Reviews: a register,
not a summary
Source-linked findings, owned decisions, and a gated Readiness Pack.
The gate has
no override
Export is a pure function of finding states. No admin flag. No force-export. No privileged role. The gate screen has no override control anywhere on it, which is the point.
“The Readiness Pack cannot be exported until each blocker is resolved.”
The gate refuses concretely, with the remedy stated per finding: “Assign a named reviewer and a due date before this finding can progress.” Not a score, not a warning banner: a list of things a person has to do.
Export gate · STUDY-A · protocol v0.3
A-001 Local assay is adequate without central confirmationWeak · owner: unassigned
A-003 No comparator arm is neededMissing · critical
F-003 No randomization and no blinding statedSupported · high risk
Readiness Pack exportBlocked until each item is decided
Append-only decisions
“Every reviewer action lands here, in order, and cannot be edited afterwards.” A database trigger raises on any UPDATE or DELETE.
Named accountability
“High-risk findings need a named reviewer, not just a role.” High-risk items cannot be deferred, only parked with a stated limitation.
Downgrade-only
Statuses are ranked, so “rules never upgrade” is a numeric comparison. Nothing a rule does can make a finding look better supported than the model proposed.
“No source, no final claim. Human review is required before export.”
Partial support never becomes complete support
A conflict is preserved rather than silently resolved. Two sources that disagree stay disagreeing, on the finding, until a person settles it.
Retrieval confidence is not generation confidence
Both are shown, separately, on every finding: retrieval confidence high · generation confidence medium. Finding the right passage and reasoning about it can fail independently.
Instructions inside a document are content
Text in an uploaded source is material to be cited, never an instruction to follow. That containment is one of the invariant checks recomputed over each round.
Relevance does not
grant authority
A reviewer’s note is not evidence. Evidence is judged against a source-role authority matrix and a decision-date boundary, in code, on every finding.
| Source role | May support | Date boundary |
|---|---|---|
protocol | design facts · eligibility · endpoints · populations · statistics · comparator rationale · biomarkers · safety monitoring · dosing · burden · feasibility | no |
sap | analysis population · statistical assumption · endpoint definition | no |
tpp | strategic intent · endpoint definition | no |
proxy_tpp | strategic intent only | no |
registry | design facts · eligibility · endpoints · feasibility · regulatory status | applies |
publication | efficacy evidence · biomarker prevalence · feasibility · statistics · safety monitoring | applies |
ib | safety monitoring · dosing · efficacy evidence · biomarker definition | applies |
regulatory_label | regulatory status · safety monitoring · efficacy evidence · dosing | applies |
synthetic_simulation | analyzability · operability, and nothing else | no |
user_provided | Nothing. | no |
One row that says it all
user_provided may support no claim type at all. A reviewer’s own assertion is not evidence: one line of code that carries the whole design.
The date boundary
External evidence dated after the decision date cannot support that decision. A label effective 2026-06 cannot back a decision made on 2026-01-15.
And where it deliberately does not
Only the four external roles. An SAP is routinely finalized after the protocol version it accompanies, so flagging it would be a false alarm every time.
Eight stages; three
never call a model
- IntakeDeterministic. Manifest hashed.Rules
- FactsThe model quotes. The engine locates.Model, then rules
- AssumptionsSeeded by a packaged readiness catalog.Model
- EvidenceThe model proposes; rules downgrade.Model, then rules
- ConflictsSources that disagree stay disagreeing until a person settles it.Model
- QuestionsOne per unresolved finding.Model
- RoutingSuggests an owner function.Rules
- GateA pure function. No override. Only a person’s decisions clear it.Rules, then a person
The register starts from a catalog
The assumptions stage does not start from a blank page. A packaged catalog for the therapeutic area seeds what to look for, so the register is comparable between two reviews rather than being whatever the model happened to notice.
It also fixes the boundary honestly: coverage is bounded by the catalog and the source bundle, and the product says so.
Claim types are named things
- biomarker prevalence
- biomarker definition
- comparator rationale
- analysis population
- endpoint definition
- statistical assumption
- eligibility
- safety monitoring
- dosing
- regulatory status
A published paper can back a biomarker prevalence figure and can never establish a design fact, because both the source role and the claim type are named things the rules compare.
Sources carry a role and a date
“Say what each one is (its role) and when it was written (its date). The engine never guesses either.” The decision date is not metadata: it is the boundary external evidence is judged against, set when the review is created.
A batch process, and it says so
The analysis runs on a durable worker with live stage progress, not as a request the browser holds open. A full Reviews analysis takes 20 to 40 minutes; we would rather state that than route a demo around it.
Queue
Every finding routed to an owner function, with its risk and whether it is still open. High-risk items need a named person, not a role.
Rounds
What each round changed, what it re-evaluated, which stages executed and on which model. A stage that did not run says skipped and names none.
Decisions
“Every reviewer action lands here, in order, and cannot be edited afterwards.”
Evidence status and risk are separate. A fact can be fully supported and still high-risk, and the product never collapses the two into one number.
It survives change,
and it survives time
The biggest practical objection to any review tool is that one changed appendix forces a re-review of the whole protocol. It does not here.
Sources are revisions
Replacing a source supersedes it and keeps its text. An analysis run months ago still resolves every citation against the exact bytes it read.
Partial re-analysis
“Findings whose evidence has not moved keep their decisions.” An unchanged manifest runs nothing at all.
Every round is traced
Per round: what changed, what it re-evaluated, which stages actually executed, and on which model.
Stale, not drifted
If sources change after a round, the evaluation marks the report stale rather than recomputing against a bundle the analysis never saw.
A question no document
tool can answer
Because the same product simulates, a review can ask whether the protocol’s extracted design actually produced a traceable dataset with a passing validation report, and answer it with a real run attached as a source. See Simulations.
“Derived deterministically from the run’s own artifacts; no model was involved in this finding.”
The finding quotes a line the run renderer itself wrote, “Deterministic validation passed for this run.”, against the run attached under the synthetic simulation role, naming the run id, the seed and the subject count.
Minted deterministically
A finalized run is rendered into a source, and the findings that answer the analyzability items are minted with no model call: the inputs are numbers.
The scope states its limit
“These questions ask what Antevra can produce from the extracted design. They ask nothing about real-world site or patient feasibility.”
Not asked is reported
A review that did not opt in reports “Computational analyzability: not assessed.” in the pack. Every time.
What Reviews
is not
The Readiness Pack records human decisions. It determines nothing.
- Not a regulatory determinationAnd not protocol approval.
- Not an accuracy claimIt verifies that its own reasoning obeyed its rules, not that a finding is clinically correct. See Verification.
- Not automated reviewA person’s decision is a structural precondition of export.
- Explicitly partialCoverage is bounded by the question catalog and the source bundle.