Surgery Partners patient access demo

Status: Preview verified | Last reviewed: 2026-10-07

The shared-API regression passed on 2026-10-07: native outbound call and accepted handoff, human catalogue sends, patient callback selection, response-driven Copilot guidance, immutable Conversation snapshots/reload, Salesforce Event and Task creation, idempotent booking retry, calendar download and wrap-up. The run used synthetic patient audio/data and the native opt-in authentication simulation. It exercised the live Preview transport and Salesforce sandbox, not a PSTN call.

The current build covers the initial outbound Voice Agent call, accepted transfer, and live human call with Copilot. It follows the reviewed recording script. The later financial counselor call, surgery booking, clinical preparation, signatures, payment plans and payment collection are outside this build.

Studio assets

Asset	Local tenant resource
Voice Agent	4701 — Surgery Partners · Patient Access
Copilot	4702 — Surgery Partners · Patient Access Copilot
Preview patient voice	4718 — Surgery Partners · Daniel rehearsal caller
Scene Agent	4762 — Surgery Partners · Outbound call scene
Patient catalog	surgery-partners-patient
Representative catalog	surgery-partners-assist
Scene catalog	surgery-partners-scene
Branding	Surgery Partners · Patient coordination
Voice tools	surgery_partners_voice
Copilot tools	surgery_partners_assist

The IDs above belong to the local Vanguard trueserve tenant. The installer uses the tenant and integration constants in model.ts and definition.ts; configure these before using another environment. Within this tenant it resolves named assets and writes IDs to private installation receipts. It preserves unrelated agents, catalogs and integrations.

The outbound agent uses GPT Live with a GPT-5.6 Terra client backend. The voice owns the greeting and privacy question. The backend returns the configured silent token VOICE_HANDLED for name confirmation, then owns messaging permission, the authenticated workflow and subsequent task questions. A silent completion is not another patient answer. This explicit division prevents the backend from repeating the voice's privacy question after a premature link announcement. The original recording exposed that overlap despite instructions asking the voice to remain silent. Later screen actions wait for spoken instructions to finish. The card-review tool updates the existing screen; the backend gives the patient a spoken confirmation instruction without creating another surface. Render payloads remain display-tool arguments.

Editable Scene copy

Surgery Partners · Outbound call scene (4762) opens at /agents/4762/director. Its source is Voice Agent 4701:v20; the Scene owns its script, branding snapshot and generated audio. It covers opening and permission, verification and connection, insurance-card review, and the out-of-network handoff. The representative conversation remains in the live Copilot demo.

scripts/surgery-partners/scene-definition.ts creates the initial script. Details tokens share patient and provider values between speech and screens. Verification follows the identity instruction, and the planning component appears at the spoken word “upload.” Ordinary lines and taps use ripple timing. The default voices are ElevenLabs Sarah for Morgan and Brian for Daniel; all selected takes are saved and editable in Director.

The surgery-partners-scene catalog exposes SurgeryScenePlan, with upload, photo, review, confirmed and coverage states. Its buttons change local presentation, allowing Director to capture and replay taps. It has no conversation lookup, fetch, upload or Salesforce write path. The installer copies the existing Surgery Partners stylesheet into its isolated workspace, then adds Scene-specific theme bindings. Director supplies the branded header; the component does not duplicate it. The live patient catalog and its verified server-state contract remain separate.

With FEATURE_SCENE_AGENTS=true in the local ai-manager environment:

bash .devcontainer/scripts/with-env.sh -- bash -c \
  'cd apps/ai-manager && npx tsx scripts/surgery-partners/create-scene.ts --apply'
bash .devcontainer/scripts/with-env.sh -- bash -c \
  'cd apps/ai-manager && npx tsx scripts/surgery-partners/verify-scene.ts'

The first command creates the Scene through /api/director/scenes, saves the script with revision checks, and generates each missing take through the normal audio API. Its private scene/scene.json receipt lets retries resume the same project without replacing saved edits or regenerating matching audio. Add --publish-catalog only when changing Scene component source; an existing Scene keeps its pinned version until updated in Director.

