CMS changed a file. Your build noticed.

Does any PHI pass through SourceLock?

It has no reason to. Every tool parameter is public and typed: an NPI, a code, a release id. Logs and receipts carry no payloads, and every receipt states PHI_NOT_EXPECTED.

The guard that enforces this is a structural best-effort refusal of patient-shaped input, not a HIPAA compliance control and not a guarantee. It refuses HL7 v2 and X12 segments, FHIR objects, SSN and MBI patterns, and a date of birth beside a name, before pydantic validation and before anything is logged. A clean scan means “nothing patient-shaped was detected”, never “this input contains no PHI”. hc_source/guard.py lists the evasion classes it does not close, including semantic-only PHI, a lone name or address, and identifiers with no universal shape. And when a legitimate value trips a detector, HC_SOURCE_GUARD_ALLOW suppresses that detector by name so a false positive is a config change rather than an abandoned pipeline.

What about CPT codes?

No HCPCS Level I (CPT) record and no ADA CDT record is vendored, and no AMA- or ADA-authored descriptor text is reproduced. Only the CMS ANWEB Level II master file is ingested, verified to contain zero CPT and zero CDT records.

One honest caveat, because the old wording got it wrong: excluding CPT records and descriptors does not exclude CPT code numbers. CMS writes part of its own Level II definitions as cross-references, so the shipped text of G0317 reads “list separately in addition to cpt codes 99306, 99310”. Seventeen vendored records read that way; they ship exactly as CMS published them, the complete list is named in the DOES_NOT_INCLUDE_CPT_DESCRIPTORS non-claim printed on every codes receipt, and codes.hcpcs_lookup lists the cited identifiers on the record itself. A test re-derives that set from the vendored tables on every run, so a re-vendoring that adds or moves one fails the build until a person decides which kind it is. CPT is copyright the AMA; nothing here conveys a licence to it.

Is a LEIE match proof someone is excluded?

No, and an NPI miss is not proof they are clear either: about 89.5% of LEIE records carry no NPI at all, so leie.check_npi returns a warning telling you to run a candidate search and verify at OIG rather than treat the miss as clearance.

When the snapshot is incomplete or a reinstatement date is populated, the tool returns screen_result: indeterminate and omits the verdict fields entirely. It refuses to answer rather than answer wrongly, because a screen that reads as “not excluded” when it simply could not parse a row is the one failure mode that gets somebody paid on a claim they should not have billed.

What exactly happens when upstream changes?

Doctor compares live canary observations to source-lock.json and exits non-zero with the observed value, the expected value, and the exact remediation. The exit code tells you which kind of problem you have: 1 drift or schema change, 2 unreachable or an adapter error, 3 observed but never pinned, 4 matched but reading out-of-date data. On the founding plan, hosted canaries run daily, you get an alert, and an update PR re-pins the lockfile once you have reviewed the diff.

What is the software license?

The CLI and MCP server are MIT-licensed. Source data carries its own terms, recorded per-adapter in SourceContract.license_notes.