One brief in. Cara Spark out — an open-source failsafe medical-triage agent creator where the clinician brings their own model keys and policy, the model is never the rule engine, and a Braintrust eval gates every release. A spark of access where it matters most. The buildable reference implementation of our triage whitepaper, demoed by standing up a real CHC triage agent live from the clinician's own protocol.
The judged project lives in a new public repo — never graft-md. Cara stays a private SaaS the app builds against, like building on Stripe. Disclosed in the README.
Judges must clearly identify event-built work; blurring it = disqualification. Platform features (safety trail, builder UI) are labeled prior work, shown only as the backdrop.
Brief well, then interact minimally. Interventions are counted; self-caught failures score, human-caught ones cost. The day is won at briefing time, not at the keyboard.
Live URL + brief + rubric + session log, public repo. Finalists demo at 6:15. Our internal deadline: 4:30.
Build on Opus 4.8. Fable 5 + Mythos 5 were suspended by a US-government export directive on 6/12 (Opus 4.8 / Sonnet / Haiku unaffected) — so the old life-sciences-reroute worry is moot; we build directly on Opus 4.8 (use /fast). Still phrase the brief operationally (forms, routing, queues).
Three bans sit next door: medical-advice bots, AI nutrition coaches, AI mental-health advisors. Our defense isn't a disclaimer — it's Property 1 of the whitepaper: no clinically meaningful action may originate from the model; a deterministic policy adjudicates every action, the model only proposes evidence. The paper's adversarial suite shows zero attacks reached the action layer. Red flags escalate to humans; a "not medical advice" notice sits on every page anyway.
70% is what it does and how it demos. 30% is how it was built — session log + brief/rubric/workflow files. Both halves are deliberate deliverables.
CLAUDE.md + AGENTS.md written first, with segregation rules: only the public Cara API, reppit-health, and the fixture pack — never private-repo code, never real patient data. /reppit drives the phases, /goal holds the target, subagents do the work — researcher, builder, verifier, security reviewer, each in an independent context — and a repo memory file turns mistakes into rules instead of re-deriving them (fail → investigate → verify → distill). Autonomy contract: one kickoff, consolidated course-corrections only, structural latitude for the model; the session log is the artifact.
Quality: /review-code with every red and yellow fixed. Security: the /secure HIPAA/SOC2/HITRUST checklist. Behavior: a localhost Playwright suite — both intake flows, red-flag escalation, the notice on every page, voice-mode smoke — green before any push, so Amplify only ever deploys what passed. A grader sub-agent in a fresh context must confirm every rubric criterion before the builder is allowed to stop — self-critique grades its own work too softly. The model catches its own failures; that is the autonomy score.
The whitepaper made buildable: Observation (typed EvidenceFact with provenance + trust level) → Inference (dual-channel — deterministic red-flag engine + calibrated probabilistic risk) → Control (deterministic π maps state to a finite action set; the model never chooses) → Evaluation. Property 1 enforced in code: no clinically meaningful action originates from the model. Forward-only workflow state machine; fail-closed under uncertainty. Built live under reppit-health (our Apache-2.0 RePPITS plugin) with a Presidio PHI screen + audit-trail JSONL.
Not one app — a creator. A clinician brings their own LLM API key and ingests their own protocol; an AI policy-builder compiles plain-language clinical rules into a signed, versioned PolicyBundle (red flags, symptom→action thresholds, the allowed/prohibited action set). The in-app clinician console — editors included, audited in-repo — governs the bundle, agent skills, and tool permissions. Michael (the clinician) authors a CHC triage bundle live and tunes a threshold on stage; because it's a creator, the same flow stands up any specialty's agent — the use case is just the protocol you feed it.
The whitepaper's Evaluation layer + Release Gates, wired to Braintrust (already in our eval stack): a locked suite plus the adversarial suite — prompt-injection, authority-spoofing, dosage-manipulation — scored for critical-case sensitivity, false-reassurance rate, and calibration. A new model or policy version cannot ship unless the gates pass. This is the grader the rubric trusts, and the Orchestration artifact judges can rerun: change the policy, watch the eval re-gate.
Cara is the only backend: EMR connect (Athena/Canvas live through the connector layer), patient-find with no PHI, and OTP by text or email. Identity is verified model-blind — a secure form sends name + DOB straight to Cara's verify endpoint, the OTP goes out via Cara comms, and the model receives only "verified" + an opaque reference. Identifiers structurally never enter context; the trail logs "0 identifiers in model context." New patients can be registered on the tenant the same way.
