Walking One Protocol End to End: RMP-PHARM-001 Medicine Barcode Check

Why walk a pharmacy protocol

Part 1 framed autonomy rungs and a 13-part protocol skeleton [11]. Part 2 walked an imaging assist protocol end to end [12]. Part 3 explained validation and who signs off — including the library’s standing pharmacy rule: mismatch → quarantine by default [13][14].

This Part 4 follows one pharmacy draft from start to finish: RMP-PHARM-001, Fetch a medicine a human has prescribed and match it to the order by barcode (v0.7, AI-assisted clinical and source review on the protocol itself; conceptual; not for clinical use) [1].

The protocol’s job is narrow. A human has already decided on a medicine. The robot fetches the sealed package, matches it to every field of that order, confirms the recipient, and either hands over a full match or quarantines the item. Choosing, recommending, dosing and giving the medicine stay with people.

Earth barcode systems cut many administration errors but do not eliminate them, and workarounds such as proxy scanning undermine them [3][4]. Exploration missions can outlast typical medication expiry dates, so expiry and storage checks matter alongside the order match [6]. Those facts motivate the protocol; they do not make this article operational guidance.

The cast: who decides what

On commercial flights, “flight surgeon” and “CMO” mean the operator’s designated medical authority and trained onboard responder. If no trained responder is aboard, this protocol is not used [1][16]. NASA programs plan for two CMOs per vehicle [8].

Communication delay: orders stay human

Unlike RENAL-001’s live-vs-store-and-forward imaging choice, this protocol does not wait on the ground to match an item [1][10]:

• Low Earth orbit: the flight surgeon can uplink orders; inventory syncs with the ground.
• Loss of link: only the robot pauses; crew care never waits for the link or the robot. On the CMO’s confirmation the robot works from the local inventory copy; logs and overrides sync at the next contact [1].
• Mars-class delay: all orders are entered onboard; inventory, expiry, override and resupply data go to the ground as packages [1][10].

Preconditions (nothing is fetched until these are true)

Encoded as preconditions [1][2]:

1. PRE-1 — A complete human order exists: prescriber, crewmember, medicine, strength, dose form, quantity and ordered time window (order.complete == true).
2. PRE-2 — The CMO started the run (human_start == true) [V2 10174].
3. PRE-3 — Inventory synced (or local copy in use with CMO confirmation); barcode and crew-ID scanners self-tested [V2 10161].
4. PRE-4 — Not an emergency where seconds matter: in that case the crew take items directly and the robot logs afterward (the protocol’s emergency block adds that it reconciles inventory) [1].

Consent to the medicine itself is a CMO responsibility, outside the robot’s role. The CMO confirms the order on read-back; the CMO can cancel the fetch at any time and the item returns to stowage [1].

Step-by-step: what the robot does

Actors in the YAML are crew or robot [1].

Fields the robot must match (verification.fields) [1]: recipient identity, crewmember on the order, medicine, strength, dose form, quantity, ordered time window, expiry, storage, and human-entered record flags (for example allergy flags entered by humans — the robot does not perform a clinical allergy review).

Language the robot is allowed to use: “MATCH TO ORDER (recipient, medicine, strength, form, quantity, time window, expiry, storage). Not a dose, interaction or allergy review.”; “MISMATCH: <fields>. NOT VERIFIED. Quarantined.”; “CANNOT VERIFY: <reason>. NOT VERIFIED. Quarantined.”; and at an override hand-over, “NOT VERIFIED - MISMATCH: <fields>. Override by CMO logged.” Never: “normal”, “all clear”, “MATCH” alone, “verified safe”, “safe to take”, “OK to give”, “recommended”, “use instead”, or any diagnosis [1].

The mismatch path: quarantine, then optional logged override

This is the standing library rule Part 3 pointed at, written out in the YAML [1][13][14]:

1. Default after any mismatch, failed scan, failed recipient check, or check that cannot be done: hard stop. Seal the item in a labeled NOT VERIFIED bag; place it in the quarantine bin. No hand-over. The robot never hands the item over unprompted [1].
2. Who may receive a NOT VERIFIED item: the CMO only — never the recipient, never another crewmember [1].
3. Explicit CMO override (two steps): (a) the CMO states “override” and the reason; the robot reads back the mismatched fields and the reason; (b) the CMO confirms in a separate, deliberate step (second spoken confirmation or confirm control). The robot confirms the CMO’s identity before releasing the item [1].
4. Log every override: timestamp, CMO identity, reason, mismatched fields, order ID, item barcode [1].
5. Flag the flight surgeon at once; if the link is down, queue and send at the next contact [1].
6. Speak and show at hand-over: “NOT VERIFIED - MISMATCH: <fields>. Override by CMO logged.” — never language that sounds like the item is verified or safe [1].

