Maintain a privacy-safe contribution ledger

[maziyarpanahi]

Summary

Audit and attribution require participation history, but a central ledger must not reveal institutions, patient counts, or local performance slices.

Scope

• Record pseudonymous participation receipts, round roles, policy versions, and update commitments with selective disclosure.
• Support independent verification of ledger continuity without publishing client-level metrics.

Acceptance criteria

• The implementation is deterministic and performs no mandatory network call.
• Logs, exceptions, reports, and fixtures contain no raw sensitive values.
• .venv/bin/python -m pytest tests/unit/governance/test_contribution_ledger.py -q

Out of scope

• A compliance certification or autonomous clinical decision guarantee.
• Bundling restricted datasets, credentials, or proprietary services.
• Unrelated changes to release publishing or existing public APIs.

Files

• openmed/governance/contribution_ledger.py
• tests/unit/governance/test_contribution_ledger.py
• docs/governance/contribution-ledger.md

---

Task: OM-174d · Milestone: v3.3 · Priority: P0 · Size: M
Depends on: — · Blocks: —
Roadmap: Audited V3 horizon expansion, 2026-08-13: OPENMED_V3_HORIZON_BRIEF.md sections 3 and 6; OPENMED_BENCHMARK_PORTFOLIO_AND_TRUST.md section 9
Spec: PLANS/V2/EXECUTION/tasks/OM-174d.md