Review and sign-off

Per-condition review

Open a clause under 條文審核 (Clause review). The default 節點審核 (Node review) tab shows the decision logic in the middle, as an outline (大綱) or a structure graph (結構圖). Click a condition and the panel on the right lists its machine evidence.

At the bottom the panel asks 這個條件的邏輯正確嗎？ (Is this condition’s logic correct?) and offers Accept (接受, shown as 接受此邏輯, “accept this logic”), Reject (退回) or Not applicable (不適用). Decisions can be changed: clicking another one adds a new record, and the latest one counts.

The panel has three tabs:

Logic review 邏輯審查

The clinical question, model review notes (when there are any), the clause text with this condition’s source highlighted, and the round-trip summary with whether it agrees with the source. A quote with no verbatim match in the text gets its own warning here; see quote verification.

Execution results 執行結果

This condition’s ablation cases: a baseline with everything true, then this condition switched to false or null to see whether the result changes as expected. If a case fails, a warning appears above the decision buttons.

CQL

The generated CQL source, read-only and collapsed by default. Review relies on the evidence in the other two tabs.

The page header also summarizes four layers of machine evidence for the whole clause:

Structure 結構

How many conditions and groups there are, derived from the compiled ELM.

Alignment 對齊

A structural comparison with the official logic picked under 對照官方 library (compare with official library) in the header. With nothing picked it shows 未指定 (not set).

Executable 可執行

How many ablation cases pass.

Faithful 忠實

Whether the round-trip summary means the same as the source. After a logic edit it shows 需重新驗證 (needs re-checking).

Each decision records the reviewer, the time, and a hash of the CQL and IR at that moment, and is written to audit_log. Once every condition has a decision, the clause moves from Draft or Analyzed to Reviewed automatically.

The header labels 需醫師簽核 (physician sign-off required) and LLM 自動通過 · 可推翻 (LLM auto-pass, can be overridden) come from triage during analysis. They are only labels and never sign off on anyone’s behalf.

Editing logic

Reviewers and admins can edit the logic right on the review page, without going back to the workbench. There are two ways in:

• Switch the decision logic view to 編輯 (Edit): add, change and delete conditions, switch a group between AND, OR and NOT, add conditions or subgroups to it, or move it into another group.
• The menu next to a condition: 編輯此條件 (edit), 在同一群組新增條件 (add a condition to the same group), 移至其他群組 (move to another group), 用 LLM 重新分析此條件 (re-analyze with the LLM) and 刪除此條件 (delete).

Conditions and groups detached from the root group are listed in an unlinked area (未連結) below. They don’t affect the result, and can be added back to a group from there.

Every condition needs at least one source. When editing a condition, the source field (出處（原文依據）) can link an existing source or add a new one from text you select in the clause. A quote you add or rewrite must appear in the source text, or the save is rejected; quotes produced by the analysis and left unchanged are exempt.

When you press 儲存修改 (Save changes), a confirmation lists how many items were added, changed and deleted, and which review decisions will be invalidated. You can add a note, which goes into the review history. On save:

• The IR is checked first; an invalid IR isn’t saved.
• The CQL is regenerated and the ablation check re-runs automatically.
• The round-trip check costs an LLM call, so it doesn’t re-run on its own; it is only marked 需重新驗證 (needs re-checking). Press 重新執行反向驗證 (re-run round-trip check) in the panel to update it.
• Review decisions are invalidated by the rules in sign-off and invalidation.

When you start editing, the page records a hash of the current CQL and IR (baseHash). If someone else saves while you edit, your save gets a 409 instead of overwriting their work. You can then load the latest version (載入最新版本) and lose your changes, or keep your changes (保留我的修改), which keeps them on screen but can’t save them.

An approved or locked clause can’t have its logic edited until it is sent back for re-review; see clause status. Nothing can be edited while the document is being analyzed. Logic edits made in the workbench follow the same rules.

用 LLM 重新分析此條件 (re-analyze this condition with the LLM) sends the condition and the text it cites back to the model for another per-condition cross-check; other conditions are untouched. The result is saved as a logic edit in your name, under the same restrictions as above. If the condition doesn’t change, no decision is invalidated. The condition’s model review notes are replaced by the new ones.

Sign-off and invalidation

Once the conditions are reviewed, switch to 簽核前對照 (pre-sign-off comparison) to sign off on the whole clause. The source text is on the left, and hovering over a condition highlights where it comes from. The right side lists each condition with its decision, and at the bottom is the clause sign-off (整條簽核) with 核准此條文 (approve this clause), 退回 (reject) and 不適用 (not applicable).

The confirmation shows how many conditions have been reviewed, how many haven’t, and how many were rejected. You can sign off with conditions still unreviewed; the dialog only warns you. The sign-off is recorded under your account.

Each sign-off applies to one version of the logic. When the logic changes, the decisions tied to it are invalidated:

The clause status is then re-derived from the decisions that remain: Reviewed if every condition still has one, otherwise back to Analyzed. When a clause is re-analyzed in the workbench and any sign-off is invalidated, it always goes back to Analyzed.

Invalidated decisions aren’t deleted. The review history (審核紀錄) still lists them, struck through, with the reason: condition changed, condition deleted, logic edited, sent back for re-review, or re-analyzed.

Clause status

A clause has six statuses. A clause-level decision moves it as follows; “—” means the status stays the same:

In other words, accepting an approved clause once more locks it.

Per-condition decisions never approve a clause. They only move Draft or Analyzed to Reviewed once every condition has a decision.

To change an approved clause, first send it back with 退回重審 (send back for re-review); reviewers and admins can both do this. Only an admin can unlock a locked clause, with 解鎖退回 (unlock and send back). You can give a reason, which goes into the review history. Sending back invalidates only the clause sign-off and keeps every condition decision, so the status returns to Reviewed or Analyzed.

Logic edits, single-condition re-analysis, send-backs, round-trip re-runs and every sign-off are written to audit_log.