OpenMed 2.3 expands the stable v2 contract across privacy-safe agent and trace workflows, multimodal asset intake, clinical evidence, local training, cross-platform runtimes, deployment adapters, and release hardening. The final audited v2.2.0..v2.3.0 release-branch range contains 252 commits and 651 changed files.

The static public Python surface grows from 37,735 to 41,729 symbols with 3,994 additions, zero removals or narrowed signatures, and zero new deprecations. Python, Swift, Kotlin/Android, JavaScript, REST, CLI, configuration, serialized evidence, and deployment contracts are reviewed in the 2.2-to-2.3 migration guide.

Added

• Added a dependency-free, versioned multimodal asset manifest with strict media and digest validation, bounded metadata-only fields, deterministic JSON serialization, and value-free rejection of paths, URLs, free text, and unknown fields (#2954).

• Added bounded streaming SHA-256 asset digests with caller-owned stream position restoration and value-free limit and read failures (#2979).

• Added bounded, dependency-free detection for PDF, PNG, JPEG, TIFF, DICOM, and WAV prefixes, with stable match, mismatch, and unknown validation results that do not log source bytes or trust filename extensions (#2955).

• Added strict, deterministic multimodal abstention records with typed pipeline stages, stable reason codes, metadata-only JSON, and value-free validation failures (#2977).

• Added image, PDF, DICOM, and audio profiles that validate canonical manifest metadata into deterministic field-and-reason findings without opening or decoding an asset (#2978).

• Added a closed, JSON-safe agent outcome vocabulary with success, abstention, reviewer-handoff, policy-denial, and failure classes, deterministic serialization, and value-free rejection of unknown codes or free-text reasons (#2950).

• Added bounded, deterministic agent-run summaries for closed outcomes, workflow identifiers, tool-call counts, durations, and artifact digests, with direct-construction invariants and value-free privacy failures (#2951).

• Added deterministic monotonic timing metadata records for agent runs and actions with exact integer durations and value-free validation failures (#2974).

• Added deterministic clinical evidence tables with source offsets, controlled assertion and review metadata, optional protected-value hashes, and value-free JSON and Markdown rendering (#2567).

• Added immutable, non-throwing consent receipt verification results with stable content-free outcome codes while preserving one-time receipt consumption.

• Added an audited teacher-ensemble registry for weak labeling with manifest-resolved PII and Privacy Filter members, bounded weights and agreement thresholds, checksum-validator policies, and fail-closed runtime source matching (#284).

• Added an experiencer-aware patient-record span filter (openmed.clinical.filter_patient_record) that partitions per-span ClinicalAssertion records into patient-record eligible and excluded sets. Non-patient experiencers (family and other) and hypothetical spans are excluded with auditable reasons; negated patient spans are retained and marked refuted. Includes a medical-device-style advisory disclaimer that the filter is a record-construction aid, not a clinical decision (#2251).

• Added a deterministic Jupyter notebook cell redaction helper that preserves code sources and execution structure, applies explicit markdown and output policies, removes unredacted binary MIME data, and emits counts-only, value-free summaries and failures (#2561).

• Added a license-quarantined MedCAT/CogStack subprocess bridge (openmed/interop/bridges/medcat.py) that shells out to a user-provided MedCAT process and maps its {cui, name, score} concept output onto OpenMed span-code fields ({system, code, score}). MedCAT is Elastic License 2.0 and is never imported in-process or bundled; invocation is blocked until the caller acknowledges the license via OPENMED_ACCEPT_MEDCAT_LICENSE or an interactive prompt. Added an empty interop-gpl extra documenting that it installs nothing (#1789).

• Added a deterministic offline resource-path portability audit with bounded inputs; traversal, root, reserved-name, normalization, and case-fold checks; immutable hash-only reports; and value-free failures (#2637).

• Added a bounded, metadata-only archive extraction safety policy with cross-platform traversal and link rejection, normalized duplicate detection, expansion limits, and immutable counts-only decisions (#2635).

• Added a deterministic export filename policy derived from validated artifact metadata, schema versions, and short provenance fingerprints, with path, raw-identifier, clock-derived, and value-leaking input rejection (#2584).

• Added a deterministic offline artifact inventory with bounded safe-path handling, byte counts, media types, SHA-256 fingerprints, and aggregate-only JSON and Markdown reports (#2581).

• Added a canonical CLI result envelope with bounded counters, artifact fingerprints, and remediation codes; strict JSON parsing; immutable state; and free-text-free failures (#2636).

• Added a deterministic CLI help-surface drift checker with canonical command, option, argument, and default snapshots plus machine-readable compatibility reports (#2583).

• Added a deterministic structured-schema snapshot compatibility checker with versioned field-path, type, and optionality rules plus value-free change evidence and canonical JSON output (#2582).

• Added fail-fast JSON Schema validation for OpenMedConfig, TOML files, and custom profiles, with aggregated value-free diagnostics, an installed schema path helper, and complete remote-backend field coverage (#2264).

• Added a dependency-free OpenSearch ingest redaction processor with validated local policies, explicitly selected fields, immutable document copies, cache-only defaults, and aggregate value-free diagnostics (#2389).

• Added a dependency-free Elasticsearch ingest redaction processor with explicit static field rules, deterministic pipeline serialization, injected local redaction, and counts-only value-free diagnostics (#2388).

• Added device-specific TensorRT engine export for ONNX token classifiers with bounded dynamic shape profiles, FP16 and fail-closed INT8 calibration, per-family G4 recall evidence, finite synthetic parity checks, rollback-safe engine and metadata publication, trusted-engine logits inference, and device-tier benchmark records (#834).

• Added configurable Android QNN and NNAPI execution-provider selection with deterministic CPU fallback, per-family operator-coverage reporting, and bounded PHI-free latency, span-parity, and recall evidence (#851).

• Added a dependency-optional Apache Beam redaction transform with explicit schema metadata, bounded record and byte state, capped retries, deterministic serialization, cache-only defaults, and aggregate value-free reports (#2387).

• Added a dependency-optional Spark redaction transform with immutable, pickle-safe configuration, partition-local workers, deterministic retry behavior, bounded serialization, and stable value-free failures (#2386).

• Added a locked Pixi Python 3.12 workflow for Linux x86_64, Intel macOS, and Apple Silicon macOS, with environments mirroring the development, documentation, Hugging Face, service, and MLX extras (#2348).

• Added parser-derived Bash, Zsh, and Fish completion scripts and documented the stable machine-readable CLI output workflow (#2347).

• Added a sender-authorized Electron de-identification bridge with bounded IPC, a shared serialized utility-process model cache, Node- and Electron-stack offline enforcement, renderer-safe span projection, and timeout-safe worker recovery (#824).

• Added a cross-browser Manifest V3 PHI guard that detects and masks text locally, fails closed on unscanned form submissions, persists per-site policy controls without raw text, and verifies zero detection-time network egress with a synthetic unpacked-extension test (#820).

• Added a dependency-free local capability probe for injected optional integrations, with deterministic availability counts, provider fingerprints, safe missing-extra classification, and exception-text-free JSON reports (#2585).

• Added a deterministic integration capability matrix covering supported adapters, optional requirements, policy boundaries, documentation, and offline test evidence, with local source and dependency validation (#2390).

• Added a deterministic offline file-sharding planner that balances declared local file metadata under byte and file-count limits, fingerprints normalized paths, rejects duplicates, and emits counts-only plans without reading files (#2639).

• Added crash-safe transactional trace redaction with a value-free recovery journal, fingerprint-verified bounded resume and rollback, transaction-owned staging cleanup, and idempotent completed recovery (#2559).

