Concept explainer
Running an integration
Describes how a live integration is watched and maintained, through connection health, the message inspector, the unmapped code queue, replay, the kill switch and rotation.
Pensieve hands each live connection to the hospital's operators in Westron, where its health, messages, codes and security signals are read and acted on. This page sets out what each signal means and what the operator does, then covers replay, the kill switch, rotation and a clean disconnect.
States and health
A connection's status records where it stands, as draft, configured, active, degraded or archived, following the lifecycle drawn in anatomy of a connection. Its health is read from the outcome of real calls as healthy, degraded or down, and that outcome moves an active connection to degraded and back. A connection whose kill switch is engaged sits in archived, and its health reads down.
Each connection's card on the health board, and how to follow one exchange from it, is shown in monitoring a connection.
Signals and what to do
Each signal points to the place where it is worked, and most settle once their cause is corrected and the held work is replayed.
| Signal | What it means | What the operator does |
|---|---|---|
| A connection reads degraded | A short run of calls to the system has failed | Open the connection, read its last error class and check the system at the other end |
| A connection reads down | The run of failures has grown long, or the kill switch is engaged | Check the switch first, then the system's reach with the connection test |
| A message held on the bridge | Its delivery attempts ran out before the platform confirmed its write | Work it from the bridge's queue, as the section on replay describes |
| A message held on the platform | It could not be mapped or applied, and its sender received an AE or AR acknowledgement | Read its issues in the message inspector, correct the mapping or the code, prove the change and replay it |
| A parked message | It mapped cleanly, and no route takes its verb yet | Add a verb route for that verb, then replay the message |
| An unmapped code | A code matched nothing in the site overlay or the central base | Resolve it in the connection's Terminology tab, then replay any message it held back |
| A security event | A crossing was refused or looked suspect, such as a cross-site attempt or a write outside the bridge's allow-list | Read it in the Audit panel and confirm which system and bridge it came from |
| An anomaly advisory | One bridge at a site gathered a cluster of cross-site refusals, credential probes or bursts of duplicate messages | Review that bridge's recent security events, and revoke the bridge if its host is in doubt |
| A send settled with an error | Its target refused it, or it could not be delivered within the outbound queue's time limit and size cap | Read the error in the requesting tool or in Westron, and check the target before the work is sent again |
The message inspector
The inspector lists a connection's recent messages without their clinical content. Each row shows the message's outcome, the acknowledgement returned, its type, the identifier its sender gave it, its time, its count of unmapped codes and any fact it raised. A header above the rows shows the connection's acknowledgement rate and how many of its messages are parked or held.
Opening a message shows the mapping, pack and terminology versions that read it, its validation outcome and its route. Decoded clinical values also need the record permission for that patient, and revealing them writes an audit entry first, as opening the patient's record would. An operator lacking that permission sees only a notice that the values are hidden.
Codes waiting for a person
Each connection's Terminology tab holds its queue of unmapped codes, each kept with its code system and the sender's original text. Resolving a code adds an entry to the site overlay under the resolver's name, and the central base stays as it is.
A message whose required code found no match was rejected and held, so a replay after the code is resolved carries it through. How the overlay and the base resolve together is set out in terminology mapping.
Replay
Replay takes a parked or held message through mapping and routing again from its stored raw bytes, once the operator confirms. Why a replay settles on the message's existing record, however often it runs, is explained in from message to record.
A message held on the bridge has no confirmed write on the platform yet, so it is worked from the bridge's queue, as message failure and replay sets out.
Stopping and removing a connection
Engaging a connection's kill switch refuses new intake before anything is written, and its live sessions are closed within seconds. Westron asks for confirmation and names the effect first, and the switch keeps who engaged it, when and any reason given. Engaging it records a critical security event, and releasing it restores service.
A connection leaves service through a clean disconnect, which runs in a fixed order. The kill switch is engaged first, and work already in flight is left to drain. The connection's configuration is then exported with patient data and secrets left out, and its access is revoked. Last, the connection is deleted with its credential reference, and Westron confirms the disconnect.
Each step of that sequence is shown in connections and credentials. A feed retired in a phased move leaves the same way, once staff work its domain in Pensieve.
Revocation and rotation
A bridge whose host is retired, replaced or in doubt is revoked by the holder of the revocation permission, which ends its sessions within seconds. Its successor goes through registration and enrolment as a new bridge.
An operator rotates a partner or provider credential by pinning its connection to the new version in the secret store. A bridge certificate is replaced by a fresh enrolment under the enrolment permission, and authentication between systems sets out both mechanisms.
Alerts and support
Pensieve's own monitoring watches the integration layer and pages its on-call engineer on the first occurrence of the most serious signals. A write outside a bridge's allow-list and a burst of duplicate messages arriving again are among them. The hospital's operators read the same security events in Westron's Audit panel, beside the advisories of the anomaly check described in governance of integrated data.
A fault that needs Pensieve is raised by one of the hospital's authorised support contacts, as getting help describes. Its severity follows the operational consequence for the hospital, under the levels in severity and escalation.
Common confusions
Is a degraded connection still carrying traffic?
It is. Degraded reports a run of failed calls while the connection stays in service, and the connection returns to active as its calls succeed.
Does a replay create a second result?
Each replay settles on the record the message already has, so a message replayed three times still has one result and one integrity record.
What does releasing a kill switch bring back?
The connection returns to active with its mapping, routes and records as they were, and intake resumes. A connection is deleted only through a clean disconnect.
Read who holds each of these duties in roles and responsibilities.