Project status

Current goal

Maintain a sourced, application-neutral knowledge base answering the exam question for England and applicable UK-wide law. Include UK GDPR, DPA 2018 and DUAA 2025, and distinguish general duties from conditional requirements.

Research state

The initial research corpus is complete. Sources were checked on 19 October 2026. A second agent reviewed material legal distinctions and current-law wording. Independent legal sign-off and service-specific applicability have not been claimed.

The DSPT follow-up recommends an explicit, mandatory and continuing contract condition for direct receipt of identifiable NHS GP records. A worked recruitment decision distinguishes this recommendation from existing statutory or contractual duties. It uses published NDG advice to explain the separate access-purpose restriction. The main framework remains application-neutral; no actual MOD contract or supplier has been assessed.

DSPT is now a dedicated entry route and an early decision across the overview, exam answer, applicability assessment, operating model and knowledge bundle. Commercial summary claims are tested against official sources. The current annual cycle, public lookup, coverage and audit requirements are distinguished from legal permission. Explanatory prose uses NHS England's “purposes beyond individual care”; the canonical question follows the same terminology. Historical records retain their wording.

The narrative review connects a clear commissioning recommendation to its policy basis, possible statutory route, actual contractual mechanism and operational acceptance record. It identifies GC21.2 precisely, distinguishes processor terms from separate-controller sharing, and clarifies consented uses, anonymisation and contractual necessity. Existing evidence states and the Standard pin remain unchanged.

The requester-readiness research identifies the recipient's duties even where the source provider states no express conditions. It applies the ICO opportunity/special-category DPIA trigger to the stated recruitment flow and distinguishes mandatory assessments and role-specific terms from the recommended evidence pack. Actual documents and any claimed exception remain unreviewed. See before requesting records.

The requester perspective is integrated across the reader routes and portable knowledge. The authoring and maintenance policies now require the same role, duty, timing and evidence distinctions in new content. Stronger wording does not change source authority or establish an actual service's compliance.

See the exam answer, source register, evidence matrix and validation queue.

Technical state

The requested local implementation is complete. Build, content, source-link and rendered browser checks have passed. Browser checks covered desktop and mobile, light and dark themes, native search, exact source-row navigation, diagrams and both graph views. Technical tests do not establish legal correctness.

npm run verify reproduces the complete acceptance workflow. It writes schema-validated results to output/verification/receipt.json and output/verification/conformance-report.json. These generated records report executed checks and gaps. The managed service builds on startup; run npm run build after source edits to refresh its HTML and Markdown publication.

The Standard pin is d339a0e30de41c4a3260f22c00c96898299a1834, version 0.1.0-candidate. The renderer is Zensical 0.0.59; OKF is 0.2. Exact toolchain and dependency versions are retained in the repository. The owner selected a private GitHub source repository and public static Cloudflare Pages publication on 19 October 2026. The canonical public origin is https://healthcare-data-management-wiki.pages.dev/. The source remains private; the rendered research is public.

The light header uses #EBE6ED. Navigation omits lifecycle icons and tooltips while source status metadata remains intact. The conditional DKBWS-HUMAN-003 rule is not applicable under the retained pin.

Wide is the initial desktop mode unless the reader has selected Standard. All prose tables fill their available content rail; horizontal scrolling remains contained where needed. The browser contract checks table-bearing routes, both width preferences, both appearances and mobile layouts.

Publication uses a verified build from the exact commit pushed to the private repository. The public staging check excludes local service identity and build metadata. Cloudflare deployment records identify each published commit; this page does not serve as a live deployment receipt.

Active priorities

None within the requested research and implementation scope. The application-specific work below remains parked.

Recorded technical limitations

• The pinned JavaScript dependency audit reports two low-severity findings in the Mermaid/KaTeX dependency chain. The configured gate rejects moderate or higher findings. The Python dependency audit reported no known vulnerabilities. Dependency upgrades require separate qualification against the pinned renderer contract.
• Native search excerpts can include Mermaid source text after the page prose. Search titles, links and navigation passed the browser checks.
• Automated design lint reports unused-token warnings. Rendered checks passed for the tested typography, contrast and geometry.

Parked work

Known host boundary

Captured response links can be checked before handoff. The host does not expose a mandatory interception hook for every uncaptured response. This is the Standard’s STD-VAL-007 limitation; it does not alter source or legal authority.