Logit-Boundary Geometric Belief Interfaces and Sparse Sheaf-Enclave Protocols: A Self-Contained Substrate for Secure Network Electronic Health Record (EHR) Interoperability

Logit-Boundary Geometric Belief Interfaces and Sparse Sheaf-Enclave Protocols: A Self-Contained Substrate for Secure Network Electronic Health Record (EHR) Interoperability

arXiv:2608.10300v1 [cs.AI] 10 Aug 2026

Alvin Spivey & Thomas Huang Light Imaging Technologies, Inc. alvin@lightimagingtech.com June 30, 2026 Revised August 10, 2026 Submitted to arXiv under the arXiv.org perpetual, non-exclusive license 1.0. Research manuscript. Not a clinical decision system, medical device, or authorization for autonomous EHR write-back. Abstract Electronic health-record interoperability is a boundary problem: legacy systems, generative models, terminology services, identity systems, and human reviewers may each expose rich internal states, while operational exchange requires a narrow shared interface of typed claims, bounded uncertainty, provenance, and explicit admission or abstention. This paper develops a mathematical and engineering architecture for that interface. The organizing idea is the logit boundary: a discovery model may propose pre-threshold scores over a local categorical decision, but a deterministic judgment substrate decides whether the proposal is admissible, requires review, or must be quarantined before any Fast Healthcare Interoperability Resources (FHIR) transaction is constructed. The resulting Geometric Belief Interface (GBI) combines finite boundary semantics, local Dirichlet evidence, cellular-sheaf and mapping-cone diagnostics, advisory geometric audit charts, and a Decentralized Cryptographic Sheaf-Enclave (DCSE) protocol sketch for fail-closed deployment. The framework does not establish clinical truth, global representation alignment, or end-to-end clinical safety; it defines certificate-producing checks at a model-to-system boundary. A companion frozen synthetic benchmark, GBI BoundaryBench v0.1, evaluated Qwen3-4B-Instruct-2507 on 256 held-out tasks across three evidence modes (768 canonical executions). All executions completed, but none produced an output accepted by the benchmark contract: 369 were rejected during safe parsing and 399 during schema validation, yielding zero coverage and deterministic quarantine. This empirical result is deliberately narrow— one 4B open-weight model under one frozen interface—and is reported as evidence about the admission boundary, not as a general claim about LLM capability or clinical safety. A Julia appendix verifies selected numerical certificates using standard libraries. For codebase, reference https://github.com/AlvinSpivey/GBI-BoundaryBench.

Contents 1 The organizing picture: logits as the clinical boundary 1.1 Reader map . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

3 4

2 Logit topology for bounded clinical discovery 2.1 Exact logit equivalence and probe-visible quotients . . . . . . . . . . . . . . . . . . . 2.2 Affine readout and the pre-threshold boundary . . . . . . . . . . . . . . . . . . . . . 2.3 Cross-model interpretation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.4 A numerical example: affine equivalence . . . . . . . . . . . . . . . . . . . . . . . . . 2.5 Softmax dynamics and top-k loss . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.6 Component logits: prisms of model interpretation . . . . . . . . . . . . . . . . . . . . 2.7 Logit space as a non-autonomous dynamical system . . . . . . . . . . . . . . . . . . 2.8 What the universal logit topology contributes . . . . . . . . . . . . . . . . . . . . . .

4 4 5 6 6 6 7 7 7

3 Finite boundary semantics 3.1 Data Semantic Representation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

7 9

4 Condensed-mathematics motivation and operational probes

9

5 Neuro-symbolic partitioning: discovery and judgment

10

6 Local hierarchical Dirichlet evidence 6.1 Local categorical decisions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.2 Evidence boxes and dynamic atom registries . . . . . . . . . . . . . . . . . . . . . . . 6.3 Numerical conditioning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.3.1 Expanded: Numerical Conditioning in the Dirichlet Fisher Metric . . . . . .

10 11 11 11 12

7 Finite sheaves and mapping-cone diagnostics 7.1 Cellular sheaves in one page . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.2 Mapping cones . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7.3 Graceful degradation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

13 13 14 14

8 Geometry for audit and state charts 15 8.1 Higher-dimensional hyperellipsoid certificates . . . . . . . . . . . . . . . . . . . . . . 15 8.2 Geometry for Audit and State Charts . . . . . . . . . . . . . . . . . . . . . . . . . . 16 9 Decentralized Cryptographic Sheaf-Enclave protocol 9.1 Protocol objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.2 Operational policy contract and domain portability . . . . . . . . . . . . . . . . . . . 9.3 TEE execution and sparse verification . . . . . . . . . . . . . . . . . . . . . . . . . . 9.4 BFT identity logging and fallback . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9.5 Zero-knowledge consistency attestations . . . . . . . . . . . . . . . . . . . . . . . . .

17 19 20 22 22 23

10 Complete EHR interoperability application at scale 10.1 Example: penicillin allergy and amoxicillin . . . . . . . . . . . . . . . . . . . . . . . 10.2 Example: metformin without renal context [22] . . . . . . . . . . . . . . . . . . . . . 10.3 FHIR resources used . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

23 24 24 24

11 Empirical admission-boundary evaluation: GBI BoundaryBench v0.1

24

2

12 Summary: hallucination containment and external validity 12.1 Where hallucination is blocked . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.1.1 The logit layer is treated as evidence, not authority . . . . . . . . . . . . . . . 12.1.2 The boundary algebra restricts what the model is allowed to say . . . . . . . 12.1.3 The model proposal is checked against external validity . . . . . . . . . . . . 12.2 What kind of hallucination this prevents . . . . . . . . . . . . . . . . . . . . . . . . . 12.3 What kind of hallucination it does not prevent . . . . . . . . . . . . . . . . . . . . . 12.4 Example: penicillin allergy . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12.5 Example: metformin without renal context [22] . . . . . . . . . . . . . . . . . . . . . 12.6 Admissibility as a layered operational criterion . . . . . . . . . . . . . . . . . . . . .

25 25 25 26 26 27 28 28 29 29

A Complete, Executable Reference Implementation in Julia

30

B Validation, System Metrics, and Operational Boundaries B.1 Verification Protocols . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . B.2 Performance and Reliability Metrics . . . . . . . . . . . . . . . . . . . . . . . . . . . B.3 Strategic Boundaries and Fail-Closed Constraints . . . . . . . . . . . . . . . . . . . .

35 35 36 36

1

The organizing picture: logits as the clinical boundary

A neural model does not usually expose its full internal state. Open-weight inference can expose full pre-threshold logits, while hosted APIs may expose only top-k log probabilities or the generated output. We use the logit boundary as the conceptual output boundary and require the receipt to record exactly which evidence was actually available; unavailable logits are never reconstructed or treated as observed. When full logits are available, they are pre-threshold scores assigned to a finite set of possible outputs. For a clinical parser, those outputs might be {exact, equivalent, narrower, broader, conflict, unmapped}. For an allergy classifier, they might be {confirmed-active, unconfirmed, refuted, historical-resolved}. The logit vector is not a fact. It is a numerical proposal over a local categorical boundary. The architecture in this paper treats it exactly that way. The practical division of labor is: untrusted discovery model

−→

logit receipt

−→

deterministic judgment engine .

The discovery model may be an LLM, a rules parser, an embedding model, or a specialist clinical classifier. It proposes local categorical scores. The judgment engine checks identity, terminology version, provenance, temporal scope, sheaf consistency, and policy. Only then may the system update evidence or construct a FHIR transaction. This logit-boundary language makes the architecture easier to communicate. It gives neural, symbolic, and distributed components a common interface: finite categories + scores + calibration + provenance. The topology and geometry enter after this boundary is fixed. They are not asked to prove clinical truth by themselves. 3

1.1

Reader map

The mathematical stack is as follows: logit topology finite semantics Dirichlet evidence sheaf diagnostics geometric charts DCSE protocols FHIR application

2

how neural outputs become finite boundary evidence, how local clinical propositions are typed, how uncertainty is calibrated over local categories, how local claims fail to glue globally, how high-risk contradictions are visualized, not decided, how identity and audit certificates are replicated safely, how the whole system behaves in EHR interoperability.

Logit topology for bounded clinical discovery

The Universal Representation Hypothesis motivates testing whether diverse neural architectures trained on identical or overlapping data distributions exhibit comparable task-facing structure; the framework here does not assume global manifold congruence. Even when models share task and data constraints, their internal geometry is not identifiable from output agreement alone. At the logit boundary, downstream behavioral equivalence is treated as an observable interface condition. Identical correct predictions establish agreement only of selected outputs; exact prethreshold-logit agreement is the stronger condition defined below. Neither condition alone implies homeomorphic or diffeomorphic alignment of hidden representations, preservation of distances or neighborhoods, or a shared semantic hierarchy. The bounded claim used here is therefore only that models can be compared through the output quantities they expose on a specified stimulus set.

2.1

Exact logit equivalence and probe-visible quotients

Let models A and B have hidden spaces HA = RDA and HB = RDB with affine readouts (WA , bA ) and (WB , bB ). The comparison below is intentionally restricted to an evaluated stimulus set X . Definition 2.1 (Exact logit equivalence). Models A and B are exactly logit-equivalent on X if WA hA (x) + bA = WB hB (x) + bB ,

∀x ∈ X .

This is stronger than agreement of argmax predictions or softmax probabilities. Theorem 2.1 (Affine reconstruction on the evaluated set). If the two models are exactly logitequivalent on X and WB ∈ RM ×DB has full column rank, then hB (x) = WB+ WA hA (x) + WB+ (bA − bB ),

x ∈ X,

where WB+ = (WB⊤ WB )−1 WB⊤ . Proof. Exact logit equivalence gives WB hB (x) = WA hA (x) + bA − bB . Multiplication by the left inverse WB+ yields the stated reconstruction because WB+ WB = IDB . The theorem is a statement about the observed stimulus set. It does not imply that the induced linear map is invertible, that it extends uniquely beyond X , or that hidden-state distances, neighborhoods, topology, or semantic organization are preserved. 4

Definition 2.2 (Probe-visible quotient). For a linear probe family V ⊆ H∗ , define K(V ) = {h ∈ H : ℓ(h) = 0 for every ℓ ∈ V },

Z(V ) = H/K(V ).

For a readout matrix W , taking V to be the span of its rows removes directions that are invisible to that readout. Thus, output agreement supplies a bounded observable comparison object. It does not by itself establish clinical correctness or global cross-model representation alignment.

