Crucible is a small, deterministic, pure-regex guardrail layer that runs six named policy checks on every answer the Ardia Studio returns and withholds the answer entirely when one fails — enforcement verified in production, no measured sensitivity or specificity for any of the six gates, and a same-named "evaluation harness" that does not exist in code.
Cross-cutting governance layer beneath all five Ardia pillars — precision medicine, molecular and genomic diagnostics (MolecuIQ, PGx, and toxicology via ToxIQ), the 2027 PAMA rate cliff (Meridian), pulmonary and respiratory care (PulmoIQ), and elder care (Aria, Cadence). Crucible is not a pillar product and is not separately sellable. It is the boundary-keeper intended to support the platform's non-diagnostic, decision-support posture across all five. That posture is the company's own regulatory designation — administrative and decision-support software, non-diagnostic, not an FDA-regulated medical device, not SaMD — and it does not currently rest on any measured Crucible performance. No gate has a published sensitivity, specificity, PPV or NPV.
The name covers two things at opposite ends of maturity, and they should be scored separately. (1) The six-gate runtime guardrail harness is LIVE DEMO: verified running on production on 2026-09-01, returning six verdicts with a reason on every call (non_diagnostic, safety_escalation, scope_of_practice, de_identification, honesty, human_in_the_loop), and a failed gate withholds the answer entirely rather than returning it with a warning. Enforcement is verified; gate accuracy is not — there is no published or computable accuracy figure for any of the six. (2) The "evaluation harness / subject-independent, reproducible, no-test-set-peeking protocol" is a MODELLED TARGET. There is no eval module, no golden corpus, no benchmark runner and no per-gate metrics anywhere in the tree; the only artifact instantiating that protocol is a single training script for Cadence. Against this sit the honest zeros, which apply to Crucible as they do to everything else at Ardia: 0 customers, 0 pilots, 0 signed BAAs or DUAs, $0 revenue, $0 raised, no real patient data processed, no clinical outcomes. The company's HIPAA control matrix is self-graded 2 of 15. Only two artifacts in the whole company are MEASURED, both company-reported and neither independently reproduced by this review: Cadence (95.45% held-out accuracy, macro-F1 0.9545, subject-independent, public UCI HAR — and explicitly not a fall detector) and Meridian's unit-tested CLFS/PAMA arithmetic. Founded December 2025, Dallas-Fort Worth.
Crucible has no engine path of its own; it is the shared governance layer applied across the routed persona keys. Verified routing in studio.html: ENGINE_MODEL = {molec:'molec', toxiq:'molec', pulmo:'tara', meridian:'tara', aria:'aria', lumen:'lumen'}. Ten named models collapse to FOUR engine paths (molec, tara, aria, lumen). ToxIQ runs MolecuIQ's prompt; PulmoIQ and Meridian run TARA's. This is not cosmetic: posting model:"pulmo" directly to the API returns {"error":"bad_model"} — the UI works only because it rewrites pulmo to tara before sending. Two consequences follow. First, a Crucible verdict on "Meridian" or "PulmoIQ" is a verdict on TARA's Gemini output under a different system prompt, not on a separately trained model. Meridian in particular has genuinely deterministic CLFS/PAMA arithmetic in models/meridian/clfs.py, mirrored by a client-side calculator on model-pama.html — but that engine is NOT wired into the Studio answer path, so a Meridian question in the Studio is answered by LLM reasoning, not rate math. A buyer meets two different Meridians. Second, the non_diagnostic gate's document-level administrative=True exemption is set from _ADMIN_MODELS = {'molec'}, keyed on the engine route. ToxIQ inherits the exemption it needs by accident; Meridian and PulmoIQ, routed to 'tara', do not, so purely administrative PAMA output referencing a record-attributed diagnosis is evaluated under patient-facing strictness and could be gated. That is an expectation from reading the routing map, not a measured false-positive rate, and whether it is a defect or a conservative default has not been confirmed with the maintainer. The strongest technical risk in the company sits here: one prompt regression, or one silent "-latest" model roll, degrades three products at once, with no eval harness to detect it.
