Platform
A wellness app, a veterinary pain monitor and a defense operator-state system should not inherit from a regulated clinical codebase just to reuse a per-subject baseline. The platform is layered so they do not have to, and the layering is what makes the framework enforceable rather than aspirational.
This is the platform’s architecture and the migration it is under, not a description of shipped software. The shared substrate is early-stage, and products are being moved onto it one at a time. Where this page says a guarantee is enforced in the type system, that is the design the interfaces are built to hold. We would rather show you the boundary and tell you how far along it is than present a roadmap in the present tense.
The problem we designed away
The natural way for a platform like this to grow is badly. You build the hardest product first, the regulated one, and then every product that follows reaches into it for the shared pieces. Within a year, a consumer wellness app transitively depends on a regulated clinical codebase in order to reuse a baseline calculation.
That coupling is expensive in every direction. The non-clinical products inherit the flagship’s release cadence, dependency surface and regulatory blast radius. The flagship acquires consumers it was never scoped for. And where teams avoid the coupling, they re-derive the same fairness and federation logic locally, so the differentiating primitives fork across repositories and drift.
The fix is a dependency inversion: extract the reusable substrate into a separately versioned library, and have every product, including the flagship, consume it as one more dependency.
Products architecturally inheriting from the regulated flagship, with shared logic living inside a medical device.
Every product depending on pathos-core.
The flagship becomes a consumer of the substrate rather than the
parent of the platform, and the regulated logic stays where it is
regulated.
Layering
Components
pathos-coreThe equity-by-construction primitives as typed interfaces, typed wrappers over the mathematics, and the client side of the federation contract, packaged as one semantically versioned library with no heavy runtime dependency.
It carries no clinical decision logic and no regulatory claim. It is product and engineering infrastructure. That boundary is a hard rule, not a current state.
wu-oracleThe single implementation of the Wu numeric primitives: memory coefficient, critical slowing down, λ* criticality, sliding-window regime detection. Nothing else reimplements them. Duplicating the numerics would fork the one thing that must not fork. See the published lineage.
pathos-centralDesigned for aggregation across deployments. The server half of a contract whose client half lives in the substrate, so both sides agree on the boundary at the type level rather than by documentation.
Pathos VigilRetains all regulated clinical decision logic, including scoring, clinical thresholds and alarm behavior. Under the layering it becomes one more consumer of the substrate rather than the thing every product inherits from.
Federation
Learning improves when it is shared across deployments. People’s physiology should not be shared at all. Those two facts are usually reconciled with a privacy policy. We reconcile them with a type.
The federation contract states, in the interface itself, which artifacts may cross the boundary between a deployment and the aggregation server, and which may never. The “never” set is not a configuration option, an environment variable, or a default that a deployment could change. There is no code path that expresses it.
A subject’s baseline is theirs. It does not leave, it is not pooled, and it is not the unit of exchange.
Model-level improvements and aggregate parameters that carry no identifiable physiology, under an explicit typed contract.
Identifiable physiological data and per-subject baselines. Not by policy: there is no interface through which they could.
Federation behavior is deployment-specific and subject to the applicable agreement. See Privacy.
Engineering posture
Significant choices are recorded as immutable ADRs next to the code: context, decision, consequences. Reversing one is a superseding record, not a silent edit. New engineers read the decision trail instead of reverse-engineering intent.
Because many products consume the substrate, breaking its public surface is a coordinated, multi-product event with a deprecation path, not a patch release.
The shared layer ships without a heavy runtime dependency, so no single product’s dependency tree can propagate into every other product through the thing they all share.
The federation boundary, the not-a-regulated-device line, the single-home rule for the mathematics, and the discipline around intellectual-property language are documented in the repository so every consumer inherits them by construction.
We keep our language precise here on purpose. Inventions are held under patent counsel. Nothing on this site states or implies that a patent application is pending or that a patent has issued. We would rather say exactly where we stand than imply protection we do not yet have.
We are happy to go deeper on the layering, the federation contract, or the mathematics with technical, clinical or investment audiences.