Cara platform + API, the EMR connector layer, the PhiGuard/safety-trail stack, the triage whitepaper (published, ours), and reppit-health (Apache-2.0, ours). The README states the boundary; the demo says it out loud. Michael's clinical policy is disclosed as authored input — and is the MD validation the whitepaper names as its next step.
Impact: any clinic — and above all community health centers and non-profits, our primary market — can stand up a failsafe triage agent on its own keys + policy. Open-source + BYO-key puts provably-safe clinical AI within reach of the safety-net providers who serve the highest-need patients — Cara Spark, a spark of access where it matters most. Not a demo, a platform. Demo: live agent on a real EMR, eval gates green, audit trail, model-blind identity. Autonomy: one brief, hands off, eval-gated stop. Orchestration: reppit-health + a Braintrust release gate anyone can rerun tomorrow.
Remote setup: bridge open 8:30–22:00, Nils screen-shares; the trail viewer gives Seth and Michael live read-only eyes on the run. Confirm in Discord #questions that remote teammates are within the rules (team max is four; we are three).
@ts-expect-error lines, /review-code + /secure on the integrated diff, every pod on the new image, screener 2/2. The platform is the stable SaaS backdrop — untouched on Saturday.This is an open-source creator for failsafe medical-triage agents. This morning I gave it one thing — a clinician's plain-language triage protocol — and it produced this agent. Here's the live URL.
The risk decision is never the model's opinion — a deterministic policy adjudicates it, and the clinician owns that policy. Watch Michael change it from his desk.
Now the part everyone asks about. The agent needs to know who I am — watch. A secure form opens; I enter a name, a birth date, and where to send my code. None of it touched the model — it went straight to the platform, and the model only learned "verified." Search the session for the name: zero hits. Everything else — every file written, every record read — was screened the same way: types and counts, never values.
We barely touched it. The session log shows the interventions; verifier agents graded the work against this rubric, and the run closed with our open-source RePPITS Secure phase — here's the HIPAA, SOC2, and HITRUST checklist it produced.
Full disclosure: our platform — the API this talks to — is prior work, and it ran live against a sandboxed test tenant: real platform calls, synthetic patients, no real PHI. Everything in this repo was built today: the policy engine, the creator, the eval gate. The architecture is our published whitepaper, linked in the README. Tomorrow this creator stands up any specialty's agent from one policy.
| If this happens | We do this |
|---|---|
| Fable reroutes us to Opus 4.8 (life-sciences guard) | Friday's dry-run tunes the phrasing first. If it still trips mid-day: Opus 4.8 is strong (it's our own advisor fallback tier) — keep the loop, note it honestly in the submission. |
| Judges file us under advice bot / nutrition coach | Beat ii is the rebuttal: the red-flag fixture escalating to a human, the no-advice rubric check, static clinician-authored education, the notice on every page. Michael's authorship is named in the README. |
| Voice flakes on stage (cascade, mic, venue noise) | Fallback chain rehearsed: LiveKit cascade → browser speech → text, the same agent throughout; the Playwright suite covers the text path, so the demo never depends on audio. The phone beat gets cut, never debugged live, if it wobbles. |
| Venue network saturated | Venue network first, hotspot the moment latency wobbles. The run is cloud-side; only our steering suffers locally. |
| Autonomous run goes sideways | One consolidated correction with new information, logged with a reason. Verifiers catching it = points for us; panic-steering = points lost. |
| Cara API hiccups mid-run | The brief tells Fable to fail soft to fixture mode; the eval set doubles as the offline fixture layer, so the app demos end-to-end regardless. The platform was frozen Friday for exactly this. |
| AWS deploy misbehaves at 15:30 | Amplify was proven Friday with hello-world; last resort is a quick re-point to Vercel or a static export + tunnel; the backup video is already recorded. |
| Credits link issues | #credit-questions immediately; our own account as a bridge only if rules allow — Seth confirms in Discord first. |
| Not a finalist | The submission stands on its own: public repo + live URL + log. Post the wrap thread; the harness becomes a Cara marketing artifact Monday. |
/fast. The event keeps its name ("Claude Fable 5 Build Day"); only our build model changes.cara-spark), demoed by standing up a real CHC triage agent from the clinician's own protocol (use case open — chosen on the day). Clinician brings their own LLM key + policy; deterministic engine adjudicates; Braintrust gates release; Cara is the data plane. "Not medical advice" throughout. Defensible against the advice-bot / nutrition-coach / mental-health-advisor bans by Property 1, not by disclaimer./triage-agent-whitepaper_v1.4.pdf on this domain (no passcode), linked from the OSS README; v1.3 retired. The plan doc itself stays passcode-gated.