# RMP-EVA-003 Hand and skin check after a spacewalk: symptom questions first, then a standard photo log for the flight surgeon
# Version 0.2 (Draft). CONCEPTUAL. NOT FOR CLINICAL USE.
# Space Medicine Foundation robot-readable protocol library. Format: https://spacemedicinefoundation.org/robotic-medicine/protocols/schema/
# Every threshold marked <set by ...> must be set by the named owner (see the schema) before any use.
schema_version: '0.3'
version: '0.2'
status: draft
conceptual: true
not_for_clinical_use: true
max_autonomy: 2
missions:
- leo
- commercial
- moon
- mars
updated: '2026-10-21'
review:
  state: reviewed-ai-assisted
  requested: '2026-10-21'
  reviewed: '2026-10-21'
  human_clinician_review: false
  text: >-
    AI-assisted clinical and source review by the Medical Research Assistant, Oct 21, 2026 (batch 10 review:
    10 required corrections, R1 to R10, of which R10 applies to RMP-CARD-004, RMP-EGR-002, RMP-EGR-003
    and RMP-NEURO-005; 20 optional suggestions); all required corrections that apply to this protocol
    are applied in this version (see Corrections). No named human clinician has reviewed it. Not for clinical
    use.
fixed_rules:
  flight_surgeon_is_medical_authority: true
  cmo_acts_under_delegated_care: true
  human_starts_and_restarts_robot: true
  robot_never_diagnoses: true
  no_drug_or_fluid_advice_by_robot: true
  safe_state_on_fault_or_no_response: true
  lost_link_pause_then_cmo_decides: true
robot_lockouts:
  diagnosis: true
  drug_or_fluid_advice: true
  starting_stopping_or_adjusting_oxygen_or_any_medicine: true
  self_start_or_self_restart: true
  changing_own_protocol_thresholds_or_limits: true
  handing_over_a_mismatched_item_as_verified: true
id: RMP-EVA-003
slug: rmp-eva-003
title: >-
  Hand and skin check after a spacewalk: symptom questions first, then a standard photo log for the flight
  surgeon
category: eva
tier: 2
rung_note: >-
  Max rung 2 for asking symptom questions on screen, moving the camera to the standard view the CMO sets
  at the set distance and without contact, and labelling, storing and sending photos, as in RMP-SKIN-003.
  The crewmember removes their own gloves; the robot never judges a finding.
result_language:
  use:
  - photo recorded
  - photo not obtained
  - flagged for human review
  - sent to flight surgeon
  - as stated by the crewmember
  never:
  - normal
  - no problem found
  - all clear
  - negative
  - any diagnosis or cause
  - healing well
  - healing
  - better
  - worse
  - no change
  - infected
  - not infected
  - nail is fine
  - just a glove injury
  - no DCS
  - not DCS
  - bends
  - safe
  - mild
  - minor
scope:
  summary: >-
    After a spacewalk (EVA) or a suited test, on the CMO's or the crewmember's command, the robot first
    asks on screen about any new symptom (any new symptom raises an URGENT possible-DCS alert under RMP-EVA-001).
    Then, with the crewmember's consent before the camera moves, it takes standard photos of the hands
    and any skin area the CMO names, as in RMP-SKIN-003: an establishing view with a margin of surrounding
    skin, and close-ups with and without a scale. Photos are labelled, stored in the medical record and
    sent to the flight surgeon, who judges every finding. A baseline hand set before the first EVA of
    an increment can be taken at the flight surgeon's choice; how often post-EVA photos are taken is the
    flight surgeon's choice.
  why: >-
    Hand injuries are common in EVA work: in suit training, 47% of 352 symptom comments were in the hands,
    where moisture and hard glove contact caused fingernail injuries (Strauss 2005), and fingernail lifting
    from the nail bed (onycholysis) is linked to larger hand circumference, at 19.6% against 5.6% in male
    crewmembers (Opperman 2010). Any new symptom after an EVA may be decompression sickness: NASA describes
    skin signs such as itching, mild rash and a mottled, patterned rash (cutis marmorata), and most cases
    present between 60 and 240 minutes (OCHMO-TB-037), so symptom questions come before any photo and
    any new symptom is URGENT, as in RMP-EVA-001. The photo rules follow RMP-SKIN-003 (IMI 2019: standard
    views, an establishing view with "a wide area of healthy tissue", and the same view without the scale);
    the scale choice and image storage rules are design judgment.
