The verdict is deterministic. The AI is everywhere else.

If extraction is correct, the verdict is correct by construction.

The architectural rule across Verum is a deliberate split between load-bearing and decorative AI. Extraction is genuinely a language task and stays LLM-bound. The verdict is a code path: rule-tree evaluation in pure TypeScript, same answer across all models, all providers, all runs. Five LLM passes run in parallel around the verdict to add narrative texture, second-opinion advisory, soft signals, and qualitative tags. None of them own the decision. The trace shows you which is which on every case.

Two production surfaces. One engine. Both sides of the payer-provider divide.

Verum runs Decide (payer-side prior authorization) and Insight (provider-side multimodal clinical decision support) on a shared `lib/clinical-policies/` framework with the same deterministic-gate architecture, the same audit ledger pattern, and the same model-portable provider lattice. The pair is connected at the data layer via the BRIDGE drawer — a PA reviewer can pull a vision read from Insight into a Decide case mid-review without leaving the surface.

Same patient. Same note. Three payer verdicts.

Cross-payer policy variance is the single most expensive operational problem in UM. Verum encodes each payer's policy as data, not prompt. The same clinical extraction runs three lanes in parallel, each evaluated against its own rule tree. The divergence is visible — every cited rule traces back to verbatim policy text and a fetchable URL.

Vision in the critical path. Never in the verdict.

Each Insight flagship is fine-tuned on Verum Vision's specialty training distribution and anchored in peer-reviewed clinical consensus. The vision encoder contributes structured facts in the same vocabulary as the text extractor. The deterministic gate runs identical code regardless of which encoder produced the evidence. When facts disagree, the audit trail names the dispute by ID.

All four flagships collapse to the same TrinaryVerdict (CLEAR / REVIEW / ESCALATE) so artifact generators — SOAP notes, advisor opinions, escalation letters, audit packets — plug in unchanged across modalities via prompt-swap.

Insight inside Decide. Cross-product integration at the data layer.

A PA reviewer in /review encounters a spine case with an MRI attached. The dictated note is borderline. They click "Read this image with Verum Vision", a right-side drawer opens, Verum Vision streams findings into the panel, high-confidence findings are pre-checked. The reviewer promotes the ones they want into the case, the Decision carries imagePromotionAudit metadata, and the PDF decision-packet gains a Page-1 banner plus a Page-3 audit-detail section. The image read never leaves the case context.

1. 01

   PA reviewer opens /review with a spine case + MRI attached

2. 02

   Reviewer clicks "Read this image with Verum · Vision"

3. 03

   BRIDGE drawer slides in. Verum Vision streams findings live.

4. 04

   High-confidence findings pre-checked. Reviewer selects promotions.

5. 05

   Decision carries imagePromotionAudit. PDF gains audit banner + detail page.

Verum Vision, in the critical path.

Verum Vision is our proprietary 4-billion-parameter clinical vision model, trained and fine-tuned on proprietary specialty corpora across four clinical domains: thoracic radiology, vitreoretinal ophthalmology, primary-care dermatology, and uropathology. The model initializes from an open-weights medical foundation and is then put through continued domain pre-training plus task-specific supervised fine-tuning per flagship. We deploy it on a customer-tenant inference endpoint behind the customer's BAA. The adapter speaks the OpenAI-compatible /v1/chat/completions wire shape, so the same protocol works against vLLM, TGI, or any compatible runtime. Each flagship runs its own specialty-register system prompt anchored in its training distribution.

Append-only ledger. Sealed records. Two export formats.

Every action since the case opened is on an append-only ledger. Sealing requires an attestation modal with a free-text statement and an optional Accept-with-reservations flag. Once sealed, the record is immutable; any further mutation throws SealedRecordError. Re-image creates a new record with supersedes lineage. Records persist locally, LRU-capped at 20.

CRD-aligned posture via meta.tag[]; Verum does not claim CRD STU 2 profile conformance the IG does not publish. The audit posture is designed for review and forensic, not for marketing literature.

Reviewer-attested override. Resolve missing facts. Counterfactual probe.

Verum is not autonomous-by-default. Three operator actions are first-class. The deterministic gate is the reproducible baseline; each operator action is captured in the audit chain so the override or resolution lives in the record alongside the verdict it changed.

Each operator action lives in the audit ledger next to the verdict it changed. The deterministic gate is the reproducible baseline; the override or resolution is the operator's attested deviation. Both survive a sealed-record forensic read.

Five providers. Forty-eight models. One env-flip to swap.

Verum is model-portable by construction. The TopBar selector switches provider live across every load-bearing call. Per-request BYOK key threading via AsyncLocalStorage means the customer's key flows through every provider factory in the call graph without changing call-site signatures. Adding a provider is one file edit plus a model-registry entry.

// the call-site stays untouched
const facts = await extractFacts(note)

// inside the factory, the BYOK key is already in scope
function groqClient() {
  const key = byokScope.get("groq")
    ?? process.env.GROQ_API_KEY
  return new Groq({ apiKey: key })
}

// AsyncLocalStorage carries the key through the call graph
withByok({ groq: customerKey }, async () => {
  return run(case)   // every nested provider call sees it
})

Twenty-two walkthrough tours. Roughly two hundred steps.

Operator training is built into the surface. Fourteen intro tours auto-launch one-per-session covering each major surface in 50-100 seconds. Eight deep-dive companions walk every load-bearing affordance: four input modes, voice sub-modes, suggest-from-note extraction, model selector, attestation flow, override flow, FHIR / PDF export, cross-payer chip resolution, simulator presets, validation ECE, eligibility heuristic, CDS Hooks discovery. Approximately 200 steps total. Enterprise rollout doesn't require a separate training program.

Over a thousand assertions, two evaluation harnesses, three wire logs.

The codebase ships with deep test coverage as a precondition, not a follow-up. Decide carries 1,020+ pure-code smoke assertions across 24+ test files. Insight ships 142+ always-on deterministic assertions plus 156+ conditional LLM assertions for opt-in end-to-end runs. Both products carry their own evaluation harness: Decide's reports ECE calibration; Insight's tracks per-flagship coverage. Three vendor-adapter wire logs (Groq, NIM, Verum Vision) capture full request bodies and raw responses for any failure forensic.

What's shipped. What's in flight.

The shipped column is what survives a customer's technical due-diligence today. The in-flight column carries target dates the team commits to. Everything on the page above this register is drawn from the shipped column.