2.2

Affine readout and the pre-threshold boundary

In modern deep learning architectures, the terminal layer functions as a map that projects latent representations onto a categorical space. Let h(x) ∈ H ⊂ RD define the hidden representation vector of an input stimulus x ∈ X within a D-dimensional Hilbert space H, commonly termed the residual stream or embedding manifold. The transformation mapping this hidden state to the pre-threshold logit space L ⊂ RM , where M = |V| represents the cardinality of the model’s vocabulary or target category set, is defined by the affine readout map: L(h(x)) = WU · h(x) + b where WU ∈ RM ×D denotes the linear unembedding weight matrix and b ∈ RM represents the bias vector. Stated again, for simplicity, we’re letting h(x) ∈ H ∼ = RD be a hidden representation of a stimulus, such as a note fragment, medication string, or context window. A model’s readout head maps this hidden state to logits L(h(x)) = W h(x) + b ∈ RM , where W ∈ RM ×D , b ∈ RM , and M is the number of local categories. The associated probability vector then becomes exp(Li /τ ) pi = softmax(L)i = PM , j=1 exp(Lj /τ ) with temperature τ > 0. When full logits are available, retaining both logits and the associated probability vector preserves information that hard thresholding would discard. When they are unavailable, the receipt records the lower-information evidence mode explicitly rather than fabricating logits. Definition 2.3 (Logit receipt). A logit receipt for a local decision consists of R = (C, L, p, τ, k, m, ρ), where C = {c1 , . . . , cM } is the local category set, L ∈ RM are logits, p = softmax(L/τ ), k is the top-k truncation level if any, m is model metadata, and ρ is cryptographic provenance binding the input, terminology bundle, prompt, model version, and runtime policy. A receipt is evidence, not authority. For providers that do not expose full logits, the envelope records the available output-only or top-k evidence and marks unavailable fields as unavailable. The judgment engine may ignore a receipt, quarantine it, ask a human to review it, or convert supported evidence into a Dirichlet update (see Section 6). 5

2.3

Cross-model interpretation

Exact logit agreement is a property of an evaluated output boundary, not a proof that two models implement the same internal representation or that either model is clinically correct. When only probabilities are observed, the common-logit-shift symmetry of softmax must also be accounted for. When a readout is rank deficient, the natural comparison is the readout image, or equivalently the quotient by readout-invisible directions. Transporting a behavioral or safety probe between architectures requires an explicitly identified inter-model correspondence and validation on the target model; the quotient construction alone does not imply zero-label probe portability.

2.4

A numerical example: affine equivalence

Take D = 3, M = 6. Let WB be full column rank, choose an affine transform T, v, and set WA = WB T,

bA = WB v + bB .

Then WA hA + bA = WB (T hA + v) + bB . A numerical verification of this construction gives ∥LA − LB ∥2 ≈ 1.49 × 10−15 , which is consistent with floating-point roundoff in the worked example. This is ordinary linear algebra, but it is conceptually important: exact logit agreement supplies a shared observable boundary for local categorical behavior on the evaluated stimulus set; it does not establish hidden-state isomorphism beyond the assumptions above.

2.5

Softmax dynamics and top-k loss

Logits are smooth; hard decisions are not. As τ → 0, softmax(L/τ ) −→ earg maxi Li , which collapses a continuous score vector to a vertex of the simplex. For clinical review this matters. Top-k display can hide rare but safety-critical alternatives. For the example L = (4.0, 2.7, 1.4, 0.7, −0.2, −1.0), Using natural logarithms, the entropy values below are in nats: τ H(softmax(L/τ )) maxi pi 1.00 0.885219 0.711530 0.50 0.293843 0.924709 0.011293 0.998496 0.20 0.05 0.000000 1.000000. The top-3 tail mass at τ = 1 is about 0.0417. A hard top-3 truncation sets nonzero probabilities to zero, making DKL (P ∥P (3) ) infinite. Therefore a clinical logit receipt must include full-spectrum logits when feasible, or at least tail mass, calibration, and a clear statement of discarded alternatives.

6

2.6

Component logits: prisms of model interpretation

If a model exposes component activations, the logit boundary can be decomposed. Suppose an approximate residual expansion has the form h(L) = h(0) +

L X ℓ=1

a(ℓ) +

L X

m(ℓ) ,

ℓ=1

where a(ℓ) is an attention-block contribution and m(ℓ) is an MLP contribution. Because the readout is affine, L L X X L = W h(0) + W a(ℓ) + W m(ℓ) + b. ℓ=1

ℓ=1

This gives a practical audit primitive [31]. A clinical model can report not only that "the proposed category is in conflict", but also which model components pushed the logit toward that category. The GBI does not need to believe these explanations. It can store them as extra receipt fields and subject them to the same deterministic review.

2.7

Logit space as a non-autonomous dynamical system

Autoregressive and interactive models are input-driven dynamical systems. In a simplified discrete form, ht+1 = Φt (ht , xt ), Lt = W ht + b, pt = softmax(Lt /τ ). For intuition, one may define category potentials Uc (h) = −Lc (h). A high logit is a low potential well. Sequential inputs move the wells, so the trajectory may drift between basins. A two-dimensional illustrative system can exhibit the same qualitative effect— for example, a category switch while entropy remains high—but the present appendix does not implement that dynamical example. This is exactly the setting where deterministic clinical judgment is needed; a smooth logit trajectory can still cross a discrete decision boundary.

2.8

What the universal logit topology contributes

The logit-topology framing contributes four concrete design rules. First, compare AI systems at their output boundary, not by assuming their hidden states have the same coordinates. Second, treat hidden-state alignment as quotient alignment through probe-visible subspaces. Third, preserve full-spectrum or tail-mass evidence because top-k displays may hide safety-relevant alternatives. Fourth, treat neural outputs as dynamical proposals that must be judged by finite semantics, sheaf diagnostics, identity certificates, and FHIR policy.

3

Finite boundary semantics

From Section 2.2, we defined an individual logit affine readout map L(h(x)) = WU · h(x) + b, where WU ∈ RM ×D denoted the linear unembedding weight matrix and b ∈ RM represented the bias vector. In the regime D ≪ M , rank(WU ) ≤ D. The affine image is L(H) = b + Im(WU ), whose dimension is rank(WU ) rather than necessarily D. 7

Mathematically, this projection partitions the latent embedding space H into two orthogonal vector subspaces: the active row space of WU and the null space or kernel, defined as: ker(WU ) = {v ∈ RD | WU v = 0} Any variation in the latent hidden representation h(x) that lies within ker(WU ) is annihilated during the transformation, exerting zero influence on the output logit vector. This kernel constitutes a functionally latent, “probe-invisible” subspace. The probe-visible quotient space relates to the logits spectrum of all available neural networks through the foundational geometric principle of readout equivalence and coordinate-free representation mapping. For any neural network, the terminal hidden state h(x) ∈ H is projected onto the M -dimensional logit space L via an affine readout head, defined as: L(h(x)) = WU · h(x) + b Because neural networks differ arbitrarily in their initialization, parameterization, and layer-wise architectures, their internal hidden coordinates are not directly comparable. However, the logit spectrum serves as a shared, behaviorally observable interface through which different networks can be compared. If we define a probe family V as the linear span of the readout directions (the rows of the unembedding matrix WU ), the hidden dimensions that do not affect the output logits constitute the probe-invisible subspace, K(V ) = ker(WU ). Factoring out this null space leaves the probe-visible quotient space: Z(V ) = H/K(V ) = H/ ker(WU ) This quotient space relates to the logit spectrum of all available neural networks through three key mathematical and operational principles: 1. The Canonical Linear Isomorphism By the first isomorphism theorem, the readout linear map Wi : Hi → RM induces a canonical linear isomorphism W̄i : Hi / ker(Wi ) −→ im(Wi ), [h] 7−→ Wi h. Thus the probe-visible quotient is canonically identified with the image of the readout linear map; no undefined dual space is required. 2. Affine Equivalence Under Output Agreement Under exact output agreement, the earlier affine reconstruction is justified when the relevant readout has full column rank. Without that assumption, quotienting identifies readout-invisible directions, but output agreement alone does not establish an invertible hidden-state transformation between models. Softmax also has a common-logit-shift symmetry that should be treated explicitly when probabilities rather than logits are compared. 3. Cross-Model Probe Portability and Transfer Because the full hidden state H contains model-specific probe-invisible directions, transferring a probe between hidden spaces may fail unless an inter-model correspondence is identified and validated. A shared probe-visible quotient can serve as a candidate comparison object, but transporting a safety or behavioral monitor between architectures requires an explicitly identified inter-model map and target-model validation. Zero-label portability is not implied by the quotient construction alone. 8

3.1

Data Semantic Representation

This means that a clinical interoperability substrate cannot begin with vague natural language. It needs a small typed boundary. Definition 3.1 (Boundary algebra). A boundary algebra is a finite Boolean algebra B. Its atoms are At(B) = {a1 , . . . , aN }, and every element of B is a union of atoms. Definition 3.2 (Model-relative semantics). Let W be a set of possible clinical worlds, T a time domain, and L a location or facility domain. A semantics for B is a Boolean homomorphism [[·]]M : B → P(W × T × L), so that [[b ∧ c]] = [[b]] ∩ [[c]], [[b ∨ c]] = [[b]] ∪ [[c]], [[¬b]] = (W × T × L) \ [[b]]. This semantics is model-relative. It does not prove reality. It says exactly what the system means when it states, for example, that an allergy is active during a half-open time interval [t0 , t1 ) at a facility.

4

Condensed-mathematics motivation and operational probes

Classical point-set topology treats a space as a set of points with open subsets. Condensed mathematics changes the perspective: a space is tested by maps from compact totally disconnected spaces [1, 2]. For a compactly generated Hausdorff space X, one writes X(S) = C 0 (S, X) for a profinite probe S. The intuition is simple. A single point may not reveal the topology of a system. A convergent sequence can. Let Rδ be the real numbers with the discrete topology and let f : Rδ → R be the identity map of sets. Algebraically, it looks bijective. Topologically, it is not an isomorphism. Use the profinite convergent sequence N∞ = N ∪ {∞}. For the cokernel statement below, regard Rδ and R as topological abelian groups and form the associated condensed abelian groups; the cokernel is taken in that additive category, not in plain set-valued condensed spaces. Then Cok(f )(N∞ ) ∼ =

{convergent real sequences} , {eventually constant real sequences}

which is nonzero. The probe detects the mismatch. In software, we cannot execute infinite profinite objects. We implement operational profinite probes: finite, clock-bounded audit loops that approximate the same testing philosophy. 9

Definition 4.1 (Operational profinite probe). An operational profinite probe is a finite sequence P = (s0 → s1 → · · · → sn ) of version-pinned tests, such as terminology snapshots, identity claims, policy versions, or FHIR capability states. A probe passes if every transition preserves the declared boundary invariants. This is an engineering analogy motivated by condensed-mathematics probing: the system is tested by structured families of contexts rather than isolated examples. The finite operational probe defined here is not claimed to approximate a condensed object in a formal convergence sense, and no condensed-mathematics theorem is used as a clinical safety guarantee.