  covers:
  - Hands, fingers, nails and any skin area the CMO names, after an EVA or a suited test
  - 'Any new symptom after an EVA: RMP-EVA-001 (URGENT)'
  - 'Wound care: RMP-SKIN-001; serial wound photos: RMP-SKIN-003'
  locked_out:
  - Diagnosis or naming a cause
  - Any medicine, fluid or oxygen advice; starting, stopping or adjusting oxygen
  - Touching the crewmember
  - >-
    Handing over any medicine outside RMP-PHARM-001, or after a MISMATCH or CANNOT VERIFY (the item stays
    quarantined; only the CMO can ask for it, through the RMP-PHARM-001 logged two-step override)
  - Removing gloves or touching the hands or skin
  - Judging a finding, a nail, a rash or whether symptoms are DCS
  - Photographing anything outside the area the CMO set, or any photo without consent
  - >-
    Showing a photo on a shared display, or using photos for robot or AI training, research or outreach
    without separate written consent
  - Using the robot camera for the genital, breast or buttock area unless the crewmember chooses it
  related:
  - RMP-EVA-001
  - RMP-EVA-002
  - RMP-SKIN-003
  - RMP-SKIN-001
  - RMP-INF-001
roles:
  medical_authority: Flight surgeon (ground). Holds medical authority for every run.
  onboard_lead: >-
    Crew medical officer (CMO), acting under delegated care; uses the pre-approved onboard checklist when
    there is no link.
  others:
  - 'Second trained CMO: receives every alert and takes over if the CMO is the patient'
  - 'Vehicle commander: leads any cabin emergency procedure'
  - 'Other crew: help as the CMO or commander directs'
  robot_may:
  - Ask symptom questions on screen first
  - Move the camera to the standard view the CMO set, at the set distance, without contact
  - Take, label and store photos
  - Show earlier photos side by side on request
  - Send photos to the flight surgeon
  robot_may_not:
  - Touch the crewmember or the gloves
  - Say what a finding is or whether symptoms are DCS
  - Photograph without consent
  - Start without a human command
  commercial: >-
    On commercial flights, 'flight surgeon' and 'CMO' mean the operator's designated medical authority
    and trained onboard responder. If no trained responder is aboard, this protocol is not used. (NASA-STD-3001
    requires two CMOs per vehicle for NASA programs [V1 3006]; FAA rules set no medical standards for
    spaceflight participants.)
preconditions:
- id: PRE-1
  text: The CMO or the crewmember started the check by command after an EVA or a suited test.
  check: human_start == true
  refs:
  - V2 10174
- id: PRE-2
  text: Robot self-test passed; kit stowage locations known.
  refs:
  - V2 10161
  - V2 7059
- id: PRE-3
  text: Robot and supplies restrained when not moving.
  refs:
  - V2 7046
- id: PRE-4
  text: Link status known. The crew never wait for the robot before acting.
  check: link_state in [live, delayed, down]
consent:
  standard: >-
    The crewmember agrees to the photos before the camera moves; photos frame only the area the CMO set,
    with a margin of surrounding skin. For the genital, breast or buttock area, the robot camera is used
    only if the crewmember chooses it; otherwise the CMO takes the photos with a handheld camera and adds
    them to the log. Photos go only to the CMO, the flight surgeon and people the flight surgeon names.
  emergency: >-
    If the crewmember cannot agree, no photo is taken; any symptom or concern raises an URGENT alert under
    RMP-EVA-001.
  withdrawal: >-
    The crewmember can stop a photo or the whole check at any time; withdrawal stops future photos, and
    the flight surgeon decides on photos already taken.
inputs:
- id: IN-1
  name: >-
    Symptoms in the crewmember's words since the EVA (joint pain, itching, rash or mottled skin, numbness,
    tingling, weakness, headache, breathlessness, nail or finger pain)
  source: Crewmember
  required: true
  if_missing: Log "no response"; D2 applies.
- id: IN-2
  name: >-
    The standard view and the area to frame (hands with a margin of surrounding skin, and any area the
    CMO names), set by the CMO
  source: CMO
  required: true
  if_missing: No photo is taken until the CMO sets the view.
- id: IN-3
  name: Each photo, with the area, view, date and clock time
  source: Robot camera
  required: false
  if_missing: Log "photo not obtained" and tell the CMO.