Gripper release to a person is blocked unless all checks passed, or the identified CMO completed that two-step override and the log entry was written (safety_limits L1–L2) [1]. Proxy scanning (any label other than the item’s own package) is not allowed (L3) [1][5]. Scan failures follow the same quarantine default; the CMO uses the pre-approved escalation process (verify by eye against the order; a second crewmember when available is marked in the YAML as a design suggestion, not from the cited source); never scan a substitute label [1][5].

Whether an expired or out-of-storage item may be used is a CMO and flight surgeon decision — not the robot’s [1][6].

What the robot must never do (lockouts)

Encoded as robot_lockouts / roles.robot_may_not / scope.locked_out and echoed in the library’s shared safety rules [1][14]:

• Never diagnose.
• Never give drug or fluid advice; never suggest a medicine, dose or alternative.
• Never start, stop or adjust oxygen or any medicine.
• Never self-start or self-restart.
• Never change its own protocol thresholds or limits.
• Never hand over a mismatched item as “verified”.
• Never hand over a NOT VERIFIED item unprompted, or to anyone other than the CMO.
• Never accept an override without the two-step confirm, the reason and the log.
• Never say or show that an item is safe, OK or verified safe.
• Never scan anything other than the item’s own package (no proxy scanning).
• Never open packaging or handle loose tablets.
• Never give a medicine to a crewmember.
• Never delay the crew from taking an item directly in an emergency.

Controlled-medicine counts belong to RMP-PHARM-004, not this protocol [1].

Failure modes and red flags

Stop rules (stop_rules) [1]:

Red flags (red_flags) [1]: any field mismatch including recipient (RF1); a human-entered allergy or other record flag (RF2 — hard stop; CMO and flight surgeon decide); storage temperature outside limits (RF3); every CMO override hand-over of a NOT VERIFIED item (RF4 — logged and flagged to the flight surgeon); stock below reorder level (RF5 — flag to ground). Thresholds marked <set by pharmacy lead> are intentional blanks until a human owner fills them [2].

Consent, privacy and the medical record

• Medicine consent is the CMO’s job; the robot only confirms order read-back and can cancel the fetch on CMO command [1].
• Logs are private medical data, encrypted, limited to the medical team [V1 6003], [V1 7003] [8].
• Every input, action, decision (with who decided), mismatch, quarantine, override and inventory change is time-stamped [V2 10163], [V2 10164] [9].
• Override logs must include timestamp, CMO identity, reason, mismatched fields, order and barcode, and when the flight surgeon flag was sent [1].

A delayed flight surgeon should be able to reconstruct the run without trusting soft language like “verified.”

How the YAML and schema encode the checks

The downloadable file is rmp-pharm-001.yaml, validated against the schema (schema_version: 0.3) at build time [1][2]. Useful fields for readers of the file:

• max_autonomy: 2 — supervised rung ceiling [15].
• verification.on_mismatch — hard_stop, quarantine default, unprompted_handoff: false, and the full cmo_override two-step / log / notify_flight_surgeon block.
• robot_lockouts.handing_over_a_mismatched_item_as_verified — hard behavioral limit, not a prose footnote.
• result_language.use / .never — including the ban on “safe to take” and bare “MATCH”.
• steps[] S1–S10, decisions[] D1–D3, stop_rules[] X1–X8, red_flags[] RF1–RF5, safety_limits[] L1–L7.
• comms.loss_of_signal / comms.mars_delay — crew care never waits; orders stay onboard under delay.
• validation[] — simulation with seeded errors (zero false MATCH TO ORDER; zero hand-overs after a mismatch) → mock-up stowage → Earth analog → flight use under flight surgeon supervision.
• signoff.each_run — started by the CMO after a human order; overrides reviewed by the flight surgeon at the next contact.
• change_control — new versions and re-validation after patient- or medicine-touching changes; the robot never edits itself.

If a hand-over after a mismatch lacks the override logging and flight-surgeon notification fields, the schema and build reject it [1][2]. That is the point of a robot-readable pharmacy rule: humans and machines share one source of truth.

Where this sits in the library

• Full protocol page: RMP-PHARM-001 [1]
• Related: RMP-PHARM-002 (inventory / expiry / storage), RMP-PHARM-003 (dose log after a human gives a medicine), RMP-PHARM-004 (controlled-medicine count)
• Schema: protocol schema [2]
• Shared safety rules [14]
• Capabilities board (pharmacy sits under logistics and inventory) [15]
• Clinical / research background: Medical kits and drug stability, Risk atlas: medications
• Series hub: Robotic and autonomous medical care

What comes next

• Part 5 (published): Contingency autonomy for 2027–2033 — fallback rungs 4–5 when human support is unavailable or insufficient; AGI prescribe/diagnose is contingency-only and does not erase this barcode/quarantine path.
• Later (planned): other library walks (for example crew-held ultrasound variants, or further pharmacy drafts), always conceptual and educational.
• Part 1 · Part 2 · Part 3 remain the framework, imaging walk-through and validation/sign-off pieces.

Part 4 makes the pharmacy mismatch rule concrete by walking the YAML that encodes it. It does not clear any protocol for flight use.