5

Neuro-symbolic partitioning: discovery and judgment

The architecture separates two roles. Ars inveniendi: discovery. An LLM, parser, embedding model, or classifier may read free text and emit logit receipts. It is an untrusted compiler from messy input to typed proposals. Its output must include model version, prompt digest, terminology version, full or bounded-tail logits, and provenance. Ars iudicandi: judgment. A deterministic engine checks whether the receipt is admissible. It performs type checking, terminology validation, Dirichlet evidence update, sheaf consistency diagnostics, identity-log verification, and FHIR transaction construction. The judgment engine is the only component allowed to create commit-ready clinical payloads. The boundary between the two layers is a signed JSON-LD envelope: E = (subject, interval, facility, category set, L, p, ρ, policy). This envelope can be reviewed by humans, tested by finite probes, and attached to FHIR Provenance or AuditEvent records [15, 16].

6

Local hierarchical Dirichlet evidence

A Dirichlet-multinomial (also called a Dirichlet compound multinomial) is a probability distribution used to model categorical count data that exhibits overdispersion (more variance than a standard model would expect). To understand the Dirichlet-multinomial, think of it as a two-step hierarchical process: 1. The Dirichlet Step: Instead of assuming all observations come from one fixed set of underlying probabilities, we assume that the underlying probability vector (the chances of a specific event occurring) is continuously changing or uncertain. We draw this probability vector from a Dirichlet distribution. 2. The Multinomial Step: Once we have our specific probability vector, we use it to generate our discrete counts using a Multinomial distribution.

10

A standard multinomial distribution assumes all data is generated from one fixed, known set of probabilities. Because of this, it can often underestimate the true variability of real-world data (a problem called overdispersion). By injecting uncertainty about the probabilities themselves (using the Dirichlet step), the Dirichlet-multinomial allows for much wider variance. It accounts for instances where groups or subjects vary much more widely in their categorical counts than a simple multinomial would predict. At the logit boundary of statistical artificial intelligence methods, this wider variance persists.

6.1

Local categorical decisions

A Dirichlet distribution belongs on a local categorical simplex. Let C = {c1 , . . . , cK } be mutually exclusive and exhaustive alternatives for one decision. Then ( ) K X K−1 K p∈∆ = p ∈ R≥0 : pi = 1 , i=1

and α ∈ RK >0 .

p ∼ Dir(α), The Fisher information matrix in α-coordinates is

I(α)ij = ψ1 (αi )δij − ψ1 (α0 ),

α0 =

X

αi ,

i

where ψ1 is the trigamma function.

6.2

Evidence boxes and dynamic atom registries

A fixed evidence box αi ∈ [ε, A] prevents boundary singularities. However, clinical terminologies split and merge. A rigid category set can create schema lock-in. We therefore use a hierarchical Dirichlet-multinomial registry. At time t, let Ct be the active category set. When a new category cK+1 appears, the registry assigns αK+1 = αnew > 0 and records the terminology version and parent category. This avoids division by zero and makes category growth auditable.

6.3

Numerical conditioning

The verification script compares α = (2, 3, 4, 5) with α = (0.01, 3, 4, 5). The first has condition number about 20.46. The second has condition number about 4.55 × 105 . This is the practical reason for an evidence box: near-boundary exclusion can make Fisher geometry numerically unstable. 11

6.3.1

Expanded: Numerical Conditioning in the Dirichlet Fisher Metric

For a K-category Dirichlet distribution with parameter α = (α1 , . . . , αK ) ∈ RK >0 ,

α0 =

K X

αi ,

i=1

the Fisher information matrix in α-coordinates is gij (α) = ψ1 (αi )δij − ψ1 (α0 ), where ψ1 is the trigamma function. Equivalently,
g(α) = diag ψ1 (α1 ), . . . , ψ1 (αK ) − ψ1 (α0 )11⊤ . The condition number is κ2 (g) =

λmax (g) . λmin (g)

The verification script compares two parameter vectors: α(a) = (2, 3, 4, 5), and α(b) = (0.01, 3, 4, 5). For the moderate interior point α(a) = (2, 3, 4, 5), one obtains approximately ψ1 (α(a) ) = (0.644934, 0.394934, 0.283823, 0.221323), and ψ1 (α0 ) = ψ1 (14) ≈ 0.074040. The eigenvalues of g(α(a) ) are approximately (0.029494, 0.254435, 0.361568, 0.603356). Therefore κ2 (g(α(a) )) =

0.603356 ≈ 20.46. 0.029494

For the near-boundary point α(b) = (0.01, 3, 4, 5), the first trigamma value is enormous: ψ1 (0.01) ≈ 10001.621. This follows from the asymptotic behavior ψ1 (x) ∼

1 x2

Thus ψ1 (0.01) ≈

as x ↓ 0.

1 = 104 , (0.01)2 12

up to lower-order terms. The resulting eigenvalues are approximately (0.021986, 0.254705, 0.362908, 10001.5344). Hence

10001.5344 ≈ 4.55 × 105 . 0.021986 If an implementation adopts a condition-number budget, the lower evidence-box bound ε can be selected by solving for the smallest value that keeps κ2 (g) below that budget over the declared parameter region. In the one-dimensional sweep [ε, 3, 4, 5], a budget of 104 is crossed near ε ≈ 0.066. This number is illustrative rather than a universal certification threshold. The Appendix A deliberately evaluates α1 = 0.01 as a near-boundary stress case; the reference script does not itself enforce an operational evidence box. Additionally, this is the practical reason for an evidence box. As any αi approaches zero, the Dirichlet Fisher geometry becomes extremely anisotropic. A small movement in the nearly excluded category direction has enormous Fisher cost, while other directions remain at ordinary scale. Numerical optimization then becomes stiff: gradient steps, Newton solves, natural gradient updates, and uncertainty propagation can become dominated by the singular boundary coordinate. It is more accurate to call this a near-boundary sparsity or near-boundary exclusion effect, rather than ordinary certainty. In a Dirichlet model, αi ≪ 1 places strong mass near the simplex face pi = 0. The category is nearly excluded, and the Fisher metric becomes singular at that face. The evidence box αi ∈ [ε, A] κ2 (g(α(b) )) =

keeps every parameter away from zero and infinity. Since ψ1 is continuous and positive on compact subsets of (0, ∞), the Fisher matrix then has finite eigenvalue bounds: 0 < λ∗ (K, ε, A) ≤ λmin (g(α)) ≤ λmax (g(α)) ≤ λ∗ (K, ε, A) < ∞. Therefore, κ2 (g(α)) ≤

λ∗ (K, ε, A) < ∞. λ∗ (K, ε, A)

The evidence box is not merely a numerical trick. It is a certificate that every categorical evidence state remains inside a computationally stable region of the Fisher–Dirichlet manifold.

7

Finite sheaves and mapping-cone diagnostics

Finite sheaves provide a structured way to represent local data constraints and their compatibility. In the intended EHR setting, a contradiction should be localized before a governed write is constructed, so that independent work items can be routed separately when policy permits. These diagnostics do not override the atomic semantics of a FHIR transaction Bundle; any stalk-level quarantine must occur before transaction construction or across separately scoped transactions or batch work.

7.1

Cellular sheaves in one page

A finite cellular sheaf assigns a vector space to each cell and a linear restriction map to each incidence [5]. In this paper, every stalk is a finite-dimensional real inner-product vector space. This is essential because Laplacians require adjoints. 13

Let X be a finite cell complex and F a sheaf on X. The cochain space is M C k (X; F) = F(σ). σ∈Xk

The coboundary δ k : C k → C k+1 is assembled from restriction maps. The Hodge Laplacian is ∆k = (δ k−1 )(δ k−1 )∗ + (δ k )∗ δ k . Its kernel represents cohomology [5]: ker ∆k ∼ = H k (X; F).

7.2

Mapping cones

Let φ : F → G be a sheaf morphism. The mapping cone measures how far φ is from gluing consistently [6]. Its cochains are C q (Cone φ) = C q+1 (X; F) ⊕ C q (X; G), with differential dcone (x, y) = (−dF x, φx + dG y). The cone Laplacian has a null space of relative obstructions. Definition 7.1 (Trace cell energy). Let Πλ be the orthogonal projector onto the obstruction null space of a cone Laplacian, and let Πσ be the projector onto a stalk subspace. Define Eσ = tr(Πλ Πσ ). Proposition 7.1 (Basis invariance). The quantity Eσ is invariant under orthogonal rotation of any basis chosen for the obstruction subspace. Proof. Only the projector Πλ = U U ⊤ matters. Replacing U by U Q for Q ∈ O(m) gives U QQ⊤ U ⊤ = U U ⊤ . Therefore tr(Πλ Πσ ) is unchanged.

7.3

Graceful degradation

For a FHIR Bundle submitted with type=transaction, atomic rollback remains the transaction semantic [15]. Stalk-level quarantine is applied before constructing that atomic transaction, or across independently scoped transactions or batch work. If Eσ > θquarantine , only the affected stalk is quarantined. Other independent stalks may proceed if policy allows. The executable appendix includes a projector-based toy obstruction surrogate with three coordinate stalks, Allergy, MedicationRequest, RenalLab.

14

After orthonormalizing the printed obstruction basis, the trace energies are Eσ toy gate stalk Allergy 0.019778 eligible MedicationRequest 1.977750 quarantine RenalLab 0.002472 eligible. These values illustrate basis-invariant localization, but the script does not construct a sheaf morphism, a mapping-cone differential, or a mapping-cone Hodge Laplacian. Therefore this numerical table is not evidence that a deployed mapping-cone diagnostic has been validated. “Eligible” means only that an independent work item could proceed to later policy gates; it does not mean partial success inside a single atomic FHIR transaction.

