diff --git a/docs/commercial/oem-brief.md b/docs/commercial/oem-brief.md index 80ddf04..b0f479f 100644 --- a/docs/commercial/oem-brief.md +++ b/docs/commercial/oem-brief.md @@ -27,12 +27,6 @@ A sealed verified run prints `VERIFIED`, a seal id, and `--seal` on replay is the intended Seal command. `openadapt flow seal` encrypts a bundle for deployment. -The buyer is the technical owner at a vertical software vendor, an RCM -provider, a BPO, or an agent platform. That company already has structured -inputs, business logic, and an exception team. OpenAdapt supplies the last -action in the customer GUI, then a Seal. Health-system IT is a downstream -environment. Do not staff this motion as an IDN RFP. - !!! note "Private pilot. Not a public API." This page describes the private-pilot product contract. It is not an self-service integration recipe and it does not publish partner access, @@ -145,25 +139,27 @@ does not infer a class or an identity from a screenshot, OCR, an application name, parameters, or a model. If the class is unavailable, it uses `record` or `item`. The runner rechecks the real identity before any resumed action. -## Two sales motions - -Do not mix these in one pitch. +## Attended and unattended operation -**Attended.** A person is in session. The runner uses that session. Consequential -writes pause for a signed phone or console answer, then recheck live identity -and state. This is the motion you can sell now. The human remains the legal -actor. A Seal is not a physician signature. +The private pilot runs attended. A person is signed in to the target +application, and the runner acts inside that session. A consequential write +pauses at `decision_required` until an authorized person answers, and the +runner rechecks live identity and workflow state before it continues. The +[attended decisions](#attended-decisions-and-mobile-delivery) section below +describes that round trip. -**Unattended.** Needs a dedicated agent identity, PAM, and session recording. It -does not type a physician password or stuff a physician login. +That person stays the legal actor. A Seal records that the configured +authorization, identity, postcondition, and effect contracts passed for one +run. A Seal is not a physician signature. -Halt UX is the commercial product: who gets the push, what they see, how they -teach one step without invalidating the bundle, and how "click continue" is -refused. +Unattended operation is qualified separately and is not part of the private +pilot. It requires a dedicated agent identity, privileged access management, +and session recording. In either mode, OpenAdapt does not type a person's +password, reuse a person's login, or share a service account. ## Oracle tiers -Charge 2 and 3. Tiers 0 and 1 never mint a production Seal. +Only a tier 2 or tier 3 oracle mints a production Seal. | Tier | What it reads | Production Seal | |---|---|---| @@ -236,7 +232,7 @@ the Seal. Map the receipt fields 1:1. | `execution_id` | The `POST /v1/executions` that produced this Seal | | `workflow_digest`, `workflow_version` | Admitted program | | `qualification_id`, `environment_id`, `runner_id`, `nonce` | Admission, environment, runner, uniqueness | -| `oracle_tier` | 0 visual, 1 second-session, 2 SoR, 3 counterparty | +| `oracle_tier` | 0 visual, 1 second-session, 2 system of record, 3 counterparty | | `outcome` | `verified` / halt / `reconciliation_required` / the other terminal values | | `contracts` | Authorization, identity, postcondition, effect | | `evidence_digest` | Pointer to retained evidence. Bytes stay in the boundary. | @@ -287,12 +283,6 @@ commercial compatibility pack. | OpenAdapt Execute | Private pilot | `POST /v1/executions` issues Seals. Not a new repository. | | Compatibility packs and verifier recipes | Commercial | Per-application and per-environment qualification assets. Bundles are not liquid. | -Embed through Execute and MCP into RCM vendors and agent platforms. Hospital -IT RFPs are not the growth engine. If Copilot or Power Automate already -clicked, OpenAdapt can still emit the Seal when asked. - -The compiler stays inspectable. Settlement is the Seal. - ## Next step [Qualify one workflow](qualification-sprint.md){ .md-button .md-button--primary } diff --git a/docs/commercial/procurement-faq.md b/docs/commercial/procurement-faq.md index 4e00681..9ed3620 100644 --- a/docs/commercial/procurement-faq.md +++ b/docs/commercial/procurement-faq.md @@ -86,15 +86,16 @@ No. The human remains the legal actor. A Seal records that the configured identity, policy, and effect checks passed for that run. **Do you sell attended and unattended as one product?** -No. Attended is the motion you can buy now: human session, phone or console -approve consequential writes. Unattended needs a dedicated agent identity, -PAM, and session recording. Do not mix them in one statement of work. Do not -type a physician password. - -**Are we buying a hospital RFP engagement?** -No. Embed through Execute and MCP into an RCM vendor, BPO, vertical SaaS, or -agent platform. Health-system IT is a downstream environment. IDN procurement -is not the growth path. +No. Attended is the mode you can buy now: a person is in session, and a phone +or console answer releases each consequential write. Unattended needs a +dedicated agent identity, privileged access management, and session recording, +and it is qualified separately. One statement of work covers one mode. +OpenAdapt does not type a person's password. + +**Does this need a health-system IT procurement?** +No. OpenAdapt embeds into your product through Execute and MCP, and your +company holds that integration. The health system is the environment where the +transaction runs. **Can Copilot or Power Automate still do the click?