• Added a deterministic cost-versus-cloud benchmark with measured local throughput amortization, cited dated AWS and Azure paid-price tiers, breakeven math, JSON/Markdown CLI output, and fail-closed citation checks (#2342).

• Added lazy runtime wiring for validated anonymizer-provider plugins and the openmed.providers registrar compatibility group, with canonical-label and locale routing, deterministic Faker access, idempotent discovery, PHI-safe failure warnings, and built-in-generator fallback (#2341).

• Added lazy async wrappers for PII extraction, de-identification, and text analysis, plus ordered batch execution with an optional hard concurrency bound that keeps synchronous work off the event-loop thread (#2338).

• Added a Kubernetes HPA reference for aggregate queue-depth and in-flight request metrics, with a concurrent CPU signal, exact load-to-replica guidance, Prometheus Adapter wiring, bounded queue labels, and PHI-safe metric tests (#831).

• Added openmed redact-files for local-only text and line-delimited file redaction with atomic output, PHI-free JSON summaries, consistent surrogate replacement, and no source overwrite (#2278).

• Added reusable iOS Share and Action extension modules for bounded plain-text redaction with bundled policy selection, local-only Nano Core ML assets, fail-closed tokenizer loading, guaranteed runtime-cache cleanup, and host-returnable output that preserves original span offsets (#835).

• Added a bounded offline JSON-lines de-identification sidecar with a typed Tauri host and frontend bridge, model pinning, serialized process reuse, renderer-safe errors, strict response validation, and synthetic termination and egress coverage (#823).

• Added a local Q4_K_M GGUF grounding runtime with private stdin prompt transport, subprocess-only llama.cpp integration, deterministic top-k recall certification, artifact-bound SHA-256 evidence, and fail-closed loading (#904).

• Added a bounded, dependency-free browser network-egress proof harness with exact or path-scoped model-asset allowlists, immediate raw-URL disposal, source-safe digest reports, and fail-closed local trace validation (#2374).

• Added a deterministic offline installation smoke check with a clean temporary home, selected-environment entry-point and package-version proof, bundled-manifest validation, repeatable synthetic redaction hashes, and value-free failure reports (#2378).

• Added a bounded zero-upload browser privacy playground with deterministic local rules, trusted same-origin adapter support, aggregate-only status, source-safe labels, and explicit network-boundary controls (#2373).

• Added a canonical, lockfile-backed uv contributor workflow with an explicitly pinned CI frontend, frozen optional-extra installs, uv-native package builds, and documented pip and Nix fallback paths (#2339).

• Added deterministic counts-only comparator reports with fixed metric definitions, bounded aggregate failure accounting, hashed custom identifiers, immutable sanitized state, environment fingerprints, and value-free JSON, Markdown, and write errors (#2380).

• Added a standard-library Agent Skills exporter for deterministic ZIP and tar.gz bundles with per-file SHA-256 manifests, source revision provenance, data-driven host and topical-pack selection, portable source-path checks, and rollback-safe overwrite handling (#2307).

• Added a deterministic offline Agent Skills validation gate for frontmatter, identifiers, local references, pack membership, and executable-helper help and test contracts, with symlink and local-path containment, path-only diagnostics, scratch-isolated helper probes, and a dedicated CI workflow that runs every focused skill test (#2306).

• Added the local-first setup-openmed skill and versioned de-identification policy template for collecting five bounded privacy decisions, producing a deterministic atomically written review draft with path-free status output, and stopping at an explicit human approval gate before the policy can control a run (#2305).

• Added an offline-first self-hosted Compose bundle with loopback-only default publishing, a hardened non-root runtime, persistent cache and read-only model mounts, an internal network, bounded logs and processes, a readiness probe, and opt-in-only remote integrations (#2372).

• Added a local-only self-hosted redaction service with explicit text and UTF-8 file workflows, deterministic offline defaults, counts-only review state, loopback Host and request-size guards, content-free errors, and an accessible aggregate-status page (#2371).

• Added a deterministic synthetic-only de-identification comparator harness with explicit fail-closed fixture provenance, enforced offline execution, bounded inputs, aggregate privacy metrics, resource budgets, and source-safe reports (#2379).

• Added an opt-in bundled-model manifest and offline bootstrap for the small English PII model, with registry checksum and license pins, mandatory cached artifact-integrity proof, concurrency-safe socket guarding, and no silent network fallback (#2375).

• Added deterministic offline bootstrap diagnostics for cache readiness, integrity manifests, optional dependencies, and local-only configuration, with stable exit codes and value-free human and JSON reports (#2376).

• Added a deterministic standalone local-redactor manifest with a synchronized package/dependency boundary, permissive-license enforcement, explicit opt-in integrations, and excluded restricted dependencies and assets (#2377).

• Added metadata-only local agent trace-store discovery with platform-aware defaults, explicit opt-out, no content reads or symlink following, PHI-free store labels, and aggregate counts and byte sizes (#2279).

• Added deterministic spawn-backed parallel trace-file sharding with fresh per-file stores, stable input-order merging, safe sequential fallback, and PHI-minimized aggregate failure metadata (#2285).

• Added a local registry for training-conversation schemas with collision-safe aliases, recursive format detection, fail-closed validation, and hashed value-free diagnostics (#2286).

• Added a role-message training schema adapter with recursive content-path redaction, deterministic structure preservation, hashed path diagnostics, and fail-closed handling for cycles and unknown parts (#2287).

• Added a preference-pair training schema adapter with structure-preserving redaction, bounded span reconciliation, validated schema-version reports, and privacy-safe labels and diagnostics (#2288).

• Added a local-first, schema-preserving columnar trace-batch adapter with bounded iteration, nested text-path redaction, deterministic defaults, unchanged labels and metadata, and hashed value-free diagnostics (#2289).

• Added a streaming, schema-preserving JSONL agent-trace content walker and rewriter with explicit string paths, value-free errors, duplicate-key rejection, same-file overwrite protection, and caller-supplied local transforms (#2280).

• Added structure-aware tool-call trace redaction for JSON objects and encoded payloads, with caller-controlled content paths, deterministic serialization, hashed path-only reports, and a local-only default de-identifier (#2281).

• Added local credential and secret-token detection for authorization headers, environment values, provider tokens, and private keys, with bounded scanning and value-free, hashed diagnostics (#2283).

• Added bounded-memory streaming redaction for structured trace records and NDJSON, with independent record and byte limits, deterministic pseudonyms, aggregate-only progress, and local cancellation (#2284).

• Added a deterministic, read-only local trace privacy inventory with counts-only store, category, and file aggregates; byte ranges; file-status totals; hashed caller-supplied labels; and value-free renderers (#2290).

• Added local-only transactional in-place trace redaction with sibling temporary files, source-consistency checks, exclusive backups, metadata preservation, atomic replacement, cleanup, and value-free errors (#2291).

• Added a deterministic offline trace-fidelity verifier that limits changes to declared content fields; preserves order, linkage, identifiers, timestamps, labels, scalar types, and structure; and emits hashed value-free diagnostics (#2292).

• Added versioned topical agent-skill packs for privacy, interoperability, coding, evaluation, and research, with an offline deterministic builder, membership and size-budget validation, canonical relative links, selection-only output, and fail-closed output preflight (#2303).

• Added the deterministic ask-openmed workflow router skill, with a fail-closed privacy override for ambiguous or negated safety statements, fixed intake-to-verification handoff ordering, canonical links to existing skills, and PHI-free route diagnostics (#2304).

