Every clinician gets one clone. The clones talk.
One persistent agent per clinician, configured for that person. It owns their hospital communication and talks directly to every other clinician's clone: asking, answering, scheduling, chasing, briefing, handing over. It runs entirely inside the hospital, on hardware the hospital owns.
One person, one clone, one Core.
LUMEN Core
One appliance · the hospital's machine room · every clone runs here as a live session · the audit chain roots hereAnswers travel down the chain. Authority never does: a clone can never see or do anything its human could not, on any path, at any instant. That is the security foundation of the design, not a policy setting.
Three properties, each an engineering requirement.
Scope inheritance
The clone holds exactly the scope of support its human holds, never more, on any path, at any instant. A resident's clone cannot see what the resident cannot see. When privileges change on rotation morning, the clone's change with them.
The real contact graph
It knows the people its human actually contacts: this attending, that pharmacist, the specific charge nurse on nights. Not the org chart. The org chart is a fiction the work routes around.
Communication ownership
The clone is in charge of all the communication its human does: asking, answering, scheduling, chasing, briefing, handing off, and reaching other clinicians' clones directly.
Three honest outcomes. Nothing else.
When one clone reaches another, a gate chooses how the request lands. It weighs three things: clinical acuity, the asker's standing, and whether the other person can be interrupted at this moment.
Interrupt now.
The request breaks through immediately, because acuity, standing and the moment justify it. The cost of breaking focus is paid knowingly, never by accident.
Queue, with an honest ETA.
The request waits, and the asker is told how long. Never a silent hold: the loop closes immediately, naming the target and the state.
Decline, honestly.
The request is refused in the open, so the asker can route around it at once. Never a silent drop: an honest no beats a slow maybe at four in the morning.
The override runs in one direction only.
- Cardiac arrestForces the interrupt
- Critical laboratory resultForces the interrupt
- Deteriorating early-warning scoreForces the interrupt
A governance-ratified list forces the interrupt no matter what the gate scores, and nothing can remove an interrupt that list requires. The failure mode we accept is one interruption too many, never one escalation too late. Validating the gate against the delayed-escalation literature is a named endpoint of the first pilot.
Authority is inherited, never exceeded.
There is no mechanism by which an agent obtains information its human could not have obtained. Answers descend the chain; authority does not.
Latency is the product.
A communication system slower than a corridor conversation loses to the corridor conversation. Every timing figure we publish is a design target, labelled as a target, and we keep those two words apart from measurement.
The clone has one owner, and the owner holds the keys.
The Lumen app is where a clinician owns their clone: configure it, check it, and read its full history and every interaction. Unlocking is designed to require four independent proofs agreeing inside one short window: the phone, the owner, the worn credential, and a deliberate physical act.
The timing, published as design targets: a full-chain unlock in under four seconds, a resume in under one, and revocation of a phone, a credential, or a person taking effect across the fleet in 100 milliseconds.
What the demo is, and what it is not.
What the demo shows
- A trilingual surface: Arabic, English, and French.
- The designed screens and flows, end to end.
- Synthetic clinical data throughout.
What the demo is not
- Not a live system. There is no inference backend.
- No real patient data, ever.
- Not evidence of clinical outcomes.
The demo runs on synthetic clinical data. There is no inference backend behind it. You will be walking the designed surface, not a live system.