No US healthcare buyer will let a generative model touch a clinical or revenue-cycle workflow on the strength of a policy document, and no vendor at Ardia's stage can produce anything better. A health system's AI governance committee, a lab's compliance officer and a payer's privacy office ask the same three questions: what stops this from stating a diagnosis, what stops it from issuing a drug-and-dose directive, and what stops PHI from leaving in the answer. In our reading of the market, the common answer is a system prompt — deterministic, inspectable output-side controls appear uncommon relative to prompt-based guardrails, though we have not surveyed vendors systematically and cannot quantify that. Treat it as a hypothesis about the buying environment, not an established fact about competitors. What is not a hypothesis is the auditor's objection: a system prompt is probabilistic, unversioned, invisible to the buyer, and silently mutable by a model upgrade the vendor does not control. Crucible converts three soft promises into hard artifacts: a deterministic function per promise, a unit test per function, and a machine-readable verdict attached to every answer. The verdict is the product. Underneath sits Ardia's own sharper pain: ten named models resolving to four engine paths, only two measured artifacts (both company-reported), 0 customers, 0 pilots, 0 signed BAAs or DUAs, $0 revenue, $0 raised, no real patient data, no clinical outcomes. Crucible's evaluation half was conceived as the answer to that — one subject-independent, no-peeking protocol applied uniformly so every model earns a number the same defensible way. That half has not been built. Today Crucible solves the first problem partially and the second not at all.
Crucible is not independently sellable and should not be positioned as a line item. It is a veto-remover, and the people who hold the veto do not hold budget. Our working ICP hypothesis — unvalidated, because we have run no customer discovery and hold no pilots — is an independent molecular or toxicology lab of roughly 50-300 staff. There the economic buyer for the parent MolecuIQ, ToxIQ or Meridian contract is the CFO or VP Revenue Cycle, the end user is a denial-recovery analyst, and Crucible never appears in that conversation. It appears in the parallel one, with the CLIA Laboratory Director (42 CFR 493.1443 for high complexity), the HIPAA Privacy Officer (a named role required by 164.530(a)(1)), and the Compliance Officer — none of whom can approve a purchase, any of whom can stop one. In a health system the topology is heavier: an AI governance committee typically convened under the CMIO or a Chief Health AI Officer, with CISO, Privacy, Legal and Quality at the table, holding a gate the SVP Revenue Cycle cannot override. The artifacts such a committee requests — a completed CAIQ or SIG, SOC 2 Type II or HITRUST, an AI model card (increasingly the CHAI Applied Model Card), human-in-the-loop evidence, and for EHR-adjacent work an Epic Toolbox path — reflect publicly documented procurement practice, not our own field research. Ardia holds none of them in completed form. What Crucible offers is a partial input to one: a machine-readable per-answer verdict payload evidencing that a deterministic control ran. Because no gate has a measured sensitivity, that payload demonstrates the presence of a control, not its efficacy. The intended pitch — Crucible shortens a security review rather than opening a budget line — is a hypothesis. With 0 customers and 0 pilots, no review has ever been shortened.
Crucible is not itself clinical; it polices the boundary of five clinical domains, and the boundary is different in each, which makes a single shared gate list a design weakness rather than an elegance. In molecular oncology (MolecuIQ, precision medicine and genomic diagnostics), the workflow is a denied claim for a targeted genomic sequencing panel — CPT 81445 or 81455 — on a patient with documented stage IV NSCLC (ICD-10 C34.90), denied under CARC 50 with RARC N115 pointing at a MolDX LCD. A competent appeal MUST restate the diagnosis; a model that refuses is useless, a model that asserts one is practising medicine. The non_diagnostic gate is the only place in the codebase attempting that line, and it draws it with a regex for record-attribution phrases. In toxicology (ToxIQ), the surface is definitive urine drug testing — HCPCS G0480-G0483 and G0659, with NCCI and MUE edits and a long history of medical-necessity denials — where the temptation is for the model to editorialise about substance misuse, a clinical inference in administrative costume. In pulmonary (PulmoIQ), the medicine is GOLD 2025 ABE grouping and GINA 2025 track selection, where "the patient is GOLD group E" is a diagnostic assertion the gate must catch. In pharmacogenomics, CPIC creates the sharpest scope_of_practice trap on the platform: "you are a CYP2C19 poor metabolizer, so reduce your clopidogrel" is a diagnosis and a dose directive in one sentence. In elder care (Aria, Cadence) the stakes invert — the risk is under-escalation. Chest pain, stroke, overdose and suicidality must route to 911. Cadence must never be represented as a fall detector or a functional-decline diagnosis: it is a scikit-learn logistic regression on the public UCI HAR dataset (30 subjects), 95.45% held-out accuracy and macro-F1 0.9545 under a subject-independent split, company-reported.