• Added standard-library HTML/HTM visible-text extraction with source character offsets and markup-preserving redaction write-back (#278).

• Added an offline, versioned key-lifecycle helper and operator guide for audit-key rotation, retired-key verification, surrogate-vault re-keying, environment isolation, and file-permission hygiene without serializing keys.

• Added conservative two- and three-column PDF reading-order reconstruction, preserving source word bboxes and character-span projection while leaving single-column extraction byte-for-byte compatible with the source-order path.

• Added deterministic, local redacted-PDF rendering with burned-in opaque rectangles, clean non-PHI text-layer reconstruction, global source-text removal verification, masked page-layout fidelity reports, synthetic fixtures, enforceable regression gates, bounded raster budgets, Type 3 font rejection, and plaintext-free serialized evidence with sanitized render errors.

• Added a rooted, backward-compatible public error taxonomy with stable machine-readable codes, actionable PHI-safe diagnostics, REST/MCP mappings, synthetic contract fixtures, and API documentation.

• Added a production browser token-classification runtime with typed batched WebGPU inference, deterministic local WASM fallback, an audited WGSL classification head, Python-reference parity and recall gates, per-device warm/cold benchmark records, and real headless-browser coverage.

• Added local EML header, plain-text, HTML, and attachment PHI redaction with decoded source-offset maps, deterministic safety sweeps, image-only PDF attachment output, and an explicit isolated extract-msg bridge extra for optional Outlook MSG input.

• Added committed Android OpenMedKit release-AAR and offline cold-start budgets, with blocking Gradle/CI gates and measured values in the Android job summary.

• Added a Triton ONNX model-repository generator and configuration-selected KServe V2 HTTP/gRPC inference backend with local tokenization and decoding, mocked local/remote span-parity coverage, and no bundled serving runtime.

• Added a Kopf-based Kubernetes model operator with the namespaced OpenMedModel CRD, manifest-pointer warm-pool rollouts, lifecycle conditions and Events, retained-version rollback, least-privilege RBAC, hardened deployment assets, operator documentation, and a synthetic fake-API reconcile suite.

• Added a BigQuery-compatible warehouse remote-function handler that validates batched row envelopes, groups policy-specific calls through process_batch, emits PHI-safe error replies, and ships synthetic tests, container deployment guidance, and registration DDL (#839).

• Added a deterministic, fully offline openmed init project scaffold with researcher, app-developer, and data-engineer presets, bundled OpenMedConfig schema validation, synthetic starter pipelines, and collision-safe reruns.

• Added opt-in, no-PHI OpenTelemetry spans and aggregate histograms for all ten core privacy-pipeline stages, with lazy optional imports, no exporter by default, shared Timer measurements, synthetic leakage regression tests, and an otel installation extra.

• Added a minimal local-artifact edge-sbc ONNX Runtime profile, native ARM64 Raspberry Pi and Jetson synthetic benchmark workflow, aggregate cold-start, token-throughput, install-size, and peak-RSS records, plus fail-closed footprint budgets and archived ARM64 proxy evidence.

Changed

• Removed the scheduled and manual GitHub-hosted model conversion and Hugging Face publication workflows, removed the daily model release-gate cron, and removed the hosted Apple Silicon model-conversion smoke job. Model conversion, evaluation, and publication remain explicit local maintainer operations (#2961).
• Optimized MLX Privacy Filter decoding with bounded BIOES transition-table reuse, equivalent NumPy and pure-Python paths, span-local grapheme work, binary32-compatible confidence reconstruction, and opt-in kernel compilation controls (#2946).

Fixed

• The openmed npm package now defaults to the public OpenMed/OpenMed-PII-ClinicalE5-Small-33M-v1-onnx-android repository (exported as DEFAULT_MODEL_ID) and routes -onnx-android model ids through loadOnnxModel() instead of the unavailable former default.

• The openmed npm package aligns Transformers.js token-classification output back to the source text before BIO decoding through alignTokenOffsets(); extractPii() requests ignore_labels: [] to retain the full sequence. The documented loadOnnxModel() to deidentify() path no longer silently returns zero spans solely because the runtime omits character offsets.

• Token alignment preserves decomposed accents and supplementary Unicode letters. Unalignable tokens fail with a content-free error instead of silently producing incomplete redaction; custom pipelines can supply exact source offsets.

• Preserved the v2.2 numeric-offset TypeScript contracts while adding raw-token input types. Model loaders align output and retain runtime metadata and resource disposal; the browser extension remains source-compatible.

• Removed obsolete Debian vulnerability exceptions after the current image report confirmed they no longer apply; security thresholds are unchanged.

Known dependency limitation

• Optional agent, LlamaIndex, QuickUMLS, and scrubadub dependency trees include NLTK 3.10.3, affected by model-artifact path-security advisory CVE-2026-81726. No fixed release is published as of 2026-09-04. OpenMed does not call the affected APIs, and its service image does not install NLTK. Do not expose NLTK model import/export paths to untrusted input in optional integrations. The CI waiver is scoped to this CVE, the nltk package, and uv.lock, and expires on 2026-09-11; it cannot suppress a fixed upstream release.

OpenMed v2.3.0

OpenMed 2.3.0 expands the stable v2 SDK across privacy-safe agent and trace workflows, multimodal asset intake, clinical evidence, local training, cross-platform runtimes, deployment adapters, and release hardening without removing a public Python symbol.

Release date: 2026-09-04.

Highlights

• Multimodal safety and provenance: bounded asset manifests, streaming digests, media-type detection, typed abstention, manifest profiles, PDF fidelity, local email intake, and metadata-safe document extraction.
• Agent and trace contracts: closed outcomes, deterministic run summaries, monotonic timing, consent verification, schema-preserving trace redaction, bounded streaming and sharding, transactional recovery, and fidelity proof.
• Clinical evidence: deterministic evidence tables, patient-record span filtering, substance-use SDOH extraction, and value-free review metadata.
• Local training: teacher-ensemble manifests, federated-round lifecycle records, reproducibility verification, and privacy-safe training schemas.
• Integrations: opt-in search, batch, notebook, orchestration, database, remote-function, Kubernetes, HPA, and self-hosted service adapters.
• On-device and desktop runtimes: iOS extensions, Android accelerator selection, browser PHI guarding, Electron and Tauri bridges, TensorRT, GGUF, WebGPU, MLX, and edge-SBC qualification paths.
• npm redaction correctness: a working default ONNX model, source-offset alignment for Transformers.js, Unicode-safe spans, and content-free failures when offset-less tokens cannot be aligned.
• Release hardening: deterministic CLI and schema contracts, package-size budgets, container digest policy, image security gates, and removal of hosted model publication automation.

Compatibility

The audited v2.2.0..v2.3.0 release-branch range contains 252 commits and 651 changed files. Commit subjects reference 127 unique issue or pull-request identifiers across that complete ancestry range.

The static public Python comparison grows from 37,735 to 41,729 symbols: 3,994 additions, zero removals or narrowed signatures, and zero new deprecations. The REST surface remains at 19 paths and 17 component schemas.

Swift, Kotlin/Android, JavaScript, CLI, configuration, trace schemas, evidence records, and deployment contracts expand. npm callers should account for the corrected default model, additive raw-token input types, and explicit alignment failures described in the 2.2-to-2.3 migration guide for the cross-surface review and upgrade checklist.

Install and upgrade

The immutable tag drives package and image publication. Registry availability can lag the source release while tag-triggered workflows complete, so automation should verify the required coordinate before deployment.