The browser check edits and restores a spoken line and its pause, captures a phone tap and undoes it, seeks through verification and card confirmation in both directions, checks saved playback after reload, and exports through the Director UI. It verifies that playback generates no new audio and invokes no live patient endpoints. Evidence, screenshots, the saved document and the MP4 live under .local-data/surgery-partners/scene/. prepare-scene-delivery.ts verifies the actual export's codecs, duration, spoken order and both speakers, then creates a standalone player with Open Scene in Director and Download MP4 links. Decoded browser audio is checked during both voices and the closing.

Validation on 2026-10-07 passed with 14 saved voice takes and a 94.823-second H.264/AAC export. Script and pause editing, captured taps and undo, backward seeking, reload and export passed in the browser. The exported audio matches the selected takes for both roles and plays audibly in the standalone player.

Data and repeatability

All people, facilities, insurers, clinical details, prices and appointments are fictional. The live connection is the existing DevSDO Salesforce sandbox. There is no live payer eligibility, authorization, payment or calendar-capacity integration.

Salesforce record	Use
Person Account and its Contact	Daniel Reed's identity and patient relationship
MemberPlan and payer Account	Recorded synthetic Harbor Health PPO eligibility and identifiers
Facility Account; surgeon and counselor Contacts	Riverside Spine Hospital, Dr. Maya Chen and Jordan Lee
Source Case	Typed scenario document in Description: surgical plan, network evidence, estimate and counselor windows
Child Case per voice conversation	This rehearsal's insurance work, handoff and outcome
Task	Consult/insurance history; authorization and agreement review assignments; counselor callback
Event	Confirmed financial counseling window
VoiceCall, when using live contact-center ingress	Relationship between the human conversation and its interaction Case

The source Case is keyed by sp:episode:daniel:spine. Each new voice session gets sp:run:<conversation UUID>. Event and Task external keys include that UUID; retries reconcile existing relationships and times instead of creating another booking. New rehearsals preserve old records and need no reset. Seeding uses additive lookup/create operations and does not overwrite a presenter's edits.

The fixed scenario occurs on October 14, 2026, with callback choices on October 15, and planned surgery on October 28. All displayed windows are Eastern. Recorded creation/audit times remain actual times.

Callback capacity is synthetic and partitioned by rehearsal. Jordan Lee is a fictional counselor Contact; Event/Task ownership is the configured integration user, recorded in the source scenario. This demonstrates a persisted assignment, not access to Jordan's production scheduling calendar.

The Daniel voice is a rehearsal aid for Studio's Copilot tester. It has no Salesforce tools and is not published to a contact-center integration.

The $8,500 estimate assumes $5,000 remaining deductible and $3,500 coinsurance. It remains conditional on the hospital arrangement and benefit treatment. Internal review Tasks are neither payer submissions nor authorization approvals.

Human-controlled patient components

SurgeryWorkspace and SurgerySupportCue offer Send estimate to patient and Send callback choices. These are authenticated actions, not model instructions to pretend a component was delivered.

They now use the shared customer-components API. The Surgery Partners handler supplies verified screen data and enforces its callback rules; shared code owns delivery, responses, receipts and Conversation history. The catalog uses dispatchAction for both directions. Its older interaction route rejects send and select_slot with 410.

1. The Surface BFF selects the signed embed cookie matching the conversation.
2. Studio verifies tenant, agent, role, patient verification, and the reciprocal link between original voice and current human conversations.
3. The action locks the original interaction and checks its revision and idempotency receipt.
4. The server persists the new patient view and native A2UI events on the original patient conversation.
5. Events are published to both UUID and transport session stream aliases. Authenticated polling and stored event replay recover a disconnected screen.

