# Partner onboarding and acceptance

Owner-managed intake is available. Automated signup, production partner approval, vendor certification, and live clinical access are not available in this preview.

## Partner record

- Integration name and vendor:
- Technical contact and support contact:
- Clinic owner and authorized approver:
- Intended use, users, and exact data flow:
- Environment and clinic IDs:
- Requested scopes, with a reason for each:
- Hosting, AI provider if used, retention, and deletion plan:
- Verified connection-to-chart mapping and clinician review workflow:
- Key owner, issue date, expiry, rotation, and revocation procedure:
- Test evidence, release owner, rollback, and incident contact:

## Acceptance checks

- [ ] Read the formal API contract and complete the read contract test.
- [ ] Test approved writes with a separate scoped key.
- [ ] Retry an identical write without creating a duplicate.
- [ ] Reject changed content with a reused request key.
- [ ] Reject an outdated plan revision.
- [ ] Keep a new plan closed until the parent accepts that revision.
- [ ] Use a second workspace to test tenant isolation.
- [ ] Use the sandbox operator's consent revocation action to verify reads stop.
- [ ] Revoke a key and verify further requests fail.
- [ ] Process events with deduplication and a committed cursor.
- [ ] Retain report provenance and require clinician review before chart attachment.
- [ ] Test token redaction, failure handling, and recovery in the integrating application.
- [ ] If using MCP, use read-only mode first and verify write approval in the host.
- [ ] Complete product launch, privacy, hosting, and clinic-specific reviews before real data.

The sandbox operator uses `sandbox/operator.mjs` with the dedicated sandbox service stopped. Its writer lock prevents editing a running store. Provisioning creates a new tenant with `.example.test` identities, random inaccessible account passwords, fictional records, and separate read and write credentials. Deliver credentials privately; do not attach them to this checklist or an issue. Consent and key revocation are operator-only fixture actions. They are not partner API permissions.