
Display-label identity matching
Source deletion instruction that automatically deletes target evidence
Transport authentication treated as target-domain authority
“Latest contract” or “latest content” binding without an explicit version policy