8

Geometry for audit and state charts

The EHR label adjudicator’s interface shows a tabular contradiction report: stalk energies, offending restrictions, terminology versions, and provenance. The clinical decision is made from discrete facts and policy. These reports are generated from version-pinned mappings, restriction checks, and provenance available to the adjudication workflow. Using Higher-dimensional hyperellipsoids, identity certificates and audit certificates are generated digitally and used to support the authenticity, accountability, and security of EHR systems. They act as the digital passport and tamper-evident logbook for clinical data. Identity certificates are cryptographic credentials assigned to a specific patient. Audit certificates are tamper-evident records or cryptographically signed metadata logs used to record and examine system activity involving patient information. An implementation may record user identity, timestamp, affected resource or action, source/device context, and provenance according to institutional policy and applicable requirements. HIPAA Security Rule audit controls require mechanisms to record and examine activity in systems that use or contain electronic protected health information [19]; this manuscript does not claim that HIPAA universally mandates the exact field set or timestamp granularity stated in the superseded text. Such logs support security, compliance, and forensic review.

8.1

Higher-dimensional hyperellipsoid certificates

For an n-dimensional state chart, the correct quasiconformal object is an orientation-preserving homeomorphism [3, 4] f : Ω ⊂ Rn → Ω′ ⊂ Rn 1,n with f ∈ Wloc and

∥Df (x)∥n ≤ KJf (x)

a.e.

At differentiability points, Df (x) maps infinitesimal spheres to ellipsoids. If the singular values are σ1 ≥ · · · ≥ σn > 0, then a practical certificate is Hf (x) =

σ1 . σn

A safety-critical implementation must also check positive Jacobian, boundary behavior, inverse residuals, and stratum preservation. 15

For the matrix

  1.20 0.10 0 A = 0.20 0.80 0.05 , 0 0.10 1.10 the script computes singular values approximately (1.254966, 1.110695, 0.737507), so H ≈ 1.701632,

8.2

J ≈ 1.028000,

KO =

σ13 ≈ 1.922661. J

Geometry for Audit and State Charts

The geometry of these certificates can be useful or validation and interpretability. The EHR label adjudicator can display a tabular contradiction report containing:   stalk energies Eσ ,  offending restriction maps,     terminology versions,     source and target code systems,   .  FHIR resource identifiers,     Provenance references,     policy rule identifiers,  recommended abstention or review action The clinical decision is made from discrete facts, policy, and human authority. The chart may orient the reviewer, but it should not authorize a write. Reports are generated deterministically by comparing candidate local sections against the version-pinned reference EHR and terminology sheaves. Formally, let ϵ : Fcand −→ Wref be the grounding morphism from candidate clinical assertions to the authoritative reference sheaf. The mapping-cone Laplacian LC exposes relative inconsistencies. For each clinical stalk σ, the trace energy Eσ = tr(Πλ Πσ ) measures how much of the obstruction space is supported on that stalk. If the visual chart distortion satisfies K > Ktabular , for example Ktabular = 1.5, the system shows the tabular contradiction report, but is not admissible as clinical assertion. This is a useful tool for certified adjudicators, clinical decision makers, and policy makers alone—not a definitive statement of what should or should not occur. Thus, the decision path is candidate claim −−−−→ identity, terminology, provenance, and policy checks −−−−→ mapping-cone contradiction report −−−−→ human adjudication or abstention −−−−→ FHIR transaction only if all gates pass. The chart is advisory. The tabular contradiction report is authoritative for review. 16

9

Decentralized Cryptographic Sheaf-Enclave protocol

A centralized permit-before-action safety-receipt layer is one relevant comparison point for failclosed clinical AI integration. U.S. Patent 12,633,414 B1 describes a safety-receipt layer interposed between an EHR and AI-assisted clinical decision support, with a canonical context envelope, policy evaluation, permit outcomes, and receipt generation [20]. The discussion here is a high-level technical comparison only; it is not a claim chart, a legal opinion, or a conclusion about patent scope, validity, infringement, or comparative novelty. The DCSE design explored here studies a different systems decomposition: distributed nonequivocation/consensus, trusted-execution checks, and sheaf-based consistency certificates are composed at the admission boundary before governed write-back. The contribution claimed in this manuscript is the architecture and its explicit separation of model proposal from deterministic admission checks, not a legal conclusion that the design is patentably novel over any cited reference. The DCSE protocol sketch contains the following interconnected components:

17

HETEROGENEOUS EHR ENCLAVES (Modular EHR Enclave, Central EHR Enclave, COTS Systems)

FHIR Transaction Bundle (Untrusted Ingestion)

HARDWARE-ENFORCED TEE BOUNDARY CONVERGENCE GATE • Runs a specified TEE-assisted nonequivocation/BFT profile • Runs small deterministic trust-boundary checks inside TEEs; dense linear algebra remains outside

Consensus-Verified Secure Assembly

COHOMOLOGICAL CONSISTENCY EVALUATION ENGINE • Maps incoming transaction records to cellular sheaf spaces on posets • Computes a degree-appropriate mapping-cone Hodge diagnostic • Isolates data stalks where local trace energy Eσ > θ Consistent State (Eσ ≤ θ)

Inconsistent Stalk Only (Eσ > θ)

COMMIT TRANSACTION • Outputs a signed consistency attestation; ZK is an optional future extension • Commits a validated atomic transaction or separately scoped transaction(s)

SURGICAL QUARANTINE • Degrades anomalous stalks into an isolated sandbox container • Quarantines before atomic transaction construction, or routes independent work separately

1. Hardware-Enforced, TEE-Assisted Consensus: DCSE places small, deterministic trust-boundary checks inside hardware-secured TEEs at participating nodes [12, 13]. An optimistic TEE-assisted non-equivocation profile may reduce protocol overhead [8], while the conservative fallback uses classical 3f + 1-style BFT assumptions [7, 9]. The manuscript does not claim a generic 2f + 1 resilience threshold or sub-millisecond latency without a specified protocol, threat model, and benchmark. Dense SVD, QR, and eigensolvers remain outside the enclave as described below. 2. Homological Inconsistency Gating: Rather than executing only static policy-graph rules, DCSE can compile incoming candidate clinical updates into a topological poset representing a cellular sheaf. The mathematical design defines a mapping-cone complex and degree-appropriate Hodge Laplacian; dense construction 18

or eigensolution may occur outside the enclave, with the enclave verifying sparse residuals or signed certificates. The toy numerical appendix uses a projector-based obstruction surrogate, which must not be identified with a mapping-cone Laplacian unless it is constructed from the cone differential. Localized obstruction support is summarized by the basis-invariant trace cell energy: Eσ = tr(Πλ Πσ ) where Πλ is the projector onto the null space (representing cohomological obstructions) and Πσ is the stalk projector. 3. Stalk-Level Surgical Degradation (Algebraic Grafting): DCSE proposes stalk-level quarantine before constructing an atomic FHIR transaction, or across separately scoped transactions. When Eσ exceeds the quarantine threshold, the affected stalk is isolated from the candidate write set. If a FHIR Bundle is submitted with type=transaction, its atomic semantics are preserved: the bundle commits as a whole or rolls back as a whole [15]. Quarantined data are excluded or routed separately rather than partially committed from the same transaction. This manuscript does not characterize the patent’s claim scope as requiring whole-transaction rollback without claim-level analysis. 4. Zero-Knowledge Consistency Attestation: A future deployment may attach a zero-knowledge proof to a hardware-attested consistency result. Such a proof would certify only the specified finite computation and policy predicate without revealing the private witness; it would not assert medical truth. Technical distinctions in the design space. The following points describe architectural differences rather than legal novelty: • Centralized receipt gating vs. distributed verification: DCSE combines a TEE-assisted nonequivocation/BFT profile with a conservative BFT fallback; exact resilience depends on the selected protocol and threat model [9]. • Policy evaluation vs. consistency diagnostics: in addition to deterministic policy checks, DCSE proposes cellular-sheaf consistency diagnostics. A deployed implementation must construct the actual mapping-cone differential before calling a derived Laplacian or obstruction space a mapping-cone certificate. • Candidate-work quarantine vs. transaction atomicity: candidate items may be quarantined before FHIR transaction construction or routed into separately scoped work. A submitted FHIR transaction retains all-or-nothing semantics [15]. • Optional privacy-preserving attestation: zero-knowledge proof machinery is future work and would attest only to a specified finite computation and policy predicate, not to medical truth.

9.1

Protocol objects

A DCSE node maintains: (B, V, Θ, F, W, L, P). These objects separate model evidence from enterprise authority:

19

B: boundary algebra. The finite typed universe of assertions and actions that a model or agent is permitted to propose. It prevents arbitrary free-form output from silently becoming an authoritative enterprise fact. V : versioned semantic bundle. The terminology, ontology, schema, code-system, mapping, message-format, and other controlled-vocabulary versions that define the meaning of a proposal at evaluation time. Θ: evidence registry. The calibrated local categorical evidence state. In the construction used here, this includes hierarchical Dirichlet evidence. A model probability or logit can update evidence only through declared rules; it is not authority by itself. F: candidate/local state. The proposed local assertions, mappings, records, actions, or work items whose compatibility is being evaluated. W: authoritative grounding state. Version-pinned systems of record, signed source data, approved registries, trusted references, human adjudications, and other external evidence against which the candidate state is judged. L: identity/provenance ledger. The immutable history used to bind a proposal to the correct subject, entity, case, or work item and to detect protocol equivocation. Ledger consistency proves provenance and non-equivocation properties, not the truth of an identity match by itself. P: runtime admissibility policy. The versioned enterprise contract that maps verified facts, failures, dependencies, authority, and operational context to allowed actions such as admit, quarantine, abstain, expert review, or reject.

9.2

Operational policy contract and domain portability

The policy object P is the most deployment-specific component. A useful operational decomposition is P = (A, G, T , D, H, Q, R, Λ, E, Fb ), where A is the allowed action set; G contains hard gating predicates; T contains thresholds, freshness limits, and temporal-validity windows; D specifies dependency rules and dependency closure; H specifies human authority, dual-control, or named-review requirements; Q defines quarantine scope; R defines recovery and escalation; Λ specifies liveness and degraded-operation constraints; E defines signed exception and override rules; and Fb defines failover behavior when required services or evidence are unavailable. A policy instance should also be attributable through fields such as (policy id, version, effective time, authority, hash). This decomposition is an engineering contract, not an additional mathematical theorem. The invariant is that every admissibility decision is reproducible under an explicit policy version rather than inferred ad hoc from model confidence. The verification architecture is therefore portable while the domain semantics are not. Table 1 illustrates how the same tuple can be instantiated in three enterprise settings without claiming that a healthcare benchmark can be copied unchanged into another sector. 20

Table 1: Illustrative domain translations of the GBI/DCSE protocol objects. The architecture is shared; semantics, authoritative evidence, and policy are domain-specific. Object

Healthcare / EHR

Financial services

Government / mission systems

B

Typed mapping, identity, temporal, evidence, and admissible-action states.

