Current work
NextConsensus estimates how likely a guideline, label, or coverage decision is to change by a set date. Ambit maps what an agent setup can already do, what one more step would unlock, and which of those tools actually work.
This work grew out of years of clinical software: escalation paths at Epic, verified identity at Doximity, reliability reviews at CancerCompass, named-owner routing at Transcarent, and physician sign-off at Andwise. I now build the same mechanisms into systems where a model makes the recommendation.
Building now
For sale · public forecast registry and published review methodology
NextConsensus
Registers a dated probability that the FDA, NICE, or a guideline committee acts by a team’s deadline. I build each one from that body’s own review record and score it in public once the deadline passes.
How a program works →
The test: Whether registered forecasts outperform the published baselines on independently resolved decisions.
Limit: Forecasts are registered before deadlines pass. The registry lists how many have resolved; predictive accuracy and client adoption remain unvalidated.
Experimental · open source, with a live demo and a published roadmap
Ambit
An agent setup is composed across MCP servers, CLI tools, skills, and credentials in separate configs. What an agent can actually do is not written in any single file, configured tools break without warning, and reach is routinely mistaken for permission to execute.
- What it does
- Reads your agent configs (Claude Code, Cursor, OpenCode, and others) into a local capability graph. It shows what is one step away, runs verification checks so broken tools do not fail silently, and provides an MCP server and terminal gate to control execution.
- What I learned
- Ambit keeps what an agent can do and what it may do as separate records from the start. A design that inferred permission from capability would have to be rebuilt before it could ever refuse.
- Why it matters
- A model with a shell, credentials, memory, and access to your infrastructure can do far more than it can in a blank chat. Agentic benchmarks measure that in a standard harness; Ambit maps it for one actual setup: what it can reach, and whether each piece works.
The test: Whether the action gate prevents unauthorized execution across independent agent runtimes without modifying host harnesses.
Limit: The gate checks actions when a runtime calls it. The downstream environment is a simulation; Ambit does not compel other runtimes to use the gate.
What an agent can do vs. what it may do, in three scenarios
The first two rows are built: each is the answer Ambit returns when a runtime integrates with its interceptor. The third represents an argument-level policy target currently in design.
| Scenario | Nothing in the path | Ambit’s interceptor |
|---|---|---|
| Production deploy | UNCHECKED checked at the tool level A deploy agent with production credentials can ship a release. Nothing between the agent and the environment asks whether this deploy was approved. | BLOCKED before execution checked at the action level Routed through Ambit’s interceptor, the deploy is refused and the environment left byte-identical until the staging check passes and a person approves this exact proposal. An approval for another proposal, an edited one, or an expired one is refused. A break-glass flag with a written reason overrides the block and is logged. |
| PR merge | UNCHECKED checked at the tool level A coding agent with write access can merge a pull request it opened. GitHub never lets an author approve their own pull request, but a repository requires no review at all until someone adds a branch-protection rule or ruleset. | GATED — human approval checked at the action level Ambit records committing as allowed and merging to the default branch as waiting for a person’s approval, so a runtime that asks about the merge is told to hold it. The Claude Code hook decides by tool rather than by action, so through it a merge and a commit get the same answer. |
| Clinical chart read | UNCHECKED checked at the tool level A model with EHR API access can read any chart the credential reaches. Nothing at runtime asks which patient a read is for. | NOT BUILT checked at the tool level Ambit decides by tool and never reads a call’s arguments, so a read for one patient and a read for another get the same answer. Limiting reads to patients on the agent’s case list is what it would need to check, and it does not check today. |
-
Production deploy
UNCHECKED
checked at the tool level
A deploy agent with production credentials can ship a release. Nothing between the agent and the environment asks whether this deploy was approved.
-
PR merge
UNCHECKED
checked at the tool level
A coding agent with write access can merge a pull request it opened. GitHub never lets an author approve their own pull request, but a repository requires no review at all until someone adds a branch-protection rule or ruleset.
-
Clinical chart read
UNCHECKED
checked at the tool level
A model with EHR API access can read any chart the credential reaches. Nothing at runtime asks which patient a read is for.
-
Production deploy
BLOCKED before execution
checked at the action level
Routed through Ambit’s interceptor, the deploy is refused and the environment left byte-identical until the staging check passes and a person approves this exact proposal. An approval for another proposal, an edited one, or an expired one is refused. A break-glass flag with a written reason overrides the block and is logged.
-
PR merge
GATED — human approval
checked at the action level
Ambit records committing as allowed and merging to the default branch as waiting for a person’s approval, so a runtime that asks about the merge is told to hold it. The Claude Code hook decides by tool rather than by action, so through it a merge and a commit get the same answer.
-
Clinical chart read
NOT BUILT
checked at the tool level
Ambit decides by tool and never reads a call’s arguments, so a read for one patient and a read for another get the same answer. Limiting reads to patients on the agent’s case list is what it would need to check, and it does not check today.
