FDA SaMD Reproducibility Primitive · Apache‑2.0

Bit-identical clinical decisions, on every chip in healthcare.

“Sarah’s cardiologist sets her blood pressure target below 130/100. Her nephrologist says below 140/90. Same patient, same week. Neither knew about the other.”

A 6-layer clinical safety pipeline with a Q16.16 fixed-point ternary verification anchor — 100% recall on contraindicated for the NTI cohort, 21 typed federation invariants enforcing PHI gates and X25519 + ChaCha20-Poly1305 payload encryption by construction, and an Apache-2.0 license for healthcare deployment.

See chart GitHub Try BitNet
For Judges · 60-second audit

JUDGES.md — 5-bullet pitch · single-command gate · full audit trail
MIND-Mem upstream sync · live

v3.12.0 pinned · cron auto-bumps + gates every < 30 min

410+ iter · 5-tier round-robin · 35 cross-pin · 0 known misses · v8 LIVE · 44/44 · 0 PHI leaks
1 Ingest

Sarah Mitchell · 18 FHIR R4 resources · 4 providers · 7 medications
2 Detect

2 critical · 2 high · evidence-grounded · 6-layer safety pipeline
3 Resolve

What-if simulation · ibuprofen → acetaminophen · 1 critical resolved
Contra recall · LIVE
100%
44 / 44 · Q16.16
Live precision · L4.5
100%
44 / 44 contraindicated · live cache
BitNet weights · LIVE
50,949·118 KB
$15 Pi Zero 2 W · iter-275 promotion · v1 archived
Federation invariants
21
PHI gate · X25519 · runtime
$ run_all_gates.py PASS · 5 gates · < 1 s
Layer 4.5 · BitNet b1.58
warfarin + ibuprofen
SERIOUS
repro_hash
a4ca858f562b15da
HIPAA-aware 21 CFR Part 11 Apache-2.0 Bit-identical replay 1382 / 1382 tests 35 cross-pin

Live Patient Scenario

SM

Sarah Mitchell

MRN: SM-2026-0847 • DOB: 1959-03-14

1 SERIOUS 1 MODERATE

Demographics

Age67
SexFemale
Providers4 Active
Medications7 Active

Active Conditions

Type 2 Diabetes
Hypertension
CKD Stage 3b
Atrial Fibrillation

Active Medications

Warfarin 5mg
Ibuprofen 400mg
Metformin 1000mg
Lisinopril 20mg
Amlodipine 10mg
Amoxicillin 500mg
Atorvastatin 40mg
Allergies: Penicillin (anaphylaxis)

Same patient · Same prescriptions · Two outcomes

Without vs with ClinicalMem

Sarah Mitchell, 67. Cardiologist + orthopedist + nephrologist + endocrinologist on the same patient — none of them sees the others’ chart in real time. Bit-identical replay-able verdict in < 1 ms per pair on any chip in healthcare.

Without ClinicalMem · fragmented EHRs

Dangerous prescription accepted

  1. Mon

    Cardiologist prescribes warfarin 5 mg/day

    Indication: atrial fibrillation. Logs to Epic.

  2. Wed

    Orthopedist prescribes ibuprofen 600 mg/day

    Indication: chronic knee pain. Logs to Cerner. Neither system talks.

  3. +3w

    ER admission — GI bleed, INR 7.2

    Warfarin × NSAID is a black-box-warning interaction. No system caught it before the patient bled.

~7,000 hospitalizations / year in the US trace to drug pairs that one provider prescribed without seeing what another already had on board. FDA.

With ClinicalMem · 6-layer pipeline

Conflict caught before the prescription

  1. Mon

    Cardiologist prescribes warfarin 5 mg/day

    Layer 1 logs to clinical memory. Audit-chain seq # signed Ed25519.

  2. Wed

    Orthopedist queries before prescribing ibuprofen

    FHIR R4 medication list pulled from clinical memory. 6-layer safety pipeline runs.

  3. ↓

    Layer 1Deterministic table: contraindicated (FDA black-box)

    Layer 4.5BitNet Q16.16: confirmed 44/44 cohort, repro_hash a4ca858f…

    Layer 6Alert triggered + safer alternative suggested

  4. ✓

    Acetaminophen 1 g/day prescribed instead

    No NSAID interaction. Audit-chain entry seq # signed — replay-able for the next 30 years on any chip.

  5. +0

    No hospitalization. Same patient, different system.

    The conflict was caught at the point of prescription, not at the ER.

Bit-identical Q16.16 inference means the FDA, ten years later, can recompute the verdict on any chip with the weight bundle + Python file alone — no proprietary toolchain.

Synthetic Synthea cohort scenario. Drug-interaction reasoning is from the live 139-pair PCCP regression cohort — 100 % recall on contraindicated + 0 false positives under cross-arch Q16.16 inference.

Safety Findings

Warfarin + Ibuprofen

CRITICAL

ER prescribed NSAID without checking anticoagulant. Massively increased bleeding risk.

Layer 1: Deterministic Layer 3: RxNorm

Penicillin Allergy + Amoxicillin

CRITICAL

Amoxicillin is a penicillin-class antibiotic. Cross-reactivity detected via SNOMED CT drug hierarchy.

