Documentation
Enough to check the claims.
This page is for the person who has to decide whether to believe the rest of the site. It says how the products are built, where the numbers come from, and what it leaves out on purpose. It is not a tour of the internals.
One person builds all three products, so they share one set of habits. The habits come from engineering and architecture inside a health plan, and from the facility side across the kitchen table.
The family, in one table
| Shape | Three products, three repositories, three domains, three front doors. They share a brand pack, a design system and a way of working, and nothing else at runtime. |
|---|---|
| Languages | TypeScript for Care and IQ. Provider: Go for the system of record, pricing engine, directory and front door; TypeScript for Provider 360 and every front end. |
| Tests | Care: 748 passing, as reported by its suite on 20 September 2026. Provider: 726 Go and 123 TypeScript, counted on 21 September 2026. IQ: 345 server and 56 web, counted on 1 October 2026. The methods differ, so there is no family total. |
| Continuous integration | Care and IQ typecheck, test and build in CI on every code change to main. Provider's CI covers Provider 360 alone, and fails the build if an internal name leaks into a public document; the rest of Provider runs its suites locally. |
| Access | The same door in all three: an owner-issued token opens a server-side session, sessions are recorded and revocable, sign-in is rate-limited, and the browser holds nothing but an opaque cookie. |
| Browser | Content Security Policy with no third-party host and no framing; scripts only from the application itself, inline styles allowed. Origin checks on state-changing requests. Fonts and assets ship inside each application. |
| Data | Synthetic only. Every environment runs on generated data for a fictional organization. No protected health information exists anywhere in the family. |
| Showing its work | Cite-or-refuse in IQ. A per-claim-line pricing trace and an audit evidence bundle in Provider. Caveats printed beside the number in Care. |
| Standards | FHIR Plan-Net (the HL7 standard for health-plan provider directories) and the QHP file Marketplace plans publish, out of Provider's directory. 42 CFR Part 2 (substance-use record confidentiality) handled at the source in Care. Plain REST and JSON elsewhere. |
| Extension | A second record system in Care is an adapter. A new document family in IQ is an identifier set and an order of authority. IQ's generation model is a setting. None of these is a rewrite. |
| Operations | Each product deploys as its own set of services with a health endpoint, and each front door reports whether every application behind it is answering. IQ meters every model call by token, latency and cost and exports the figures for monitoring. |
| Design | One design system across every screen. Self-hosted fonts. Light first. |
Per product
Meadowlark Care
- Four services, one container and one domain each. The three consoles never call one another server to server; they share a session, not a database.
- Read-only is enforced in code: every query passes a guard that allows one SELECT or WITH statement and refuses write keywords before it reaches the source.
- Nine role lenses are enforced on the server. A lens changes what a page asks for, never what a person may see.
- The one outbound model call is off by default and sends only a de-identified subset of the record.
- Self-run hardening pass on 20 September 2026: no critical issue in the code, no committed secrets, no known-vulnerable dependencies. Its three high-rated findings were deployment settings, all three checked and closed on the live service on 7 October 2026.
Meadowlark Provider
- Four applications behind one door, five services in all, each application with its own database. Cross-application data moves only over the documented interfaces, and the boundary is written down in a contract shipped with the source.
- The system of record is the only place a provider is created or changed. Merges are two-step confirmations; rate-file promotion waits for a logged approval, which the submitting token can also give; directory corrections are governed write-backs.
- The social security number column is under AES-SIV (RFC 5297), matched on but never read back in the clear. It is deterministic by design, so equal numbers encrypt alike.
- FHIR Plan-Net resources and the QHP machine-readable file are produced by the directory today, not planned.
Meadowlark IQ
- One TypeScript service and one web application from the same process. One store holds the corpus and its indexes; a separate store holds only sessions.
- Six stages: scope, rewrite, retrieve, rerank, gate, and generate-and-verify. The trace returned with the answer records each decision, with timings.
- Every model in the stack is open-weight. The reranker already runs as a service the operator hosts; the rest can move the same way.
- Accuracy, refusal and citation figures on this site come from the run of 19 September 2026 over 1,503 answerable and 60 should-refuse questions on the synthetic corpus. Model and cost figures come from a 125-question comparison of five models on 7 August 2026.
What this page does not cover
Left out on purpose, so the omission reads as a decision rather than an oversight.
- The vendors behind each stack, the record system the Care mirror was modelled on, and the names of the models in IQ's catalogue.
- Hostnames, service names, token formats and anything else that would help someone find a door rather than knock on it.
- Corpus internals: how the synthetic contracts were generated and what makes the near-duplicates hard.
- Repository histories, including the earlier prototypes two of the three repositories were assembled from.
If a claim on this site cannot be checked from what is here, write in, and Meadowlark will either show the evidence or take the claim down.