Approve, hold, review, sanctionsreview, fraud-review, reconciliationconflict, reject.

Verified, conflicting, incomplete, releasable, restricted, review-required, reject.

V

FHIR versions; RxNorm, SNOMED CT, LOINC, local dictionaries; policy versions.

Instrument and product taxonomies; legal-entity schemas; message, sanctions-list, and risk-model versions.

Mission schemas; controlled vocabularies; policy directives; handling and data-standard versions.

Θ

Evidence over bounded mapping, identity, temporal, or policy-action categories.

Evidence over legitimate/suspicious/blocked/unknown, entity matching, or other bounded risk decisions.

Evidence over entity resolution, source reliability, mission status, or action categories.

F

Candidate mapping, FHIR resource, identity link, temporal status, or write-ready work item.

Candidate payment, trade, reconciliation update, underwriting result, account change, or agent action.

Candidate claim, case update, entity association, report element, workflow action, or agent tool call.

W

Source EHR records, authoritative terminology, provenance, policy, and human adjudication.

Core ledger, KYC systems, approved market feeds, sanctions sources, risk limits, signed authorizations.

Authoritative registries, signed source records, mission systems, directives, and human adjudications.

L

Patient/entity identity decisions plus immutable execution provenance.

Customer, account, and legal-entity identity plus transaction provenance and authorization lineage.

Entity, case, and credential identity plus signed provenance and nonequivocation history.

P

Identity, terminology, temporal, evidence, dependency, write-policy, review, and failover constraints.

Limits, counterparty eligibility, sanctions, freshness, separation of duties, jurisdiction, human approval, permitted automation, overrides, and failover.

Access, classification/handling, needto-know, provenance, jurisdiction, autonomous-action limits, human authority, continuity-of-operations, and degraded-mode rules.

21

Liveness without violating atomicity. Localized quarantine is a pre-commit work-item mechanism, not permission to partially commit an operation whose underlying system requires atomicity. In a financial workflow, for example, one disputed payment or legal-entity mapping can be excluded from a candidate settlement batch and routed for review while independent verified work continues if institutional policy permits. In a government workflow, one ambiguous entity association can be quarantined while unrelated mission work remains live. The same rule appears in the EHR setting: an inadmissible stalk is excluded or separately routed before an atomic FHIR transaction is constructed. Human review and automation bias. The review surface should expose the deterministic reasons for inadmissibility—for example candidate value, authoritative evidence, source freshness, schema or terminology version, authority, dependencies, provenance, policy rule, and required action—rather than reduce review to a model confidence number. Geometric charts can remain advisory, while a scannable tabular contradiction record is the authoritative review artifact. Customer-deployed diagnostic evaluation. A versioned evaluation package can be executed locally against an enterprise’s actual model, agent, retrieval, data-interface, and policy stack. The output is then a customer-specific empirical failure surface rather than only a generic leaderboard score or proxy estimate. Failure slices can inform a data-development roadmap: expert labeling, synthetic or counterfactual examples, evaluator and grader development, retrieval changes, benchmark expansion, or post-training environments, followed by re-evaluation. This diagnostic loop is vendor-neutral; it identifies where intervention may add value without predetermining the intervention or provider.

9.3

TEE execution and sparse verification

Trusted execution environments are useful for confidentiality and attestation [12, 13], but enclaves are not a place to run arbitrary dense numerical workloads. The DCSE design places small, deterministic checks inside the enclave: • signature and nonce verification, • sparse residual checks such as ∥Lx∥, • hash-chain validation, • policy evaluation, • certificate signing. Dense SVD, QR, and large eigensolvers are performed outside the enclave or replaced with sparse certified residual checks. A WASM/WAMR-style packaging can enforce heap, I/O, and syscall budgets for deterministic enclave modules.

9.4

BFT identity logging and fallback

TEE-assisted protocols using a unique sequential identifier generator can reduce communication [8] in optimistic settings, but hardware counters can fail. Therefore the identity ledger has two modes. Fast path. If attestation and supported monotonic-counter or equivalent trusted freshness services are healthy, the node may use a TEE-assisted non-equivocation profile [13, 14]. 22

Fallback path. On counter failure, enclave restart, attestation loss, or equivocation evidence, authoritative clinical writes halt and the system falls back to conservative 3f + 1-style BFT assumptions [7, 9]. The fallback may be implemented by a mechanized BFT protocol family [10, 11]. This protects clinical safety from a single hardware-counter failure. The ledger proves protocol-level non-equivocation, not patient identity truth. Clinical identity remains an external validity predicate.

9.5

Zero-knowledge consistency attestations

A future deployment may attach a zero-knowledge proof that a specified finite verification computation and policy predicate passed without revealing the private witness. A schematic statement is ∃ w : VerifyConeCertificate(c, w) = 1 ∧ Policy(w) = pass, where the public input c binds the transaction digest, policy version, and verification parameters. If vanishing of a particular cohomology group is part of the certificate, that property must be encoded by a concrete finite computation or residual check; the expression H 1 (Cone φ) = 0 is not itself a witness predicate. The proof would attest only to the encoded computation, not to medical truth.

10

Complete EHR interoperability application at scale

The motivating setting is a large federated clinical network with legacy RPMS/VistA-like records, local site dictionaries, terminology services, FHIR-capable endpoints, identity-reconciliation needs, and human review [23, 24]. The Indian Health Service (IHS) is used here as a public interoperability context, not as a deployment claim, endorsement, or statement that this architecture is part of PATH EHR. The proposed substrate would sit between systems as a fail-closed co-processor rather than replace the EHR. The complete pipeline for this case would be: 1. Capability discovery. Query the destination FHIR server’s capability statement and record supported resources, interactions, versioning, security, and transaction behavior [15]. 2. Identity gate. Resolve source and destination patient identifiers through a BFT-backed identity-decision log. If identity confidence or protocol safety fails, halt. 3. Discovery parse. An LLM or parser emits logit receipts over local categories, such as medication mapping status or allergy state. 4. Boundary type check. The judgment engine checks category sets, timestamps, facility scope, terminology bundle, and provenance. 5. Evidence update. Accepted receipts update local hierarchical Dirichlet registries. 6. Sheaf diagnostic. Mapping-cone stalk energies identify contradictions. 7. Reviewer presentation. High-risk contradictions are shown as tables first. Charts are optional secondary aids. 8. Commit or abstain. Safe human-approved changes are sent as FHIR transactions with Provenance and AuditEvent. Failures return OperationOutcome and quarantine data [15, 16, 17].

23

10.1

Example: penicillin allergy and amoxicillin

Suppose the source record contains an active confirmed high-criticality penicillin allergy. A clinician proposes amoxicillin [21]. The parser emits a medication-allergy logit receipt over {no-conflict, possible-conflict, confirmed-conflict, unknown}. The judgment engine checks a version-pinned clinical terminology and policy bundle; if that bundle classifies the proposed order as conflicting with the recorded allergy state and the sheaf diagnostic exceeds its review threshold, the system treats the candidate write as inadmissible. It emits [17]: OperationOutcome(severity=error, code=business-rule). No medication transaction is committed unless a named clinician performs an explicit override with Provenance [16].

10.2

Example: metformin without renal context [22]

Suppose a metformin order is proposed and the version-pinned local clinical policy requires qualifying renal context, but no qualifying renal observation is available. The local category is {renal-context-present, renal-context-expired, renal-context-missing}. Under that version-pinned policy, a high posterior mass on renal-context-missing routes the candidate medication request to quarantine or review rather than authorizing a write. The system may commit a Provenance record of the abstention but not the medication update.

10.3

FHIR resources used

The core implementation uses [15, 16, 17]: Patient MedicationRequest AllergyIntolerance Observation Provenance AuditEvent OperationOutcome

11

identity-bound subject, candidate medication orders, allergy state, labs such as eGFR, evidence lineage and signatures, security audit trail, structured fail-closed response.

Empirical admission-boundary evaluation: GBI BoundaryBench v0.1

The architecture above motivates a separate empirical question: can a model proposal cross a frozen structured-admissibility boundary without access to the trusted answer package? GBI BoundaryBench v0.1 is a synthetic legacy-EHR benchmark built for that purpose [25]. It is a companion evaluation artifact, not a clinical validation study of DCSE. The frozen held-out package contains 256 tasks spanning eight task families. A single open-weight model, Qwen/Qwen3-4B-Instruct-2507, was evaluated under three preregistered evidence modes: output only, token top k, and full category evidence. The model-execution host contained the answer-key-free model inputs and cryptographically pinned manifests, but not the trusted held-out references. Raw outputs were frozen before trusted scoring. 24

Across the three canonical runs there were 256 × 3 = 768 completed executions. The frozen scorer accepted zero model result records. The status distribution was 369 safe parse reject

and

399 safe schema reject,

with the same per-mode split of 123 parse rejects and 133 schema rejects. Thus coverage was 0, the invalid-output rate was 1.0, all 768 executions were quarantined by the benchmark policy, and selective risk is undefined because no output entered the accepted set. This is a result about the interface and one frozen model/configuration, not a general statement about LLM capability, healthcare safety, or the usefulness of richer evidence in other settings. In this run, additional model-side evidence access did not improve verified completion because failures occurred earlier at the parse/schema admissibility boundary. The experiment therefore illustrates the system-level distinction emphasized throughout this paper: successful neural inference is not equivalent to an admissible downstream action. The public repository releases the architecture, aggregate scored results, figures, and provenance hashes while withholding hidden held-out references and raw held-out responses so that future blind evaluations remain possible [25].

12

Summary: hallucination containment and external validity

The precise safety claim of the framework is not that a neural model is prevented from hallucinating internally. A model may still produce a high-confidence but unsupported proposal. The claim precisely is:

The framework prevents unsupported model outputs from being silently promoted into authoritative clinical facts or EHR writes. Thus, the architecture provides hallucination containment and admission control, though not hallucination elimination.

12.1

Where hallucination is blocked

The system has several gates. A hallucination may occur at the LLM or logit layer, but it must pass deterministic validity checks before it can affect clinical state. 12.1.1

The logit layer is treated as evidence, not authority

The model emits logits L(h) = W h + b,

p = softmax(L/τ ).