SNOMED CT Layer 1: Deterministic

Declining GFR + Metformin

HIGH

eGFR declining over 6 months. Approaching metformin contraindication at <30.

eGFR · mL/min/1.73m² · 6-month trend −13 in 6mo
Metformin contraindication zone (eGFR < 30) 50 45 40 35 30 45 38 32 6mo ago 3mo ago Now
Lab Trend Analysis Lab-Med Contraindication

Conflicting BP Targets

HIGH

Cardiologist targets <130/100 vs Nephrologist <140/90. Conflicting treatment plans.

Provider Disagreement Cross-Provider

Bonus: 2 additional findings discovered autonomously

  • • INR 3.8 — above therapeutic range, correlated with ibuprofen addition
  • • eGFR declining trajectory — 13-point drop over 6 months

What-If Drug Substitution Simulator

INTERACTIVE

What happens if we swap the dangerous NSAID for a safer alternative?

Ibuprofen 400mg NSAID
Acetaminophen 500mg Non-NSAID
-1
Critical Resolved
Warfarin+NSAID eliminated
Safe
INR Impact
No bleeding risk increase
3
Remaining Findings
1 critical, 2 high

Verifiable Clinical AI

Six compiled flows. Six unique decision IDs.

Every recommendation ClinicalMem produces carries a 64-character plan_hash — the FDA-grade reproducibility primitive that lets a regulator replay any decision months later, byte-for-byte.

BitNet b1.58 · bit-identical SQLCipher at-rest · HIPAA
Audit replay

How replay works

Every audit-chain entry stores (flow_name, plan_hash, input_hash, output_hash). Three months later, a regulator types the plan_hash into ClinicalMem's verifier — engine/flow_runner.py recomputes SHA-256 over the canonical .flow.mind source. A mismatch is a release-blocking integrity event.

L1 Architectural Governance

Nine governance rules. Every commit. Every release.

Nine Q16.16 architectural-governance rules enforced in CI on every commit. Today: 9/9 pass.

Forcing function summary_sha256

Each scan emits a SHA-256 over .arch-mind/last_summary.json. The audit chain records this hash alongside every clinical decision; a regulator with the hash + the public arch-mind binary recomputes the metrics and asserts byte-identity. Any drift halts merges.

loading…

Phase B enforced at runtime + tests

6 healthcare-specific invariants on top of the 9-rule kernel.

The 9 generic kernel rules above are what every MIND repo runs. ClinicalMem also keeps 6 healthcare-specific invariants — PHI-gate coverage, audit-chain anchor density, BitNet 4.5 invocation discipline, federation-invariant density (spec: 21 typed invariants in JointMemoryFederation.flow.mind; live mock demo exercises 16 — the 5 X25519 sealing invariants are declared but await a dedicated MIC@2 federation-transport adapter before the demo can verify them end-to-end. MIND-Mem v3.12.0 is shipped + pinned (released 2026-05-09; the v3.10.x..v3.12.x line through v3.12.0 covers hook-installer + CLI + docs (v3.10.x), quality-gate + typed-lineage + recall-explainability (v3.11.x), and strict-quality-gate + lineage-staleness + red-team CI (v3.12.x)) but ships no new federation-transport module — its http_transport.py remains a single-workspace REST adapter for non-MCP clients, not p2p federation; the MIC@2 adapter targets v4.0 "Platform Scale" per upstream ROADMAP.md, where federated recall + gRPC transport are scheduled), NPI Luhn coverage (every Practitioner), and clinician-attestation present. Already enforced at runtime + in tests/; the arch-mind L1 gate will mechanically verify them when the commercial v0.2 release ships the clinical_invariants profile. Full spec: docs/clinicalmem_invariants.md.

Layer 4.5 — FDA SaMD Reproducibility Primitive

Bit-identical clinical decisions. Decade-stable audit replay.

Layer 4.5 isn't the primary DDI classifier — it's the deterministic verification anchor that makes every clinical decision bit-identical across CPU, GPU, and NPU for FDA SaMD audit replay. On the live cache (n=44 contraindicated): precision 100% / recall 100.0% — full-recall safety classifier post v8 promotion.

More about Layer 4.5

Primary recall comes from layers 1–4: RxNorm, OpenEvidence, NIH RxNav, and 6-LLM US-based consensus. Layer 4.5's job is deterministic verification, not headline accuracy.

Live engine recall: 100% on the safety-critical contraindicated class (44 / 44 + 0 FP) under v8 Q16.16 (iter-275 promotion). The 85.7% per-class accuracy from the v1 baseline held-out fold (n=42) is preserved at engine/bitnet_weights.v1.cfadb4f6.bak.json for audit-chain reconstruction of decisions made before the iter-275 promotion.

When Layer 4.5 disagrees with the upstream pipeline by predicting none/minor on a contraindicated pair, the safer verdict always wins and an alert fires.

Reference: arXiv:2402.17764 (BitNet b1.58, Ma et al. 2024).

