Amani

The smallest
decisive test.

A biomedical evidence engine should spend its complexity on the science. Amani’s next test: preserve the rigorous boundaries, shrink the machinery, and make every exit report.

Inspect the proposed test Read the code

Architecture review · 16 October 2026 · Proposed work is not a measured result

The evidence boundaryCurrent execution contract
One locked plan, six fixed physical executions A locked plan precedes one primary execution, four fixed verification executions, and one blind other-family replica. Those six executions are not six adaptive looks. Receipts feed a report. Locked plan 123456 PrimaryFixed verification × 4Replica Receipts → report
1 + 4 + 1Physical executions in the accounted completed Amani ledger
≠ 6 looksFixed verification does not grant adaptive access to outcomes

Rigor stays.Plan lock, outcome separation, multiplicity, verification, and truthful abstention.

Operations shrink.One deadline, one disposable operating-system boundary, reusable immutable evidence.

Claims stay scoped.Historical counts, proposed experiments, and statistical guarantees are different things.

Keep the boundary.
Reduce the moving parts.

Three architectures, three scopes. The migration target preserves the current execution contract. A thinner spike first asks whether the operational core can work at all.

Current Amani

Existing engine and software certification path

Current Amani flow Question and safe schema, plan lock, development and Fleet scheduling, primary execution, certification and reruns, blind replica, certification, then report and cleanup. Question + safe schema Plan lock Development / Fleet Primary execution Certification + reruns Blind replica Certification Report + cleanup Primary + 4 verification + 1 replica

Existing controls include a hypothesis registry, program-wide LORD++ accounting for registered abandoned proposals, and first-decision finality.

Evidence kernel

Proposed simplification · preserve the rigor contract

Proposed evidence kernel flow Free safe generator, lock, a disposable operating-system unit, immutable receipts, pure checks and labels, and a deadline report. The rigor-equivalent migration keeps one primary, four fixed verification executions, and one blind replica. Free safe generator Lock Disposable OS unit Immutable receipts Pure checks / labels Deadline report Same fixed executions. Fewer control paths.

The first thin spike is weaker. It omits certification and must declare that capability limit. It makes no production rigor claim.

Hypothesis loop

Proposed scientific workflow · separate protocol

Proposed hypothesis loop flow A topic and deidentified data are split by patient into discovery and confirmation. Discovery supports exploration and an all-hypothesis ledger. Finite tests are ranked and locked before an exactly-once confirmation kernel produces an association report. Topic + deidentified data Patient-level splitDiscovery / confirmation Free explorationAll-hypothesis ledger · discovery only Rank / lock finite tests Exactly-once kernelConfirmation patients only Association report Further waves require new validity.

Fresh confirmation patients or separately proved selective / sequential validity are required for adaptive waves. Unspent alpha does not refresh a holdout.

A statistical label is not a software certificate.The current entrypoint runs with OS user separation off, which caps its strongest software label at Tentative. A future “confirmed-association” label must remain separate from engine Confirmed and preserve that cap.

What rigor keeps

  • Locked plans, one-look outcome access, and outcome separation
  • Hypothesis registry, validity checks, and multiplicity accounting
  • Four fixed verification executions and a blind other-family replica
  • Host ledger, signing, first-decision finality, and truthful abstention

What operations changes

  • Free generation inside a safe development boundary
  • One deadline and one disposable operating-system boundary
  • Pure evidence reuse instead of repeated evidence production
  • Deterministic partial reports on every terminal path

The clearest signal
is operational.

Supplied internal observations point to execution machinery as the largest visible failure category. They do not establish scientific accuracy or the cause of every failure.

58

Selected historical
attempts

Overlapping development attempts. These are not independent tasks and are not an accuracy estimate.

All selected attemptsCount / 58
Outcomes of 58 selected overlapping historical attempts 22 were complete-correct, 34 were system faults, and 2 were justified abstentions. The chart is counts only, not an accuracy estimate. 2234
Scope: the selected historical review. “Complete-correct” and “system fault” are supplied review categories, not a public benchmark.

Inside the 34 system faults

Process / provider28
Rigor plumbing5
Mixed plumbing / model1

Scope: fault category, not causal certainty. The process / provider count includes one provisional attribution.

Attribution confidence is separate

32 / 34have specifically supported operational causes

2 remain attribution-uncertain. This is an evidence-support distinction within the same 34 faults, not another outcome category.