Python

pip install --upgrade "openmed==2.3.0"
pip install --upgrade "openmed[hf,fhir]==2.3.0"
pip install --upgrade "openmed[mlx]==2.3.0"

Browser and Node.js

npm install openmed@2.3.0

The web package remains unscoped and provides ESM and CommonJS exports. Install @huggingface/transformers to use the default ONNX model, or inject a local token-classification pipeline. See the migration guide for the offset contract.

Swift

dependencies: [
    .package(url: "https://github.com/maziyarpanahi/openmed.git", from: "2.3.0"),
]

Android

dependencies {
    implementation("com.github.maziyarpanahi:openmed:v2.3.0")
}

JitPack resolves the immutable v2.3.0 repository tag. OpenMedKit performs local inference and declares no Android INTERNET permission.

Container and Helm

After publication, the immutable container coordinate is ghcr.io/maziyarpanahi/openmed:v2.3.0. The Helm chart's app version and default image tag are synchronized to 2.3.0; explicit release-image selection uses image.tag=v2.3.0.

Privacy and clinical boundaries

OpenMed keeps local processing as the default. Model downloads and optional remote integrations are explicit boundaries; after required artifacts are present, core PHI processing does not require a cloud service. Telemetry stays off by default, and release evidence uses hashes, counts, offsets, and provenance rather than raw identifiers.

No de-identification or structured privacy system can guarantee zero residual risk. Validate direct-identifier recall, leakage, span integrity, language and format coverage, policy behavior, and quantized-model deltas on the exact deployment path.

Clinical extraction, evidence, filtering, and mapping are assistive software, not a medical device or a source of clinical ground truth. Outputs require qualified review and must not automatically trigger diagnosis, treatment, billing, data release, or other clinical decisions.

Validation and publication

The optional agents, llamaindex, quickumls, and scrubadub dependency trees include NLTK 3.10.3. Its model-artifact path-security advisory CVE-2026-81726 has no published fixed version as of 2026-09-14. OpenMed does not call the affected model-file APIs, and the service image does not install NLTK. Applications using these optional dependencies must not expose NLTK model import/export paths to untrusted input. This is a known upstream limitation, not a claim that NLTK is patched. The repository's waiver is restricted to this CVE, the nltk package, and the uv.lock target, and expires on 2026-09-28. A fixed upstream release cannot be waived by this policy.

The exact release commit is required to pass:

• repository, dependency-license, secret, and action-reference policy;
• locked dependencies, lint, formatting, and the complete Python test suite;
• strict documentation, README translation drift, marketing staging, and regenerated OpenAPI checks;
• wheel/sdist build, metadata, contents, Twine, SBOM, and provenance tests;
• npm install, audit, tests, type checking, build, and tarball inspection;
• Swift resolve/build/tests plus applicable hosted Apple platform jobs;
• Android AAR build/tests, lint, network-denial, consumer-rule, and budget checks;
• Helm default and synthetic-value lint/render checks;
• applicable amd64 and arm64 container build and smoke jobs; and
• API compatibility evidence against the published v2.2.0 tree.

OpenMed 2.3.0 does not promote a model pointer. Model conversion, evaluation, and publication remain explicit local maintainer operations. A future model promotion still requires a real candidate, public SHIELD and golden evidence, signed extraction gates, and a final decision of exactly READY.

Hosted checks must refer to the exact release commit; successful jobs on an earlier source head do not qualify the release. Package publication, container publication, release assets, and registry verification remain tag-driven follow-up actions.

Full Changelog: https://github.com/maziyarpanahi/openmed/compare/v2.2.0...v2.3.0

OpenMed 2.2 completes the trustworthy clinical-data-exchange milestone across terminology grounding, document intake, FHIR, OMOP, structured privacy, MCP, service security, local model runtimes, and offline release evidence. The final audited v2.1.0..v2.2.0 range contains 111 commits and 571 changed files. GitHub generated notes associate 38 PRs with that range, including the contributor commits preserved by maintainer integration batches.

The static public Python surface grows from 31,619 to 37,735 symbols with 6,116 additions, zero removals or narrowed signatures, and zero new deprecations. The REST surface grows additively from 17 to 19 paths and from 15 to 17 component schemas through POST /ground and POST /pii/deidentify/stream. Swift adds public Maple and Compass local-model runtimes without removing an existing package API. Android keeps its public method signatures while making diagnostic descriptions and internal logging PHI-safe by default.

Added

• Added pinned DeepGrove Maple Preview support through Python MLX-LM and a native OpenMedKit MLX architecture, with privacy-bounded PII removal, clinical entities, directed relations, and note-grounded reasoning/chat. Added polished iOS scanning, Android Compose, and browser WebGPU demos plus reproducible 4-bit/8-bit MLX planning and checksum-verified ONNX/ORT bundle tooling. Model weights remain external and every clinical or disclosure result requires human review.
• Added first-class Cohere Compass vision-language inference for the five OpenMed North Micro Vision MLX precision variants: a native Python runtime, a shared OpenMedKit Swift/iOS runtime, local and Hub artifact loading, native-resolution image processing, and deterministic text/image parity tests across Python and Swift.
• Added a four-part, synthetic-only Jupyter notebook gallery for redaction, batch processing, FHIR export, and multilingual evaluation, with offline execution and committed-output freshness checks in CI.
• Added a local-first terminology workbench with checksum-pinned vocabulary snapshots, exact and ranked grounding, calibration, section context, caller-supplied Athena and crosswalk support, value-free provenance, and explicit terminology-conflict decisions.
• Added FHIR R4 patient-summary and clinical-document assembly, explicit R4/R5 conversion boundaries, local profile validation, Bundle reference-integrity reports, privacy-safe SDC form handling, OperationOutcome helpers, Bulk Data pagination and resumable digest-only checkpoints, and a FHIR-to-OMOP CDM 5.4 bridge with caller-supplied vocabulary mappings.
• Added deterministic clinical form and key/value extraction, cross-format offset projection, PDF table reconstruction, XLSX/PPTX/ODT intake, HL7 v2 narrative handling, X12 837 redaction, and fail-closed MIME quarantine for document intake.
• Added structured privacy profiling and release controls for k-anonymity, l-diversity, t-closeness, membership-inference self-tests, aggregate-only differential privacy, qualified-review evidence, and local ARX/sdcMicro bridge boundaries.
• Added PHI-safe integrations for Arrow Flight, SQLAlchemy, PostgreSQL PL/Python, executable UDFs, distributed SQL, Dataflow, Dagster, Ray, pandas-on-Spark, search ingest, and stream processors.
• Added service grounding and streaming de-identification routes, GraphQL, backpressure and batching controls, load-test assets, model-cache quotas, a CPU INT8 token-classification path, and additive Go/TypeScript client coverage.
• Added mTLS, HMAC replay protection, prompt-injection guards, MCP protected resource and OAuth-style authorization boundaries, consent receipts, upstream endpoint policy, and Part 11-oriented aggregate audit evidence.
• Added local-first Android inference guards with no INTERNET permission, socket-denial tests, opt-in typed aggregate logging, hashed entity descriptions, and explicit assistive-use documentation.
• Added hard-negative mining, per-language identifier/date traps, clinical domain coverage, FHIR round-trip fixtures, timeline provenance, and the versioned v2.2 synthetic conformance matrix with pinned FHIR, OMOP, and evidence hashes.
• Added optional fhir, dagster, and sqlalchemy extras, expanded the multimodal and service extras, and added the openmed-executable-udf entry point.

