GLHS: A Co-Versioned Disclosure-to-Commit Governance Contract for Longitudinal Health AI

1. Introduction

Longitudinal records are difficult for reasons that go beyond retrieval. A fact may be clinically valid at one time and only become known later. Another source may disagree with it. The same information may be appropriate for one task or actor but not for another. A system can therefore retrieve something relevant and still show the AI the wrong historical state, or more of the record than the current use permits. The difficulty does not end when the model finishes reasoning: the record, consent state, or policy may change before the model’s proposal is written back.

The components needed to handle these problems are well established. Medical database work separates valid time from transaction or knowledge time [1,2,3]. FHIR Provenance and Consent represent lineage and policy-relevant information [4,5], and FHIR HTTP supports version-aware updates [6]. openEHR maintains versioned EHR content and reconstructable contributions [7], while W3C PROV provides a general provenance model [8]. Zhao et al. [9] already describe bitemporal, supersession-aware, conflict-preserving state arbitration for longitudinal health AI, and related systems address persistent patient state, reconciliation, and provenance-linked timelines [10,11,12].

Recent agent-memory work covers much of the same ground from a different direction. MemTX couples transactional commit with evidence, permissions, provenance, and validity [13]. MemTxn moves update validation, temporal conflict handling, and recovery outside the answer model [14]. MemClaw addresses scoped retrieval and policy-governed propagation [15], while HealthClaw applies privacy-aware memory selection to longitudinal personal health management [16]. These papers make temporal state, governed memory, and transactional write control part of the prior-art baseline for this study.

Our question starts one step later. Suppose an AI has already received an authorized disclosure and then returns a proposal that would alter persistent state. A matching base version alone does not tell us which governed disclosure supplied the evidence and policy context for that proposal. GLHS keeps that relationship explicit across the two operations.

In GLHS, the disclosed snapshot remains part of the proposal’s admission context. Before commit, the service also checks whether the relevant state, authorization, consent, policy, and expiry conditions still hold. The work therefore concerns the way existing mechanisms are joined across the read and write boundary; it does not present bitemporality, provenance, consent enforcement, conflict preservation, task-bounded disclosure, or optimistic concurrency as separate inventions. For the snapshot-bound mode studied here, the operative invariant is that proposal admissibility requires an exact match to the persisted disclosure identity and digest together with governance that remains valid at commit.

Table 1 summarizes the relationship between these established mechanisms and the GLHS contract evaluated here.

2. Materials and Methods

2.1. Design Scope and Governed Longitudinal Substrate

GLHS represents a system view that is evidence-backed and permitted for the current use. It is not meant to stand in for an unquestionable biological truth. Evidence, events, assertions, state, transitions, conflicts, and projections remain separate so that provenance and uncertainty are not flattened into the current view. State can be reconstructed at clinical valid time $t_v$ and semantic knowledge time $t_k$. Database write time stays in the audit trail; it is not substituted for knowledge time.

For subject u, we write the governed state as $S_u(t_v,t_k)$. Assertions retain their provenance, epistemic status, and lifecycle. Conflicting assertions can remain visible together until a resolution becomes valid and known. This is the state from which a governed disclosure is compiled.

$$S_u(t_v,t_k)={\mathrm{GovernedView}}_u(t_v,t_k).$$

(1)

2.2. Task-Bounded Health State Snapshot

THSS is the governed object produced on the read path. Besides the selected content, it stores the coordinates needed to reproduce what the AI was allowed to see. We write a snapshot H as:

$$H=\langle u,a,r,\varphi ,\tau ,v_s,v_{\pi },v_c,t_v,t_k,{\mathrm{id}}_H,d_H,E_H\rangle .$$

(2)

In Equation (2), u identifies the subject or profile, while a and r identify the actor and role; $\varphi$ and $\tau$ denote purpose and task. The snapshot also records state version $v_s$, policy version $v_{\pi }$, consent/governance version $v_c$, and the valid- and knowledge-time cutoffs $t_v$ and $t_k$. ${\mathrm{id}}_H$ names the persisted snapshot, $d_H$ is its consistency digest, and $E_H$ is the disclosed content. In the implementation, canonical bytes are produced using a project-defined canonicalization profile and hashed with SHA-256. The profile sorts object keys, preserves array order, emits compact UTF-8 JSON, normalizes timezone-aware datetimes to UTC and negative zero to zero, and rejects unsupported or non-finite values; it is not presented as RFC 8785.

