Copilot

Executive summary

Copilot is the assistant at the centre of the workspace. A clinical lane answers from the patient chart and from retrieved, cited literature; a concierge lane runs the practice day through a set of read-only tools. Every turn is routed deterministically to one lane, every answer is reviewed for prompt-injection echoes before it is stored, and every clinical claim is linked to the passages that support it — or marked as not grounded. Reports are generated as governed artifacts that the clinician reviews like any other draft.

Overview

ProductionReason · Copilot
Answer the clinician’s questions about a patient, the evidence and the practice, with every clinical statement traceable to its source.

Pipeline

A deterministic turn router picks the lane per turn; when unsure it fails closed to the clinical lane (ADR 0025).
Clinical lane: resolve patient context (chart, facts, memory, current encounter), plan evidence retrieval, generate a grounded answer as structured answer blocks.
Concierge lane: a tool loop over read-only practice tools — the day’s schedule, the review queue, open treatment plans, patient documents, recent literature — then a full-model answer (ADR 0028).
Output review checks the reply; an echoed prompt injection blocks it from canonical persistence. An optional high-risk critic may withhold speech, never rewrite it.
Claims are persisted with evidence links; reports run asynchronously as jobs and land as review-required artifacts.

Data owned

Clinical responses and revisions
Holds
Every answer and its revisions
Claims and claim–evidence links
Holds
Each clinical statement and the passages that support, oppose or qualify it
Answer-block value provenance
Holds
Where each value shown in an answer came from
Conversation state and preferences
Holds
Concierge conversation memory and clinician preferences
AI jobs
Holds
Asynchronous report generation

Store	Holds
Clinical responses and revisions	Every answer and its revisions
Claims and claim–evidence links	Each clinical statement and the passages that support, oppose or qualify it
Answer-block value provenance	Where each value shown in an answer came from
Conversation state and preferences	Concierge conversation memory and clinician preferences
AI jobs	Asynchronous report generation

Models and engines

Typed and spoken clinical turns, reports
Model or engine
Gemini 3 Flash (latest generation, per-lane override)
Notes
Pro tier; overrides are owner decisions recorded in the model-evaluation folder
Concierge lane
Model or engine
Gemini 3 Flash (latest generation)
Notes
Full-model concierge with tool calls
Conversation and turn classification
Model or engine
Gemini 3 Flash-Lite (lite tier)
Notes
Never a fallback target
High-risk critic
Model or engine
MedGemma 27B (self-hosted)
Notes
Secondary reader only — can withhold speech, never rewrites

Step	Model or engine	Notes
Typed and spoken clinical turns, reports	Gemini 3 Flash (latest generation, per-lane override)	Pro tier; overrides are owner decisions recorded in the model-evaluation folder
Concierge lane	Gemini 3 Flash (latest generation)	Full-model concierge with tool calls
Conversation and turn classification	Gemini 3 Flash-Lite (lite tier)	Never a fallback target
High-risk critic	MedGemma 27B (self-hosted)	Secondary reader only — can withhold speech, never rewrites

Guardrails

Lane routing is deterministic and fails closed to the clinical lane.
An actionable clinical claim without acceptable support is visibly not grounded and requires review (EVID-10).
AI-generated content never counts as evidence for itself (EVID-03).
A deterministic red-flag interceptor stops emergencies and lethal contraindications without a model in the path.
Prompt-injection echoes in output block canonical persistence; PII is scanned on the way out.

Rollout and status

ProductionClinical and concierge lanes, turn router, block protocol v2
Enabled in the production configuration
ProductionReport hardening and clinical structure
Reports as governed artifacts
Rolling outHigh-risk critic
Wired; depends on the self-hosted MedGemma 27B deployment
PlannedConversation router
Implemented with a shadow mode; off in production
PlannedPractice write tools, spoken source watch, verified speech
Implemented behind flags that default off

Interfaces

Consumes
What
Evidence base (snapshots, passages, entailment)
Consumes
What
Patient memory, facts and timeline
Consumes
What
Voice OS (spoken turns)
Emits
What
Claims with evidence links
Emits
What
Report artifacts
Emits
What
Spoken answers via the voice output bus

Direction	What
Consumes	Evidence base (snapshots, passages, entailment)
Consumes	Patient memory, facts and timeline
Consumes	Voice OS (spoken turns)
Emits	Claims with evidence links
Emits	Report artifacts
Emits	Spoken answers via the voice output bus

Invariants

EVID-01…12 — grounding and source governance
ADR 0024 claim subject scope; ADR 0025 per-turn lane; ADR 0028 concierge as a full LLM

SOURCE OF TRUTH

server/services/copilot/
server/services/copilot/concierge/
server/routes/ai/copilot.ts
src/components/copilot/
docs/clinical-invariants/evidence.md