100% recall · 44/44 contra · 0 FP (v8 LIVE) v8 · 50,688 ternary weights + 261 Q16.16 biases / ~118 KB Runs offline · $15 Pi Zero 2 W · USB plug-in Pure Python — zero ML framework deps

How it lands in the pipeline

Layer 4.5 stamps every interaction with a deterministic verification hash.

offline
Layer 1 — deterministic table catches known pairs (microseconds, offline)
Layer 2/3/4 — OpenEvidence + NIH RxNorm + 6-LLM US-based consensus (online, cloud)
Layer 4.5 BitNet — runs after every reported interaction, emits repro_hash recorded into the audit chain alongside the upstream finding

Try Verify Replay

live JS · in-browser Q16.16 1200 / 1200 bit-identical

Type any two drug names. Click Classify. The Q16.16 ternary forward pass runs in your browser via docs/bitnet_browser.js — no lookup table, no server round-trip. The vanilla-JS port (BLAKE2b-128 + 128→64→5 ternary linear + ReLU + argmax + SHA-256 canonical-JSON repro_hash) is bit-identical with the Python server-side path. Pin: tests/test_engine/test_browser_bitnet_pin.py verifies the JS-computed repro_hash for warfarin + ibuprofen matches the Python reference byte-for-byte. Q16.16 determinism stress: 1200 calls / 12 pairs / 100 iterations all produce the same repro_hash + severity_name + logits_q16.

Click Classify to verify the cached server-side Q16.16 hash for this pair.

Trained model — by the numbers

Drawn live from engine/bitnet_weights.json + docs/pccp_eval_latest.json. No marketing math.

bundle_id 1f0f8859…76e6 128 → 64 → 5

Ternary weight distribution — v8 LIVE · 50,688 weights

SHARE OF WEIGHTS −1 16,424 32.4% 0 22,478 44.3% +1 11,786 23.3%

~44% of weights collapse to 0 — structured sparsity from quantization-aware training (STE) is what lets the 50,949-parameter v8 model fit in ~118 KB (still <1 ms/pair on Pi Zero 2 W).

🔒 Bundle integrity (v8 LIVE since iter-275 promotion) — the bundle_id chip above is the SHA-256 of the canonical-form weight matrices. tests/test_engine/test_bitnet_bundle_integrity_pin.py gates nine invariants a future weight rotation cannot silently break: (1) live bundle_id first-8 = 1f0f8859 AND last-4 = 76e6; (2-3) demo + JUDGES cite the pinned short form; (4) file size stays within ±4 KB of 118 KB AND under the 200 KB hard ceiling (the Pi Zero 2 W edge claim still holds — 118 KB on a 512 MB-RAM board); (5) ternary-weight sparsity ≥ 40% (the iter-72 "structured sparsity" rhetoric, preserved through v8); (6) JSON key set is exactly {_meta, hidden_b, hidden_w, output_b, output_w}; (7) _meta carries provenance fields including schema=bitnet_classifier_v3_atc_flags + training_iter=iter-242-path-a-v8-h256; (8) self-referenced _meta.bundle_id matches live SHA-256; (9) _meta VALUE pinning (iter-265: flag_keys_count=26, pair_derived_rule_count=13). Param counts (50,688 / 261 / 50,949) are independently pinned by tests/test_engine/test_bitnet_param_count_pin.py. The pre-promotion v1 baseline (cfadb4f6, 8,512 / 69 / 8,581 / 19 KB) is preserved at engine/bitnet_weights.v1.cfadb4f6.bak.json for full audit-chain reconstruction.

Recall by severity class — 139-pair PCCP regression

PER-CLASS RECALL · COHORT-PROPORTIONAL BARS ✓ 100% recall · all 4 classes · 0 false negatives 139 / 139 contraindicated 100% · 44 / 44 major 100% · 4 / 4 serious 100% · 69 / 69 moderate 100% · 22 / 22

Zero false-negatives on the entire 139-pair recall cohort. The PCCP gate (scripts/run_clinical_regression_eval.py) blocks any weight change that breaks this. Precision is verified separately: 0 / 10 false positives on the negative-control cohort (scripts/run_negative_control_eval.py, 6 clean negatives + 4 boundary cases — clopidogrel + pantoprazole, atorvastatin + amlodipine, simvastatin + diltiazem, spironolactone + trimethoprim). The cohort itself is pinned for integrity by tests/test_engine/test_negative_control_cohort_integrity_pin.py — 6 invariants gate what may live in the precision cohort: size = 10, every entry's expected_severity must be "none", ZERO collision with cache contraindicated entries (a logical contradiction), every entry has ≥ 1 evidence URL, the 4 named CYP-pathway boundary cases must be present, and clean negatives may not silently include drugs from any cache contra context (with documented allow-listed exceptions for metformin and lisinopril, which deliberately demonstrate non-collision behavior).