Source: Owner-approved architecture review and count-only race checkpoint, 16 October 2026; overlapping development attempts. These are supplied internal observations and are not publicly independently reproducible.

A checkpoint.
Not an accuracy ranking.

Race2b, counts only. The 15 October 2026 checkpoint is incomplete, and operational failures leave unequal scientific grading denominators.

15Pairs planned
10Terminal
5Unstarted

No matched accuracy ranking follows from this checkpoint. Terminal means an attempt ended; it does not mean it was scientifically graded.

Race2b count-only checkpoint. Different grading denominators prevent a matched accuracy ranking.
SystemTerminal / gradedCriteria creditedFull-card passesWhat ended
Plain Codex3 / 347 / 47Across 3 graded cards3 / 33 graded attempts
Amani4 / 229 / 32Across 2 graded cards0 / 22 correct verdicts2 other attempts hit ungraded operational caps
Biomni3 / 0UngradedRecorded 0 / 47 is not scientific accuracy evidence—No graded cards3 runtime failuresBefore scientific analysis

A correct verdict is a narrower outcome than a full-card pass. Amani’s two graded verdicts were correct while neither graded card passed every criterion.

Amani model calls are unknown. Physical execution counts do not supply missing model-call counts or a matched resource comparison.

Count executions.
Do not invent extra looks.

The accounted completed Amani ledger contains six physical executions: one primary, four fixed verification executions, and one replica.

Six physical executions are not six adaptive looks One primary execution plus four verification executions plus one blind replica equals six physical executions. This is not six adaptive looks. 123456 Primary4 fixed verificationsReplica

Source: Owner-approved architecture review and count-only race checkpoint, 16 October 2026. Race checkpoint: 15 October 2026. Supplied internal observations; not publicly independently reproducible.

A smaller test
with a useful answer.

A proposed development-practice ablation starts with the two endpoints and a structural safeguard. Continue into the missing arms only if the kernel is functional.

6 cards4 estimable, diverse structures
2 known legitimate abstentions
18 firstScreen the same 6 cards across
A0, A2, and A5
36 total6 cards × 6 arms if functional
Expand to all 24 only after screening

Proposed attempt matrix

Proposed screen: 18 card-arm attempts Six practice cards form the rows and arms A0 to A5 form the columns. The initial screen uses arms A0, A2, and A5 for all six cards. The full proposed matrix contains 36 attempts. No results are shown. A0A1A2A3A4A5 Estimable structure 1Estimable structure 2Estimable structure 3Estimable structure 4Legitimate abstention 1Legitimate abstention 2 Proposed screen: 18 card-arm attemptsRows one through four are estimable structures. Rows five and six are legitimate abstentions. The initial screen uses A0, A2, and A5 on every card. The full matrix adds A1, A3, and A4. Filled cells are proposed attempts, not results. A0A1A2A3A4A5 Estimable 1Estimable 2Estimable 3Estimable 4Abstention 1Abstention 2

Filled cells are the 18 proposed screen attempts in A0, A2, and A5. Empty cells are deferred. No experiments have been executed for this proposal.

  1. A0

    Plain CodexBaseline under the same resource caps.

  2. A1

    Locked plan + one executionThe thin kernel. Declares its weaker capability.

  3. A2

    Add a structural twinOutcome-hidden application binary interface (ABI).

  4. A3

    Add all four verificationsFour fixed verification executions.

  5. A4

    Add a blind replicaOther model family. Six total physical executions.

  6. A5

    Full current engineBundle / control, rather than an isolated causal component.

Equal caps. Complete accounting. Report verdicts, criteria, abstentions, unjustified claims, faults, elapsed time, and model calls. The incremental rungs describe component differences; the A5 bundle comparison cannot prove an isolated cause.

Small screens do not establish reliability. Even zero faults in six independent attempts leaves a one-sided 95% binomial upper bound of 39.3%. This is an illustrative design calculation, not an observed result.

Explore freely.
Confirm once.

The proposed loop gives exploration room to search while keeping confirmation patients behind a boundary. Its statistical protocol must be specified and validated separately.