Canonicalization is applied before digest persistence. The manifest records schema glhs.snapshot.v3, payload schema glhs.snapshot.payload.v3, the digest algorithm and canonicalization profile, and validation fails closed if these values or the recomputed digests disagree. Strict model-facing disclosure additionally records the consent basis, expiry, assertion identifiers and hashes, evidence identifiers, and an opaque profile scope.

2.3. Snapshot-Bound Persistent Proposal and GST

The model is not given unrestricted write access. Instead, it returns a persistent proposal P:

$$P=\langle u,a,r,\varphi ,\tau ,v_s,v_{\pi },v_c,{\mathrm{id}}_H,d_H,\Delta ,\rho \rangle .$$

(3)

$\Delta$ is the proposed change and $\rho$ records proposal provenance, including a model-manifest reference when applicable. The gateway supports a base-version-only path as well as snapshot-bound proposals. This paper evaluates the stronger snapshot-bound path. At the manuscript freeze, however, the service does not yet enforce a provenance-sensitive rule that forces every model proposal derived from Strict THSS to remain snapshot-bound after review. We therefore do not claim downgrade prevention: the exact-binding claims in Equations (2)–(4) apply to proposals submitted through snapshot-bound mode.

$$\begin{array}{cc}\hfill \mathrm{Commit}\left(P\right)⟺& \mathrm{Bound}(P,H)\wedge \mathrm{StateCurrent}\left(P\right)\hfill \\ \hfill & \wedge \mathrm{GovernanceCurrent}\left(P\right)\wedge \mathrm{SnapshotValid}\left(P\right).\hfill \end{array}$$

(4)

$\mathrm{GovernanceCurrent}\left(P\right)$ groups the authorization, consent, and policy checks. $\mathrm{Bound}(P,H)$ fails when the proposal does not agree with the snapshot on profile, actor, role, purpose, task, base state version, snapshot identity or digest, or the declared evidence set. During commit, the gateway obtains a FOR UPDATE lock on the profile row, rechecks the base state, rereads current consent, compares the frozen policy version, and then writes the transition and resulting state in the same database session. This serializes the tested state-version path. We did not establish that concurrent consent or authorization writers take the same lock, and no concurrent governance-revocation race is reported; cross-transaction governance TOCTOU atomicity therefore remains unproven.

The complete disclosure-to-commit path is illustrated in Figure 1.

2.4. Implementation and Reproducibility Boundary

The reference implementation was frozen for this manuscript. Snapshot-bound proposals are validated in the API-owned commitment gateway. Strict disclosures read the persisted manifest identity and digests after canonicalization and fail if required binding fields are missing. The persisted manifest carries the schema, payload-schema, SHA-256 digest-algorithm, and canonicalization-profile fields described above, and the validator rejects metadata or digest mismatch. State replay exposes separate valid-time and semantic knowledge-time cutoffs. Historical conflict visibility is reconstructed from conflict-creation and conflict-resolution transitions rather than from mutable current status. Generic and commitment THSS share the same executable five-stage trace. Each reported run keeps its own implementation SHA and checksum lineage; older results are not reassigned to this manuscript-level freeze.

Model-mediated evaluation used the completed 64-subject solver-v5 cohort on 11 August 2026. The run was tied to a sealed reproducibility record containing the implementation identifier, an internal preregistration SHA-256, and a pre-execution seal. Provider calls used an OpenAI-compatible /chat/completions endpoint with requested IDs antigravity/claude-sonnet-4-6 and antigravity/gemini-3.6-flash-high; returned IDs had to match claude-sonnet-4-6 and gemini-3.6-flash-high. Requests used temperature 0, max_tokens 1024, stream=false, and JSON-schema response mode; top_p and a provider API-version parameter were not set. The client timeout was 60 s and allowed at most two retries for declared transient HTTP failures, with 0.25-s initial backoff. The completed run had zero errors and zero retries. Prompt, schema, cohort, model-mapping and analysis inputs were part of the sealed transitive-input inventory rather than being changed after execution.