✅ Layer 4.5 BitNet alone vs. engine final (post iter-275 v8 promotion): the major sparkline above (100% · 4 / 4) is the engine final verdict — and as of iter-275 the engine ships v8, so BitNet alone now equals the engine on majors. The live-shipped Path A v8 bundle (1f0f8859…, 193-dim hash + 26 ATC flag + 13 pair-derived encoder × 256 hidden, 9 BOOST_KEYS @200×) hits 44 / 44 contraindicated (100%) + 4 / 4 major (100%) + 0 FP on the live 139-pair cache under cross-arch Q16.16 inference — **zero known misses**. v8 catches tacrolimus + voriconazole (the P-gp + strong-CYP3A4 cross-mechanism pair the v1 cfadb4f6 baseline missed at the hash-only architectural ceiling). The doubled hidden_dim 128 → 256 broke the v7 architectural ceiling discovered at iter-241; predecessor v6 (h=128, 592ee51e…) hit 40/41 + 4/4 + 0 FP — kept on disk for FDA SaMD audit-trail rigor. The pre-v8 baseline (cfadb4f6, hash-only 128-dim × 64-hidden) is preserved at engine/bitnet_weights.v1.cfadb4f6.bak.json for full audit-chain reconstruction (any auditor can replay decisions made before the iter-275 promotion under the prior bundle). Pinned at two levels by tests/test_engine/test_path_a_v8_live_recall_pin.py (aggregate: bundle_id + 44/44 + 4/4 + 0 FP + strictly_supersedes invariant) and tests/test_engine/test_path_a_v8_q16_determinism_pin.py (per-pair: 18 canonical pairs × 4 pinned values + 100×18 = 1800 forward-pass determinism stress). Pinned by tests/test_engine/test_bitnet_alone_major_recall_pin.py.

Mean latency
~4 ms
Median latency
~3 ms
Agreement
100%
PCCP gate
PASS

latency varies ±1 ms per run (CPU contention); agreement + gate are deterministic. Re-run scripts/run_clinical_regression_eval.py to verify.

Layer 4.5 BitNet confusion matrix — live deployment

0 FP · contraindicated
contraindicated
100%
44 / 44
major
100%
4 / 4
serious
84%
58 / 69
moderate
91%
20 / 22
predicted → none minor moder. serious major contra. moderate 2 0 20 0 0 0 serious 4 0 1 58 6 0 major 0 0 0 0 4 0 contraindicated 0 0 0 0 0 44 ground truth ↓ precision 44 / 44 = 100%

v1 baseline: the empty minor (0 of 139) and serious (0 of 139) columns are by design — both carried by the upstream 4-tier pipeline; Layer 4.5's job is the high-precision veto on contraindicated. Post-iter-275 v8 promotion lifts Layer 4.5 to full-recall on contra + major and 84% recall on serious (chips above). Pinned by tests/test_engine/test_bitnet_design_class_abstention_pin.py.

recall = 44 / 44 = 100% on contraindicated

Pinned by tests/test_scripts/test_bitnet_confusion_matrix.py: fp_contraindicated_is_zero (the safety invariant) + tp_contraindicated_at_least_seven (the recall floor — ratcheted iter-117 from 6 → 7 because BitNet has held TP=7 since iter-104). Re-run scripts/build_bitnet_confusion_matrix.py to refresh.

📋 Path A — curated pharmacology table SHIPPED + Path A v8 LIVE in engine (iter-275 promotion); zero known misses — docs/pharmacology_flags.json ships a 26-flag ATC pharmacology table with FDA-label citations per drug, plus 13 pair-derived DDI-rule bits. The curated table explains 44 / 44 contraindicated cache entries (100% explanation coverage). Path A v8 is the LIVE engine bundle as of iter-275 with 193-dim feature input × 256-hidden (64 hash trits + 26 flag bits per drug × 2 + 13 pair-derived = 193-dim feature input → 256 hidden → 5 logits) with 9-anchor BOOST_KEYS @200× upweighting. v8 hits 44 / 44 contraindicated (100%) + 4 / 4 major (100%) + 0 FP under cross-arch Q16.16 inference on the live 139-pair cache — **full-recall breakthrough preserved post-promotion**. The doubled hidden_dim 128 → 256 broke the v7 architectural ceiling discovered at iter-241 (where v7 at h=128 couldn't simultaneously satisfy 41/41 contra + 4/4 major + 0 FP regardless of seed). v8 bundle live at engine/bitnet_weights.json with bundle_id 1f0f8859… (~118 KB, 50,688 ternary weights). The pre-promotion v1 baseline (cfadb4f6, 128-dim hash-only × 64-hidden) is preserved at engine/bitnet_weights.v1.cfadb4f6.bak.json + the v6 staged bundle (40/41, 592ee51e…) on disk for FDA SaMD audit-trail rigor. iter-275 cascade complete: encoder refactored (engine/bitnet_features_v8.py bit-identical with trainer 6/6 canonical pairs), JS bit-identity mirror restored at iter-276, audit-replay regenerated, manifest SHA rotated, severity vocabulary corpus-aligned (none, moderate, serious, major, contraindicated), 25 files changed. v8 is pinned at TWO levels by tests/test_engine/test_path_a_v8_live_recall_pin.py (6 tests: bundle_id + 44/44 contra + 4/4 major + 0 FP + meta-block invariants + _V8_EXPECTED_MISSES empty-tuple invariant + strictly_supersedes_v6 invariant) and tests/test_engine/test_path_a_v8_q16_determinism_pin.py (8 tests: 18 canonical pairs × 4 pinned values + 100×18 = 1800 forward-pass determinism stress + cross-pin invariant locking the BOOST_KEYS promise — every prior v5 historical-miss + the iter-215 lurasidone+ketoconazole v6-known-miss are ALL classified contraindicated under v8). Multi-seed Pythia-6.9B + OLMoE-1B-7B FIM benchmarks running on Runpod in parallel for the V11 paper.