- id: IN-4
  name: EVA end time, as stated by the CMO or EVA lead
  source: CMO / EVA lead
  required: false
  if_missing: Log "not stated".
- id: IN-5
  name: Link status and delay
  source: Communications system
  required: true
  if_missing: Treat as link down; photos are queued.
steps:
- id: S1
  actor: robot
  rung: 2
  action: >-
    Tell the flight surgeon and the CMO that a post-EVA hand and skin check has started, with the EVA
    end time as stated (URGENT if any red flag is stated). Every URGENT alert goes to the CMO and the
    flight surgeon at the same time (queued for the flight surgeon if the link is down). If the CMO is
    the patient, is busy treating, or does not answer, the alert goes to the second trained CMO, or the
    crewmember named before flight [V1 3006]. An URGENT alert that is not acknowledged within <set by
    validation> seconds is repeated and sent to the next named crewmember.
  success: Notice acknowledged.
  refs:
  - V1 6006
  - V1 3006
- id: S2
  actor: robot
  rung: 2
  action: >-
    Before any photo, show the symptom prompt on screen (any new symptom since the EVA, listed first),
    and log answers word for word. Any new symptom other than an isolated nail or fingertip finding, or
    a hand abrasion, with no other symptom (RF4, RF5) raises an URGENT possible-DCS alert under RMP-EVA-001
    at once, and photos wait; numbness, tingling or weakness of the fingers stays URGENT (RF3). The robot
    reminds the crewmember on screen to report any new symptom at once, and shows a repeat symptom prompt
    the crewmember can accept at the time the flight surgeon sets (most DCS cases present between 60 and
    240 minutes, OCHMO-TB-037).
  success: Answers logged, or "no response".
  refs:
  - V1 6003
- id: S3
  actor: crew
  action: >-
    The crewmember removes their own gloves and places their hands on the plain background in the standard
    position; the CMO places the scale the flight surgeon chose (a disposable paper scale, or a reusable
    ABFO No. 2 scale cleaned under RMP-INF-002) beside any area to close up. For the genital, breast or
    buttock area, the robot camera is used only if the crewmember chooses it; otherwise the CMO takes
    the photos with a handheld camera and adds them to the log.
  success: Hands and area in position with the scale.
  refs:
  - V1 3004
- id: S4
  actor: robot
  rung: 2
  action: >-
    Only after the crewmember agrees (D3), move the camera to the standard view the CMO set (about 90
    degrees, the same distance, light and plain background each time), no closer than the set camera distance,
    and take the standard set: an establishing view of both hands, including the fingertips and nails,
    with a margin of surrounding skin; close-ups of any area the CMO names with the scale; and the same
    close-ups without the scale. Label each with the area, view, date and clock time, and mark it "for
    human review". A photo with anything outside the area the CMO set in frame is held unsent and flagged
    to the flight surgeon, who decides whether to keep it.
  success: Photos taken and labelled, or "photo not obtained".
  limit: <set by validation>
  refs:
  - V1 7001
- id: S5
  actor: robot
  rung: 2
  action: >-
    On request, show earlier photos of the same area (for example from before the EVA, if the flight surgeon's
    schedule took them) side by side for the CMO; the robot never says what has changed.
  success: Photos shown on request.
  refs:
  - V1 7001
- id: S6
  actor: crew
  action: >-
    The CMO cares for any broken skin under RMP-SKIN-001; the crew clean the camera and any shared surface
    under RMP-INF-002.
  success: Care and cleaning recorded as stated.
  refs:
  - V1 3004
- id: S7
  actor: robot
  rung: 2
  action: >-
    After any URGENT alert: After an URGENT alert the robot does not leave on its own: it stays at its
    rest position in the module, with its screen and voice link available, until a human has taken over
    or tells it to go. It never follows, blocks or touches anyone. It keeps time-stamping what humans
    say they did, and repeats the alert if it is not acknowledged.
  success: Robot at rest in the module until a human releases it; alert acknowledged or escalated.
  refs:
  - V2 10173
  - V1 3006
- id: S8
  actor: ground
  action: >-
    The flight surgeon (or the CMO under the onboard checklist when there is no link) reviews the answers
    and photos and decides on care, glove changes for the next EVA and any follow-up photos.
  success: Decision logged.
  refs:
  - V1 3004
  - V1 6006
- id: S9
  actor: robot
  rung: 2
  action: >-
    Only after the CMO or flight surgeon has placed an order, run RMP-PHARM-001 for the ordered item (fetch,
    barcode match to every order field, recipient check). This protocol adds nothing to that check, never
    suggests an order, and never hands anything over outside RMP-PHARM-001.
