Viewer
Authoritative launch
Direct clinical Viewer access fails closed.
Authorized one-time launch is required.
Intelligent Radiologist · iRad System
Backend Status
AWS staging control-plane and imaging-path status. This page contains operational metadata only; no credentials, authentication artifacts, DICOM content, or patient information.
AWS STAGING OPERATIONAL
CLINICAL RELEASE NOT AUTHORIZED
Session security
Server-bound
Imaging requires authoritative
sessionId.
Legacy HMAC reading sessions have no imaging authority.
Imaging
AWS HealthImaging
Session-bound connection version 1.
QIDO/WADO and DICOM instance retrieval verified.
Next work package
WP-09
Effective Capability Manifest &
Server-Driven Viewer Controls.
Current request path
Authoritative Viewer → Imaging Architecture
Authorized Launch
single-use credential
→
/api/session/redeem
same-origin redemption
→
ACTIVE Session
tenant · site · case bound
→
Viewer
in-memory sessionId
→
/api/imaging/*
sessionId required
→
Immutable Connection
server-resolved v1
→
AWS HealthImaging
private backend path
Implementation progress
Work Packages
WP-01
Inventory & migration verificationCOMPLETE
WP-02
Admin skeletonCOMPLETE
WP-03
Tenant configuration storeCOMPLETE
WP-04
Brand / OEM configurationCOMPLETE
WP-05
Identity / session serviceCOMPLETE
WP-06
Imaging connection registryCOMPLETE
WP-07
Runtime adapter resolutionCOMPLETE
WP-08
Authoritative session-to-imaging authorizationCOMPLETE
Pre-WP-09
Viewer authoritative-session cutoverCOMPLETE
WP-09
Effective capability manifestNEXT
Security state
Verified Controls
✓
Authoritative session required for imaging
Missing sessionId returns
viewer_session_required.✓
Legacy imaging authority removed
A valid legacy HMAC reading session is rejected by imaging APIs.
✓
Client routing authority removed
Tenant and imaging connection are derived server-side.
✓
Cross-tenant substitution blocked
Client-supplied tenant/connection values cannot change the bound route.
✓
Revocation and expiration enforced
Expired and revoked authoritative sessions fail closed.
✓
Audit-safe imaging events
Operational identifiers retained without credentials or clinical content.
✓
AWS adapter healthy
QIDO, WADO metadata and DICOM instance retrieval verified.
●
DICOMweb remains fail-closed
Registered but not runtime-qualified; no AWS fallback.
Current deployment
Staging Baseline
✓
Viewer bundle
main-DuSvn-zO.js✓
Core stack
irad-aws-staging · UPDATE_COMPLETE✓
Viewer origin
Private S3 behind CloudFront.
✓
Backend path
CloudFront → API Gateway → Lambda → private imaging adapter.