The output is not interpreted as: “the model says this, therefore it is true.” It is interpreted as: “the model proposes a categorical evidence vector over a bounded decision.”

25

A safe logit receipt should include (L1 , . . . , LK ),

exp(Li /τ ) pi = P , j exp(Lj /τ )

H(p),

∆ = L(1) − L(2) ,

DKL (pfull ∥ptruncated ).

High entropy, small margin, large tail loss, or cross-model disagreement means do not commit; route to review. The logit layer can expose uncertainty and instability, but it does not establish admissibility or external validity. 12.1.2

The boundary algebra restricts what the model is allowed to say

The model cannot emit arbitrary prose directly as an authoritative clinical assertion. It must map into a finite boundary decision such as: {exact, equivalent, narrower, broader, conflict, unmapped} or, {no allergy documented, confirmed allergy, unconfirmed allergy, refuted}. This turns free-form generation into a typed proposal over a small categorical interface. Thus the first defense is: No free-form clinical assertion can directly become a database update. 12.1.3

The model proposal is checked against external validity

The operational admission gate is the external-validity predicate EV : B × W → {0, 1}, where B is the finite boundary algebra and W is the measurable world/evidence space. Operationally, EV is a terminating Boolean procedure over authoritative evidence, not an LLM judgment. In the EHR setting,   patient identity log,  FHIR resources,     signed terminology bundle,    . W =  Provenance,   AuditEvent,     policy rules,  human adjudications A clinical claim b ∈ B is accepted only if EV (b, w) = 1. This is an operational admissibility test relative to an institutionally defined evidence model; it is not a declaration of ground-truth medical certainty.

26

A more explicit semantics is: [[b]]M ⊆ W × T × L × V × P, where, W = clinical evidence state, T = time interval, L = care setting, facility, or source system, V = terminology version, and, P = provenance and authority chain. The system accepts a proposed assertion only when its witness lies inside the interpretation: (w, t, ℓ, v, p) ∈ [[b]]M .

12.2

What kind of hallucination this prevents

The framework prevents many operationally dangerous hallucinations from becoming authoritative clinical state. Hallucination type Nonexistent code

How it is caught Signed terminology bundle rejects it.

Unsupported clinical assertion

No matching FHIR resource or provenance witness exists, so EV = 0.

Wrong patient

The external identity predicate must reject an invalid or ambiguous match; the BFT log provides nonequivocation and auditability of the identity decision, not correctness of the match itself.

Stale fact

Temporal interval check fails.

Free-text overreach

NLP output lacks acceptable provenance or human signoff.

Unsupported medication mapping

Categorical mapping remains unmapped, conflict, or unknown.

Internal inconsistency

Sheaf or mapping-cone obstruction flags incompatible local sections.

Overconfident model guess

Entropy, margin, tail-loss, or cross-model checks trigger review.

Unsafe commit

FHIR transaction is not posted; an OperationOutcome and Provenance record the abstention.

Table 2: Operational hallucination containment mechanisms. The central design invariant is: 27

The substrate emits typed certificates, not autonomous clinical decisions. On precondition failure, it emits an OperationOutcome, records Provenance, and refuses authoritative write-back.

12.3

What kind of hallucination it does not prevent

The framework does not prevent a model from internally forming a false but coherent story. A model can still produce p(equivalent mapping) = 0.98 for a bad mapping. A model can still produce a fluent explanation. A model can still be wrong in a way that is internally consistent. The architecture blocks that proposal only if the claim fails some external test: EV (b, w) = 0, or creates a sheaf obstruction, [ds] ̸= 0, or lacks provenance, Prov(b) = ∅, or violates policy, Policy(b) = 0. Therefore, GBI/DCSE is not hallucination elimination. It is hallucination containment and admission control. The following two examples are synthetic policy-gating illustrations, not medication recommendations or clinical decision support.

12.4

Example: penicillin allergy

Suppose an LLM proposes: “Amoxicillin is safe for this patient.” The framework does not ask whether the sentence sounds plausible. It atomizes the proposal into a boundary claim b = “amoxicillin order is compatible with active allergy profile.” It then checks the authoritative state   Patient X identity accepted,         AllergyIntolerance: penicillin allergy,       clinicalStatus=active, w= [21]. verificationStatus=confirmed,           criticality=high,     RxNorm/SNOMED terminology bundle 28

If the sheaf consistency check finds conflict on the allergy–medication compatibility relation, the substrate emits a business-rule OperationOutcome and commits no clinical transaction. The hallucination is not prevented at generation time. It is prevented from becoming a clinical write.

12.5

Example: metformin without renal context [22]

Suppose the model says: “The proposed metformin order is appropriate.” The system asks: EV (metformin order allowed, w) = 1? If the version-pinned clinical policy requires a qualifying renal-function observation [22] and no observation satisfying that policy’s terminology and validity window is available, the necessary witness is missing. The system emits a warning or required OperationOutcome, records the abstention, and does not commit the medication order. Absence of evidence is not silently filled by the model.

12.6

Admissibility as a layered operational criterion

The substrate’s acceptance criterion is operational:

AdmissibleGBI (b) = 1

⇐⇒

there exists an admissible witness w such that EV (b, w) = 1.

An admissible witness is not a logit. It is a bundle   identity certificate,  FHIR resource,      terminology version,   . w=  provenance signature,   temporal interval,     policy rule,  optional human adjudication The layers have distinct roles: logits propose, Dirichlet evidence calibrates, sheaves check consistency, BFT checks non-equivocation, FHIR and Provenance check source authority, human review handles residual ambiguity. No single layer establishes medical truth. The operational admission decision is the composition of external-validity predicates over institutionally authoritative records and policy.

29

The Proposal. The system does not claim to eliminate hallucinations inside neural models. A neural model may emit a high-confidence but unsupported proposal. The GBI/DCSE architecture prevents such proposals from becoming authoritative clinical state unless they are witnessed by the external validity predicate over signed identity, terminology, provenance, temporal, and policy objects. In this sense, the architecture provides hallucination containment: it converts unsupported model outputs into abstentions, review tasks, or OperationOutcome records, rather than FHIR commits. Model-relative admissibility. Admissibility is model-relative. A boundary assertion b is admissible to the substrate only relative to a declared institutional model M consisting of accepted identity facts, version-pinned terminology, FHIR resources, temporal validity windows, provenance signatures, policy rules, and human adjudications. The substrate can be wrong if M is wrong; it cannot repair corrupted source records or incomplete institutional policy. Its guarantee is traceability of accepted claims to declared admissible witnesses and policies, not that those witnesses perfectly mirror the world.

A

Complete, Executable Reference Implementation in Julia

The executable source is reproduced below and is also supplied as arXiv ancillary material in anc/gbi dcse arxiv revised.jl. Run it directly in a Julia environment. It requires only the standard LinearAlgebra and Printf libraries. The appendix implements numerical certificates and a toy projector-based stalk-obstruction surrogate; it is not the enterprise policy object P, a FHIR writer, an enclave, or a clinical decision system. using LinearAlgebra using Printf # Numerical appendix for the DCSE/GBI paper. # # The paper treats neural/logit output as bounded evidence, not clinical truth. # This script verifies the small numerical certificates used by that boundary: # Dirichlet-Fisher conditioning, advisory chart distortion, # higher-dimensional ellipsoid distortion, and a projector-based stalk-obstruction surrogate. # # It is not a FHIR writer, enterprise policy engine, enclave, or clinician. # QUARANTINE_THRESHOLD is a toy appendix parameter, not the runtime policy P. # The only commit/quarantine decision represented here is the toy stalk-level # trace-energy gate used to illustrate localization. const MAPPING_STATUS_LABELS = ("exact", "equivalent", "narrower", "broader", "conflict", "unmapped") const FISHER_MIN_EIGENVALUE = 1e-6 const QUARANTINE_THRESHOLD = 0.80 const KTABULAR = 1.5 const PSD_TOL = 1e-10 function condensed_probe_demo() # Section 4 intuition: a condensed/operational probe is stricter than # ordinary pointwise convergence. The toy sequence 1/n converges, but it is # not eventually constant, so it fails the operational compatibility check. seq = [1.0 / i for i in 1:20] tail_variation = maximum(abs.(seq[end-4:end] .- seq[end])) return ( eventually_constant = tail_variation < 1e-12, tail_variation = tail_variation, ) end function entropy_bits(p::AbstractVector{<:Real})::Float64

30

entropy = 0.0 @inbounds for x in p xf = Float64(x) if xf > 0.0 entropy -= xf * log2(xf) end end return entropy end function approx_trigamma(x::Float64)::Float64 # Section 6 uses the Dirichlet Fisher metric # g_ij(alpha) = trigamma(alpha_i) * delta_ij - trigamma(sum(alpha)). # This recurrence plus asymptotic expansion avoids non-stdlib packages. x > 0.0 || throw(DomainError(x, "trigamma approximation requires x > 0")) y = x acc = 0.0 while y < 8.0 acc += 1.0 / (y * y) y += 1.0 end inv_y = 1.0 / y inv2 = inv_y * inv_y inv3 = inv2 * inv_y inv5 = inv2 * inv3 inv7 = inv2 * inv5 inv9 = inv2 * inv7 return acc + inv_y + 0.5 * inv2 + inv3 / 6.0 - inv5 / 30.0 + inv7 / 42.0 - inv9 / 30.0 end function fisher_dirichlet(alpha::AbstractVector{<:Real})::Matrix{Float64} # The caller is expected to enforce the paper’s evidence box alpha_i in # [phi, A]. This routine still rejects non-positive values so the metric # cannot be evaluated on the singular simplex boundary. k = length(alpha) k > 0 || throw(ArgumentError("alpha must be non-empty")) alpha_sum = 0.0 @inbounds for a in alpha af = Float64(a) af > 0.0 || throw(DomainError(af, "Dirichlet alpha values must be > 0")) alpha_sum += af end base = -approx_trigamma(alpha_sum) metric = fill(base, k, k) @inbounds for i in eachindex(alpha) metric[i, i] += approx_trigamma(Float64(alpha[i])) end return metric end f_map(z::ComplexF64, theta::Float64)::ComplexF64 = z * z + theta * conj(z) function wirtinger_exact(z::ComplexF64, theta::Float64) # Section 9 says the visual chart is advisory only. For the fixed chart # f(z; theta) = z^2 + theta * conj(z), the Wirtinger derivatives are exact: # df/dz = 2z and df/dconj(z) = theta. return 2.0 * z, ComplexF64(theta, 0.0) end function wirtinger_fd(z::ComplexF64, theta::Float64, h::Float64) # Kept as a validation fallback for the exact derivative above. fx = (f_map(z + h, theta) - f_map(z - h, theta)) / (2.0 * h)

