Code Demo Case

Run one synthetic chart through the production coding pipeline.

Same engine as POST /api/v1/code — the same CodingAgentService, the same verification passes — so what a prospect sees here is what they would buy.

Three deliberate differences from /code, each of which reads as a missing gate until you know what this endpoint can and cannot receive:

• No ai_coding_enabled check. That flag gates the capability being sold: coding text the customer supplies. This endpoint cannot code customer text at all, so gating it on the paid flag would make the free tier undemonstrable, which is the whole problem.
• No BAA gate. /code is BAA-gated because it ingests PHI. This corpus is fabricated and the request carries no text, so there is no PHI to be a business associate for. Requiring a BAA to look at fictional charts would invert the policy it enforces.
• No PHI audit event and no trace persistence. /code writes a PHI_CREATE/phi_accessed=True audit row that feeds HIPAA accounting-of-disclosures. Writing one here would file records that contain no PHI into the disclosure trail and make it less useful, not more. The usage meter still records the call.