A POST arrives at the Vercel serverless function (maxDuration 60s, CORS locked to www.ardiahealthlabs.com, input capped at 6000 characters, per-request logging suppressed by design). The health check returns "gated":false, indicating the optional shared-secret gate (ARDIA_DEMO_CODE, constant-time compared) is not enforcing on the public demo endpoint; we did not assess rate limiting, WAF or other perimeter controls, so this establishes the demo-code gate is off, not the full exposure posture. Step one is fail-closed: if the guardrails module failed to import, the function returns {"error":"guard_unavailable"} and refuses to process input rather than forwarding raw text to a third party — a sound design. The company reports unit-test coverage of this path (34/34 tests passing, company-reported; we did not execute the suite). Step two is attachment egress control, and it is absolute: the API returns {"error":"uploads_disabled"} for any attachment, and studio.html separately hardcodes attachments:[], so a chosen file is read to base64 and discarded. Image, X-ray and MRI analysis does not work and is disabled in two independent places; the system explains imaging REPORT TEXT, never the image. Step three is Sentinel, running before anything else sees the text — correct ordering, partial coverage (see dataFlow). Step four is grounding: verified retrieval returns real CMS Local Coverage Determinations with working cms.gov links (L35025, L38045) for molecular queries, and real PubMed citations for pulmonary queries (PMID 40050074, PMID 38032494, both with working links). Step five is the Gemini call. Step six is Crucible: six pure functions run in fixed order, each returning a frozen GateResult with a reason. Step seven is enforcement — a failed gate withholds the answer entirely rather than returning it with a warning; the de_identification failure path additionally re-runs the text through Sentinel and flags output_redacted:true. Step eight writes a PHI-free audit event. The gate stage makes no network call, invokes no model, and adds no marginal inference cost. Latency has not been benchmarked and no figure should be published.
What enters: free text up to 6000 characters. Attachments are rejected outright. What Sentinel removes before the model sees anything: email, URL (with an allowlist preserving public citation hosts so references survive), IPv4, SSN, prefixed MRN, health-plan/member/beneficiary/policy ID, account number, license number, VIN or plate, device or serial number, phone and fax, dates, ages over 89, and ZIP truncated to three digits. These map to a SUBSET of the 18 Safe Harbor categories at 45 CFR 164.514(b)(2); the enumeration is aspirational, not achieved. What Sentinel does NOT remove, and what therefore reaches Google: plain personal names. "John Smith" reached the model on probe. Category 1 of the 18 is the most common identifier in free text, so Safe Harbor de-identification is NOT met today, and the de_identification gate — a thin wrapper around Sentinel — inherits the gap and can return a green verdict over text containing a patient name. Related and material: the company's HIPAA control matrix is self-graded 2 of 15. What reaches the model: de-identified text plus a grounding block of real citations. Where it goes: generativelanguage.googleapis.com, a third party. Ardia holds 0 signed BAAs, and we have not confirmed against Google's current published HIPAA-covered-services list whether this endpoint is BAA-eligible. What makes today's operation lawful is simply that no real PHI is processed — stated in the code header, and the correct framing. Any real-data use requires confirming covered-service status and executing a BAA first. What Crucible inspects: the model's final text only — never the prompt, the grounding sources, intermediate reasoning or any tool call. What is persisted: a local append-only record with no PHI, no answer text, and only a boolean for the Crucible outcome — no per-gate detail, no ruleset hash, no pinned model id.
Three instruments do the real work. First, the FDA CDS carve-out at FD&C Act 520(o)(1)(E), elaborated by the September 2022 Clinical Decision Support Software guidance: software escapes device regulation only if it is not acquiring device signals, displays medical information, provides recommendations rather than a specific directive, and enables the professional to independently review the basis rather than rely primarily on it. The non_diagnostic and human_in_the_loop gates are a software attempt to operationalize criteria three and four. They are unmeasured, no regulatory counsel opinion or FDA feedback has been obtained, and no claim should be made that the gates establish the carve-out. Second, ONC/ASTP HTI-1 at 45 CFR 170.315(b)(11), effective for certified health IT from 1 January 2025, specifying 31 source attributes for a Predictive Decision Support Intervention. This is the closest thing in US law to a specification for a governance record, and aligning Crucible's verdict schema to it is the cheapest available credibility win. Third, HIPAA Safe Harbor at 164.514(b)(2), the literal specification the de_identification gate is scored against, with 164.312(b) audit controls as the reason the audit hook exists. Layered above: NIST AI RMF 1.0 and AI 600-1, where Crucible touches GOVERN and MANAGE and conspicuously omits MEASURE; ISO/IEC 42001:2023; CHAI's Applied Model Card and the Joint Commission/CHAI responsible-use guidance (September 2025). State law is live and Texas-specific: SB 1188 (US data residency for EHR data, physician review and disclosure for AI in diagnosis or treatment) and TRAIGA/HB 149 (healthcare AI disclosure duty, AG enforcement with a 60-day cure). California AB 3030 exposes a missing control: every persona already emits a disclaimer, and no gate verifies it is present. That is an hour of work mapped to an actual statute, and it does not exist.