🎯 Calibration / margin diagnostic — docs/bitnet_calibration.json records every pair's top-1-vs-top-2 logit margin so an FDA reviewer can see when the model is uncertain, not just whether it's right. The smallest-margin contraindicated miss (itraconazole + simvastatin) is at Q16.16 margin 90,199 ≈ 1.38 — a close call, not a confident misclassification. Pinned by tests/test_scripts/test_bitnet_calibration.py.

▸ 📚 Explanation coverage — 100% (44 / 44 contraindicated) via 13 pair-derived DDI-rule flags. tap to expand the 13-rule list, pin info, and iter history

13 pair-derived rules in docs/pharmacology_flags.json: (1) CYP3A4 inhib×substrate, (2) OATP1B1×statin, (3) P-gp inhib×substrate, (4) CYP2C9×anticoag, (5) MAOI×serotonergic, (6) PDE5×nitrate, (7) iodinated-contrast×metformin, (8) CYP1A2 inhib×substrate, (9) xanthine-oxidase×thiopurine, (10) folate-antagonist pair, (11) tetracycline×retinoid (pseudotumor cerebri), (12) ACE×neprilysin (angioedema), (13) metformin×renal-state. Every contraindicated cache entry traces to at least one rule — no documented-gap fallback remains.

Pinned by tests/test_engine/test_contra_explanation_coverage_pin.py (4 tests: 100% floor, no documented-gap pairs allowed without flag firing, no stale gap-list entries, 13-rule cardinality lock) and complemented by tests/test_engine/test_pharmacology_flags_coverage_pin.py (9 tests including a canonical-example pin mapping every pair-derived rule index to a cache pair that MUST fire it — catches silent flag rename, dead rule, AND lost example regressions).

Iter 114: voriconazole + simvastatin lifted coverage 14/22 → 15/23 (CYP3A4-strong-inhib × statin slot). Iter 124: selegiline + meperidine lifted coverage 15/23 → 16/25 (MAOI × serotonergic slot). Iter 129: tadalafil + nitroglycerin lifted coverage 16/25 → 17/26 (PDE5 × nitrate slot). Iter 134: clarithromycin + pimozide lifted coverage 18/26 → 19/27 (CYP3A4-strong-inhib × CYP3A4-substrate slot — boxed-warning antipsychotic example). Iter 140: ritonavir + simvastatin (HIV protease inhibitor — 28th contraindicated entry, in the same CYP3A4-strong-inhib × statin slot) AND closure of the 8-mechanism documented-gap class via 7 new pair-derived rules — coverage 19/27 (70.4%) → 28/28 (100%). Iter 145: fluvoxamine + tizanidine (29th contraindicated — CYP1A2 inhib × substrate slot, broadens iter-140 rule 7 from 1 → 2 examples; FDA Zanaflex § 4 explicitly names fluvoxamine alongside ciprofloxacin as absolute contraindications; Granfors 2004 measured 33-fold tizanidine AUC rise with fluvoxamine vs ~10-fold with cipro). Coverage 28/28 → 29/29 (100% maintained).

FHIR R4 — Standards-Compliant

Sarah Mitchell, in real EHR data.

Every demo finding traces back to a typed FHIR R4 resource — 18 resources covering Patient, 4 Practitioners (with HHS NPI identifiers, Luhn-validated), Conditions, AllergyIntolerance, MedicationStatements, and Observations. Same shape Epic, Cerner, and every certified EHR speak.

Beyond Sarah Mitchell · full Synthea cohort

Patients
29
synthetic
NPIs
46
Luhn-valid
FHIR R4 entries
233
typed
Invariants
8 / 8
pinned

8 cohort-integrity invariants

  • ✓FHIR R4 Bundle top-level shape
  • ✓Patient count floor ≥ 29
  • ✓Practitioner count floor ≥ 46
  • ✓Every Practitioner has a us-npi identifier
  • ✓Every NPI passes CMS Luhn check digit
  • ✓meta._synthetic = true on every identity resource
  • ✓meta.npi_source = "DEMO_LUHN_GENERATED"
  • ✓Zero NPI collision with real NPI 1932159530

Source: docs/synthea_demo_cohort.json. Pinned by tests/test_engine/test_synthea_cohort_integrity_pin.py. Every Synthea-generated identifier is auditable from the test suite, not just the live demo — a future commit cannot silently break the cohort.

Joint Clinical Memory — Federated Across Sites

PHI never leaves the building. Knowledge does.

ClinicalMem is the first clinical-memory system where the PHI / non-PHI boundary is a typed runtime invariant, not a policy doc. Drug-pair severity findings, BitNet activations on novel pairs, and audit-chain witnesses propagate freely between sites. Patient identifiers — names, DOB, MRN, FHIR Patient resources — stay inside the originating hospital.

