§ A
AI-first
Intelligence lives in the domain. Not in the UI. Not as a wrapper around someone else's API.
Every AI-generated artifact carries a provenance block — model, prompt-hash, tokens, cost, trace, reviewer. A single AI Gateway is the only egress for any LLM call across each platform — model selection, PHI redaction, HIPAA-mode routing, cost ceilings, and moderation are enforced at one boundary and backed by ADRs. Swapping a provider is a config change, not a code change. That's only true if it's designed in from day one.
- Single AI Gateway in eHealth, edTech, Melmastoon, and Intake OS — the only egress for any LLM call. ABAC + API-gateway allow-list keep every other service out of the model network entirely.
- Multi-provider LLM port — switching models is a config change, not a code change. Budget, safety, and provenance enforced at the port, not at the call site.
- Working experience with retrieval-augmented generation, vector retrieval, tool-calling orchestration, on-device inference for offline clients, and AI evaluation pipelines.
- AI provenance metadata is a value object rejected at the aggregate boundary when missing — the domain refuses to persist AI content without it.