Execution fabric

Runtime

The governed execution layer that makes any care site trial-capable. Runtime carries every Damaros run: protocol compile, evidence sync, deterministic screening, REVIEW routing, human adjudication, Replay, and governed agent tasks.

Community clinics and major centers share the same run model. A community site executes with NCI-grade rigor. A major center bolts governed execution onto whatever it already runs.

A run is not a chat, a dashboard refresh, or a model answer. It is a typed execution event with versioned inputs, policy scope, actor identity, output state, provenance, and replay linkage. Damaros does not ask institutions to trust AI. It asks them to inspect the run.

Enterprise FHIR, JWT, and JWKS reference
01WHY

Why Runtime exists

Clinical trials have systems of record. They do not have a system of execution.

CTMS, EDC, eTMF, and the EHR each hold a fragment. None owns the moment a patient meets the protocol.

Does this patient, at this site, under this protocol version, with this evidence, meet the criteria? That answer still gets rebuilt by hand. Damaros makes it a governed run.

~80% of cancer care happens in community clinics. Almost none of the trials do. Runtime is the layer that closes the gap.
02RUN MODEL

Run model

The run is the atomic unit of Damaros. Every run carries a manifest.

RUN_IDUnique identifier for the execution event.
RUN_TYPEProtocol compile, evidence sync, screening, review, replay, agent task, export, validation, or cutover check.
TENANT / ORG / TRIAL / SITEThe scope in which the run occurred.
ACTORHuman user, service principal, system worker, or governed agent.
INPUT_MANIFESTProtocol version, evidence snapshot, cohort snapshot, task contract, source references, or configuration inputs.
OUTPUT_MANIFESTCriterion states, REVIEW queue, evidence artifact, Replay bundle, Console signal, mapping suggestion, or export artifact.
POLICY_SCOPEThe access, PHI, egress, model, and review policy governing the run.
VERSIONINGProtocol version, engine version, Trident artifact version, Luna task version, connector version, and prompt/template version where applicable.
REPLAY_LINKAGEThe chain needed to reconstruct what happened.
Core primitive. This is what makes the homepage language real.
03GOVERNED CHAIN

The governed run chain

Protocol → Evidence → Screening → Review → Replay. One governed run from protocol intent to inspectable proof.

01Protocol compile

Trident structures protocol language into executable eligibility logic and evidence expectations. Surfaces criterion structure, temporal windows, lab thresholds, mapping candidates, ambiguity flags, and amendment deltas. Trident does not screen patients or issue eligibility verdicts.

02Evidence sync

Forge and Node admit site-approved evidence. FHIR R4, Epic Backend Services, Cerner/Oracle Health FHIR, bulk FHIR where approved, REDCap, CSV/TSV/Excel, warehouse extracts, pathology and lab tables, site-approved file drops. Output is a protocol-scoped evidence snapshot, not a shadow chart.

03Screening

The deterministic engine evaluates locked protocol logic against an admitted evidence snapshot. Same protocol version, same evidence snapshot, same engine version, same evaluation_as_of, same outcome. AI can assist upstream. The engine governs the decision state.

04Review

Router owns uncertainty. REVIEW is emitted when evidence is missing, stale, conflicting, ambiguous, unmapped, or judgment-dependent. Records reviewer identity, role, timestamp, criterion state, adjudication action, rationale, and Replay linkage. REVIEW is not failure, it is Damaros refusing to fabricate certainty.

05Replay

Replay reconstructs protocol version, Trident compile lineage, evidence snapshot, screening run, engine version, criterion outcomes, REVIEW events, human adjudication, authorization, artifact hash, export lineage, and AI-origin metadata where relevant. Not a report, PDF, or model transcript.

04AI BOUNDARY

AI boundary

Agents accelerate. Humans decide. The engine governs. Luna governs agent task runs through explicit task contracts.

TASK_CONTRACTAllowed inputs, forbidden inputs, PHI policy, model/provider policy, tool permissions, network permissions, output schema, human review requirement, retention policy, downstream eligibility, Replay binding, failure behavior.