Patient-level discovery and confirmation separation Deidentified data are split at patient level. Discovery patients feed exploration and an all-hypothesis ledger. Ranked tests are locked, then run exactly once on confirmation patients. Further adaptive waves need fresh confirmation patients or separately proved selective or sequential validity. Topic + deidentified patient data Patient-level split Discovery patientsConfirmation patients Free explorationEvery hypothesis enters the ledgerRank a finite test set Outcomes remain hiddenNo tuning against this partitionUsed by the locked kernel only Lock → exactly-once confirmation Association report with complete accounting Patient-level discovery and confirmation separationSplit deidentified data by patient. Explore on discovery patients and log every hypothesis. Keep confirmation outcomes hidden. Rank and lock finite tests, then use the confirmation kernel exactly once to produce an association report. Topic + deidentified patient data Patient-level split Discovery patientsFree explorationEvery hypothesis enters the ledgerRank a finite test set Confirmation patientsOutcomes remain hiddenNo tuning against this partitionUsed by the locked kernel only Lock finite testsExactly-once confirmation Association reportComplete accounting, scoped claims
Conceptual architecture, not patient data or measured outcomes. Patient-level separation must be preserved across repeated records and later adaptive waves.

The search belongs in discovery.

Exploration can propose, revise, and rank ideas. The all-hypothesis ledger records the search; it does not, by itself, make selected confirmation tests valid. See Gelman & Loken on forking paths.

The split is a scientific control.

Lock a finite family before confirmation, with valid p-values conditional on discovery selection. Meinshausen, Meier & Bühlmann on sample splitting provides a primary statistical reference.

Alpha remaining does not mean patients reset.

Further adaptive waves need fresh confirmation patients or separately proved selective / sequential validity. Never recycle a holdout merely because there is budget left.

Exploratory

A discovery-stage signal. It is available to guide a future locked test.

Confirmed association

A statistical claim under a specified valid confirmation protocol.

Causal claim not made

Association alone supplies no causal identification.

A budget that
only spends.

An illustrative, conservative alpha-spending protocol for a future loop. This is a separate versioned proposal—not a measured result or a silent replacement for current Amani certification.

Remaining alpha wealth

Initial W = 0.050 · Ten locked hypotheses · Spend 0.005 each

Illustrative nonreplenishing alpha-spending budget The budget starts at 0.05. Each of ten locked hypotheses spends 0.005, so remaining alpha descends by equal steps to zero. No rejection results are simulated. Rejection never replenishes this proposed version-one budget. 0.0500.0250.000 012345678910Locked hypotheses tested Start 0.050Finish 0.000 Illustrative alpha-spending budget declines from 0.05 to zeroEach of ten locked hypotheses spends 0.005. This illustration shows remaining budget only, not test results. Rejections do not replenish it. 0.0500.0250.000 0510Locked hypotheses tested
Illustration only. No accept / reject outcomes are generated. Rejection never replenishes this v1 budget. This is not a LORD or SAFFRON simulation.
FWER ≤ 0.05For valid prelocked p-values under the stated selection conditions; therefore FDR ≤ 0.05.

Simple accounting.
Explicit assumptions.

Ten tests at 0.005 spend at most 0.05. Bonferroni’s union bound allows correlated tests; valid p-values conditional on discovery selection are still required.

Alternative procedures such as e-BH for e-values have their own evidence conditions. Future online controllers require their specific assumptions.

Current Amani already has program-wide LORD++ accounting. Any new adaptive loop must qualify its registry, selection validity, and multiplicity protocol. This conservative proposal remains separately versioned.

Three days to a
sharper decision.

Estimate: a three-day thin-kernel spike for tabular practice, assuming a disposable runtime is available. Test the operational boundary before expanding the scientific ambition.

Allow an estimated 1–2 extra days for platform qualification if needed, plus 1–2 days to qualify the A2 twin and all six sentinels before the screen. This proposal makes no production rigor or measured success claim.

01

Lock and account

Plan lock, host ledger, and a deterministic report path. Define truthful partial outcomes before execution.

02

Execute and receipt

One execution inside the disposable runtime. Capture immutable receipts under a single deadline.

03

Break the boundary

Check fault boundaries and prepare the six practice cards. Start the 18-attempt screen only after functional checks.

Go criteria

No extra look. No outcome leak. Every exit produces a report.

After the screen: evaluate the missing components, then test synthetic planted and null cases. The first public cancer pilots are UCI WDBC and Coimbra: historical rediscovery, not unseen scientific confirmation. A random split does not erase prior full-cohort access. An open TCGA-BRCA panel can follow later. Expand to all 24 practice cards only after the first screen.

The decision is concrete: can a smaller engine preserve the evidence boundary while removing operational failure paths? The proposed experiments have not been run.