31

fy = (f_map(z + im * h, theta) - f_map(z - im * h, theta)) / (2.0 * h) return 0.5 * (fx - im * fy), 0.5 * (fx + im * fy) end function hyperellipsoid_certificate(A::AbstractMatrix{<:Real}) # Section 8.1 certificate: Df maps infinitesimal spheres to ellipsoids. # Singular values provide H = sigma_max / sigma_min and # K_outer = sigma_max^n / det(A). Positive Jacobian is required. A64 = Matrix{Float64}(A) singular_values = svdvals(A64) sigma_min = minimum(singular_values) sigma_max = maximum(singular_values) jacobian = det(A64) sigma_min > 0.0 || throw(DomainError(sigma_min, "matrix must be full rank")) jacobian > 0.0 || throw(DomainError(jacobian, "matrix must have positive Jacobian")) return ( singular_values = singular_values, axis_eccentricity = sigma_max / sigma_min, jacobian = jacobian, outer_distortion = sigma_max^size(A64, 1) / jacobian, ) end function orthonormal_columns(M::AbstractMatrix{<:Real})::Matrix{Float64} # The trace energy E_sigma = tr(P_lambda P_sigma) is basis-invariant only # after the obstruction basis has been made orthonormal. M64 = Matrix{Float64}(M) rows, cols = size(M64) cols <= rows || throw(ArgumentError("matrix must have at least as many rows as columns")) factor = qr(M64) return Matrix(factor.Q)[:, 1:cols] end function appendix_raw_obstructions() # Appendix A’s explicit 6x2 obstruction matrix. # # The row pairs model Allergy, MedicationRequest, and RenalLab stalks. The # After orthonormalization, this explicit matrix reproduces the Section 7.3 # toy stalk energies to the displayed rounding. The routine below remains a # projector-based surrogate; it does not construct a mapping-cone differential. return [0.10 0.10; 0.10 -0.10; 1.00 1.00; 1.00 -1.00; 0.05 0.00; 0.00 0.05] end function mapping_cone_certificate( raw_obstructions::AbstractMatrix{<:Real}; threshold::Float64 = QUARANTINE_THRESHOLD, ) # Toy obstruction surrogate used by Sections 7-10. P_lambda projects onto # the span of the supplied obstruction vectors; each stalk energy is the trace # against a coordinate-stalk projector. This is not a mapping-cone Laplacian. U = orthonormal_columns(raw_obstructions) projector = U * transpose(U) laplacian = Matrix{Float64}(I, size(projector, 1), size(projector, 2)) laplacian .-= projector stalk_ranges = ( ("Allergy", 1:2), ("MedicationRequest", 3:4), ("RenalLab", 5:6), )

32

energies = map(stalk_ranges) do (name, idxs) energy = sum(projector[i, i] for i in idxs) (name = name, energy = energy, decision = energy > threshold ? "QUARANTINE" : "COMMIT") end return ( basis = U, projector = projector, laplacian = laplacian, eigenvalues = eigvals(Symmetric(laplacian)), energies = energies, ) end function run_self_check() alpha = [2.0, 3.0, 4.0, 5.0] metric = fisher_dirichlet(alpha) @assert issymmetric(metric) @assert minimum(eigvals(Symmetric(metric))) > FISHER_MIN_EIGENVALUE boundary_alpha = [0.01, 3.0, 4.0, 5.0] boundary_metric = fisher_dirichlet(boundary_alpha) @assert minimum(eigvals(Symmetric(boundary_metric))) > FISHER_MIN_EIGENVALUE z = 1.0 + 1.0im theta = 0.35 fz_exact, fzb_exact = wirtinger_exact(z, theta) fz_fd, fzb_fd = wirtinger_fd(z, theta, 1e-5) @assert isapprox(fz_exact, fz_fd; rtol = 1e-10, atol = 1e-10) @assert isapprox(fzb_exact, fzb_fd; rtol = 1e-10, atol = 1e-10) A = [1.20 0.10 0.0; 0.20 0.80 0.05; 0.0 0.10 1.10] cert = hyperellipsoid_certificate(A) @assert cert.axis_eccentricity >= 1.0 @assert cert.outer_distortion >= 1.0 raw = appendix_raw_obstructions() cone = mapping_cone_certificate(raw) @assert isapprox(cone.basis’ * cone.basis, Matrix{Float64}(I, 2, 2); atol = 1e-12) @assert issymmetric(cone.laplacian) @assert minimum(cone.eigenvalues) >= -PSD_TOL angle = 0.73 rotation = [cos(angle) -sin(angle); sin(angle) cos(angle)] rotated_projector = (cone.basis * rotation) * transpose(cone.basis * rotation) @assert norm(cone.projector - rotated_projector) <= 1e-12 return true end function run_report() println("========================================================================") println(" GBI/DCSE MATHEMATICAL CO-PROCESSOR VERIFICATION RUN") println("========================================================================") probe = condensed_probe_demo() println("\n Condensed operational probe:") println(" Sequence 1/n eventually constant? ", probe.eventually_constant) @printf(" Tail variation over last five terms: %.6f\n", probe.tail_variation) status_alpha = [1.0, 14.0, 1.0, 1.0, 3.0, 1.0] status_p = status_alpha ./ sum(status_alpha) println("\n Local mapping-status evidence:") println(" Labels: ", MAPPING_STATUS_LABELS) println(" Posterior mean p: ", round.(status_p; digits = 4)) @printf(" Entropy: %.4f bits\n", entropy_bits(status_p)) alpha_a = [2.0, 3.0, 4.0, 5.0]

33

alpha_b = [0.01, 3.0, 4.0, 5.0] for (label, alpha) in (("Interior", alpha_a), ("Boundary", alpha_b)) metric = fisher_dirichlet(alpha) ev = eigvals(Symmetric(metric)) @printf("\n %s alpha: %s\n", label, alpha) println(" Eigenvalues: ", round.(ev; digits = 4)) @printf(" Condition number: %.2f\n", maximum(ev) / minimum(ev)) end z = 1.0 + 1.0im theta = 0.35 fz, fzb = wirtinger_exact(z, theta) A = [1.20 0.10 0.0; 0.20 0.80 0.05; 0.0 0.10 1.10] ellipsoid = hyperellipsoid_certificate(A) println("\n Scaling matrix A: ", A) println(" Singular values: ", round.(ellipsoid.singular_values; digits = 4)) @printf(" Axis eccentricity H: %.4f\n", ellipsoid.axis_eccentricity) @printf(" Jacobian det J: %.4f\n", ellipsoid.jacobian) @printf(" Outer distortion Ko: %.4f\n", ellipsoid.outer_distortion) raw_obstructions = appendix_raw_obstructions() cone = mapping_cone_certificate(raw_obstructions) println("\n Eigenvalues of cone Laplacian Lc: ", round.(cone.eigenvalues; digits = 4)) println(" Stalk obstruction energies:") for item in cone.energies @printf(" %-18s energy = %.4f -> %s\n", item.name, item.energy, item.decision) end println("========================================================================") end function trigamma_kernel(values::AbstractVector{Float64})::Float64 acc = 0.0 @inbounds for x in values acc += approx_trigamma(x) end return acc end function wirtinger_exact_kernel(points::AbstractVector{ComplexF64}, theta::Float64)::Float64 acc = 0.0 @inbounds for z in points fz, fzb = wirtinger_exact(z, theta) acc += abs2(fz) + abs2(fzb) end return acc end function wirtinger_fd_kernel(points::AbstractVector{ComplexF64}, theta::Float64, h::Float64)::Float64 acc = 0.0 @inbounds for z in points fz, fzb = wirtinger_fd(z, theta, h) acc += abs2(fz) + abs2(fzb) end return acc end function benchmark_call(label::String, f::Function, reps::Int; ops_per_rep::Int = 1) f() GC.gc() last_result = nothing guarded_f = Base.inferencebarrier(f) elapsed = @elapsed begin for _ in 1:reps last_result = Base.inferencebarrier(guarded_f()) end end

34

@printf( "%-34s %10.3f us/op (%d reps, %d ops/rep)\n", label, elapsed * 1e6 / (reps * ops_per_rep), reps, ops_per_rep, ) return last_result end function run_benchmarks() println("Benchmarks exclude Julia startup/compilation cost and use Base timing only.") alpha = [2.0, 3.0, 4.0, 5.0] theta = 0.35 A = [1.20 0.10 0.0; 0.20 0.80 0.05; 0.0 0.10 1.10] raw = appendix_raw_obstructions() trigamma_values = collect(range(0.25, 12.0; length = 512)) points = ComplexF64[ ComplexF64(cos(t), sin(t)) for t in range(0.1, 2.9; length = 512) ] benchmark_call( "approx_trigamma", () -> trigamma_kernel(trigamma_values), 10_000; ops_per_rep = length(trigamma_values), ) benchmark_call("fisher_dirichlet", () -> fisher_dirichlet(alpha), 200_000) benchmark_call( "wirtinger_exact", () -> wirtinger_exact_kernel(points, theta), 50_000; ops_per_rep = length(points), ) benchmark_call( "wirtinger_fd", () -> wirtinger_fd_kernel(points, theta, 1e-5), 50_000; ops_per_rep = length(points), ) benchmark_call("hyperellipsoid_certificate", () -> hyperellipsoid_certificate(A), 100_000) benchmark_call("mapping_cone_certificate", () -> mapping_cone_certificate(raw), 100_000) end function main(args = ARGS) run_self_check() if "--benchmark" in args run_benchmarks() else run_report() end end if abspath(PROGRAM_FILE) == @__FILE__ main() end

B

Validation, System Metrics, and Operational Boundaries

B.1

Verification Protocols

To ensure the DCSE-GBI co-processor is deployed safely, engineering teams must execute a threetiered validation plan before writing back any transactions to a production EHR: 35

