# RMP-SKIN-004 Rash and skin irritation photo log: symptom questions first, then standard consented photos for the flight surgeon (the CMO examines)
# Version 0.2 (Draft). CONCEPTUAL. NOT FOR CLINICAL USE.
# Space Medicine Foundation robot-readable protocol library. Format: https://spacemedicinefoundation.org/robotic-medicine/protocols/schema/
# Every threshold marked <set by ...> must be set by the named owner (see the schema) before any use.
schema_version: '0.3'
version: '0.2'
status: draft
conceptual: true
not_for_clinical_use: true
max_autonomy: 2
missions:
- leo
- commercial
- moon
- mars
updated: '2026-10-21'
review:
  state: reviewed-ai-assisted
  requested: '2026-10-21'
  reviewed: '2026-10-21'
  human_clinician_review: false
  text: >-
    AI-assisted clinical and source review by the Medical Research Assistant, Oct 21, 2026 (batch 11 review:
    10 required corrections, R1 to R10; 9 optional suggestions not applied in this version); all required
    corrections that apply to this protocol are applied in this version (see Corrections). No named human
    clinician has reviewed it. Not for clinical use.
fixed_rules:
  flight_surgeon_is_medical_authority: true
  cmo_acts_under_delegated_care: true
  human_starts_and_restarts_robot: true
  robot_never_diagnoses: true
  no_drug_or_fluid_advice_by_robot: true
  safe_state_on_fault_or_no_response: true
  lost_link_pause_then_cmo_decides: true
robot_lockouts:
  diagnosis: true
  drug_or_fluid_advice: true
  starting_stopping_or_adjusting_oxygen_or_any_medicine: true
  self_start_or_self_restart: true
  changing_own_protocol_thresholds_or_limits: true
  handing_over_a_mismatched_item_as_verified: true
id: RMP-SKIN-004
slug: rmp-skin-004
title: >-
  Rash and skin irritation photo log: symptom questions first, then standard consented photos for the
  flight surgeon (the CMO examines)
category: skin
tier: 3
rung_note: >-
  Max rung 2 for asking symptom questions on screen, moving the camera to the standard view the CMO sets
  at the set distance and without contact, and labelling, storing and sending photos, as in RMP-SKIN-003.
  The robot never judges a rash.
result_language:
  use:
  - photo recorded
  - photo not obtained
  - flagged for human review
  - as stated by the CMO
  - sent to flight surgeon
  never:
  - normal
  - no problem found
  - all clear
  - negative
  - any diagnosis or cause
  - allergy
  - allergic
  - eczema
  - heat rash
  - not serious
  - fading
  - blanching
  - non-blanching
  - better
  - worse
  - spreading
  - no change
  - infected
  - not infected
  - contagious
  - safe
  - mild
  - minor
scope:
  summary: >-
    When a crewmember has a rash or skin irritation, on the crewmember's or the CMO's command, the robot
    first asks symptom questions on screen and raises an URGENT alert for any red flag. Then, with consent
    before the camera moves, it takes standard photos of the area the CMO sets, as in RMP-SKIN-003: an
    establishing view with a margin of surrounding skin, a close-up with a scale, and the same close-up
    without it. If the CMO does a glass test (pressing a clear glass on the rash), the robot records what
    the CMO states. Photos are labelled, stored in the medical record and sent to the flight surgeon,
    who judges every finding.
  why: >-
    Skin rashes were the most reported clinical event in long-duration ISS crew among the categories studied
    (Crucian 2016). A non-blanching rash, or one that spreads quickly, can be meningococcal disease and
    needs emergency care; it can be harder to see on brown, black or tanned skin and can change from blanching
    to non-blanching, so the CMO checks the whole body and the robot only records what the CMO states
    (NICE NG240). A painful spreading rash with blisters and sores of the eyes, mouth or genitals, usually
    in the first week of a new medicine, can be a severe drug reaction (DermNet 2016), so it is URGENT.
    Breathing trouble or swelling of the lips, tongue or throat is treated as a severe allergic reaction
    (Resuscitation Council UK). The photo rules follow RMP-SKIN-003 (IMI 2019); the robot's role is design
    judgment.