Permitted AI surfaces

  • Protocol structuring and ambiguity detection
  • Mapping suggestions and evidence expectation drafting
  • REVIEW explanation support and operator support
  • Packet assembly, Console summaries, monitoring preparation
  • Deviation candidate surfacing, when scoped

Prohibited AI surfaces

  • LLM-issued eligibility verdicts
  • Model adjudication of patient status
  • Model-generated source of truth
  • Ungoverned PHI serialization
  • Sponsor-facing raw patient evidence by default
  • Autonomous referral or protocol deviation classification without human review
The line: Damaros is agentic before the decision boundary and deterministic at the decision boundary.
05EVIDENCE

Evidence boundary

Patient evidence stays protocol-scoped. Damaros is read-only by default, does not request write scopes initially, omits Binary, keeps DocumentReference metadata only, excludes narrative content from deterministic screening, and PHI never reaches an LLM.

Damaros does not become a second EHR. Evidence enters as protocol-scoped execution material:

That is the difference between “data integration” and “execution infrastructure.”
06NODE

Node boundary, site-governed execution

Node is where patient evidence is admitted, screened, reviewed, and confirmed. The clinic holds the reins.

Node controls

  • Site-approved evidence sources and local users/roles
  • REVIEW adjudication and clinician confirmation
  • Local evidence visibility and artifact release
  • Sponsor-safe signal emission

Node does not

  • Turn the site into a sponsor-controlled endpoint
  • Expose raw chart browsing by default
  • Replace clinician judgment or auto-refer from engine output
  • Send PHI to LLMs on the eligibility path
Node gives the protocol contact with reality while preserving local control. It is what lets a community clinic run a complex protocol at the standard of a major academic center, for the patients already in its care.
07CONSOLE

Console boundary, sponsor command without patient-data exposure

Console receives permissioned, de-identified execution signals, not raw PHI by default.

SPONSOR_VISIBILITYPermissioned, de-identified by default, trial-scoped, site-governed where required, artifact-gated where required, contract-bound.
The line: Console gives sponsors command over execution, not ownership of the patient chart.
08DEPLOYMENT

Deployment models

Runs in Damaros Cloud, your cloud, institution-hosted Node, or air-gapped for federal and zero-trust environments. The run model stays the same. The boundary changes.

Model A

Damaros Cloud tenant

For early pilots, sponsor demos, retrospective validation, and deployments where Damaros-hosted execution is approved. Isolated tenant, tenant-scoped run store, Node and Console access, Trident compile runs, Luna task governance, Replay bundles, structured audit logs, integration configuration, environment separation.

Model B

Dedicated customer cloud

Damaros deployed into the customer’s AWS, Azure, or GCP account. Best for health systems, large sponsor networks, academic medical centers, strict infrastructure review, expanded validation, federal-adjacent posture. Customer controls VPC, identity provider, key management, logging, egress, backup, retention, and security monitoring.

Model C

Institution-hosted Node

Node runs inside the institution-approved boundary. Best for strict PHI control, hospital security review, site-hosted validation, no-external-PHI deployments, and research networks with local data governance. Damaros Cloud can receive approved metadata, de-identified execution signals, and Replay artifact status depending on contract.

Model D

Restricted egress / air-gapped

For federal networks, defense-adjacent deployments, VA/DHA-style posture, or highly controlled research environments. Deny-by-default egress, explicit allowlists, no public model calls, local-only task execution where approved, private package registries, customer-managed keys, manual artifact promotion, offline validation packs.

09SECURITY

Security and observability

Every run is attributable. Server-side secrets, TLS, JWKS endpoints with public key material only, private PEM never in logs or public JSON, structured logs with non-PHI identifiers, time-bound sessions, RBAC, and retention by BAA/DPA.

OBSERVABILITYRun status, connector health, sync failure, mapping failure, REVIEW queue age, engine reproducibility checks, Replay completeness, blocked egress attempts, blocked PHI-to-agent attempts, export events, admin actions.
10VALIDATION

Validation

Execution integrity, not clinical efficacy. Validation and production share the same eligibility engine, protocol compiler, and Replay model. Cutover is a credential/environment swap rather than a workflow rebuild.

We validate the execution chain. We do not claim clinical efficacy.
11RELATED

Related documents