1. Mathematical Validation: • Assertion 1: The Boolean-algebra implementation should be stress-tested over at least 216 randomized join/meet/complement operations, including atom-disjointness and closure checks. This is an implementation test, not a proof of the algebraic specification. • Assertion 2: For a declared evidence box EK,ϵ,A , numerical validation should sweep corners and adversarial near-boundary cases and require λmin (I(α)) to exceed an implementation tolerance such as 10−6 . The tolerance is an engineering criterion, not a theorem that follows from a finite sample alone. • Assertion 3: When an actual mapping-cone Laplacian is constructed, the implementation should verify symmetry and positive semi-definiteness to numerical tolerance. Trace-based stalk energies should also be checked under randomized orthogonal basis rotations; the toy appendix demonstrates basis invariance for its projector surrogate, not a full mapping-cone implementation. 2. Systems Validation: • Attestation Verification: Deploy the system in a staging environment and inject invalid, expired, or modified remote attestation claims [13]. Verify that invalid or stale attestation causes the governed write path to fail closed. Key revocation should be tested only in deployments whose key-management design actually uses attestation-bound database keys. • Consensus Fault Injector: Simulate network partition and validator crash faults to test the liveness and safety invariants of the non-equivocating Byzantine state logs. For any selected BFT protocol, test the protocol-specific resilience and quorum conditions. Under the usual classical 3f + 1 model, tolerating f Byzantine faults requires the active replica population to satisfy n ≥ 3f + 1 [7, 9]; falling below the required threshold must halt authoritative writes. • Rollback Conformance: Inject a corrupted medication order nested within a multi-resource FHIR transaction bundle. Verify that the target FHIR gateway rejects the transaction atomically and returns an appropriate OperationOutcome; capture the failed attempt in the deployment’s audit/provenance path according to policy. Unrelated resources outside the submitted transaction should remain unchanged. 3. Clinical Validation: • Retrospective Playback: A future clinical validation program should preregister a sufficiently powered retrospective or shadow-mode cohort, with expert adjudication and subgroup analysis, before any clinical deployment claim. A nominal target such as 10,000 encounters may be useful for planning, but sample size must be justified by prevalence, target confidence intervals, and the intended claims rather than fixed by this manuscript.

B.2

Performance and Reliability Metrics

The following values are proposed engineering targets for validation and benchmarking; they are not presented here as externally certified thresholds or empirically established safety guarantees:

B.3

Strategic Boundaries and Fail-Closed Constraints

The DCSE-GBI framework is a fail-closed clinical co-processor, not an autonomous practitioner. It is designed to safely restrict data transitions rather than deduce patient care paths. Operational teams must strictly enforce the following execution limits: 36

Table 3: Proposed Operational Performance and Reliability Targets Proposed Baseline

Metric Group

Specific Measure

Testing Methodology

Mathematical

Spectral Gap (λ1 − λ0 )

≥ 0.15

SVD spectrum sweep on LC

Mathematical

Fisher Matrix Condition Number

≤ 104

SVD evaluation on EK,ϵ,A

Systems

End-to-End Latency (Enclave)

≤ 150 ms

Benchmarking from FHIR request to response

Systems

Attestation Bootstrapping Time

≤ 2.5 s

TEE/IAS handshake latency measurement

Clinical

Severe Contradiction Sensitivity

100%

Golden-standard retrospective chart injection

Clinical

False Conflict Adjudication Rate

≤ 4%

Shadow-mode user experience trial

• Boundary 1: The co-processor must immediately halt and deny write permissions if patient identity resolution yields an ambiguous match, regardless of demographic similarity scores. • Boundary 2: Unsigned, unpinned, or stale terminology updates must automatically trigger an administrative freeze, preventing clinical lookups from executing under obsolete mapping semantics. • Boundary 3: The visual audit chart’s linear distortion coefficient K acts solely as a notification tool to assist manual human review. High visual distortion must never be interpreted as proof of logical inconsistency. A quarantine decision must follow the declared deterministic policy over validated identity, terminology, provenance, temporal, dependency, and consistency checks; mapping-cone-derived energies may be one input only when an actual cone construction has been implemented and validated.

References [1] D. Clausen and P. Scholze, Condensed Mathematics and Complex Geometry, arXiv:2605.11731, 2026. https://arxiv.org/abs/2605.11731. [2] P. Scholze, Lectures on Condensed Mathematics, arXiv:2605.03658, 2026. https://arxiv.org/ abs/2605.03658. [3] Y. G. Reshetnyak, Space Mappings with Bounded Distortion, Translations of Mathematical Monographs, American Mathematical Society, 1989. [4] J. Väisälä, Lectures on n-Dimensional Quasiconformal Mappings, Lecture Notes in Mathematics, vol. 229, Springer, 1971. [5] J. Hansen and R. Ghrist, “Toward a spectral theory of cellular sheaves,” Journal of Applied and Computational Topology, vol. 3, pp. 315–358, 2019. doi:10.1007/s41468-019-00038-7. [6] C. A. Weibel, An Introduction to Homological Algebra, Cambridge University Press, 1994. [7] M. Castro and B. Liskov, “Practical Byzantine Fault Tolerance,” in Proceedings of the 3rd Symposium on Operating Systems Design and Implementation (OSDI ’99), 37

USENIX Association, pp. 173–186, 1999. https://www.usenix.org/conference/osdi-99/ practical-byzantine-fault-tolerance. [8] G. S. Veronese, M. Correia, A. N. Bessani, L. C. Lung, and P. Verissimo, “Efficient Byzantine Fault-Tolerance,” IEEE Transactions on Computers, vol. 62, no. 1, pp. 16–30, 2013. doi:10.1109/TC.2011.221. [9] M. J. Amiri, C. Wu, D. Agrawal, A. El Abbadi, B. T. Loo, and M. Sadoghi, The Bedrock of Byzantine Fault Tolerance: A Unified Platform for BFT Protocol Design and Implementation, arXiv:2205.04534, 2022. https://arxiv.org/abs/2205.04534. [10] Q. Zhao, G. Pı̂rlea, K. Grzeszkiewicz, S. Gilbert, and I. Sergey, “Compositional Verification of Composite Byzantine Protocols,” in Proceedings of the 2024 ACM SIGSAC Conference on Computer and Communications Security (CCS ’24), pp. 34–48, 2024. doi:10.1145/3658644.3690355. [11] Q. Zhao, G. Pı̂rlea, K. Grzeszkiewicz, S. Gilbert, and I. Sergey, Bythos: Compositional Verification of Composite Byzantine Protocols—Research Artifact, Zenodo, 2024. doi:10.5281/zenodo.12787570. [12] Intel Corporation, Intel Software Guard Extensions (Intel SGX), Developer Documentation and Overview, accessed August 8, 2026. https://www.intel.com/content/www/us/en/ developer/tools/software-guard-extensions/overview.html. [13] Intel Corporation, Attestation Services for Intel Software Guard Extensions, accessed August 8, 2026. https://www.intel.com/content/www/us/en/developer/tools/ software-guard-extensions/attestation-services.html. [14] Intel Corporation, “What Is the Role of the Intel Software Guard Extensions Platform Services Enclave (PSE) and How Is It Invoked?” Intel Support Article 000058691, reviewed August 6, 2021. https://www.intel.com/content/www/us/en/support/articles/000058691/ software/intel-security-products.html. [15] HL7 International, FHIR Release 4: RESTful API. https://hl7.org/fhir/R4/http.html. [16] HL7 International, FHIR Release 4: Provenance Resource. https://hl7.org/fhir/R4/ provenance.html. [17] HL7 International, FHIR Release 4: OperationOutcome Resource. https://hl7.org/fhir/ R4/operationoutcome.html. [18] HL7 International, SMART App Launch Implementation Guide, version 2.2.0. https://hl7. org/fhir/smart-app-launch/. [19] U.S. Department of Health and Human Services, “Audit Controls,” 45 C.F.R. §164.312(b) (2026). https://www.ecfr.gov/current/title-45/subtitle-A/subchapter-C/part-164/ subpart-C/section-164.312. [20] Y. B. Lee, Safety Receipt Layer for Permit-Before-Action Gating of AI-Assisted Clinical Decision Support Interventions, U.S. Patent No. 12,633,414 B1, May 19, 2026. [21] U.S. Food and Drug Administration, AMOXIL (Amoxicillin): Prescribing Information, NDA 050542, Supplement 032, 2024. https://www.accessdata.fda.gov/drugsatfda_docs/ label/2024/050542s032lbl.pdf. 38

[22] U.S. National Library of Medicine, DailyMed: Metformin Hydrochloride Tablets, Full Prescribing Information, current U.S. labeling, accessed August 8, 2026. https://dailymed.nlm.nih.gov/ dailymed/drugInfo.cfm?setid=59a4ccda-5487-4ac4-9373-0c0fc8b7c88b. [23] Indian Health Service, PATH EHR, IHS Health Information Technology Modernization Program, accessed August 10, 2026. https://www.ihs.gov/HIT/path-ehr/. [24] Indian Health Service, RPMS EHR Technical Overview, accessed August 10, 2026. https: //www.ihs.gov/ehr/technicaloverview/. [25] A. Spivey, GBI BoundaryBench v0.1: Programmatic Verification of Legacy-EHR Transformations, public research showcase and aggregate results, 2026. https://github.com/ AlvinSpivey/GBI-BoundaryBench. [26] R. Jordan, D. Kinderlehrer, and F. Otto, “The variational formulation of the Fokker–Planck equation,” SIAM Journal on Mathematical Analysis, vol. 29, no. 1, pp. 1–17, 1998. [27] B. O. Koopman, “Hamiltonian systems and transformation in Hilbert space,” Proceedings of the National Academy of Sciences, vol. 17, no. 5, pp. 315–318, 1931. [28] N. Tishby, F. C. Pereira, and W. Bialek, “The information bottleneck method,” in Proceedings of the 37th Annual Allerton Conference on Communication, Control, and Computing, 1999. [29] H. Edelsbrunner and J. Harer, Computational Topology: An Introduction, American Mathematical Society, 2010. [30] N. Elhage et al., “Toy Models of Superposition,” Transformer Circuits Thread, Anthropic, 2022. [31] Nostalgebraist, “Interpreting GPT: The Logit Lens,” 2020.

39

Related documents

• Extensible Authentication Protocol (EAP)#408957
• Using the Encapsulating Security Payload (ESP) Transport Format with the Host Identity Protocol (HIP)#420375
• Beyond the Headset: A Systematization of Knowledge on Extended Reality Privacy and Security in Healthcare#1142882
• The Anonymity Gap: Understanding Real Privacy in Shielded UTXO-based Protocols for DeFi#482056
• The Integrated Holistic Security and Privacy Framework Deployed in CrowdHEALTH Project#964881