  covers:
  - Rashes, hives, itching and skin irritation, including from tape, sweat or equipment contact
  - >-
    Wound photos: RMP-SKIN-003; skin and wound care: RMP-SKIN-001; mottled skin after an EVA: RMP-EVA-001;
    chemical skin contact: RMP-ENV-005
  locked_out:
  - Diagnosis or naming a cause
  - Any medicine, fluid or oxygen advice; starting, stopping or adjusting oxygen
  - Touching the crewmember
  - >-
    Handing over any medicine outside RMP-PHARM-001, or after a MISMATCH or CANNOT VERIFY (the item stays
    quarantined; only the CMO can ask for it, through the RMP-PHARM-001 logged two-step override)
  - Touching the skin or pressing a glass on the rash
  - Judging a rash, whether it fades under pressure, or whether it is spreading
  - Photographing anything outside the area the CMO set, or any photo without consent
  - >-
    Showing a photo on a shared display, or using photos for robot or AI training, research or outreach
    without separate written consent
  - Using the robot camera for the genital, breast or buttock area unless the crewmember chooses it
  - Any cream, ointment or medicine advice
  related:
  - RMP-SKIN-003
  - RMP-SKIN-001
  - RMP-RESP-003
  - RMP-INF-001
  - RMP-EVA-001
  - RMP-ENV-005
  - RMP-PHARM-001
roles:
  medical_authority: Flight surgeon (ground). Holds medical authority for every run.
  onboard_lead: >-
    Crew medical officer (CMO), acting under delegated care; uses the pre-approved onboard checklist when
    there is no link.
  others:
  - 'Second trained CMO: receives every alert and takes over if the CMO is the patient'
  - 'Vehicle commander: leads any cabin emergency procedure'
  - 'Other crew: help as the CMO or commander directs'
  robot_may:
  - Ask symptom questions on screen first
  - Move the camera to the standard view the CMO set, at the set distance, without contact
  - Take, label and store photos
  - Record the CMO's glass test result as stated
  - Show earlier photos side by side on request
  - Send photos to the flight surgeon
  robot_may_not:
  - Touch the crewmember
  - Say what a rash is or whether it fades
  - Photograph without consent
  - Start without a human command
  commercial: >-
    On commercial flights, 'flight surgeon' and 'CMO' mean the operator's designated medical authority
    and trained onboard responder. If no trained responder is aboard, this protocol is not used. (NASA-STD-3001
    requires two CMOs per vehicle for NASA programs [V1 3006]; FAA rules set no medical standards for
    spaceflight participants.)
preconditions:
- id: PRE-1
  text: The crewmember or the CMO started the protocol by command for a rash or skin irritation.
  check: human_start == true
  refs:
  - V2 10174
- id: PRE-2
  text: Robot self-test passed; kit stowage locations known.
  refs:
  - V2 10161
  - V2 7059
- id: PRE-3
  text: Robot and supplies restrained when not moving.
  refs:
  - V2 7046
- id: PRE-4
  text: Link status known. The crew never wait for the robot before acting.
  check: link_state in [live, delayed, down]
consent:
  standard: >-
    The crewmember agrees to the photos before the camera moves; photos frame only the area the CMO set,
    with a margin of surrounding skin. For the genital, breast or buttock area, the robot camera is used
    only if the crewmember chooses it; otherwise the CMO takes the photos with a handheld camera and adds
    them to the log. Photos go only to the CMO, the flight surgeon and people the flight surgeon names.
  emergency: If the crewmember cannot agree, no photo is taken; any red flag raises an URGENT alert.
  withdrawal: >-
    The crewmember can stop a photo or the whole log at any time; withdrawal stops future photos, and
    the flight surgeon decides on photos already taken.
inputs:
- id: IN-1
  name: >-
    Symptoms in the crewmember's words: where, since when, itching or pain, blisters, mouth, eye or genital
    sores, breathing trouble or swelling, fever, a new medicine, recent EVA, chemical or equipment contact
  source: Crewmember
  required: true
  if_missing: Log "no response"; D2 applies.
- id: IN-2
  name: The area to frame and the standard view, set by the CMO
  source: CMO
  required: true
  if_missing: No photo is taken until the CMO sets the view.
- id: IN-3
  name: The CMO's glass test result and findings, as stated
  source: CMO
  required: false
  if_missing: Log "not stated".
- id: IN-4
  name: Each photo, with the area, view, date and clock time
  source: Robot camera
  required: false
  if_missing: Log "photo not obtained" and tell the CMO.
- id: IN-5
  name: Link status and delay
  source: Communications system
  required: true
  if_missing: Treat as link down; photos are queued.
steps:
- id: S1
  actor: robot
  rung: 2
  action: >-
    Tell the CMO and the flight surgeon that a rash photo log has started (URGENT if any red flag is stated).
