Skip to content
LocumView

Platform

A governed desktop, built from code.

LocumView is being built as a complete clinical workspace defined as code: hardened operating system, curated applications, local AI, and secure delivery. Live today: secure browser delivery of a hardened RHEL 10 desktop, versioned with a full changelog. In progress: the desktop as an image built from code, which already installs and provisions itself; the signing pipeline is next.

The four pillars

  • Secure by design

    Linux desktops hardened to the DISA STIG profile and scanned with OpenSCAP, with every exception documented (done on the reference desktop and built into the desktop image), and each HIPAA technical safeguard mapped to its control, with the gaps stated. Compliance evidence is versioned alongside the code.

    • Done: baseline hardening applied at image build time, not after deployment
    • Next: every image scanned against its profile before promotion
    • Findings, exceptions, and fixes tracked in version control (live: a public changelog with evidence for every change)
    • Done: controls mapped to the HIPAA Security Rule technical safeguards
    DISA STIGOpenSCAPHIPAA mapping

  • AI that stays inside the boundary

    Planned: local models and agents run inside your environment, so no patient data leaves the regulated boundary. Local GPU inference already runs in the build lab; the clinical agents are not built yet.

    • Models served on your own hardware or private cloud
    • Agents will read data only through governed FHIR access
    • No prompts or patient data sent to third-party AI services
    • Every agent action to be recorded in the audit trail
    • Planned (ADR 0011): a local AI operator for engineering work that can only propose changes as pull requests a person reviews
    Local inferenceNo external callsLogged

  • Delivered anywhere, through the browser

    Desktops reach users through a browser with single sign-on and MFA. No desktop is ever exposed directly to the internet.

    • No client software to install on clinical endpoints
    • Live: single sign-on with group-based desktop assignment
    • Live: organizational accounts from a central directory (Red Hat IdM); Keycloak is the only MFA authority
    • WebAuthn and FIDO2 security keys next, for phishing resistance
    • Remote desktop protocols stay on the private network
    Browser accessSSOMFA

  • Reproducible and auditable

    The goal: every desktop a versioned, rollback-capable image built from code. Built: the desktop image installs and provisions itself with no manual steps. CI builds, signs, and attaches an SBOM to every image, and desktops accept only signed updates. Proven rebuildable from a clean clone with zero manual steps. The live demo still runs on the hand-built reference desktop, which moves to the image next.

    • Done: the desktop defined declaratively in a Containerfile, built and signed in a pipeline, with an SBOM attached
    • Live: every change is committed with a changelog entry and its evidence; every image is tagged with the commit it was built from and signed
    • Image updates and rollback verified on image-built desktops; the live desktop rolls back by VM snapshot
    • Planned: identical rebuilds across test, staging, and production
    Image-basedVersionedRollback

Architecture

Four layers, one boundary.

The target architecture: each layer independently versioned and tested, with patient data inside the regulated boundary at every layer. Live today: the access layer and one desktop profile.
Regulated boundary
  1. Access
    • Browser
    • TLS at the Cloudflare edge
    • Guacamole gateway
    • Keycloak SSO + MFA
  2. Workspace
    • Clinical profile
    • Research profile
    • Admin profile
  3. Platform services
    • Local AI runtime
    • Governed knowledge base
    • FHIR client
    • Messaging
    • Files
    • Audit log
  4. Infrastructure
    • Enterprise Linux
    • Virtualization
    • Kubernetes
    • Private or sovereign cloud

Desktop profiles

The right desktop for each role.

Planned: profiles assigned at sign-in based on role, each with only the applications and data access that role needs. Today there is one standard desktop plus an isolated guest desktop, assigned by group.
  • Clinical

    Pharmacists, nurses, physicians

    • Browser-based EHR access
    • Clinical AI agents
    • Unit dashboards
    • Secure messaging
    • Documents
  • Research

    Data scientists, researchers

    • Python, R, and Jupyter
    • Local model serving
    • De-identified datasets
    • Shared notebooks
  • Admin

    Managers, operations, IT

    • Email and calendar
    • Office documents
    • Reporting dashboards
    • Messaging and video

Image-based delivery

Ship desktops like software. Roll back like software.

In progress: the desktop is an image built from a Containerfile, hardened at build time, with updates and rollback through RHEL image mode (bootc). Built: CI builds every image, signs it, and attaches an SBOM, and the installer accepts only a signed image. Still to come: a scan on every build, and promotion from test to production.

  1. Define

    Desktop, packages, and hardening declared in version control.

  2. Build

    A pipeline builds the image from source, identically every time.

  3. Scan

    OpenSCAP checks the image against its hardening profile.

  4. Promote

    Signed images move from test to staging to production.

  5. Roll back

    Any prior image can be restored if a release misbehaves.