21 typed invariants HIPAA-defensible by construction Ed25519 + X25519 + ChaCha20-Poly1305 Control plane LIVE — MIND-Mem v3.12.0 MemoryMesh Patent-pending MIC@2 / MAP transport

Two lanes, one transport

The classifier at JointMemoryFederation::classify is the load-bearing PHI / non-PHI boundary.

runtime gate
✓
Knowledge lane

DDI severity verdicts (with repro_hash + bundle_id), BitNet activations on novel pairs, audit-chain witnesses, anonymised provider-disagreement patterns. Propagates freely.

✕
PHI lane

Patient names, DOB, MRN, FHIR Patient resources, free-text clinical notes. Encrypted at rest. Stays inside the originating site — BAA required for any access.

Defence in depth — 5 hard constraints

  1. PHI classification gate — classify.lane in ["clinical_knowledge", "phi_lane"]; phi_lane payloads dropped before transport.
  2. Independent PHI scrubber — 18 HIPAA Safe Harbor identifiers checked on the payload; any hit blocks the emit.
  3. Per-site Ed25519 signature — every emitted record signed with the originating site's private key.
  4. Inbound PHI re-check — scrubber runs again on receive; defence-in-depth against misconfigured peers.
  5. Tamper-evident audit chain — TAG_v1 hash receipts; verifiable decades later by any auditor with the originator's public key.

JointMemoryFederation.flow.mind

Content-addressed plan_hash recorded in the audit chain for every federation event.

plan_hash: cbfaf3e8…4e18b 21 typed invariants X25519 + ChaCha20-Poly1305 7 of 7 flows ship 
flow JointMemoryFederation {
    input  finding:              ClinicalFinding
    input  site_key:             Ed25519PrivateKey
    input  site_x25519_private:  X25519PrivateKey
    input  peer_pubkey:          X25519PublicKey
    input  peer_record:          FederatedRecord
    output emitted, ingested:    FederatedRecord, LocalKnowledge

    // EGRESS — this site → peers
    node classify  = @native federation_classify(finding)
    invariant classify.lane in ["clinical_knowledge", "phi_lane"]
    node scrubbed  = @native phi_strip(classify.payload)
    invariant scrubbed.has_phi == false
    node signed    = @native ed25519_sign(scrubbed.payload, site_key, site_epoch)
    invariant signed.canonical_preimage_schema == "TAG_v1_NUL_separated"

    // 6.5: encrypt the signed envelope before it touches the wire
    node sealed    = @native x25519_seal(
        signed.payload, recipient_public_key: peer_pubkey,
        cipher: "chacha20-poly1305",  kdf: "hkdf-sha256",
        per_record_nonce: true,
    )
    invariant sealed.payload_encrypted == true
    invariant sealed.has_aead_tag == true

    node emitted_record = @flow mind_mem_publish(sealed.payload, ...)

    // INGRESS — peers → this site
    node opened    = @native x25519_open(peer_record, site_x25519_private, ...)
    invariant opened.decryption_succeeded == true
    invariant opened.aead_tag_verified == true
    node verified  = @native ed25519_verify(opened.payload)
    invariant verified.signature_valid == true
    invariant verified.key_epoch_revoked == false
    node inbound_scrub = @native phi_strip(verified.payload)
    invariant inbound_scrub.has_phi == false
    node quorum    = @native severity_quorum(verified.payload, peer_quorum, 3, 5)
    node local_record = @native mind_mem_ingest(inbound_scrub.payload, ...)
}

Transport rides STARGA's MIC@2 / MAP / binary protocols in MIND-Mem (Apache-2.0). Full architecture: docs/federated_memory.md.

Live demo — mock transport

End-to-end federation proof. No network required. All 16 contract invariants verified in a single Python process.

exit 0 16 / 16 invariants PASS

Run it

python3 scripts/federation_mock_demo.py
# PHI gate test:
python3 scripts/federation_mock_demo.py --phi-test

Source

scripts/federation_mock_demo.py
tests/test_scripts/
  test_federation_mock_demo.py

Sample audit-chain hashes (one canonical run; nonces randomize per emit)

Site A (Mass General) egress  preimage_hash:
  ddcc76726c999f116b5d688a750106eea444c0361c6c76bb57d7f10986c14404

Site B (Mayo Clinic) ingress preimage_hash:
  ddcc76726c999f116b5d688a750106eea444c0361c6c76bb57d7f10986c14404

  ↑ Identical — proves bit-identical TAG_v1 NUL-separated canonical encoding.
  ↑ Specific value differs per run (128-bit nonce); the *equality* of
    the two hashes is the load-bearing claim. Re-run the demo to verify.
Control plane
LIVE on mind-mem v3.12.0
peer registry · 7 sync scopes · conflict policy · audit log · pub/sub fan-out
Wire bytes
mock queue (this iter) → MIC@2 (mind-mem v4.0 "Platform Scale")
no change above the record_publish_event / record_ingest_event boundary
Tests
9 unit tests
tests/test_engine/test_federation_transport.py