    Before any photo, show the symptom prompt on screen (breathing trouble or swelling of the lips, tongue
    or throat is asked first) and log answers word for word. Every URGENT alert goes to the CMO and the
    flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is
    the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the
    crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within <set by
    validation> seconds is repeated and sent to the next named crewmember.
  success: Notice acknowledged; answers logged, or "no response".
  refs:
  - V1 3004
  - V1 3006
- id: S2
  actor: crew
  action: >-
    The CMO examines the skin under the onboard checklist line "check all over the body and the conjunctivae
    (the inside of the eyelids); a rash may be difficult to see on brown, black or tanned skin", sets
    the standard view and the area to frame (with a margin of surrounding skin) and places the scale the
    flight surgeon chose. If the CMO does a glass test, the CMO states the result. For the genital, breast
    or buttock area, the robot camera is used only if the crewmember chooses it; otherwise the CMO takes
    the photos with a handheld camera and adds them to the log.
  success: View and area set; findings stated.
  refs:
  - V1 3004
- id: S3
  actor: robot
  rung: 2
  action: >-
    Record the CMO's findings and any glass test result word for word, marked "as stated by the CMO";
    the robot never judges whether a rash fades. A fading glass test result never ends an alert and is
    never logged as reassuring.
  success: Findings logged.
  refs:
  - V1 7001
- id: S4
  actor: robot
  rung: 2
  action: >-
    Only after the crewmember agrees (D3), move the camera to the standard view the CMO set (about 90
    degrees, the same distance, light and plain background each time), no closer than the set camera distance,
    and take the standard set: an establishing view with a margin of surrounding skin (the area the CMO
    set), a close-up with the scale, and the same close-up without the scale. Label each with the area,
    view, date and clock time, and mark it "for human review". A photo with anything outside the area
    the CMO set in frame is held unsent and flagged to the flight surgeon, who decides whether to keep
    it.
  success: Photos taken and labelled, or "photo not obtained".
  limit: <set by validation>
  refs:
  - V1 7001
- id: S5
  actor: robot
  rung: 2
  action: >-
    On request, show earlier photos of the same area side by side for the CMO; the robot never says what
    has changed.
  success: Photos shown on request.
  refs:
  - V1 7001
- id: S6
  actor: crew
  action: The crew clean the camera, the scale and any shared surface under RMP-INF-002.
  success: Cleaning recorded as stated.
  refs:
  - V2 7046
- id: S7
  actor: robot
  rung: 2
  action: >-
    After any URGENT alert: After an URGENT alert the robot does not leave on its own: it stays at its
    rest position in the module, with its screen and voice link available, until a human has taken over
    or tells it to go. It never follows, blocks or touches anyone. It keeps time-stamping what humans
    say they did, and repeats the alert if it is not acknowledged.
  success: Robot at rest in the module until a human releases it; alert acknowledged or escalated.
  refs:
  - V2 10173
  - V1 3006
- id: S8
  actor: ground
  action: >-
    The flight surgeon (or the CMO under the onboard checklist when there is no link) reviews the answers
    and photos and decides on care, follow-up photos and any medicine through RMP-PHARM-001.
  success: Decision logged.
  refs:
  - V1 3004
- id: S9
  actor: robot
  rung: 2
  action: >-
    Only after the CMO or flight surgeon has placed an order, run RMP-PHARM-001 for the ordered item (fetch,
    barcode match to every order field, recipient check). This protocol adds nothing to that check, never
    suggests an order, and never hands anything over outside RMP-PHARM-001.
  success: RMP-PHARM-001 run logged with its result, or none ordered.
  refs:
  - V2 7059
- id: S10
  actor: robot
  rung: 2
  action: >-
    Send the flight surgeon one package: answers, findings as stated, labelled photos, alerts and decisions.
    Photos are stored only in the crewmember's medical record, encrypted in storage and in transit as
    the program requires; access is limited to the CMO, the flight surgeon and people the flight surgeon
    names. They are never shown on a shared display and never used for robot or AI training, research
    or outreach without separate written consent.
  success: Package delivered or queued.
  refs:
  - V1 6003
  - V1 7003
decisions:
- id: D1
  after: S1
  decided_by: robot
  question: >-
    Checked after every answer and at any point in the run (even mid-question or mid-step): does any answer,
    reading or observation meet a red flag?
  branches:
  - if: 'Yes'
    then: >-
      Stop the current question or step at once and apply the action listed for each matching red flag
      (URGENT alert, flag, or stop), with the answer or reading itself, never a cause. Every URGENT alert
      goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link
      is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the
      second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not
      acknowledged within <set by validation> seconds is repeated and sent to the next named crewmember.
  - if: 'No'
    then: Continue.
- id: D2
  after: S1
  decided_by: robot
  question: Did the crewmember answer the symptom prompt, or say they want to skip it?
  branches:
  - if: 'Yes'
    then: Continue.