2.5. Comparator and Contract-Clause Isolation

The contract experiments and the model comparators answer different questions. The standards-composed mechanism comparator includes bitemporal resolution, version-aware writes, current authorization, provenance, and audit. We did not verify a single comparator that matches GLHS on every current consent, policy, purpose, and expiry check while differing only in exact snapshot binding, so it is used as a mechanism comparator rather than as a binding-only causal ablation. In the solver-v5 cohort, Strict THSS was compared with full authorized history, long chronological context, Naive RAG, LWW, and BTSA. These contrasts test the usefulness of disclosure context for model reasoning, not the later GST persistence boundary.

To exercise individual contract checks, we applied seven progressively stronger variants to the same 16 developer-authored cases, giving 112 deterministic conformance executions. They are not 112 independent samples. The variants add, in order: temporal/provenance resolution; base-version checking; authorization at disclosure; provenance and audit; snapshot identity; full context/digest plus disclosed-evidence membership; and current reauthorization with policy, consent, and expiry checks. Case order, clause order, runner digest, and engine digest were frozen. Separate property-based, adversarial, leakage, and boundary tests exercise the implementation outside this matrix; those tests are not pooled with the 112 cells, and mutation testing was not part of this study.

2.6. PostgreSQL Concurrency and Service-Layer Evaluation

We exercised state-version concurrency on PostgreSQL 16.14. A four-writer test covered both a shared semantic slot and four unrelated slots under the current profile-global version counter. A second contention grid used 1, 2, 4, 8, and 16 writers, with five independent profile races at each level, for 50 races and 310 writer attempts. Losses on the same semantic dependency were classified as true stale and rejections on unrelated slots as false stale. These runs did not introduce simultaneous authorization loss, consent revocation, or policy changes, so they do not test governance TOCTOU races.

Service-layer overhead was measured in a clean, one-worker, in-process run on PostgreSQL 16.14 using read-committed isolation, synchronous commit, a history depth of 50, and 30 repetitions per operation. The artifact was produced from the frozen implementation and its associated checksum inventory. HTTP transport, worker scaling, and provider inference were not included. Because only 30 repetitions were collected, we report p50 and p95 but omit p99; the rate column is a single-worker sequential operation rate, not concurrent throughput.

2.7. PII/PHI and Sensitive-Data Boundary

PII, PHI, and other sensitive health attributes are treated as governed data rather than ordinary model context. The canonical record may retain identifiers or source material when permitted, but THSS decides what is actually disclosed to the AI for the current actor, purpose, task, consent state, and policy. Direct identifiers or sensitive classes can therefore be omitted, minimized, or pseudonymized before model access while their provenance remains in the governed record.

Evaluation artifacts use synthetic or de-identified inputs where applicable, opaque study-local subject tokens, and content hashes. Credentials, unrestricted provider payloads, and raw licensed patient resources are excluded from tracked evidence bundles. Public or sealed benchmark copies also replace synthetic FHIR Patient/… references with an opaque study URN while keeping a separately verified source-cohort hash and redaction provenance. For a stored governed decision, reconstruction can recover the manifest and snapshot identifiers and digests, disclosed evidence/assertion set, state/policy/consent versions, actor/role/purpose/task, temporal cutoffs, transition identifier, base/result state versions, review status, and recorded reason/model references. The clause-ablation artifacts separately record the first rejecting clause for each conformance case; this should not be read as a claim that every production rejection is persisted at clause-level granularity. Hashes are not treated as anonymization guarantees.

2.8. Evidence Classification and Analysis

The preregistered model endpoint was subject-level all-axes exact match. Strict THSS was compared with five alternatives for each model, giving ten paired tests in one Holm family. Missing or malformed outputs counted as errors. For each contrast, paired subject-level differences were bootstrapped 1000 times with seed 20260811; the reported 95% interval is the percentile interval over those resamples. Exact two-sided sign tests used only discordant subjects and were Holm-adjusted across all ten tests. The frozen 64-subject plan targeted at least 51 non-tied pairs and approximately 81.5% power for a directional win probability of 0.75 under a conservative 0.005 per-test threshold. That target was an informative-pair requirement, not a guarantee about comparator discordance. The significant contrasts ultimately contained only 9–21 non-tied subjects, so inference is underpowered relative to the plan even where adjusted p-values are significant.