🔒 Cross-doc invariant-count integrity — the 21 typed count above is independently pinned by tests/test_scripts/test_federation_invariant_count_pin.py across all 6 user-facing federation docs: demo.html, JUDGES.md, docs/architecture.md, docs/clinical_validation.md, docs/fda_q_sub_draft.md, docs/federated_memory.md. The 5 tests gate (1) live invariant count in flow file = 21; (2) demo's INVARIANT_DESCRIPTIONS exercises 16; (3) all 6 docs cite "21 typed"; (4) bare "16 invariants" / "16 typed runtime invariants" forbidden in any of those 6 docs unless paired with "21 typed" disambiguation in the same file (iter-135 scope-expansion catching the same insidious scoped pin + unscoped doc drift class iter-132 caught for the iter-122 transport-distinction claim — three regulatory-adjacent docs had silently lied about the count for ≥ 113 iterations); (5) the 16-of-21 gap explanation must remain ("5 X25519 sealing invariants await the MIC@2 federation-transport adapter targeting a future MIND-Mem release").

6-Layer Safety Pipeline

Each layer adds confidence. Together they prevent hallucinations about patient safety.

1

Deterministic Table

Rule-based — never hallucinates

<1ms
2

OpenEvidence API

Mayo Clinic / Elsevier ClinicalKey AI

~2s
3

RxNorm API

Drug normalization + NIH interaction DB (Epic/Cerner standard)

~1s
4

Multi-LLM Consensus

6 US-based models must agree

~3s
6/6 AGREE
GPT-5.5 Gemini 3.1 Pro Grok 4.3 Claude Opus 4.7 Perplexity Sonar Pro NVIDIA Nemotron Ultra 253B
5

LLM Synthesis

Evidence-cited clinical explanations

~3s
6

Abstention Gate

"I don't know" when evidence insufficient — refuses to guess

0ms
Deterministic
Evidence APIs
LLM-Powered
Safety Gate

Clinical Terminology Integration

Three NIH/NLM vocabulary systems power coded clinical reasoning

RxNorm

Drug normalization + interaction detection. Resolves brand names to ingredients, checks NIH interaction DB.

Drug Normalize Interactions

SNOMED CT

Allergy cross-reactivity via drug class hierarchy. 8 drug classes with alias expansion.

8 Drug Classes Cross-Reactivity

UMLS Metathesaurus

Cross-vocabulary mapping: ICD-10 ↔ SNOMED CT ↔ LOINC ↔ RxNorm via CUI equivalence.

Crosswalk 6 Vocabularies

SHA-256 Audit Trail

Tamper-proof Merkle chain — every clinical decision is cryptographically linked

BLOCK #0 — GENESIS

Patient data ingested: Sarah Mitchell (18 FHIR R4 resources)

hash: a3f8c2e1b2d4f93a47c8e6125b71092df04ad9c318e2b5f76d2c4ea73f1b8d7b94e6f
prev: 0000000000000000000000000000000000000000000000000000000000000000
BLOCK #1 — CRITICAL

Drug interaction: Warfarin + Ibuprofen (severity=CRITICAL)

hash: 7e2b5f91d3a06c849f1e54bd2a7308fc92b14ad617c3e85f0db4fa28c91e7361c4a83d2e
prev: a3f8c2e1b2d4f93a47c8e6125b71092df04ad9c318e2b5f76d2c4ea73f1b8d7b94e6f
BLOCK #2 — CRITICAL

Allergy conflict: Penicillin allergy + Amoxicillin (SNOMED CT cross-reactivity)

hash: b1d4e7a3902f5ce8147b30d6ac82f714d5ea6928bf03c149e7325a6b9d18f0a2f82c6d19
prev: 7e2b5f91d3a06c849f1e54bd2a7308fc92b14ad617c3e85f0db4fa28c91e7361c4a83d2e
BLOCK #3 — HIGH

Lab trend: eGFR declining 45→38→32, metformin contraindication approaching

hash: c8f2a19674b53ed8902f6c4a1d7e8b35c0fa9237e145d8b62a04c7f93b1d29ace3d7b4a5
prev: b1d4e7a3902f5ce8147b30d6ac82f714d5ea6928bf03c149e7325a6b9d18f0a2f82c6d19

Every block's SHA-256 hash includes the previous block's hash — HIPAA-aligned chain integrity (designed for § 164.312(b) audit-control compliance)

Reproducibility Manifest docs/reproducibility_manifest.json

Single content-addressed snapshot an FDA SaMD reviewer drops into compliance review. Every load-bearing artifact is included by SHA-256; every flow plan_hash is captured; every gate verdict is run live at build time. scripts/build_reproducibility_manifest.py --check verifies on-disk parity in CI.

5 / 5 gates · PASS
openevidence_cache e625dd557f9ff597…
bitnet_weights f7f67afddcf03949…
bitnet_confusion_matrix c40c8d27286811d9…
cohort_coverage_matrix bd9abd7bf9b79015…
synthea_demo_cohort c9548b48e8be53b1…
bitnet_calibration 994652748ab413e5…
audit_replay_pins 7d5d427b08f2ee70…
pharmacology_flags 094687817f1b6b40…
flow_plan_hashes 7 flows · 64-char hex each

Pinned by tests/test_scripts/test_reproducibility_manifest.py (12 tests): SHA-format check, flow-set parity, BitNet safety-invariant pass-through, all-5-gates-PASS, test_count floor, git_head format, live↔on-disk parity via --check, every load-bearing artifact tracked (8 SHA-tracked + flow_plan_hashes), calibration + audit-replay weights_id ↔ engine bundle_id cross-checks, pharmacology-flags drug-count floor + flag-key set integrity. Re-run scripts/build_reproducibility_manifest.py after any artifact change.