  - if: Declined explicitly (the crewmember says no to a question)
    then: Log "declined" for that question only; the alert already sent stands.
  - if: No response, or the answer does not make sense
    then: >-
      URGENT: log "no response" (never "declined"); the CMO, or the second trained CMO if the CMO is the
      patient, checks the crewmember in person at once.
- id: D3
  after: S3
  decided_by: robot
  question: >-
    Before the camera moves: did the crewmember agree to this session's photos (each view is named on
    screen before it is taken)?
  branches:
  - if: 'Yes'
    then: Continue to S4; the crewmember can say stop before or during any view.
  - if: No, or no answer
    then: The camera does not move and no photo is taken; log "photo not taken – no consent" and tell
      the CMO.
- id: D4
  after: S8
  decided_by: ground
  question: What is the plan (care, follow-up photos, any medicine)?
  branches:
  - if: Link live
    then: Flight surgeon decides; robot logs.
  - if: Link down or delay too long
    then: >-
      The CMO decides under the pre-approved onboard checklist; the flight surgeon reviews the log at
      the next contact.
- id: D5
  after: S9
  decided_by: robot
  question: What did RMP-PHARM-001 show for the ordered item?
  branches:
  - if: MATCH TO ORDER
    then: >-
      RMP-PHARM-001 completes its own recipient check and hand-over; this protocol only logs "MATCH TO
      ORDER. Not a dose, interaction or allergy review." and the clock time.
  - if: MISMATCH or CANNOT VERIFY on any field, or a failed scan or recipient check
    then: >-
      MISMATCH or CANNOT VERIFY shown with the fields named. No hand-over under this protocol: the item
      stays sealed in the NOT VERIFIED bag in quarantine (the RMP-PHARM-001 default), and the robot never
      hands it over unprompted or to anyone but the CMO. The robot does not offer or suggest an override.
      Only if the CMO explicitly makes the two-step override request inside RMP-PHARM-001 can the item
      go to the CMO, logged there as an override with the reason and the mismatched fields, and flagged
      to the flight surgeon.
    handoff: none
stop_rules:
- id: X1
  trigger: The patient (or the crewmember being examined) says stop, or withdraws consent
  action: >-
    Robot stops all motion at once, backs away to its rest position and tells the CMO. Recording stops
    unless the patient agrees to keep it running.
  level: stop
  refs:
  - V2 10165
- id: X2
  trigger: Any crewmember presses stop or takes over control
  action: Protective stop; robot holds its stopped position; only a human may restart it.
  level: safe-state
  refs:
  - V2 10165
  - V2 10168
  - V2 10174
- id: X3
  trigger: Robot fault, sensor fault, or a force, speed or reach limit is reached
  action: Protective stop and hand control to the CMO; log the fault.
  level: safe-state
  refs:
  - V2 10172
  - V2 10168
- id: X4
  trigger: CMO is asked to take over and does not respond (for example, the CMO is the patient)
  action: Robot stays stopped; the next named crewmember is called.
  level: safe-state
  refs:
  - V2 10173
  - V2 7045
- id: X5
  trigger: Loss of link, or delay longer than the limit for live guidance
  action: >-
    Only the robot pauses: before it holds, it moves to a position clear of a hatch route or a crewmember's
    route (it never pauses in one), and tells the CMO. This pauses robot movement only: crew care already
    under way and all other care continue under the onboard checklist and never wait for the link or the
    robot. The CMO decides whether the robot continues offline under the pre-approved onboard checklist;
    it resumes only on the CMO's confirmation.
  level: pause
  refs:
  - V2 10172
  - V2 10173
- id: X6
  trigger: An URGENT alert is not acknowledged within the set time
  action: >-
    Robot repeats the alert and sends it to the next named crewmember (the second trained CMO first if
    the CMO is the patient), and keeps repeating at the set interval. It stays where it is: it does not
    leave on its own.
  level: urgent
  refs:
  - V1 3006
  - V2 10173
- id: X7
  trigger: The crewmember stops responding, or seems confused or drowsy, at any point
  action: >-
    URGENT alert at once, even mid-question or mid-step; the robot stops its current task, stays at its
    rest position and does not continue the run; a crewmember checks in person.
  level: urgent
- id: X8
  trigger: A crewmember asks the robot what is wrong, or for medicine, fluid or treatment advice
  action: >-
    Robot declines, says it cannot assess or advise, and routes the question to the CMO or flight surgeon.
  level: stop
- id: X9
  trigger: The crewmember or CMO asks to stop photos, or anything outside the area the CMO set is in frame
  action: >-
    Robot stops the camera at once and logs it; any photo with something outside the set area in frame
    is held unsent and flagged to the flight surgeon, who decides whether to keep it.