  success: RMP-PHARM-001 run logged with its result, or none ordered.
  refs:
  - V2 7059
- id: S10
  actor: robot
  rung: 2
  action: >-
    Send the flight surgeon one package: answers, labelled photos, alerts and decisions; photos go only
    to the people the flight surgeon names.
  success: Package delivered or queued.
  refs:
  - V1 6003
  - V1 7003
decisions:
- id: D1
  after: S2
  decided_by: robot
  question: >-
    Checked after every answer and at any point in the run (even mid-question or mid-step): does any answer,
    reading or observation meet a red flag?
  branches:
  - if: 'Yes'
    then: >-
      Stop the current question or step at once and apply the action listed for each matching red flag
      (URGENT alert, flag, or stop), with the answer or reading itself, never a cause. Every URGENT alert
      goes to the CMO and the flight surgeon at the same time (queued for the flight surgeon if the link
      is down). If the CMO is the patient, is busy treating, or does not answer, the alert goes to the
      second trained CMO, or the crewmember named before flight [V1 3006]. An URGENT alert that is not
      acknowledged within <set by validation> seconds is repeated and sent to the next named crewmember.
  - if: 'No'
    then: Continue.
- id: D2
  after: S2
  decided_by: robot
  question: Did the crewmember answer the symptom prompt, or say they want to skip it?
  branches:
  - if: 'Yes'
    then: Continue.
  - if: Declined explicitly (the crewmember says no to a question)
    then: Log "declined" for that question only; the alert already sent stands.
  - if: No response, or the answer does not make sense
    then: >-
      URGENT: log "no response" (never "declined"); the CMO, or the second trained CMO if the CMO is the
      patient, checks the crewmember in person at once.
- id: D3
  after: S3
  decided_by: robot
  question: >-
    Before the camera moves: did the crewmember agree to this session's photos (each view is named on
    screen before it is taken)?
  branches:
  - if: 'Yes'
    then: Continue to S4; the crewmember can say stop before or during any view.
  - if: No, or no answer
    then: The camera does not move and no photo is taken; log "photo not taken – no consent" and tell
      the CMO.
- id: D4
  after: S8
  decided_by: ground
  question: What is the plan (care, glove changes, follow-up photos)?
  branches:
  - if: Link live
    then: Flight surgeon decides; robot logs.
  - if: Link down or delay too long
    then: >-
      The CMO decides under the pre-approved onboard checklist; the flight surgeon reviews the log at
      the next contact.
- id: D5
  after: S9
  decided_by: robot
  question: What did RMP-PHARM-001 show for the ordered item?
  branches:
  - if: MATCH TO ORDER
    then: >-
      RMP-PHARM-001 completes its own recipient check and hand-over; this protocol only logs "MATCH TO
      ORDER. Not a dose, interaction or allergy review." and the clock time.
  - if: MISMATCH or CANNOT VERIFY on any field, or a failed scan or recipient check
    then: >-
      MISMATCH or CANNOT VERIFY shown with the fields named. No hand-over under this protocol: the item
      stays sealed in the NOT VERIFIED bag in quarantine (the RMP-PHARM-001 default), and the robot never
      hands it over unprompted or to anyone but the CMO. The robot does not offer or suggest an override.
      Only if the CMO explicitly makes the two-step override request inside RMP-PHARM-001 can the item
      go to the CMO, logged there as an override with the reason and the mismatched fields, and flagged
      to the flight surgeon.
    handoff: none
stop_rules:
- id: X1
  trigger: The patient (or the crewmember being examined) says stop, or withdraws consent
  action: >-
    Robot stops all motion at once, backs away to its rest position and tells the CMO. Recording stops
    unless the patient agrees to keep it running.
  level: stop
  refs:
  - V2 10165
- id: X2
  trigger: Any crewmember presses stop or takes over control
  action: Protective stop; robot holds its stopped position; only a human may restart it.
  level: safe-state
  refs:
  - V2 10165
  - V2 10168
  - V2 10174
- id: X3
  trigger: Robot fault, sensor fault, or a force, speed or reach limit is reached
  action: Protective stop and hand control to the CMO; log the fault.