Changed

• Grounding, interoperability, structured privacy, service, and MCP features remain offline-first and require caller-supplied licensed terminology, credentials, models, or external runtimes where applicable; no restricted vocabulary or real-patient fixture is bundled.
• Android EntityPrediction.description now emits label, offsets, confidence, and a SHA-256 digest instead of raw detected text. Applications that need a local UI preview must read the explicit text field and must not send it to diagnostics or telemetry.
• Active Python, npm, Swift, Android/JitPack, Helm, container, website, and documentation coordinates now target 2.2.0 / v2.2.0.
• The final candidate wheel is reproducibly 4,134,629 bytes and remains within the committed 4,483,996-byte maximum. The gate retains its 4,076,360-byte baseline and 10% headroom; the payload contains source, synthetic metadata, and the committed model manifest rather than an unexpected binary or restricted vocabulary asset.

Fixed

• Fixed production builds to emit Core Metadata 2.4 for compatibility with the PyPI publisher, pinned the recovery workflow for older immutable tags, and made npm recovery skip an existing version only after its source commit and packaged contents match a fresh tag build.
• Stopped redundant tag-triggered Pages deployments that GitHub's master-only environment protection rules reject; documentation continues to deploy from master.
• Restored the v2.1 public openmed.clinical.grounding.SnapshotManifest binding while exposing the new vocabulary manifest as VocabularySnapshotManifest, and retained ConceptResolver as a public type alias after the OMOP exporter became a package. The v2.1-to-v2.2 static API gate now reports zero breaking symbols.
• Reconciled the combined v2.2 batches so FHIR profiles, OMOP mappings, grounding provenance, privacy reports, service schemas, generated clients, documentation publication, and shared fixtures agree on one integrated contract.

Release integration ledger

• GitHub-generated release-note PRs (38): #2228, #2230, #2237, #2239, #2241, #2243, #2244, #2245, #2541, #2543, #2548, #2549, #2550, #2551, #2678, #2679, #2680, #2681, #2682, #2685, #2686, #2687, #2688, #2689, #2690, #2691, #2692, #2693, #2694, #2695, #2696, #2698, #2699, #2700, #2885, #2886, #2887, and #2891.
• The GitHub generated-note set is intentionally smaller than the complete 111-commit ancestry range because the maintainer batches preserve source contributor commits while presenting one reviewed integration PR per coherent subsystem.

OpenMed v2.2.0

OpenMed 2.2.0 completes the trustworthy clinical-data-exchange milestone across terminology grounding, document intake, FHIR, OMOP, structured privacy, MCP, service security, local model runtimes, Android local inference, and offline release evidence without removing a public Python symbol.

Release date: 2026-08-21.

Highlights

• Terminology and clinical grounding: checksum-pinned vocabulary snapshots, exact and ranked grounding, calibration, section context, caller-supplied Athena and crosswalk support, value-free provenance, and explicit terminology-conflict decisions.
• FHIR and OMOP exchange: FHIR R4 patient summaries and clinical documents, explicit R4/R5 conversion boundaries, local profile validation, Bundle reference-integrity reports, SDC privacy projection, OperationOutcome helpers, Bulk Data resume checkpoints, and FHIR-to-OMOP CDM 5.4 mapping.
• Multimodal intake: deterministic clinical forms and key/value extraction, cross-format offset projection, PDF table reconstruction, XLSX/PPTX/ODT intake, HL7 v2 narrative handling, X12 837 redaction, and fail-closed MIME quarantine.
• Structured privacy: k-anonymity, l-diversity, t-closeness, membership-inference self-tests, aggregate-only differential privacy, and qualified-review evidence for dataset release decisions.
• Service and integration boundaries: grounding and streaming de-identification routes, GraphQL, backpressure and batching, CPU INT8 classification, model-cache quotas, and opt-in database, orchestration, and stream-processing adapters.
• Security and consent: mTLS, HMAC replay protection, prompt-injection guards, MCP protected-resource and authorization boundaries, consent receipts, upstream endpoint policy, and aggregate Part 11-oriented evidence.
• On-device safety: Android network-denial guards, no INTERNET permission, opt-in typed aggregate logging, hashed entity descriptions, and explicit assistive-use documentation.
• Local model runtimes: pinned Maple clinical task support and native Compass vision-language inference across Python and OpenMedKit, with external weights, checksum-bound artifacts, and human-review boundaries.
• Validated examples: a four-part synthetic notebook gallery for redaction, batch processing, FHIR export, and multilingual evaluation, with offline execution and committed-output freshness checks.
• Release conformance: hard-negative and multilingual traps, FHIR round-trip fixtures, timeline provenance, and a versioned synthetic v2.2 matrix with pinned FHIR, OMOP, and evidence hashes.

Compatibility

The audited v2.1.0..v2.2.0 range contains 111 commits and 571 changed files; GitHub generated notes associate 38 PRs with the complete ancestry range.

The static public Python comparison grows from 31,619 to 37,735 symbols: 6,116 additions, zero removals or narrowed signatures, and zero new deprecations. The REST surface grows additively from 17 to 19 paths and from 15 to 17 component schemas with POST /ground and POST /pii/deidentify/stream.

The v2.1 root import openmed.clinical.grounding.SnapshotManifest keeps its snapshot-cache meaning. The new vocabulary type is available as VocabularySnapshotManifest. The public OMOP ConceptResolver type alias is also retained.

Swift adds public Maple task/runtime types and Compass vision-language loading and generation without removing an existing OpenMedKit API. Android public method signatures are unchanged, but EntityPrediction.description now contains a SHA-256 digest instead of raw detected text. Applications that need a local UI preview must use the explicit text field and keep it out of logs, telemetry, crash reports, and remote diagnostics.

See the 2.1-to-2.2 migration guide for the cross-surface review and upgrade checklist.

Install and upgrade

The immutable tag drives package and image publication. Registry availability can lag the source release while tag-triggered workflows complete, so automation should verify the required coordinate before deployment.

Python

pip install --upgrade "openmed==2.2.0"
pip install --upgrade "openmed[hf,fhir]==2.2.0"
pip install --upgrade "openmed[mlx]==2.2.0"

Browser and Node.js

npm install openmed@2.2.0

The web package remains unscoped and provides ESM and CommonJS exports.

Swift

dependencies: [
    .package(url: "https://github.com/maziyarpanahi/openmed.git", from: "2.2.0"),
]

Android

dependencies {
    implementation("com.github.maziyarpanahi:openmed:v2.2.0")
}

JitPack resolves the immutable v2.2.0 repository tag. OpenMedKit performs local inference and declares no Android INTERNET permission.

Container and Helm

After publication, the immutable container coordinate is ghcr.io/maziyarpanahi/openmed:v2.2.0. The Helm chart's app version and default image tag are synchronized to 2.2.0; explicit release-image selection uses image.tag=v2.2.0.

Privacy and clinical boundaries

OpenMed keeps local processing as the default. Model downloads and optional remote integrations are explicit boundaries; after required artifacts are present, core PHI processing does not require a cloud service. Telemetry stays off by default, and release evidence uses hashes, counts, offsets, and provenance rather than raw identifiers.

No de-identification or structured privacy system can guarantee zero residual risk. Validate direct-identifier recall, leakage, span integrity, language and format coverage, policy behavior, and quantized-model deltas on the exact deployment path.

Clinical extraction and mapping are assistive software, not a medical device or a source of clinical ground truth. Outputs require qualified review and must not automatically trigger diagnosis, treatment, billing, data release, or other clinical decisions.