  level: stop
- id: X10
  trigger: Someone needs the space or route the robot is in
  action: Robot moves clear at once without contact and holds; it never pauses in a hatch route.
  level: safe-state
  refs:
  - V2 10172
red_flags:
- id: RF1
  sign: >-
    Breathing trouble, wheeze, or swelling of the lips, tongue or throat, with or without a rash, as stated
  threshold: any
  action: URGENT alert; start RMP-RESP-003 now
  source: rcuk
- id: RF2
  sign: >-
    A rash that does not fade when the CMO presses a glass on it, or a rash that is spreading quickly,
    as stated by the CMO, or the CMO is not sure
  threshold: any
  action: URGENT alert to the CMO and flight surgeon; see RMP-INF-001
  source: ng240
- id: RF3
  sign: Fever or shaking chills with a rash
  threshold: >-
    <set by clinical lead> degrees (shared parameter FEVER_ALERT_C: body temperature in degrees Celsius,
    the same value in RMP-GI-003, RMP-ENT-002, RMP-SKIN-002 and RMP-RENAL-004) or higher, or any shaking
    chills
  action: URGENT alert; see RMP-INF-001
  source: ng253
- id: RF4
  sign: Painful skin, blisters, peeling skin, or sores of the eyes, mouth or genitals, as stated
  threshold: any
  action: URGENT alert to the CMO and flight surgeon
  source: dermnetsjs
- id: RF5
  sign: Mottled, patterned or marbled skin after an EVA or a pressure change, as stated
  threshold: any
  action: URGENT alert; start RMP-EVA-001 (possible DCS)
  source: tb037
- id: RF6
  sign: Skin contact with a chemical or a leaking fluid, as stated
  threshold: any
  action: URGENT alert; see RMP-ENV-005
- id: RF7
  sign: A rash that started after a new medicine, as stated (design judgment)
  threshold: any
  action: Flag to the flight surgeon at once; the CMO checks for the URGENT signs above
- id: RF8
  sign: Spreading redness, warmth or pus, as stated (design judgment)
  threshold: any
  action: Flag to the flight surgeon at once; see RMP-SKIN-001
- id: RF9
  sign: Unresponsive, or not breathing normally
  threshold: any
  action: URGENT alert; start RMP-CARD-001 now
  source: aha2025bls
safety_limits:
- id: L1
  name: Contact with the crewmember
  value: not allowed
  enforced: Keep-out zone in the robot controller
  refs:
  - V2 10172
- id: L2
  name: Camera distance from the crewmember
  value: <set by validation>
  enforced: Hard limit in the controller
  refs:
  - V2 10172
- id: L3
  name: >-
    Photo shown on a shared display, or used for robot or AI training, research or outreach without separate
    written consent
  value: not allowed
  enforced: >-
    Photos are stored only in the crewmember's medical record, encrypted in storage and in transit as
    the program requires; access is limited to the CMO, the flight surgeon and people the flight surgeon
    names.
  refs:
  - V1 7003
- id: L4
  name: Automatic measurement, grading or comparison of photos
  value: not allowed
  enforced: No such function is loaded
- id: L5
  name: Robot speed near the crewmember
  value: <set by validation>
  enforced: Hard limit in the controller
  refs:
  - V2 10172
logs:
- id: LOG-1
  text: Every input, robot action, decision (with who made it) and hand-off, time-stamped to the second.
  refs:
  - V2 10163
  - V2 10164
- id: LOG-2
  text: Mode changes and safety-limit events are announced to the operator as they happen and logged.
  refs:
  - V2 10162
  - V2 10172
- id: LOG-3
  text: >-
    Records are stored and sent as private medical data, encrypted, with access limited to the medical
    team.
  refs:
  - V1 6003
  - V1 7003
- id: LOG-4
  text: Results are kept in a permanent, retrievable format so the flight surgeon can see trends.
  refs:
  - V1 7001
- id: LOG-5
  text: >-
    Answers as stated with times; findings and glass test results as stated by the CMO; consent before
    each session; each photo with area, view, date and time; photos held unsent and the flight surgeon's
    decision; photos taken by the CMO with a handheld camera; who viewed the photos.
- id: LOG-6
  text: >-
    Each URGENT alert, who received it, the time it was acknowledged (or the escalation to the next named
    crewmember), and the time a human released the robot.
  refs:
  - V2 10163
- id: LOG-8
  text: >-
    Each RMP-PHARM-001 run started from this protocol: order ID, result (MATCH TO ORDER, MISMATCH or CANNOT
    VERIFY with the fields), quarantine, and any CMO override logged by RMP-PHARM-001 (reason and mismatched
    fields), at clock time. No running counter of doses.
  refs:
  - V2 7059
requirements:
- id: V1 3004
  use: In-mission care includes skin care; the flight surgeon reviews every photo.
