How Antevra
works inside
Both pipelines from source to export, every model call marked, and what is and is not measured.
Where the model is,
and where it is not
Software proposes. Rules decide. A person signs. In Simulations exactly two steps call a model. In Reviews, the three stages that decide anything (intake, routing and the gate) never do.
A protocol becomes a dataset
Extract, and repair
The model reads the protocol into a typed design and, only when validation fails, proposes an adjusted one. Nothing else in this pipeline calls a model.
A person approves the design
Generation runs only against an approved design, and a repair is a proposal parked for a person, because a repair changes the study.
Deterministic Python
Generation, the realism overlay, the integrity gate, validation, the assumptions report and the traceability spec. No model, no network, no clock.
Same seed, same bytes
Because the generating half is deterministic, the output is reproducible byte for byte and pinned by committed golden hashes.
A bundle of documents becomes a record
Rules only ever downgrade
Statuses are ranked, so a rule can push a finding down the ladder and nothing can push it up. A numeric comparison, not a convention.
Five of eight stages call a model
Facts, assumptions, evidence, conflicts and questions call a model. Intake, routing and the gate never do, and the model only ever proposes.
A gate with no override
Export is a pure function of finding states. No admin flag, no force-export, no privileged role: the only way past it is a person deciding each blocker.
The life of a claim
- Source revisionImmutable, role-tagged, dated. Nothing is ever overwritten.
- Quote and proposed statusA verbatim passage, and what the model thinks it supports.
- Locate, authority, boundaryFind the quote by character offset. Check the role. Check the date.
- Downgrade, never upRole mismatch, post-cutoff, proxy, unlocated quote, low confidence, no citation.
- Routed to an ownerClinical, biostatistics, safety, regulatory or operations.
- Named reviewer, due dateHigh-risk findings need a person, not a role. They cannot be deferred.
- Decision, append-onlyAccept, correct, reject, park with a due date, or keep as a labeled limitation.
- The gateA pure function of finding states. There is no override to find.
- Readiness PackJSON canonical and content-hashed; Markdown and HTML rendered from it.
One engine, one server,
one ledger
The dependency arrow points one way, server to engine, and a test that walks the syntax tree fails the build if it ever reverses.
- SurfacesA React workspace, a command line, an MCP server and a local console. None is privileged; the CLI and MCP reach the engine with no database near them.
- Control planeA versioned API, a durable worker and a storage seam on PostgreSQL, with append-only triggers on the decision and determination logs: immutable at the database, not by convention.
- The engineA pure library: no web framework, no database, no ORM. Simulation, readiness, design risk and assurance packages.
- One model seamA façade and switchable backends, including a model you host yourself. Nothing outside it knows which backend served a call.
Five rules the code enforces
Software proposes. Rules decide. A person signs.
The model extracts, proposes, repairs and detects. The engine generates every row, applies authority and the date boundary, computes the estimate, runs the gate and builds the pack.
Rules only ever downgrade
Evidence statuses are ranked, so a rule can push a finding down and nothing can push it up.
Same seed, same bytes
Design, subjects, seed and realism configuration determine the output byte for byte, answer key included, and committed golden hashes pin it.
Bounded honesty
A failing validation is surfaced, never faked clean. A blocked gate never becomes an export. A stage that did not run is skipped and names no model.
Engine purity
The engine imports no server code, which is what lets the CLI and the MCP server reach it with no database near them.
The answering model is what gets written down
Tiers, not fixed ids
Callers ask for a reasoning tier or a cheap tier. Each backend maps a tier onto its own model, in an ordered fallback chain read from configuration.
The invocation scope
Every call passes through a scope that records the answering model, the prompt hash and the token counts: the ledger that Assurance reads.
A versioned extraction cache
A protocol’s extraction is cached by document hash and cache version. A cache hit records that no model ran, rather than the model that would have.
Every artifact
has a screen
The answer key, the ranked design-risk report and the seven-step dossier each have a screen, and every screen inherits the rule its artifact carries. Every figure is read from a server artifact; the browser derives none.
Home
Only what you can act on, such as a parked repair proposal or a blocked dossier, each linking to where that decision lives.
Efficacy
Kaplan–Meier per arm under either convention and any of four evaluators, with a number-at-risk table and the subjects on which the two rules disagree.
Central review
Elected versus achieved discordance, a reader-agreement matrix, the adjudication log with the accepted flag, and the charter rule quoted from the server.
Subjects
A swimmer lane per subject; waterfall and spider from the measurements; the RECIST rule’s inputs and output side by side.
Schedule
Visits × assessments as a grid (planned, observed, within window, deviated) with a click filtering the deviations table.
Design risks
A filter rail, cards in the report’s own order, a protocol pane that scrolls to the cited page, and the M11 tree.
Dossiers
Seven steps, the Context of Use, evidence with its hash and ledger flag, append-only determinations, the reconstruction viewer.