Standards conformance

The OpenMed v2.2 tested standards matrix is generated from synthetic fixtures and records the exact FHIR, OMOP, and evidence hashes used by the conformance gate. It is implementation evidence, not certification by HL7, OHDSI, a regulator, or a standards body.

Licensed vocabularies, real-patient records, DUA-gated corpora, UMLS, SNOMED CT, CPT, MIMIC, i2b2, and n2c2 assets are not bundled. Restricted integrations require caller-supplied rights, keys, snapshots, or out-of-process bridges.

Validation and publication

The exact release commit is required to pass:

• repository, dependency-license, secret, and action-reference policy;
• locked dependencies, lint, formatting, and the complete Python test suite;
• strict documentation, README translation drift, marketing staging, and regenerated OpenAPI checks;
• offline execution and committed-output checks for the synthetic notebook gallery;
• wheel/sdist build, metadata, contents, Twine, SBOM, and provenance tests;
• npm install, audit, tests, type checking, build, and tarball inspection;
• Swift resolve/build/tests plus applicable hosted Apple platform jobs;
• Android AAR build/tests, lint, network-denial, consumer-rule, and catalog checks;
• Helm default and synthetic-value lint/render checks;
• applicable amd64 and arm64 container build and smoke jobs;
• API compatibility evidence against the published v2.1.0 tree; and
• committed catalog and registry integrity with latest equal to retained last_green evidence.

OpenMed 2.2.0 does not promote a model pointer. PII/latest and PII/last_green remain OpenMed/OpenMed-PII-SuperClinical-Small-44M-v1-mlx, and PII/canary remains unset. Model promotion remains a separate fail-closed workflow requiring a real candidate and benchmark evidence. Missing candidate files block that workflow but do not create a fictitious candidate for this SDK release.

Hosted checks must refer to the exact release commit; successful jobs on an earlier source head do not qualify the release. Package publication, container publication, release assets, and registry verification remain tag-driven follow-up actions.

Full Changelog: https://github.com/maziyarpanahi/openmed/compare/v2.1.0...v2.2.0

OpenMed 2.1 is the first feature release on the stable v2 line. The audited source scope covers every current-master change after the v2.0.0 integration boundary at b9ab7a3d. The current published v2.0.0 tag resolves to the rewritten-history commit 94ace7d and is an ancestor of master through that boundary. Public API compatibility compares the tagged trees directly, while the integration ledger below follows changes after the integration boundary.

The range adds clinical section, note-type, relation, temporal, coreference, radiology, discharge, medication, dosing, and fact-faithfulness workflows; offline terminology grounding, OMOP, FHIR, OpenEHR, cohort, and clinical MCP surfaces; structured generalization, relational privacy, differential-privacy, streaming, and attacker-model risk tools; multilingual, RTF, DICOM-SR, OCR, Android, Flutter, Beam, Ray, Spark, plugin, and model-cache adapters; and expanded deterministic, signed, rollback-safe evaluation and release gates.

The static Python API grows from 20,538 to 31,619 public symbols with 11,081 additions, zero breaking changes, and zero new deprecations. REST grows additively from 15 paths and 12 component schemas to 17 paths and 15 schemas. Android's offset implementation now matches the documented Unicode scalar contract; callers that treated offsets as Kotlin UTF-16 indices for non-BMP text should follow docs/migration/2.0-to-2.1.md.

Added

• Added dependency-free OpenDocument Text (.odt) extraction with paragraph and list reading order, deterministic table linearization, character-offset source maps, multimodal registry discovery, and usage documentation (#857).

• Added a read-only Strawberry GraphQL endpoint for selective analysis and de-identification fields, canonical entity discovery, policy details, safe aggregate risk facets, introspection, and deterministic SDL export (#828).

• Added versioned HMAC-SHA256 request signing over method, path, timestamp, nonce, and body digest, with client-side header helpers, bounded fail-closed replay protection, and verifier-compatible signatures on async job webhooks (#849).

• Added a weekday-themed model release orchestrator that chains conversion, synthetic evaluation, signed release gates, model-card generation, publication, fresh-environment smoke checks, last-green rollback, quarantine reporting, and an append-only offline audit ledger (#1243).

• Completed longitudinal document linking with exact caller-supplied patient boundaries, conservative cross-document entity de-duplication with complete hashed occurrence provenance, and summary-card/timeline adapters (#1284).

• Added offline family-transfer adapter routing that prefers installed target adapters, falls back to compatible donor adapters with scored provenance, and returns explicit unsupported or unavailable routing failures (#1331).

• Added stdlib-only RTF text extraction (openmed.multimodal.extract_rtf, dispatched by redact_document for .rtf) with a character-offset map back to the source. Destination groups such as \fonttbl, \colortbl, \info, \pict, and \*-marked extensions are skipped; control words, control symbols, \'hh codepage escapes (\ansicpg-aware), \uN Unicode escapes with the group-scoped \ucN fallback count, and \bin payloads are handled without leaking markup into the extracted text (#856).

• Completed clinical temporal timeline composition with DCT/TIMEX anchors on every ordered event, transitively reduced public TLINK graphs, metric-ready edge keys, and retained/pruned privacy-safe decision provenance (#1253).

• Added closure-aware temporal TLINK F1, PHI-safe transitive-closure consistency scoring, a zero-violation blocking gate, and synthetic discharge-summary gold with DCT, EVENT-TIMEX, EVENT-EVENT, reduction, and contradiction-trap coverage (#1309).

• Added deterministic OncoTree tumor-type mapping (openmed.clinical.load_oncotree, map_tumor_type) against a caller-supplied local release snapshot (path / OPENMED_ONCOTREE_PATH and version / OPENMED_ONCOTREE_VERSION; nothing is bundled or downloaded). The snapshot must be a flat JSON list of tumor-type nodes; nested OncoTree tree dumps are unsupported. Exact and normalized name/code lookup supports an optional caller-supplied synonyms list and indexes history and revocation aliases with current codes winning collisions; unmatched or ambiguous mentions stay unmapped with a reason (no fuzzy/lexical fallback). Results are version-stamped OncoTreeMapping values. Includes synthetic golden fixtures and oncotree_top1_accuracy evaluation support.

• Added an experimental yasbd sentence-segmentation backend selectable via segment_text(..., backend="yasbd") and analyze_text(..., sentence_backend="yasbd"), backed by the optional yasbd-lib extra. The default routing and core dependency set remain unchanged; opt-in spans are normalized to OpenMed's exact contiguous-offset contract, with explicit errors for missing dependencies, unknown backends, and conflicting preconstructed segmenters (#1848).

• Added deterministic Urdu-versus-Arabic disambiguation for shared Arabic script runs. urdu_language_evidence() scores the six Urdu-exclusive letters (tteh, ddal, rreh, noon ghunna, heh doachashmee, yeh barree) and their sixteen Arabic presentation forms, derived from single-character NFKC decompositions so the Koranic stop-sign ligatures U+FDF0/U+FDF1 are excluded. Extended Arabic-Indic digits reinforce an existing letter signal but never trigger one, keeping Persian on the Arabic route. Evidence moves ur ahead of ar in the run's candidate order, and runs report stdlib:urdu-cues when an Urdu pack is registered or stdlib:arabic-fallback at a lower confidence when none is. Script-run offsets and grapheme boundaries are unchanged (#1571).