  level: safe-state
  refs:
  - V2 10172
  - V2 10168
- id: X4
  trigger: CMO is asked to take over and does not respond (for example, the CMO is the patient)
  action: Robot stays stopped; the next named crewmember is called.
  level: safe-state
  refs:
  - V2 10173
  - V2 7045
- id: X5
  trigger: Loss of link, or delay longer than the limit for live guidance
  action: >-
    Only the robot pauses: before it holds, it moves to a position clear of a hatch route or a crewmember's
    route (it never pauses in one), and tells the CMO. This pauses robot movement only: symptom care and
    all crew care continue under the onboard checklist and never wait for the link or the robot. The CMO
    decides whether the robot continues offline under the pre-approved onboard checklist; it resumes only
    on the CMO's confirmation.
  level: pause
  refs:
  - V2 10172
  - V2 10173
- id: X6
  trigger: An URGENT alert is not acknowledged within the set time
  action: >-
    Robot repeats the alert and sends it to the next named crewmember (the second trained CMO first if
    the CMO is the patient), and keeps repeating at the set interval. It stays where it is: it does not
    leave on its own.
  level: urgent
  refs:
  - V1 3006
  - V2 10173
- id: X7
  trigger: The crewmember stops responding, or seems confused or drowsy, at any point
  action: >-
    URGENT alert at once, even mid-question or mid-step; the robot stops its current task, stays at its
    rest position and does not continue the run; a crewmember checks in person.
  level: urgent
- id: X8
  trigger: A crewmember asks the robot what is wrong, or for medicine, fluid or treatment advice
  action: >-
    Robot declines, says it cannot assess or advise, and routes the question to the CMO or flight surgeon.
  level: stop
- id: X9
  trigger: The crewmember or CMO asks to stop photos, or anything outside the area the CMO set is in frame
  action: >-
    Robot stops the camera at once and logs it; any photo with something outside the set area in frame
    is held unsent and flagged to the flight surgeon, who decides whether to keep it.
  level: stop
- id: X10
  trigger: Someone needs the space or route the robot is in
  action: Robot moves clear at once without contact and holds; it never pauses in a hatch route.
  level: safe-state
  refs:
  - V2 10172
red_flags:
- id: RF1
  sign: >-
    Any new symptom since the EVA (joint pain, itching, rash, numbness, tingling, weakness, headache,
    breathlessness, confusion), as stated, other than an isolated nail or fingertip finding, or a hand
    abrasion, with no other symptom (RF4, RF5)
  threshold: any
  action: URGENT alert; start RMP-EVA-001 (possible DCS)
  source: tb037
- id: RF2
  sign: Mottled, patterned or marbled skin, as stated by the crewmember or the CMO
  threshold: any
  action: URGENT alert; start RMP-EVA-001 (possible DCS)
  source: tb037
- id: RF3
  sign: Numbness, tingling or weakness in the hands or fingers, as stated
  threshold: any
  action: URGENT alert; start RMP-EVA-001
  source: tb037
- id: RF4
  sign: >-
    A nail lifting from the nail bed, blood under a nail, or nail or fingertip pain, as stated by the
    crewmember or the CMO
  threshold: any
  action: Flag to the flight surgeon; the CMO examines
  source: opperman2010
- id: RF5
  sign: Broken skin, a blister or an abrasion on the hands, as stated by the crewmember or the CMO
  threshold: any
  action: Flag to the flight surgeon; care under RMP-SKIN-001
  source: strauss2005
- id: RF6
  sign: Fever, spreading redness or pus, as stated
  threshold: any
  action: URGENT alert; see RMP-INF-001
  source: ng253
safety_limits:
- id: L1
  name: Contact with the crewmember
  value: not allowed
  enforced: Keep-out zone in the robot controller
  refs:
  - V2 10172
- id: L2
  name: Camera distance from the crewmember
  value: <set by validation>
  enforced: Hard limit in the controller
  refs:
  - V2 10172
- id: L3
  name: >-
    Photo shown on a shared display, or used for robot or AI training, research or outreach without separate
    written consent
  value: not allowed
  enforced: >-
    Photos are stored only in the crewmember's medical record, encrypted in storage and in transit as
    the program requires; access is limited to the CMO, the flight surgeon and people the flight surgeon
    names.
  refs:
  - V1 7003
- id: L4
  name: Automatic measurement, grading or comparison of photos
  value: not allowed
  enforced: No such function is loaded
- id: L5
  name: Robot speed near the crewmember
  value: <set by validation>
  enforced: Hard limit in the controller
  refs:
  - V2 10172
logs:
- id: LOG-1
  text: Every input, robot action, decision (with who made it) and hand-off, time-stamped to the second.