The Connected indicator uses the authenticated patient screen's 15-second heartbeat, independently of the ended voice transport. It shows a recently open screen, not proof that the patient read or approved the displayed content.

Ending the AI leg does not terminate this administrative patient plan while its linked representative call remains active. Patient selection flows through the same API and appears in the representative's workspace. Book callback creates an all-or-none Salesforce Event/Task pair, reads it back, and then displays confirmation. A Preview call also receives a durable demo phone notification. A live call receives the patient-plan confirmation; this build does not claim carrier SMS delivery for that confirmation.

Shared patient links cannot invoke representative actions. Patient actions cannot supply a different Salesforce record, mark a booking complete, or choose a screen. Stale requests fail with a refresh message. Retrying the identical action returns the existing result; reusing its ID for another action fails.

The catalog uses direct patient headings and one instruction per action. After card extraction, Replace card photos folds away the upload controls. Estimate details, Call notes, and Medications expand on demand. The estimate's uncertainty and required patient confirmations stay visible. Copilot shows a suggested reply and its send action; the model's explanatory reason remains in the audit payload. Guidance prompts limit headings to six words and replies to two sentences and 45 words. Product screens omit demo narration, slogans and Salesforce implementation details.

Verification and handoff

Patient access requires successful native authentication audit evidence bound to Daniel's Salesforce identity. A spoken name, session variable, or model claim is insufficient. Native Simulate in Preview is enabled for repeat rehearsal; its result is honored only when the conversation's persisted is_test is true. It never counts as real assurance for a live call.

Card upload uses the existing conversation attachment API. Only two different images belonging to this conversation can be read. Vision extraction compares the payer, member ID and group with MemberPlan. A matching extraction still requires the patient's These details are correct action.

The native Studio phone renders the same catalog without a Surface iframe. Its /api/surgery-partners/interactions/{conversationId} BFF requires a registered phone owner matching the Studio user and tenant, the Surgery Partners Voice Agent, a persisted test conversation, and native patient verification. It always assigns the patient role, even when the Studio user is an administrator. /api/phone/conversations/{conversationId}/images forwards bounded image uploads with the registered conversation's signed scope. /api/conversations/{conversationId}/images is the catalog-compatible alias and enforces the same ownership. Neither route accepts an unregistered conversation ID.

The transfer tool evaluates the actual latest caller response against the preceding question. Frustration alone is not acceptance. Explicit early requests for a representative are honored with an accurate partial handoff.

Preview Copilot sessions supply related_conversation_id as a session variable. The Copilot tool binds it to original_conversation_id; the runtime does not persist arbitrary template variables in conversation metadata. Both sessions must be persisted test conversations, with a verified patient and accepted handoff. Once attached, the reciprocal relationship is persisted and locked to that representative session. Live sessions resolve a Salesforce VoiceCall whose VendorCallKey identifies the human session and whose RelatedRecordId points to the original interaction Case. A guessed variable cannot attach a Preview session to a live patient call.

An interrupted test representative session can be reopened against the same accepted test handoff. The prior human session must have ended, the interaction must remain incomplete, and all three conversations must be test records. Prior representative IDs remain in the audit metadata; reciprocal authorization prevents the old session from continuing to control the plan. Active or live human calls cannot be taken over this way.

After booking, the callback suggestion offers Send confirmation. The API rejects stale requests to reopen callback choices for an already booked interaction.

Genesys is the preferred contact-center integration. Publishing an agent against that integration is distinct from configuring an outbound campaign, queue, Architect transfer flow and Salesforce VoiceCall mapping. Preserve existing Takeda and other telephone routes.

