docs/rap_compliance.md

RAP compliance

This repository is organised to meet Gold RAP under the NHS RAP Community of Practice maturity framework. The levels are cumulative — Gold includes everything in Baseline and Silver. The structure also draws on the NHS England repository template and the NHS England "package your code" workshop.

Baseline RAP

Criterion	Status	Evidence
Data produced by code in an open-source language	✅	Python pipeline (src/, agent/, eval/).
Code is version controlled	✅	Git, hosted on GitHub.
README details steps to reproduce	✅	README.md, docs/user_guide.md.
Code has been peer reviewed	✅	Pull request workflow with template + required human review.
Code is published in the open	✅	Public GitHub repository, MIT licensed.

Silver RAP

Criterion	Status	Evidence
Outputs produced with minimal manual intervention	✅	uvicorn app.api:app / python -m eval.run_eval; one-command startup.
Code is well-documented (guidance, structure, docstrings)	✅	Module + function docstrings throughout; docs/ directory.
Well-organised, standard directory format	✅	src/ core, agent/, app/, eval/, tests/, docs/, data/.
Reusable functions and/or classes	✅	NoteGuard, load_known_from_csv(), build_graph() — composable and parameterisable.
Adheres to agreed coding standards	✅	PEP 8, type hints, ruff lint + format (see pyproject.toml).
Pipeline includes a testing framework	✅	pytest suite in tests/ (24 tests; de-id core covered; no external deps needed).
Dependency information included	✅	pyproject.toml — single source of truth; optional extras for the demo and dev tooling.
Logs automatically recorded by the pipeline	✅	LangSmith auto-traces every graph run (LANGSMITH_TRACING=true).
Configuration aids reusability	✅	All settings from environment variables; .env.example provided.

Gold RAP

Criterion	Status	Evidence
Code is fully packaged	✅	pyproject.toml (setuptools, pip install -e ".[dev]", optional extras).
Tests run automatically via CI/CD	✅	.github/workflows/ci.yml — ruff + pytest on 3.10–3.12.
Process runs on event-based triggers or a schedule	✅	CI on push / pull request; agent runs on live query events.
Changes clearly signposted (changelog, releases)	✅	CHANGELOG.md, VERSION, semantic versioning.

Additional good practice

• Pre-commit hooks (.pre-commit-config.yaml) for local quality gates.
• Editor configuration (.editorconfig) for consistent formatting.
• Pull request template and CONTRIBUTING.md documenting the review process.
• Secret hygiene: no credentials in code; .env git-ignored; a detect-private-key pre-commit hook.
• Hard privacy guarantee: assert_clean() enforced at every PHI boundary — the de-id node before the model, and the zero_phi_to_model LangSmith eval.
• Reproducible outputs via the web UI: GET / + POST /process provide a documented, versioned HTTP interface that produces the same clinician output for the same input — satisfying the reproducibility intent of RAP Gold.
• Documented API contract: docs/architecture.md specifies every endpoint, request/response shape, and the assert_clean() guarantee; consumers can reproduce the analysis without reading source code.
• Governance documentation: docs/tool_card.md (Five Safes mapping, bias & fairness statement, DPIA prerequisites) and docs/report.md (gov.uk ATRS record, Tier 1 + Tier 2).