  refs:
  - V2 10163
  - V2 10164
- id: LOG-2
  text: Mode changes and safety-limit events are announced to the operator as they happen and logged.
  refs:
  - V2 10162
  - V2 10172
- id: LOG-3
  text: >-
    Records are stored and sent as private medical data, encrypted, with access limited to the medical
    team.
  refs:
  - V1 6003
  - V1 7003
- id: LOG-4
  text: Results are kept in a permanent, retrievable format so the flight surgeon can see trends.
  refs:
  - V1 7001
- id: LOG-5
  text: >-
    Answers as stated with times; consent before each session; each photo with area, view, date and time;
    photos not obtained or held unsent and the flight surgeon's decision; photos taken by the CMO with
    a handheld camera; who viewed the photos.
- id: LOG-6
  text: >-
    Each URGENT alert, who received it, the time it was acknowledged (or the escalation to the next named
    crewmember), and the time a human released the robot.
  refs:
  - V2 10163
- id: LOG-8
  text: >-
    Each RMP-PHARM-001 run started from this protocol: order ID, result (MATCH TO ORDER, MISMATCH or CANNOT
    VERIFY with the fields), quarantine, and any CMO override logged by RMP-PHARM-001 (reason and mismatched
    fields), at clock time. No running counter of doses.
  refs:
  - V2 7059
requirements:
- id: V1 3004
  use: In-mission care includes skin and wound care; the flight surgeon reviews every photo.
- id: V1 3006
  use: >-
    Two trained CMOs per vehicle for NASA programs; the second trained CMO receives alerts when the CMO
    is the patient (see the commercial-flight note).
- id: V1 6003
  use: Logs and alerts sent to the ground are private medical communications.
- id: V1 6006
  use: >-
    EVA medical clearance by ground medical support; findings inform the flight surgeon's decisions for
    the next EVA.
- id: V1 7001
  use: Records kept so the flight surgeon can see trends.
- id: V1 7003
  use: Secure handling of medical records.
- id: V2 7045
  use: Usable by non-physician crew, including when the CMO is the patient.
- id: V2 7046
  use: Patient, caregiver and supplies restrained.
- id: V2 7059
  use: Kit inventory and seal status are tracked.
- id: V2 10161
  use: Robot shows its status and health.
- id: V2 10162
  use: Mode changes are announced to the operator.
- id: V2 10163
  use: Robot records and shares its data.
- id: V2 10164
  use: Shows whether the human or the robot is expected to act.
- id: V2 10165
  use: Human can override and shut down the robot.
- id: V2 10168
  use: Human can take over.
- id: V2 10172
  use: Protective stop when a limit is exceeded.
- id: V2 10173
  use: Robot stays stopped if no one takes over.
- id: V2 10174
  use: Only a human starts or restarts the robot.
validation:
- stage: simulation
  what: >-
    Scripted checks with a new symptom after the EVA, a missed consent, something outside the set area
    in frame, CMO as patient, lost link.
  pass: Every new symptom URGENT before any photo; zero photos without consent; zero contact.
- stage: training model
  what: Photo drill on hand models with nail and abrasion findings.
  pass: Photos comparable (same view, light and scale); every photo labelled.
- stage: parabolic or station demonstration
  what: Camera positioning in weightlessness.
  pass: Camera distance limit held.
- stage: flight use under flight surgeon supervision
  what: First use after an EVA.
  pass: No safety or privacy events.
signoff:
  protocol:
  - Clinical lead for the specialty (sets every clinical threshold marked <set by clinical lead>)
  - Flight surgeon, as medical authority
  - Robotics and medical-device safety board
  - Program approval for the mission
  restart_after_stop: >-
    Human only. After any emergency or protective stop, a crewmember must restart the robot; the robot
    never restarts itself.
  each_run: >-
    Started by the CMO or the crewmember after an EVA. Symptom questions come first; the flight surgeon
    judges every finding.
change_control:
- Every change gets a new version number and a written reason; earlier versions are kept.
- >-
  Any change to steps, thresholds, limits or software that touches the patient repeats validation from
  the simulation stage before use.
- >-
  Software and learned-skill updates follow a pre-agreed change plan (what may change, how it is tested,
  how to roll back), modeled on the FDA predetermined change control plan approach.