- id: V1 3006
  use: >-
    Two trained CMOs per vehicle for NASA programs; the second trained CMO receives alerts when the CMO
    is the patient (see the commercial-flight note).
- id: V1 6003
  use: Logs and alerts sent to the ground are private medical communications.
- id: V1 7001
  use: Records kept so the flight surgeon can see trends.
- id: V1 7003
  use: Secure handling of medical records.
- id: V2 7045
  use: Usable by non-physician crew, including when the CMO is the patient.
- id: V2 7046
  use: Patient, caregiver and supplies restrained.
- id: V2 7059
  use: Kit inventory and seal status are tracked.
- id: V2 10161
  use: Robot shows its status and health.
- id: V2 10162
  use: Mode changes are announced to the operator.
- id: V2 10163
  use: Robot records and shares its data.
- id: V2 10164
  use: Shows whether the human or the robot is expected to act.
- id: V2 10165
  use: Human can override and shut down the robot.
- id: V2 10168
  use: Human can take over.
- id: V2 10172
  use: Protective stop when a limit is exceeded.
- id: V2 10173
  use: Robot stays stopped if no one takes over.
- id: V2 10174
  use: Only a human starts or restarts the robot.
validation:
- stage: simulation
  what: >-
    Scripted logs with breathing trouble, a non-blanching rash stated by the CMO, mucosal sores, a missed
    consent, something outside the set area in frame, CMO as patient, lost link.
  pass: Every red flag URGENT before any photo; zero photos without consent; zero contact.
- stage: training model
  what: Photo drill on skin models with rashes on different skin tones.
  pass: Photos comparable (same view, light and scale); every photo labelled.
- stage: parabolic or station demonstration
  what: Camera positioning in weightlessness.
  pass: Camera distance limit held.
- stage: flight use under flight surgeon supervision
  what: First use for a rash.
  pass: No safety or privacy events.
signoff:
  protocol:
  - Clinical lead for the specialty (sets every clinical threshold marked <set by clinical lead>)
  - Flight surgeon, as medical authority
  - Robotics and medical-device safety board
  - Program approval for the mission
  restart_after_stop: >-
    Human only. After any emergency or protective stop, a crewmember must restart the robot; the robot
    never restarts itself.
  each_run: >-
    Started by the crewmember or the CMO. Symptom questions come first; the CMO examines and the flight
    surgeon judges every finding.
change_control:
- Every change gets a new version number and a written reason; earlier versions are kept.
- >-
  Any change to steps, thresholds, limits or software that touches the patient repeats validation from
  the simulation stage before use.
- >-
  Software and learned-skill updates follow a pre-agreed change plan (what may change, how it is tested,
  how to roll back), modeled on the FDA predetermined change control plan approach.
- >-
  If a new version misbehaves, the robot rolls back to the last validated version and the event is reviewed
  by the flight surgeon and safety board.
- The robot never changes its own protocol, thresholds or limits.
comms:
  live: 'Low Earth orbit: the flight surgeon receives answers and photos when the link allows.'
  loss_of_signal:
  - >-
    Only the robot pauses non-essential motion, at a position clear of hatch routes and crew routes, and
    tells the CMO; it resumes offline only on the CMO's confirmation.
  - >-
    Crew care already under way and all other care continue under the onboard checklist and never wait
    for the link or the robot.
  - Photos are queued; any red flag goes to the CMO at once.
  mars_delay:
  - 'Mars: photos arrive with delay; the CMO decides under the onboard checklist.'
sources:
- key: crucian
  text: >-
    Crucian B, Babiak-Vazquez A, Johnston S, et al. Incidence of clinical symptoms during long-duration
    orbital spaceflight. Int J Gen Med. 2016;9:383-391.
  url: https://doi.org/10.2147/IJGM.S114188
  doi: 10.2147/IJGM.S114188
  pmid: '27843335'
  supports: >-
    Among 46 long-duration ISS crewmembers, skin rashes were the most reported clinical event in the categories
    studied (infections, allergies, rashes and hypersensitivities), at 1.12 per flight year. Wounds were
    not studied.
- key: ng240
  text: >-
    National Institute for Health and Care Excellence. Meningitis (bacterial) and meningococcal disease:
    recognition, diagnosis and management. NICE guideline NG240 (2024).
  url: https://www.nice.org.uk/guidance/ng240
  supports: >-
    Strongly suspect meningococcal disease with a haemorrhagic, non-blanching rash with lesions larger
    than 2 mm, or a rapidly progressive or spreading non-blanching rash; check the whole body, including
    the conjunctivae; a rash can be harder to see on brown, black or tanned skin and can change from blanching
    to non-blanching; transfer as an emergency. Read Oct 21, 2026 (saved copy in src/b11).