• Registered the Indic and Urdu routing candidates (mr, ne, bn, as, ta, kn, ml, gu, pa, or, ur) across the public language surfaces. Nepali and Urdu now have display names, model prefixes, and REST, MCP, TypeScript, and Go language enums; Nepali resolves to Faker's native ne_NP locale. Languages in USER_SUPPLIED_MODEL_LANGUAGES claim no bundled default model and raise an actionable ValueError naming every user-supplied code when model_name is omitted, while SUPPORTED_LANGUAGES stays model-backed-only so documented model-backed counts are unchanged (#1569).

• Promoted Vietnamese (vi) to a model-backed PII language pack routed to OpenMed/OpenMed-PII-Vietnamese-SuperClinical-Small-44M-v1, taking SUPPORTED_LANGUAGES to 35 codes. Adds Vietnamese month names, deterministic locale PHI generation, vi_VN surrogate and CCCD provider coverage across the REST, MCP, TypeScript, and Go surfaces, and a second synthetic golden i18n fixture exercising a native ngày D tháng M năm YYYY date, an 0xx mobile, a 12-digit CCCD, and a diacritic-bearing address (#263).

• Added grapheme-aligned mixed-script run routing. segment_by_script now yields ScriptRun, a tuple-compatible NamedTuple, and every run boundary falls on an extended grapheme-cluster boundary, so a run can no longer split a combining sequence, an Indic virama conjunct, a zero-width joiner sequence, or a regional-indicator pair. Each cluster takes the script of its first script-bearing code point, keeping a cross-script combining mark attached to the base character it decorates. LanguageRun gained candidates, normalizer, tokenizer, and numeral_set, and SCRIPT_NORMALIZERS, SCRIPT_NUMERAL_SETS, normalizer_for_script, and numeral_set_for_script expose the per-script routing tables (#1570).

• Added decide_rollback() in openmed/eval/rollout.py, the pure decision function mapping a gate diff to a rollback target. It diffs monitored per-label recall and residual leakage against the committed last-green baseline via eval/history.diff_against_baseline, applies the shared G7_RECALL_DROP_LIMIT tolerance, and returns HOLD / ADVANCE / ROLLBACK. A regression past tolerance rolls back to the committed last_green pointer and never advances, even when the candidate's own gate is RELEASABLE. The decision is side-effect-free and reproducible from the report plus committed baseline and rollout state with no live API call, and emits a PHI-free audit record carrying metric names, numeric deltas, store keys and hashes only (#1803).

• Added a read-only catalog coherence gate that checks every models.jsonl canonical_labels value against openmed.core.labels.CANONICAL_LABELS, resolving aliases (CHEM/SIMPLE_CHEMICAL -> CHEMICAL) while still rejecting labels that only survive normalize_label's OTHER fallthrough; exposed as openmed.core.labels.is_recognized_label, openmed.core.catalog_coherence.manifest_label_errors, and a Catalog coherence workflow (#2246).

Changed

• Script runs that previously began inside a grapheme cluster now begin at the cluster boundary. A token opening with a combining mark, such as the Gurmukhi addak U+0A71, starts one code point earlier because UAX #29 binds that mark to the preceding separator. Offsets remain half-open code-point indices and every run still tiles the source exactly (#1570).

Fixed

• Separated fail-closed model promotion from tag-driven Library/SDK publication so an SDK tag cannot accidentally attempt a pointer promotion without a staged challenger, while retaining API compatibility and migration enforcement in the tag-driven provenance job. Recalibrated the synthetic Chinese and Indic throughput gate from six GitHub-hosted Ubuntu runs instead of comparing hosted Linux against an Apple Silicon workstation baseline. Also fixed Transformers 5 local-snapshot loading so local_files_only is not forwarded twice to AutoConfig.

• Refreshed the canonical public model snapshot from 1,520 to 2,266 entries and restored the Android AAR's generated on-device catalog with 753 permissively licensed ONNX/TFLite entries. Manifest refreshes now disable implicit Hub authentication, preserve audited metadata for retained and converted models, distinguish generative PII models from token-classification evidence, and retain MIT license metadata. Android packaging now fails closed instead of writing an empty catalog.

• Replaced the Tamil default's authenticated-only checkpoint with the existing public multilingual placeholder and classified Tamil alongside Russian as a non-model-backed compatibility route. The stable pii_ta_msuperclinical_large registry key now resolves to that placeholder; production Tamil extraction still requires explicitly qualified weights.

• Fixed quadratic script segmentation on text containing long combining-mark runs whose marks carry a different script from their base. Such input passes validate_pii_input because the combining and format-sequence guards reset on each other's characters, and previously cost seconds per document in segment_by_script, route_runs, and is_indic_text. Cluster starts are now memoized so segmentation stays linear (#1570).

• Fixed Pipeline.stage2_language_script rejecting national-ID-only and user-supplied language codes that openmed.core.pii already accepted, so an explicit lang is no longer refused one stage earlier (#1569).

• Fixed the shared input gateway rejecting USER_SUPPLIED_MODEL_LANGUAGES codes. openmed.utils.gateway.validate_language now includes them in its default acceptance set, so the REST and MCP edges accept every code they advertise on their language enums instead of returning unsupported_language for ne and ur. include_national_id still toggles exactly NATIONAL_ID_ONLY_LANGUAGES (#1569).

• Fixed day-first date handling for Vietnamese so shifted, replacement, and format-preserving date surrogates all render DD/MM/YYYY instead of MM/DD/YYYY, matching the dmy locale contract already declared for vi (#263).

• Corrected the languages metadata on the 18 OpenMed-PII-Vietnamese-* manifest rows from ["en"] to ["vi"], so Vietnamese PII checkpoints resolve through get_pii_models_by_language("vi"). Those 34 registry keys move from pii_vietnamese_* to pii_vi_* and, as with the Bengali, Chinese, and Tamil reclassification, they no longer appear in get_pii_models_by_language("en"), which drops from 219 to 185 entries (#263).

• Fixed the PySpark batch de-identification adapter so make_deidentify_udf() supplies concrete pandas Series annotations during UDF construction instead of failing with an unsupported Any signature (#1942).

• Fixed openmed risk discover, risk assess, and risk anonymize handling of UTF-8 BOM-prefixed CSV and TSV schemas so the first column is classified consistently, and added bounded validation causes to structured-release CLI errors instead of replacing actionable TypeError and ValueError details with a generic schema mismatch.