- >-
  If a new version misbehaves, the robot rolls back to the last validated version and the event is reviewed
  by the flight surgeon and safety board.
- The robot never changes its own protocol, thresholds or limits.
comms:
  live: 'Low Earth orbit: the flight surgeon receives answers and photos when the link allows.'
  loss_of_signal:
  - >-
    Only the robot pauses non-essential motion, at a position clear of hatch routes and crew routes, and
    tells the CMO; it resumes offline only on the CMO's confirmation.
  - >-
    Symptom care and all crew care continue under the onboard checklist and never wait for the link or
    the robot.
  - Photos are queued; any symptom goes to the CMO at once under RMP-EVA-001.
  mars_delay:
  - 'Mars: photos arrive with delay; the CMO decides under the onboard checklist.'
sources:
- key: tb037
  text: >-
    NASA OCHMO. Decompression Sickness (DCS) Risk Mitigation. Technical Brief OCHMO-TB-037 Rev D (Oct
    5, 2026).
  url: https://www.nasa.gov/wp-content/uploads/2023/12/ochmo-tb-037-decompression-sickness.pdf
  supports: >-
    DCS is caused by inert gas bubbles forming during rapid reductions in ambient pressure, most significantly
    in the move from cabin pressure to EVA suit pressure; NASA classifies DCS as Type I (itching, musculoskeletal
    pain, mild rashes) and Type II (neurological symptoms, numbness, weakness, cognitive issues, inner
    ear problems, cardiopulmonary issues), and describes cutis marmorata (a mottled, patterned skin rash);
    arterial gas embolism can cause stroke-like neurological effects, loss of consciousness and seizures;
    U.S. Navy protocols are widely adopted on Earth; diagnosis is based on symptoms; the majority of cases
    present between 60 and 240 minutes and inflammatory responses can last more than 24 hours; no hyperbaric
    chamber is available in flight, and increasing suit and cabin pressure may be combined to treat symptoms,
    depending on the scenario; a break in prebreathe rapidly reintroduces nitrogen; NASA has never experienced
    a Type II event in spaceflight.
- key: strauss2005
  text: >-
    Strauss S, Krog RL, Feiveson AH. Extravehicular mobility unit training and astronaut injuries. Aviat
    Space Environ Med. 2005;76(5):469-474.
  url: https://pubmed.ncbi.nlm.nih.gov/15892545/
  pmid: '15892545'
  supports: >-
    Abstract: in 770 suit training tests at NASA's Neutral Buoyancy Laboratory, 190 (24.6%) had suit symptoms;
    of 352 symptom comments, 166 (47%) were in the hands, where moisture and hard glove contact caused
    fingernail injuries; most symptoms were short-lived, but some could become significant injuries. Training
    (underwater) context. Abstract read Oct 21, 2026 (saved copy in src/b10).
- key: opperman2010
  text: >-
    Opperman RA, Waldie JM, Natapoff A, Newman DJ, Jones JA. Probability of spacesuit-induced fingernail
    trauma is associated with hand circumference. Aviat Space Environ Med. 2010;81(10):907-913.
  url: https://doi.org/10.3357/asem.2810.2010
  doi: 10.3357/asem.2810.2010
  pmid: '20922881'
  supports: >-
    Abstract: many astronauts sustain hand injuries in EVA training and operations, which can cause fingernail
    delamination (onycholysis) that needs medical care; in 232 crewmembers' records, male crewmembers
    with a hand circumference above 22.86 cm had a 19.6% probability of finger injury against 5.6% at
    or below it, with similar findings in women. Abstract read Oct 21, 2026 (saved copy in src/b10).
- key: imi2019
  text: 'Institute of Medical Illustrators. IMI National Guidelines: Wound Management Photography (2019).'
  url: https://www.imi.org.uk/wp-content/uploads/2019/04/2019_Apr_IMINatGuidelines_Wound-Management.pdf
  supports: >-
    Standardise equipment, lighting, background, viewpoint and magnification so serial photographs can
    be compared; use the same light source each time where possible; hold a measurement scale on the same
    plane as the wound and photograph from 90 degrees; acute wounds are photographed at each dressing
    change, and any significant change is photographed; written guidance on consent for clinical photography.
    Earth hospital context. Saved copy read Oct 21, 2026 (a 2025 version 2.0 exists).