- key: dermnetsjs
  text: DermNet. Stevens-Johnson syndrome/toxic epidermal necrolysis (2016).
  url: https://dermnetnz.org/topics/stevens-johnson-syndrome-toxic-epidermal-necrolysis
  supports: >-
    Usually starts within the first week of a new antibiotic; a prodrome of fever above 39 °C, sore throat
    and sore red eyes; then an abrupt, tender or painful red rash spreading over hours to days, flaccid
    blisters, and sores of at least two mucosal surfaces (eyes, lips and mouth, genitals). Read Oct 21,
    2026 (saved copy in src/b11).
- key: rcuk
  text: >-
    Resuscitation Council UK. Emergency treatment of anaphylaxis: guidelines for healthcare providers
    (May 2021; printed review date May 2026, which has passed. The RCUK guideline page, as fetched on
    Oct 20, 2026, still lists May 2021 as the most recent version; a newer version was not found).
  url: >-
    https://www.resus.org.uk/sites/default/files/2021-05/Emergency%20Treatment%20of%20Anaphylaxis%20May%202021_0.pdf
  supports: >-
    Anaphylaxis is characterised by sudden onset and rapid progression of symptoms, Airway and/or Breathing
    and/or Circulation problems, and usually skin or mucosal changes; airway problems include throat or
    tongue swelling, hoarse voice and stridor; breathing problems include wheeze, persistent cough, increased
    work of breathing, tiredness and hypoxaemia (SpO2 below 94%); circulation problems include pale clammy
    skin, fast heart rate, low blood pressure, dizziness, decreased conscious level and collapse; skin
    or mucosal changes alone are not a sign of anaphylaxis and may be absent in up to 20% of reactions;
    in up to 30% of cases there may be no obvious trigger; gastrointestinal symptoms without airway, breathing
    or circulation problems do not usually indicate anaphylaxis; call for help early; biphasic reactions
    occur in around 5% of patients, also after milder reactions, with a median time of around 12 hours,
    and observation for 6-12 hours may miss over half of them; adrenaline is the first-line treatment,
    given intramuscularly, and is repeated after 5 minutes if airway, breathing or circulation problems
    persist; medication accounts for 39% of anaphylaxis-related deaths (Table 1), and allergens given
    by a parenteral route (for example an IV drug or intramuscular injection) cause a more rapid onset;
    patients must not walk or stand during acute reactions.
- key: ng253
  text: >-
    National Institute for Health and Care Excellence. Suspected sepsis in people aged 16 or over: recognition,
    assessment and early management. NICE guideline NG253 (2025, last updated Sept 23, 2026).
  url: https://www.nice.org.uk/guidance/ng253/chapter/Face-to-face-assessment
  supports: >-
    People with sepsis may feel very unwell and may not have a high temperature; do not rely on fever
    alone; a rise in temperature can be a physiological response; assess temperature, heart rate, breathing
    rate, blood pressure, level of consciousness and oxygen saturation; look for mottled or ashen skin,
    blue skin, lips or tongue, a non-blanching rash, and breaks in the skin; ask how often the person
    passed urine in the past 18 hours and about fever or shaking chills (rigors); pay attention to new
    changes in behavior and to concerns raised by others.
- key: tb037
  text: >-
    NASA OCHMO. Decompression Sickness (DCS) Risk Mitigation. Technical Brief OCHMO-TB-037 Rev D (Oct
    5, 2026).
  url: https://www.nasa.gov/wp-content/uploads/2023/12/ochmo-tb-037-decompression-sickness.pdf
  supports: >-
    DCS is caused by inert gas bubbles forming during rapid reductions in ambient pressure, most significantly
    in the move from cabin pressure to EVA suit pressure; NASA classifies DCS as Type I (itching, musculoskeletal
    pain, mild rashes) and Type II (neurological symptoms, numbness, weakness, cognitive issues, inner
    ear problems, cardiopulmonary issues), and describes cutis marmorata (a mottled, patterned skin rash);
    arterial gas embolism can cause stroke-like neurological effects, loss of consciousness and seizures;
    U.S. Navy protocols are widely adopted on Earth; diagnosis is based on symptoms; the majority of cases
    present between 60 and 240 minutes and inflammatory responses can last more than 24 hours; no hyperbaric
    chamber is available in flight, and increasing suit and cabin pressure may be combined to treat symptoms,
    depending on the scenario; a break in prebreathe rapidly reintroduces nitrogen; NASA has never experienced
    a Type II event in spaceflight.