Install and validate

From the repository root:

python apps/ai-manager/scripts/surgery-partners/make-card-fixtures.py
bash .devcontainer/scripts/with-env.sh -- bash -c \
  'cd apps/ai-manager && npx tsx scripts/surgery-partners/seed.ts --apply'
bash .devcontainer/scripts/with-env.sh -- bash -c \
  'cd apps/ai-manager && npx tsx scripts/surgery-partners/install.ts --apply'
bash .devcontainer/scripts/with-env.sh -- bash -c \
  'cd apps/ai-manager && npx tsx scripts/surgery-partners/preflight.ts'
bash .devcontainer/scripts/with-env.sh -- bash -c \
  'cd apps/ai-manager && npx tsx scripts/surgery-partners/rehearsal.ts --simulate-auth'

The card generator uses Pillow and the bundled brand fonts. Isolated behavioral checks run with npx tsx scripts/surgery-partners/model-evals.ts under the same environment wrapper. These separately exercise transfer consent, secondary insurance reconciliation, and Copilot guidance.

Use model-evals.ts --copilot-only after guidance-copy changes to check the four Copilot scenarios three times, including headline and reply length. Results go to copy-model-evals.json without replacing the full suite's evidence.

install.ts --apply --publish additionally uses Studio's normal publish API. For a voice-only revision, publish-voice.ts --apply validates the editor configuration, updates that draft, and publishes through the same API. It preserves the Copilot and rehearsal-caller versions. Catalog publishing first runs a TypeScript check against the installed React and icon declarations. A successful bundle alone does not establish that every screen can render. The rehearsal uses native Preview gRPC, real STT/voice/model calls, a browser and real Salesforce writes. Synthetic caller audio and demo notification delivery do not exercise PSTN or a live Genesys representative.

Private receipts, screenshots, transcripts and browser video are written under .local-data/surgery-partners/. Never check in embed tokens, authentication links, browser sessions or integration credentials.

inspect-studio.ts checks the real Studio Suggestions / Workspace switch and selection of the Daniel stand-in. privacy-rehearsal.ts runs short native audio regressions without completing identity verification. standin-rehearsal.ts checks that Daniel voices the cost concern and prefers a later counselor conversation while staying in the patient role.

After a successful fresh rehearsal, run python apps/ai-manager/scripts/surgery-partners/render-rehearsal.py from the repository root to compose the actual browser videos and captured Preview PCM into an MP4. Opening and closing silence are trimmed. Branded opening panels cover the initial blank patient page and representative browser setup; the representative view appears when the human portion begins. The recording contains synthetic patient and representative voices and does not demonstrate PSTN transport.

For a recording of Studio's actual phone and AI Activity, use its native tab recorder:

xvfb-run -a -s '-screen 0 1920x1200x24' \
  bash .devcontainer/scripts/with-env.sh -- bash -c \
  'cd apps/ai-manager && npx tsx scripts/surgery-partners/browser-recording.ts'

This opens headful Chromium, enables Show AI Activity, Recording, and Mock Caller, then clicks Test & Record. SMS stays off so messages use Preview's phone tray rather than carrier delivery. Daniel's speech comes from Studio's configured Mock Caller; the browser operator opens the native verification screen, uploads the two card fixtures, and confirms the readback. It uses Studio's canonical persisted utterances to identify each instruction and observes PCM durations through DevTools to wait for speech to finish before submitting the next screen action. Silent packets do not extend that wait; repeated transport caption fragments are not treated as new words. The script downloads Studio's MP4 after the accepted handoff. It does not replace capture APIs, intercept application responses, or compose a phone UI over separate footage. --inspect checks the setup without starting a call. Output is private under browser-preview-ordered/; SP_RECORDING_DIRECTORY selects another private take directory. Shorten long silences in downloads is enabled: gaps over 1.8 seconds retain 0.9 seconds, and quiet edges are trimmed. Studio applies the same edit intervals to audio and video in their original sequence. The evidence records the converter's removed-seconds response header. Live Preview retains its real timing. The recorder requires the native Call ended status and End Session activity after the accepted handoff. A provider failure does not pass simply because a partial video is available. Run verify-browser-video.ts under the same environment wrapper to inspect the exported streams and transcribe the actual MP4 audio with the configured Deepgram integration. It checks both speakers, the recorded insurance and transfer discussion, and the audible order of the privacy question, patient answer and secure-link instructions. Review the remaining exported utterances for repeats or cut-off instructions as well. The verifier also rejects spoken internal completion messages and requires one additional-insurance question. prepare-browser-delivery.ts packages that verified export with normalized AAC audio, copying the video stream, and creates a standalone player with a Play with sound button. It checks decoded browser audio during both speakers and the closing. The original timing is retained separately in native-untrimmed.mp4, downloaded through Download original MP4; the native converter supplies all silence edits.