3. Results

3.1. Exact Disclosure-Context Binding and Clause Isolation

The focused tests exercised Equations (2)–(4) directly. Snapshot-bound proposals were rejected for mismatches in profile, actor, role, purpose, task, base state version, snapshot identity, or digest. The write path also rechecked current policy, consent, and expiry. Incomplete binding metadata was rejected, as were THSS traces with missing or reordered stages. A separate historical regression confirmed that a conflict resolved in August still appears in a July snapshot compiled later, because conflict visibility is replayed from transition history rather than read from the current conflict projection. These tests concern software conformance rather than clinical or legal correctness.

All 112 cells in the 16-case × 7-variant matrix produced the expected conformance result and identified the first clause responsible for rejection. The incremental matrix helps localize which added check changes each case outcome. Because the standards-composed comparator is not fully matched on every current governance semantic, however, these executions should not be read as a causal estimate of exact snapshot binding alone.

3.2. Atomic Write Safety and Version-Granularity Trade-Off

In the $N=4$ PostgreSQL test, both the same-slot race and the unrelated-slot race produced one atomic winner and three stale rejections, with no database error. Under these specific concurrent-write conditions, the profile-global contract therefore failed closed.

The larger contention grid confirmed a direct consequence of profile-wide versioning. With one winner per simultaneous profile race, unrelated-slot false-stale rejection followed the expected pattern: 0 with one writer, 0.50 with two, 0.75 with four, 0.875 with eight, and 0.9375 with sixteen. Losses on the same dependency were true stale. We therefore report these values as a design consequence reproduced by the benchmark, not as estimated population rates. Resource-partitioned and dependency-aware alternatives were not run on PostgreSQL.

3.3. Service-Layer Overhead

The descriptive service-layer measurements are reported in Table 2.

Peak process RSS across these operations was approximately 109 MiB. The measurements describe one local, in-process service-layer environment. They should not be read as public-HTTP latency, deployment capacity, or production throughput.

3.4. Prospective Two-Model Solver-v5 Evaluation

The solver-v5 benchmark completed all 1152 solver cells with zero errors and zero retries. Across those cells, accuracy was 93.06% for lifecycle, 96.79% for evidence, 99.22% for timeliness, and 99.83% for escalation; 1027/1152 cells (89.15%) were exact on all four axes. On the subject-level primary endpoint, Strict THSS reached 63/64 (98.44%) with Claude and 64/64 (100%) with Gemini. The single remaining Strict-THSS Claude error—a cancelled history predicted as satisfied—was retained without post-hoc repair. The 128 construction-review requests served a separate, bounded purpose: two model reviews per subject checked the deterministic anchor construction, while code retained final authority. All 64 constructions were accepted; candidate-slot F1 and due-window exact accuracy were both 1.0.

The ten preregistered paired contrasts are reported in Table 3.

Six contrasts remained Holm-significant, but only 9–21 discordant subjects informed those tests, well below the planned 51 informative pairs. Claude versus BTSA was not significant (+4.69 percentage points, Holm $p=1.0$), and Gemini tied BTSA, full history, and long context exactly. The exact sign tests remain valid for the observed discordances, but the high tie rate limits effect-size precision and confirmatory strength.

3.5. Claim Boundary

The model cohort and the contract tests should not be read as the same kind of evidence. The former asks whether the THSS context helps with a frozen synthetic reasoning task; the latter asks whether the software keeps that disclosure tied to a later write and rechecks it at commit. In the model cohort, Strict THSS performed better than several context constructions for both models, but not every comparator. None of these results measures clinical accuracy or clinical safety. Independent clinical adjudication, real-world policy completeness, deployed-boundary security testing, and prospective patient outcomes were not part of this study.

4. Discussion

4.1. What Is Novel—And What Is Not

Bitemporal health state, provenance, consent representation, conflict preservation, and version-aware writes all have established antecedents [1,2,3,4,5,6,7,8,9]. Transactional commit, governed propagation, and privacy-aware longitudinal memory also appear in recent agent-memory systems [13,14,15,16]. What GLHS adds is the connection across the system boundary: the disclosure supplied to the AI remains part of the admission check when a later proposal tries to change persistent state.