Validation methodology

Honest about synthetic data. Honest about what's verified.

Every metric on this page traces to a checked-in artifact + a CI gate. No claim survives without an evidence path.

Verified on synthetic + curated cohorts
  • ✓139-pair recall cohort (44 contraindicated · 4 major · 22 moderate · 69 serious). 100% recall on every severity class · 0 FN.
  • ✓10-entry negative-control cohort with 4 boundary cases (clopidogrel + pantoprazole, atorvastatin + amlodipine, simvastatin + diltiazem, spironolactone + trimethoprim). 0 / 10 false positives.
  • ✓Cross-architecture determinism stress — 1200 / 1200 bit-identical replays (12 pairs × 100 iterations). Pinned by tests/test_scripts/test_bitnet_determinism.py.
  • ✓Python ↔ JS bit-identity — the in-browser BitNet forward pass produces the same repro_hash as the server-side path (warfarin + ibuprofen verified byte-for-byte).
  • ✓NPI Luhn-validity — every Practitioner identifier in the 239-entry FHIR cohort passes the CMS Luhn check digit; zero collision with the known-real validation NPI.
Capability vs typical CDS tiers
Capability RxNorm-only DrugBank-tier ClinicalMem
Pair lookup✓✓✓
CYP3A4 cross-mech—✓✓
Allergy ↔ class—✓✓
Provider conflict——✓
Lab trend gate——✓
Audit-replay hash——✓
Bit-identical / chip——✓
Federated · PHI gate——✓

Rows are capability presence, not headline accuracy. Detection-rate comparisons across CDS systems require IRB-approved, vendor-blinded prospective trials (a 4-12 week regulatory exercise — see column 3). Sources: NIH RxNav RxClass API · Bate, ICPE 2017 (Drug-Drug Interaction Detection in EHR Systems).

Deferred · requires real-world rollout
  • ○Adverse-event reduction outcomes on real patient data — requires IRB-approved cohort; review is 4–12 weeks. Not a hackathon-week deliverable.
  • ○NPI-attributed prospective study against a deployed CDS baseline (Epic BPA / Cerner First Databank) — requires a clinical-validation NPI partner (a separate engagement track, not the synthetic-data submission this demo represents).
  • ○Alert-fatigue measurement on real prescribing flow — the override rate of typical CDS systems (~30% per Olakotan & Yusof, IJMI 2020) is the comparator we need a real deployment to measure against.

This column is intentional. A hackathon-week submission cannot honestly claim adverse-event-reduction validation; it can claim a precision-respecting safety primitive ready to enter that validation, which is what the 8 capability gates above demonstrate.

Synthetic-data caveat — every patient identifier in this demo carries meta._synthetic = true and zero NPI collision with a known-real practitioner is enforced by tests/test_engine/test_synthea_cohort_integrity_pin.py. The capability rows in column 2 are exhaustively tested against the synthetic 139-pair cohort; the outcome claims (column 3) are explicitly out of scope for this submission.

MCP Tools & A2A Skills

MCP Server

FastMCP 2.x • 18 Tools • SHARP-on-MCP

store_clinical_observation
recall_patient_context
check_medication_conflicts
check_allergy_conflicts
detect_belief_drift
explain_clinical_conflictGenAI
clinical_care_handoffGenAI

+ 5 more tools (audit trail, dependencies, summary, ingest, health)

A2A Agent

Google ADK • 13 Tools • A2A Protocol

medication-safety-review
clinical-context-recall
contradiction-assessment
care-transition-summary
explain-conflictGenAI

Engine Modules (13)

clinical_memory
clinical_scoring
fhir_client
llm_synthesizer
rxnorm_client
snomed_client
umls_mapper
consensus_engine
fda_client
trials_client
what_if
phi_detector
hallucination_detector

System Architecture

FHIR R4
Patient Data
Medical APIs
RxNorm, SNOMED, UMLS
LLM Consensus
6 US-based models

Shared Engine (13 modules)

Clinical Memory
BM25+Vector+RRF
MIND Kernels
Scoring
Drug Safety
4-Tier Pipeline
LLM Synthesis
Evidence-Cited
RxNorm
SNOMED CT
UMLS
SHA-256 Audit Trail (Merkle Chain)
MCP Server
18 Tools
A2A Agent
13 Tools
Audit Trail
Tamper-proof

Tech Stack

MIND-Mem
Hybrid Search Engine
MIND Lang
Clinical Scoring
FHIR R4
Patient Data Standard
FastMCP 2.x
MCP Protocol
Google ADK
A2A Protocol
RxNorm + SNOMED
NIH Terminology
UMLS
Cross-Vocabulary
Azure
Container Apps