- Built
- A local SQLite capability graph, CLI (npx ambit-cli), MCP server, and interactive browser map. Discovers 15+ agent runtimes, verifies tools against live checks, and provides an action gate and tamper-evident execution log.
- Limits
- The gate is a brake, not a security boundary. Approval identity rests on the machine’s user accounts, and sandboxing tool execution is planned, not built.
- The Claude Code hook decides by tool, so a commit and a merge get the same answer. Ambit does not inspect call arguments to restrict chart reads to individual patients.
Research and evaluation
Draft · 3 of 12 development cases built across clinical error trajectories
Fast Harm, Slow Repair
Model evaluations measure whether a system answers correctly. Fast Harm follows a wrong answer through the workflow: who acts on it, how long correction takes, and what remains wrong afterward.
See the code →- What it does
- Scores error spread, action rollback, and unresolved persistence in a simulated healthcare documentation workflow after a record is corrected, with deterministic state scoring rather than an LLM judge.
Show the details Hide the details
- Built
- Case and state schemas, a deterministic trajectory scorer (no LLM-as-a-judge), input extractors, a Cloudflare Workers AI runner, and test fixtures for recovered, unrecovered, and over-corrected error states.
- Limits
- Protocol cases and evaluation suites remain in active development.
Public · proposed standards at ethotechnics.org, each with a version number
Ethotechnics
Uptime and cost have owners because a contract or a budget names one. In the teams I have worked with, nothing named an owner for when the evidence changes, the model degrades, or a patient is harmed.
Explore Ethotechnics →- What it does
- Specifies what evidence an automated decision must carry, who may approve or challenge it, and how to record a correction.
Show the details Hide the details
- Built
- Draft standards with JSON Schemas, a conformance checker that grades decision logs against them, a casebook scoring five public failures on six safeguards, and a crosswalk of seven controls to NIST AI RMF, ISO/IEC 42001, and the EU AI Act.
- Limits
- Standards are proposed specifications and open schemas; no outside institution has adopted one.
Supporting infrastructure
Live · open source, with a scheduled observation bot and a 15,926-event public test set
Refract
Replays source revisions into dated change events so readers can check which citations might be out of date. The same source history produces the same events on every run.
See the code →The test: Whether replaying source revisions detects consequential downstream evidence changes at acceptable precision, with no silent drops in the published corpus.
Limit: Rerunning the event stream shows the results are consistent. It doesn’t show they’re medically true, accurate as forecasts, or used by anyone else.
Show the details Hide the details
- Built
- A deterministic revision-comparison engine, published on npm (@refract-org/cli) with an MCP server and a scheduled bot watching live sources. The published test set contains 15,926 change events across ten Wikipedia articles.
| Page watched | Events in 30 days | Newest event | Seen |
|---|---|---|---|
| Bitcoin | 7 | a citation added in “(lead)” | |
| COVID-19 | 100 | a section reorganized in “Bioethics” |
Every morning the bot replays the last 30 days of each page’s revision history and commits only when something changed. The raw files →
Writing
Public · 230+ essays at thecrumple.zone
The Crumple Zone
Automated decisions move faster than anyone can review them, and people are harmed in the time between the two.
Read the essays →- What it does
- Essays named for what Madeleine Clare Elish called the “moral crumple zone” (2019): the person nearest an automated system, who takes the blame when it fails despite having little control over it.
- What I learned
- Fraud filters, benefits queues, and clinical alerts kept producing a common structure despite sharing no technology, regulator, or vocabulary. I began specifying shared requirements for review and correction, while leaving domain-specific decisions to the people qualified to make them.
- Why it matters
- The same patterns became requirements in the framework: decisions made under depleted attention, systems where a wait works as a denial, and harms that are fast to cause and slow to undo.
Show the details Hide the details
- Built
- I write about who absorbs an institution’s failures and who can make it correct them.
How I build
I build with AI coding agents and keep reusable copy reviews and pre-deploy checks beside the code. I run classification, extraction, summarization, and log scanning on local models; reasoning goes to a frontier model.
The interface rule is to build for the person who is stressed, tired, and operating on 15% battery, not the hero user. I call that designing for the person at 15% battery.
The site is a tool surface too: agent access returns the same records these pages render, with a URL to check each one.
Product breadth
Tools, civic data projects, and graphics engineering I build alongside my main systems work.
The test: Whether compiled presets match projectM reference captures at interactive frame rates.
Limit: A preset that compiles is not necessarily a visual match to projectM. Measured results apply to the presets and reference captures I tested.
The test: Whether weekly operating thresholds improve capital preservation and hiring timing over fixed-cadence planning.
Limit: Whether its recommendations improve independent users’ decisions remains unvalidated.
In draft
Two Unicode proposals, built the way the case studies are: reconstruct what the institution already decided, state what the proposal would need, and publish the draft.
- Tunnel emoji proposal: never proposed before, so no earlier decline holds it back.
- Whistle emoji proposal: the same emoji has been declined, and a 2025 decline may count against this one.
Revised