- key: imi2019
  text: 'Institute of Medical Illustrators. IMI National Guidelines: Wound Management Photography (2019).'
  url: https://www.imi.org.uk/wp-content/uploads/2019/04/2019_Apr_IMINatGuidelines_Wound-Management.pdf
  supports: >-
    Standardise equipment, lighting, background, viewpoint and magnification so serial photographs can
    be compared; use the same light source each time where possible; hold a measurement scale on the same
    plane as the wound and photograph from 90 degrees; acute wounds are photographed at each dressing
    change, and any significant change is photographed; written guidance on consent for clinical photography.
    Earth hospital context. Saved copy read Oct 21, 2026 (a 2025 version 2.0 exists).
- key: aha2025bls
  text: >-
    Kleinman ME, Buick JE, Huber N, et al. Part 7: Adult Basic Life Support: 2025 American Heart Association
    Guidelines for Cardiopulmonary Resuscitation and Emergency Cardiovascular Care. Circulation. 2025;152(16_suppl_2):S448-S478.
  url: https://doi.org/10.1161/CIR.0000000000001369
  doi: 10.1161/CIR.0000000000001369
  pmid: '41122888'
  supports: >-
    Adult basic life support: initial recognition of cardiac arrest, activation of the emergency response,
    high-quality CPR and use of an automated external defibrillator; also respiratory arrest and foreign-body
    airway obstruction. Earth guidance; the onboard checklist leads. Abstract read via PubMed Oct 21,
    2026; full text not read.
- key: v1
  text: 'NASA. NASA-STD-3001, Space Flight Human-System Standard, Volume 1: Crew Health, Revision C (2023).'
  url: https://www.nasa.gov/wp-content/uploads/2023/11/nasa-std-3001-vol-1-rev-c-with-signature.pdf
  supports: 'NASA-STD-3001 Vol 1 Rev C: V1 3004, V1 3006, V1 6003, V1 7001, V1 7003.'
- key: v2
  text: >-
    NASA. NASA-STD-3001, Volume 2: Human Factors, Habitability, and Environmental Health (Rev F, 2026),
    including Section 10.6 Automated and Robotic Systems.
  url: https://standards.nasa.gov/standard/NASA/NASA-STD-3001_VOL_2
  supports: Requirement IDs beginning V2.
- key: tb044
  text: NASA OCHMO. Medical Operations. Technical Brief OCHMO-TB-044 (2025).
  url: https://www.nasa.gov/wp-content/uploads/2025/08/ochmo-tb-044-medical-operations.pdf
  supports: >-
    The crew surgeon keeps medical authority when care is delegated; crew medical officers train on the
    JSC 48522 medical checklist.
- key: marsdelay
  text: >-
    NASA. Mars communications disruption and delay (fact sheet, 2023 Moon to Mars Architecture Concept
    Review).
  url: https://www.nasa.gov/wp-content/uploads/2024/01/mars-communications-disruption-and-delay.pdf
  supports: >-
    One-way Earth-Mars delay up to about 21-23 minutes, plus blackouts of about 2-3 weeks near solar conjunction.
- key: pccp
  text: >-
    U.S. Food and Drug Administration. Marketing submission recommendations for a predetermined change
    control plan for artificial intelligence-enabled device software functions (guidance).
  url: >-
    https://www.fda.gov/regulatory-information/search-fda-guidance-documents/marketing-submission-recommendations-predetermined-change-control-plan-artificial-intelligence
  supports: A model for planning, validating and rolling back software updates.
- key: faa460
  text: 'U.S. Code of Federal Regulations, Title 14, Part 460: Human space flight requirements.'
  url: https://www.ecfr.gov/current/title-14/chapter-III/subchapter-C/part-460
  supports: >-
    Federal rules for crew and spaceflight participants on licensed commercial flights; they set no medical
    standards for spaceflight participants.
corrections:
- date: '2026-10-21'
  version: '0.2'
  source: Batch 11 AI-assisted clinical review (Medical Research Assistant), Oct 21, 2026
  items:
  - >-
    R10: S2 adds the CMO checklist line "check all over the body and the conjunctivae; a rash may be difficult
    to see on brown, black or tanned skin" (NICE NG240, 1.1.12 and table 3). A fading glass test result
    never ends an alert and is never logged as reassuring (S3). RF2 also applies when the CMO is not sure.
  - >-
    Batch 11 protocols now record the review as AI-assisted (Medical Research Assistant, Oct 21, 2026);
    no named human clinician.