Release integration ledger

• PR-associated integrations (213): #335, #340, #1286, #1315, #1344, #1358, #1360, #1369, #1370, #1903, #1904, #1905, #1906, #1907, #1909, #1910, #1911, #1912, #1913, #1914, #1915, #1916, #1917, #1918, #1919, #1920, #1921, #1922, #1923, #1924, #1925, #1926, #1928, #1929, #1930, #1931, #1932, #1933, #1934, #1935, #1936, #1937, #1938, #1940, #1941, #1943, #1945, #1946, #1949, #1951, #1953, #1954, #1955, #1956, #1957, #1958, #1959, #1960, #1972, #1982, #1984, #1987, #1988, #1993, #1994, #1996, #1997, #1999, #2000, #2001, #2002, #2003, #2004, #2005, #2006, #2007, #2008, #2009, #2010, #2011, #2012, #2013, #2014, #2017, #2018, #2019, #2021, #2022, #2023, #2024, #2025, #2026, #2041, #2043, #2045, #2047, #2050, #2052, #2054, #2055, #2056, #2057, #2058, #2059, #2060, #2061, #2062, #2063, #2064, #2065, #2066, #2067, #2068, #2070, #2071, #2072, #2073, #2074, #2075, #2076, #2077, #2078, #2079, #2080, #2081, #2084, #2086, #2087, #2088, #2089, #2090, #2091, #2103, #2104, #2105, #2106, #2108, #2110, #2111, #2112, #2114, #2115, #2116, #2117, #2118, #2119, #2120, #2121, #2122, #2124, #2125, #2126, #2128, #2129, #2131, #2132, #2134, #2136, #2137, #2138, #2139, #2141, #2143, #2144, #2145, #2146, #2147, #2148, #2150, #2151, #2153, #2180, #2182, #2183, #2184, #2188, #2189, #2190, #2194, #2198, #2199, #2201, #2203, #2205, #2207, #2209, #2211, #2212, #2213, #2216, #2217, #2218, #2219, #2221, #2222, #2223, #2224, #2231, #2232, #2235, #2236, #2238, #2240, #2242, #2253, #2256, #2266, #2269, #2270, #2271, #2272, #2273, and #2275.
• Direct integrations: 9b867bcc (nursing-care observation domain), 9b3fa7b4 (TNM extraction), 3c5dad71 (HGVS parsing), e41628df (NER family label maps), 37d5817f (release run ledger), 544e75bf (private marketplace owner email), and a6e10b6b (README maintenance).
• Final release hardening in this change set covers public-manifest refresh, fail-closed Android catalog generation, lazy-export API comparison, release workflow defaults, dependency policy, deterministic test reliability, and fail-closed Pages artifact boundaries. It is described here without a preassigned commit hash so the permanent changelog remains correct after maintainer review and merge.
• GitHub's generated-note set contains 153 entries. The ancestry ledger above is authoritative for range accounting because it also includes integrations excluded from generated notes and direct commits without associated PRs.

OpenMed v2.1.0

OpenMed 2.1.0 is the first feature release on the stable v2 line. It expands local-first clinical extraction, structured privacy, terminology grounding, interoperability, evaluation, and on-device tooling without removing a public Python symbol.

Release date: 2026-08-12.

The release scope covers every current-master change after the v2.0.0 integration boundary at b9ab7a3d. The current published v2.0.0 tag resolves to rewritten-history commit 94ace7d and is an ancestor of master through that boundary. API compatibility compares the published tag tree directly with the v2.1.0 tree; the integration ledger starts after the boundary.

Highlights

• Clinical extraction: note-type and section routing, temporal and coreference graphs, calibrated relations, radiology and discharge-summary structures, dosing sanity checks, clinical fact recall, and span-grounded faithfulness.
• Grounding and interoperability: offline terminology snapshots, hybrid grounding, OMOP loading, FHIR and OpenEHR export, local cohort phenotype resolution, and typed clinical MCP workflows.
• Structured privacy: declarative generalization, relational k-anonymity, streaming tabular anonymization, aggregate-only differential privacy, attacker-model risk reports, and review-first column semantics.
• Multilingual and multimodal intake: Unicode normalization, Belgian and Swiss national-ID validation, RTF and DICOM-SR extraction, OCR layout reconstruction, and opt-in YASBD sentence segmentation.
• On-device and distributed adapters: Android Unicode-scalar parity and grapheme repair, packaged R8 consumer rules, a 753-entry on-device model catalog derived from the 2,266-entry public manifest snapshot, a cross-platform Flutter FFI plugin, and optional Beam, Ray Data, PySpark, Haystack, and LangGraph paths.
• Evaluation and release safety: DirectID evidence, deterministic safety sweeps, signed scorecards, cross-corpus and cross-lingual evaluation, staged promotion, last-green rollback, public-API checks, and fail-closed release readiness.

Compatibility

The static public Python comparison grows from 20,538 to 31,619 symbols: 11,081 additions, zero removals or narrowed signatures, and zero new deprecations. The REST surface grows additively from 15 to 17 paths and from 12 to 15 component schemas with POST /cohort/resolve and POST /omop/load.

Android now enforces the documented cross-platform Unicode scalar offset contract. Applications that passed OpenMed offsets directly to Kotlin UTF-16 string APIs for text containing non-BMP characters must use EntityPrediction.utf16SpanIn. See the 2.0-to-2.1 migration guide for details and the complete cross-surface review.

The bundled Android model catalog is generated from public manifest metadata only and contains 753 permissively licensed ONNX/TFLite entries in this release. Its build now fails if that derivation is empty, preventing a successful AAR from shipping a catalog that makes the documented ModelCatalog.entries.first() flow unusable.

The prior Tamil default checkpoint is no longer present in the public Hub catalog. Tamil now uses the same explicit public placeholder convention as Russian, so this release advertises 33 model-backed PII languages across 35 supported routes. The compatibility alias remains available, but production Tamil extraction requires caller-qualified weights and evaluation.

Install and upgrade

The immutable tag drives package and image publication. Registry availability can lag the source release while those workflows complete, so automation should verify the required coordinate before deployment.

Python

pip install --upgrade "openmed==2.1.0"
pip install --upgrade "openmed[hf,zh,indic]==2.1.0"

Browser and Node.js

npm install openmed@2.1.0

The web package remains unscoped and provides ESM and CommonJS exports.

Swift

dependencies: [
    .package(url: "https://github.com/maziyarpanahi/openmed.git", from: "2.1.0"),
]

Swift package sources are unchanged in this release range.

Android

dependencies {
    implementation("com.github.maziyarpanahi:openmed:v2.1.0")
}

Container and Helm

After publication, the immutable container coordinate is ghcr.io/maziyarpanahi/openmed:v2.1.0. The Helm chart's app version and default image tag are synchronized to 2.1.0; explicit release-image selection uses image.tag=v2.1.0.

Privacy and clinical boundaries

OpenMed keeps local processing as the default. Model downloads and optional remote integrations are explicit boundaries; after required artifacts are present, core PHI processing does not require a cloud service. Telemetry stays off by default, and release evidence uses hashes, counts, offsets, and provenance rather than raw identifiers.

No de-identification system can guarantee zero residual risk. Validate direct identifier recall, leakage, span integrity, language coverage, policy behavior, and quantized-model deltas on the exact deployment path.

Clinical extraction is assistive software, not a medical device or a source of clinical ground truth. Outputs require qualified review and must not automatically trigger diagnosis, treatment, billing, or other clinical decisions.

Validation and publication

The exact release commit is required to pass:

• repository, dependency-license, secret, and action-reference policy;
• locked dependencies, lint, formatting, and the complete Python test suite;
• strict documentation, README translation drift, marketing staging, and regenerated OpenAPI checks;
• wheel/sdist build, metadata, contents, Twine, SBOM, and provenance tests;
• npm install, audit, tests, and tarball inspection;
• Swift resolve/build/tests plus applicable hosted Apple platform jobs;
• Android AAR build/tests, consumer-rule verification, and catalog checks;
• Helm default and synthetic-value lint/render checks;
• applicable amd64 and arm64 container build/smoke jobs;
• API compatibility evidence against the published v2.0.0 tree; and
• committed catalog and registry integrity with the existing latest model pointer equal to its retained last_green evidence.

OpenMed 2.1.0 does not promote a model pointer. Model promotion remains a separate fail-closed workflow: any future change to canary, latest, or last_green requires real staged golden and public SHIELD reports, a signed model gate, and a final readiness decision of exactly READY. Missing candidate files block that model dispatch, but do not turn an unchanged model pointer into a fictitious candidate during an SDK tag.

Hosted checks must refer to the exact release commit; successful jobs on an earlier source head do not qualify the release. Package publication, container publication, release assets, and registry verification remain tag-driven follow-up actions.

Full Changelog: https://github.com/maziyarpanahi/openmed/compare/v2.0.0...v2.1.0