** Yes. OpenAdapt can emit a Seal from another actuator when asked. The diff --git a/docs/commercial/qualification-sprint.md b/docs/commercial/qualification-sprint.md index 1d7c4ac..291e7b6 100644 --- a/docs/commercial/qualification-sprint.md +++ b/docs/commercial/qualification-sprint.md @@ -49,8 +49,9 @@ Days on which access is broken or revoked pause the clock. See the confirmation is oracle tier 0 and never a production Seal. See [effect verification](../concepts/effect-verification.md) and [The Seal](seal.md). -- The sales motion: attended (human session, phone approve writes) or - unattended (dedicated agent identity, PAM). Do not mix them in one sprint. +- The operation mode for the workflow: attended (a person is in session and + answers a pause from a phone or console) or unattended (a dedicated agent + identity and privileged access management). One sprint qualifies one mode. - A security contact for boundary and data-handling questions. ## Exclusions diff --git a/docs/commercial/seal.md b/docs/commercial/seal.md index b442545..86cff56 100644 --- a/docs/commercial/seal.md +++ b/docs/commercial/seal.md @@ -19,16 +19,15 @@ failure: if a consequential tool returns done without a Seal, treat the call as failed. The compiler stays MIT. Record, compile, replay, halt, teach, `openadapt-types`, -local MCP, and Agent Skills stay inspectable. Settlement is the Seal. +local MCP, and Agent Skills stay inspectable. Public verify pages list synthetic and non-PHI Seals. They do not list healthcare production. Bundles are bound to one app build, one farm, one -resolution, one custom screen. Do not publish a public healthcare procedure -npm. +resolution, one custom screen. ## Oracle tiers -Charge tiers 2 and 3. Tiers 0 and 1 never mint a production Seal. +Only a tier 2 or tier 3 oracle mints a production Seal. | Tier | What it reads | Production Seal | |---|---|---| @@ -49,24 +48,20 @@ banner must halt. The store must stay unchanged. A Seal that points at a screenshot hash is a liability. Do not mint production `verified` below tier 2. -## Two sales motions +## Attended and unattended operation -Attended and unattended are two motions. Do not mix them in one pitch. +Attended is the mode available now. A person is already signed in to the +target application and the runner acts inside that session. A consequential +write pauses at `decision_required`. The operator answers from the local +console or the authenticated phone surface. The runner then reacquires focus, +a fresh observation, identity, and the target before it continues. -**Attended.** A person is already in session. The runner uses that session. A -consequential write pauses at `decision_required`. The operator answers from -the local console or the authenticated phone surface. The runner then -reacquires focus, a fresh observation, identity, and the target before it -continues. This is the product you can sell now. The human remains the legal -actor. A Seal is not a physician signature. +That person stays the legal actor. A Seal is not a physician signature. -**Unattended.** Needs a dedicated agent identity, PAM, and session recording. -It does not type a physician password, stuff a physician login, or share a -service account. Treat that as a later motion with its own identity design. - -Halt UX is the commercial product. Who gets the 2 a.m. push, what they see, how -they teach one step without invalidating the bundle, and how "click continue" -is refused: that is renewal. +Unattended operation needs a dedicated agent identity, privileged access +management, and session recording, and it is qualified separately. In either +mode, OpenAdapt does not type a person's password, reuse a person's login, or +share a service account. ## CLI story @@ -107,7 +102,7 @@ on that page. | `environment_id` | environment | The qualified environment | | `runner_id` | runner | The customer-controlled runner | | `nonce` | nonce | Per-Seal uniqueness so a consumer does not need the original request | -| `oracle_tier` | oracle | 0 visual, 1 second-session, 2 SoR, 3 counterparty | +| `oracle_tier` | oracle | 0 visual, 1 second-session, 2 system of record, 3 counterparty | | `outcome` | outcome | `verified`, `halted_before_effect`, `reconciliation_required`, `rejected_policy`, `failed_platform`, or `rolled_back_verified` | | `contracts` | contracts | Authorization, identity, postcondition, effect, required and observed strength, `model_used`, `external_network_used` | | `delivery_uncertain` | delivery | True when a write may have landed | @@ -138,17 +133,10 @@ The partner still validates the Seal the same way: `receipt_id`, ## How it ships -The buyer is the technical owner at an RCM vendor, BPO, vertical SaaS, or -agent platform that already finishes last-mile work in someone else's GUI. -Health-system IT is a downstream environment. IDN RFPs are not the growth -engine. - -Embed through Execute and MCP. One partner is many environments. A hospital -procurement cycle is 12 to 18 months. +A partner embeds OpenAdapt through Execute and MCP. -If Copilot, Power Automate, or another actuator already clicked, OpenAdapt -can still emit the Seal when asked. We do not need to win the chat box. Until -a counterparty demands the Seal, the incumbent keeps distribution. Coexist. +If Copilot, Power Automate, or another actuator already clicked, OpenAdapt can +still emit the Seal for that action when asked. Compile-once is a cache when the job is stable. If a computer-use agent gets cheap, the run still has to prove identity and effect, or halt.