A version check alone can reject stale writes, but it does not identify the disclosure from which a proposal arose. Conversely, a disclosure policy can restrict what the model sees and still disappear from the decision path once the model returns an output. GLHS carries the same coordinates across both steps. THSS records the governed read context; the proposal cites that context and its base state; GST checks them again before persistence.

4.2. Relation to Transactional and Governed Agent Memory

MemTX is the closest transactional neighbor because it separates staged memory writes from committed beliefs and includes permissions, provenance, and validity in the commit discipline [13]. MemTxn likewise keeps validation and recovery outside the answer model [14]. MemClaw treats scope, temporal contradiction, provenance, and policy propagation as service concerns [15], and HealthClaw studies privacy-aware memory selection in longitudinal health assistance [16]. GLHS places its boundary at a different point: the purpose- and consent-bounded health disclosure is still consulted when the later proposal is admitted for persistence.

4.3. Safety, Privacy and Operational Implications

The same boundary is also useful when the world changes while a model is working. If state, consent, actor permission, policy, or snapshot validity changes during inference, the proposal can be rejected or reconciled instead of being written silently. The strict representation carries the persisted manifest and its temporal scope. THSS also reconstructs historical conflicts from transition lineage and keeps a fixed order from authorization through minimization. This exposes the basis of the disclosure without adding answer labels or a scoring shortcut.

THSS can also reduce what reaches the model. PII, PHI, and task-irrelevant health attributes may be removed before disclosure while the persisted snapshot records what was actually shown. The benchmark copies further replace synthetic FHIR subject references with an opaque study URN and record the redaction in artifact provenance. These safeguards do not amount to legal “minimum necessary” compliance, anonymization, sender authentication, or a general privacy guarantee. Their value here is that the disclosure decision remains auditable.

The concurrency experiment gives the design a less comfortable result. A profile-global version counter is simple to reason about, but it also treats unrelated writes as competitors. In our grid, the false-stale rate for unrelated slots reached 0.9375 at 16 writers. Finer-grained versioning could reduce that contention, although it would need its own safety evaluation because lost updates and cross-dependency errors can reappear when the version boundary is split.

4.4. Limitations

Several limits remain. The prospective model cohort contains only 64 synthetic subjects, and frequent ties left 9–21 informative pairs in the significant comparisons rather than the planned 51. The exact paired tests remain valid for those discordances, but effect estimates are less precise and the cohort is underpowered relative to plan. Strict THSS was not significantly better than BTSA for Claude; Gemini tied BTSA, full history, and long context. The current gateway also retains a base-version-only proposal path and does not yet enforce provenance-sensitive downgrade prevention for every Strict-THSS-derived model proposal after review. State-version commit uses a profile-row lock and rereads consent in the same service transaction, but atomicity against concurrent authorization, consent, or policy writers has not been demonstrated with race tests. No single baseline was verified to match every governance semantic while differing only in exact snapshot binding. Service/API tests do not include a deployed-boundary attack matrix across HTTP, cache, and retrieval; historical guarantees are strongest for conflicts with complete transition lineage; the performance run used one in-process worker; and there is no independent human adjudication or real-world clinical validation.

5. Conclusions

GLHS treats persistent longitudinal health AI as a governed read-write process. THSS records the state and governance context shown to the AI. A snapshot-bound proposal carries those source coordinates forward, and GST checks that they are still valid before persistence. Bitemporality, provenance, consent, conflict preservation, and optimistic concurrency serve as components of this process rather than as separate novelty claims.

The implementation rejected the tested context mismatches, the clause ablation showed where invalid proposals failed, and the PostgreSQL experiments prevented stale commits in the tested state-version races. In the prospective two-model cohort, Strict THSS reached 98.44% all-axes exact with Claude and 100% with Gemini; six prespecified comparisons remained significant after Holm correction, although only 9–21 discordant subjects informed those significant tests and the planned power target was not reached. Under the tested conditions, the evidence supports a traceable software path from governed disclosure to persistent write. Clinical benefit, downgrade-resistant policy for every model-derived path, governance-race atomicity, and independent validation of institutional policy require separate work.