- key: ng253
  text: >-
    National Institute for Health and Care Excellence. Suspected sepsis in people aged 16 or over: recognition,
    assessment and early management. NICE guideline NG253 (2025, last updated Sept 23, 2026).
  url: https://www.nice.org.uk/guidance/ng253/chapter/Face-to-face-assessment
  supports: >-
    People with sepsis may feel very unwell and may not have a high temperature; do not rely on fever
    alone; a rise in temperature can be a physiological response; assess temperature, heart rate, breathing
    rate, blood pressure, level of consciousness and oxygen saturation; look for mottled or ashen skin,
    blue skin, lips or tongue, a non-blanching rash, and breaks in the skin; ask how often the person
    passed urine in the past 18 hours and about fever or shaking chills (rigors); pay attention to new
    changes in behavior and to concerns raised by others.
- key: v1
  text: 'NASA. NASA-STD-3001, Space Flight Human-System Standard, Volume 1: Crew Health, Revision C (2023).'
  url: https://www.nasa.gov/wp-content/uploads/2023/11/nasa-std-3001-vol-1-rev-c-with-signature.pdf
  supports: 'NASA-STD-3001 Vol 1 Rev C: V1 3004, V1 3006, V1 6003, V1 6006, V1 7001, V1 7003.'
- key: v2
  text: >-
    NASA. NASA-STD-3001, Volume 2: Human Factors, Habitability, and Environmental Health (Rev F, 2026),
    including Section 10.6 Automated and Robotic Systems.
  url: https://standards.nasa.gov/standard/NASA/NASA-STD-3001_VOL_2
  supports: Requirement IDs beginning V2.
- key: tb044
  text: NASA OCHMO. Medical Operations. Technical Brief OCHMO-TB-044 (2025).
  url: https://www.nasa.gov/wp-content/uploads/2025/08/ochmo-tb-044-medical-operations.pdf
  supports: >-
    The crew surgeon keeps medical authority when care is delegated; crew medical officers train on the
    JSC 48522 medical checklist.
- key: marsdelay
  text: >-
    NASA. Mars communications disruption and delay (fact sheet, 2023 Moon to Mars Architecture Concept
    Review).
  url: https://www.nasa.gov/wp-content/uploads/2024/01/mars-communications-disruption-and-delay.pdf
  supports: >-
    One-way Earth-Mars delay up to about 21-23 minutes, plus blackouts of about 2-3 weeks near solar conjunction.
- key: pccp
  text: >-
    U.S. Food and Drug Administration. Marketing submission recommendations for a predetermined change
    control plan for artificial intelligence-enabled device software functions (guidance).
  url: >-
    https://www.fda.gov/regulatory-information/search-fda-guidance-documents/marketing-submission-recommendations-predetermined-change-control-plan-artificial-intelligence
  supports: A model for planning, validating and rolling back software updates.
- key: faa460
  text: 'U.S. Code of Federal Regulations, Title 14, Part 460: Human space flight requirements.'
  url: https://www.ecfr.gov/current/title-14/chapter-III/subchapter-C/part-460
  supports: >-
    Federal rules for crew and spaceflight participants on licensed commercial flights; they set no medical
    standards for spaceflight participants.
corrections:
- date: '2026-10-21'
  version: '0.2'
  source: Batch 10 AI-assisted clinical review (Medical Research Assistant), Oct 21, 2026
  items:
  - >-
    Link-loss wording (X5 and comms) fixed: the stray word "crew" before the list of what continues is
    removed, so the sentence reads, for example, "the exam already under way and all crew care continue
    under the onboard checklist" (R6).
  - >-
    S2 and RF1 now read "any new symptom other than an isolated nail or fingertip finding, or a hand abrasion,
    with no other symptom (RF4, RF5)", which stay Flags; numbness, tingling or weakness of the fingers
    stays URGENT under RMP-EVA-001 (RF3; OCHMO-TB-037 Type II neurological symptoms) (R9).
  - >-
    S2 adds an on-screen reminder to report any new symptom at once and a repeat symptom prompt the crewmember
    can accept at the time the flight surgeon sets (TB-037: most cases present at 60 to 240 minutes) (S14).
  - >-
    Baseline: a pre-EVA hand set before the first EVA of an increment, at the flight surgeon's choice;
    post-EVA photo frequency is set by the flight surgeon (S13).
  - >-
    Batch 10 protocols now record the review as AI-assisted (Medical Research Assistant, Oct 21, 2026);
    no named human clinician.