Study hub and run compare
One protocol’s designs, runs, reviews and dossiers on one timeline; two runs side by side with equal hash pairs marked.
Rules every screen keeps
- Numbers are read, never derivedNo total, no recount, no hash computed in the browser.
- Every chart has a tableA chart is never the only way to read a number.
- One reveal per pageMotion after that answers a person’s action, and reduced motion returns the final frame.
- A prepared check is not a passA tab for a capability the server does not have is absent, not empty.
- The state lives in the URLTabs, sorts and filters round-trip through the address bar, so a link is a place.
An assistant that
can only quote
A docked reader beside every screen. Ask why a run is blocked, which subjects match a condition, what a source says, or what a chart means. Every sentence it answers with is attributed to something the engine produced in that turn. It never writes. It never forms a verdict. “I don’t have that” is a first-class answer.
Assistant · scope: one run · read-only
Why is this run blocked?question
Tools: validation_findings, dataset_sqlretrieved
Two high-severity findings in AE; the AE to EX query returns the subjectsanswer
Citations resolved; one unresolved marker droppedadmitted
Answers from evidence
It asks a tool first. If the tool returns nothing, the answer is a refusal that names the tools it tried. If the model cites something the tools did not return, the citation is dropped before you see it.
Reads verdicts, never forms them
Export state, evidence status, validation result, gate blockers: read from the engine’s own producers and quoted. No prompt asks a model whether something passes.
Two model calls at most
A cheap call, or a deterministic shortcut, plans which tools to use. Python retrieves. One call answers over the retrieved evidence. Python then resolves every citation, and an answer with none left becomes a refusal.
Scope is stated
Every turn carries a scope (workspace, protocol, run or review) shown before you send. Widening it is your action. An answer never reaches across studies or tenants.
SQL in a sandbox
Data questions become one read-only SELECT over the run’s own SDTM domains, in an embedded engine confined to that run’s directory with external access closed.
Read-only at the seam
The tool catalog’s type has no representation for a mutating tool, and the API behind it is the viewer role. Read-only is a property of the code, not an instruction in a prompt.
| Scope | Tools | What it can cite |
|---|---|---|
| Run | run_summary dataset_sql validation_findings assumptions_report traceability repair_proposals protocol_design | The run’s manifest, its SDTM domains through sandboxed SQL, its validation findings, what the generator had to invent, the traceability chain, and any repair parked for a person. |
| Review | review_summary review_findings review_gate review_decisions review_queue source_excerpt readiness_pack | Findings with their citations, the gate exactly as the engine computed it, the decision log, who owns what, a located excerpt from a source, and a section of the pack. |
| Workspace | list_scope eval_results docs_lookup | What the signed-in user has, how the golden evals scored, and definitions from the shipped documentation, never from the model’s memory. |
- It does not decide, approve, apply or exportNo answer can become a decision row.
- It does not give clinical, regulatory or statistical adviceThat question is refused as out of scope, in a sentence.
- It does not stream or loopOne plan, one retrieval, one answer.
- Transcripts are redacted, never deletedRetention empties a message’s content on its clock and keeps the row, its timings, its tool names and its refusal code.
It checks that it
obeyed its rules
Antevra does not claim to have measured clinical accuracy, which is exactly why every claim is attributed to a source and routed to a named person before it can be exported.
Did the rules get applied correctly?
Deterministic invariant checks (authority, date boundary, downgrade soundness, coverage, injection containment) recomputed over a recorded round. No model is called.
Did it agree with the gold labels?
30 golden eval cases: disagreement with each case’s labels for evidence status, claim type, routing and located citations. A different question from the checks, and the two are never summed.
A check that was written but not run is not a passing check, so the dashboard counts them separately and shows the count. It serves no single merged pass number, so none can be quoted as an accuracy score.
Every check, and what it asserts
- Schema and refs validEvery finding has a unique, well-formed ref and a title.
- Citations locatableNo supported or weak finding rests on an unlocated citation.
- Authority flags consistentRecorded flags match the matrix recomputed now.
- Date-boundary flags consistentRecorded flags match the boundary recomputed now.
- No proxy supports a final claimNo proxy citation supports a final claim.
- Status soundEvery status equals the recomputed one, and none outranks its proposal.
- Catalog coverage completeEvery applicable catalog item has a finding or an explicit gap.
- No unsupported claim exportedNothing unsupported is allowed out without an accepted limitation.
- Injection containedA finding suspected of injection is not supported and not exported.
- Rules unchanged since the roundThe evaluation rules are unchanged since this analysis ran.
What has not been measured
There is no measurement of whether an extracted fact is clinically correct against expert ground truth. If a page needs one of these numbers, the answer is that it does not exist.
- Extraction accuracy, precision, recall or F1Not measured.
- Agreement with human reviewersNot measured.
- Time or cost saved, or amendments avoidedNot measured.
- False-positive or false-negative ratesNot measured.
- Uptime, service levels or throughputNot offered.