Run phone-route-checks.ts <conversation-id> under the same environment wrapper to check anonymous, other-user, unregistered-session, invalid-image, and patient-role denials against the real Studio BFF. Use --before-verification on an unverified phone session to check its identity gate. These checks do not change patient records.

Verified behavior

The October 7 validation used actual native Preview audio, live models, browser uploads and buttons, and Salesforce DevSDO writes:

• Two consecutive fresh outbound calls completed verification, two-sided card extraction, explicit card confirmation, additional-insurance reconciliation, review Task creation, accepted handoff, and voice-leg termination.
• The human Copilot attached through its runtime-bound startup tool. Its affordability and callback suggestions drove the actual patient-screen buttons.
• Patient selection, Event/Task creation, read-back, Preview notification, calendar download, page recovery, and Case wrap-up passed.
• Duplicate actions returned their existing receipts. Changed payloads under an existing action ID and new actions with stale revisions were rejected. A patient capability could not invoke representative booking.
• Fifty-one isolated live-model checks passed, as did three native privacy rehearsals, the Daniel stand-in rehearsal, six domain/Preview URL tests, and three share-branding authorization tests.
• The additive seed returned the same supporting record IDs. The real Studio view switch and stand-in selector passed browser checks. Both app type checks and the isolated catalog type check passed.
• After the copy review, another full Preview rehearsal passed with the revised screens, including replacement-photo expansion and the human send/booking controls. Twelve focused Copilot checks passed for next action, reply length and filler phrases. The updated recording uses those revised screens.
• A native Studio phone recording against Voice Agent 4701:v13 completed verification, both card uploads, on-screen confirmation, coverage review, accepted handoff and normal termination. The 2:21 H.264/AAC export includes AI Activity and the complete closing announcement. Transcription of the exported audio identified both speakers. Seventeen targeted unit checks and eighteen real BFF checks passed for the new phone routes and Mock Caller message delivery, published-version resolution and silent waiting.
• The replacement recording against 4701:v20 completed the same workflow with the opening, card review, additional-insurance question and handoff in order. Studio shortened 78.6 seconds of silence to produce a 92-second export. Transcription of that MP4 confirmed both speakers and the complete closing, with no repeated insurance question or spoken internal completion message. The standalone player's decoded audio passed checks during Morgan, Daniel, and the closing. The local GPT Live suite passed all 244 tests after the application-reply ordering and empty-completion fixes; the ten recording unit checks and user-guide build also passed.

Private evidence is in fresh-rehearsal-passed.json, rehearsal-latest.json, human-continuation-passed.json, model-evals.json, privacy-rehearsal.json, standin-rehearsal.json, studio-preview-check.json, copy-review.json, and copy-model-evals.json under the local artifact directory. Native phone evidence, the MP4, access checks, and exported-audio verification are under browser-preview/; the replacement recording, original timing, audio transcript and player checks are under browser-preview-ordered/. The user guide builds and API/SDK references regenerate. The wider route-auth audit reports four unrelated handlers in Allianz reviews and Takeda interactions; none are Surgery Partners routes.

The wire contract lives in apps/ai-manager/lib/surgery-partners/model.ts. Installation copies it into the isolated catalog workspace as domain.ts; Next's application build must not import runtime code from a sibling catalog directory. UI code lives in apps/catalog-builder/catalogs/tenant/surgery-partners.

See the presenter guide and brand asset provenance.