Non-negotiable rules

This is the canonical copy of these rules — each repo’s CONTRIBUTING.md links here instead of repeating the full text. If you’re citing or updating them, do it on this page.

These rules aren’t bureaucracy: they’re what keeps a well-intentioned change from causing a real problem (legal, clinical-trust, or study-validity). Read them before your first line of code, not after.

1. Stealth / treat as confidential

The registry and the collaborating physicians/entities are in stealth mode. There’s no signed NDA, but the treatment is as if there were: no public surface may name the registry, the collaborating physicians, or the entities involved, or imply their endorsement/participation. This includes public repos, posts, third-party demos, portfolio, LinkedIn.

This site is access-gated, not public — but the content is just as sensitive as the private repos it links to. Don’t forward it, don’t take screenshots to share outside the authorized group, don’t assume “gated” means “casual.” If you’re unsure whether something counts as a public surface, ask before publishing.

2. Real patient data never enters a repo

The corpus of 110 notes is real patient information (the filenames are patient names) and stays outside git on purpose — not even in a private repo, not “just for testing.” Work with synthetic notes, never with the real corpus.

Example synthetic notes already exist: src/routes/persona-isolation.test.ts and persona-runtime-guard.test.ts in pokta-grader-bioagent (one note at a time), and the hardcoded examples in the monorepo’s biobadamex-sweep-dry-run.ts. None are at the scale of 110 — if you need more synthetic variety, generate invented notes, never ask for the real ones for local development.

3. Study integrity — the easiest rule to break unintentionally

Any improvement whose number will back the study is measured on held-out data, never on the same 110 notes the study reports results against.

Why it matters: if you tune a change while watching how well it does against those 110 notes, and then report that same number as a study result, you’re training against the test set. The number goes up because you specifically tuned for that set — not because the system extracts better in general — and that invalidates the comparison between arms, which is the entire point of the exercise.

This is easy to violate without bad intent: “I improved the score” feels good and is the closest metric at hand. The rule exists precisely because it’s the most natural trap to fall into.

Improving any of the three systems as a product is the goal, and that’s perfectly fine. The nuance is where you measure the number you’re going to show as a study result.

4. Push and merge

The three code repos (pokta-grader-bioagent, rheuma-ai-bioagent, pokta-care-monorepo) prohibit working directly on main or pushing directly — branches + PR + human review, always. This documentation site follows the same rule. Third-party forks (like BioAgents) are never pushed back to upstream/third-party remotes.

What’s still undecided

• Compensation / formal collaboration terms for external contributors.
• Coordinating pending handoffs with Dr. Erick Zamora.
• Whether the optional fourth study arm ever gets built.

If any of these is blocking you, say so directly to whoever onboarded you — don’t improvise a solution for something that isn’t yours to decide.