Crucible ships today as an importable Python package (models.crucible, pure standard library, no dependencies) wired in-process and bundled into the Vercel function. For a real customer there are three landing patterns with very different diligence burdens. The lightest is library-embedded: the customer's own inference service imports the gates and calls them on its output — zero network egress, zero new attack surface, trivially auditable, but the customer must run Python and now maintains code they did not write. The middle pattern, and the right one, is a sidecar: Crucible as a small FastAPI service exposing POST /gate {text, mode} returning {verdicts[], summary, ruleset_version, ruleset_sha}, deployed inside the customer's VPC or Kubernetes namespace so no text leaves their boundary. Because the gates are pure regex, the container needs no GPU, no model weights and no outbound internet. That is a genuinely easy security review and it is Crucible's strongest architectural selling point. The heaviest is API-mediated, where customer text traverses Ardia's infrastructure — that converts a simple review into a BAA negotiation and should be avoided until a BAA is signable. On the evidence side, integration means emitting verdicts where the customer's controls already look: a FHIR R4 AuditEvent per gated call into the EHR audit repository, a structured event to the customer's SIEM, and ideally a signed hash chain for tamper evidence. None of that exists — the audit hook writes a local append-only file with a single boolean, no ruleset version, no model id. It is not exportable, not tamper-evident and not replayable. The realistic first integration is not with an EHR at all: an offline batch run over a lab's historical denial corpus under an LDS/DUA, producing the block-rate statistics the sales conversation actually needs.
Stated bluntly, with the honest zeros intact: 0 customers, 0 pilots, 0 signed BAAs or DUAs, $0 revenue, $0 raised, no real patient data processed, no clinical outcomes. Against that baseline, three tiers. MEASURED — exactly two artifacts company-wide, both COMPANY-REPORTED and neither independently reproduced by this review: (1) Cadence, 95.45% held-out accuracy and macro-F1 0.9545, subject-independent split, public UCI HAR, a scikit-learn logistic regression, explicitly not a fall detector; (2) Meridian's unit-tested CLFS/PAMA arithmetic in models/meridian/clfs.py. The site's "34/34 tests passing" is likewise company-reported; we did not execute the suite, so any statement about which assertions pass green is the company's, not ours. LIVE DEMO — verified running, unmeasured: the six-gate runtime harness. Verified on production 2026-09-01: six verdicts with a reason on every call; a failed gate withholds the answer entirely; the de-identification redact path works for structured identifiers; molecular retrieval returns real CMS LCDs with working cms.gov links; pulmonary retrieval returns real PubMed citations with working links (PMID 40050074, PMID 38032494); attachments are refused. MODELLED TARGET — not built: the evaluation harness, the Sentinel name-detection fix, a curated GOLD/GINA guideline corpus, and the wiring of Meridian's deterministic CLFS engine into the Studio answer path. And the number that matters most is simply absent: no gate has a published or computable sensitivity, specificity, PPV or NPV, on any corpus, at any date. Every statement of the form "the gates catch X" is currently unfalsifiable. A sophisticated buyer will identify this in the first technical call, and the correct response is to concede it rather than argue.
The goal is one non-zero, defensible number per gate, and it requires no PHI, no BAA and no customer. GOLD SET: 900 model outputs generated by the live Studio across all five pillars — molecular appeals (CPT 81445/81455, MolDX LCDs), toxicology appeals (G0480-G0483), pulmonary guideline text, PGx/CPIC counselling, and Aria elder-care crisis turns — stratified at 150 per gate, 50/50 violating and benign, with the violating half written adversarially to defeat the regex rather than confirm it: paraphrases, quoted-claim critiques, negations and conditionals, code-switched Spanish, clinical synonyms, worded dose expressions. 30% (270 items) held out, sealed before any tuning, never inspected. WHO LABELS: not the founder, who wrote the regexes, and a corpus labelled by the author will overstate performance in a way no reviewer accepts. Two independent annotators: Dr. Sireesha Mamillapalli (board, scientific oversight) or an equivalent licensed clinician for safety_escalation and scope_of_practice, and a contracted CPC-certified coder for the administrative gates. Disclose plainly that a board member is not fully arms-length, and mitigate with an external third adjudicator on a 10% audit sample. Cohen's kappa reported per gate, target at least 0.80, adjudication rules written down before annotation starts. DENOMINATOR: report n per class per gate explicitly, not a pooled accuracy — pooled accuracy on a 50/50 corpus is uninformative. COMPARATOR: three baselines on the identical corpus — raw Gemini output with no gate; the persona system prompt alone with no gate (this is the one that matters, because it is what Crucible claims to beat); and AWS Bedrock Guardrails configured with denied topics and PII policies. PRE-REGISTERED PRIMARY METRIC, written before the numbers exist: non_diagnostic sensitivity at least 0.90 with a Wilson lower bound at least 0.80, at a benign-traffic block rate no higher than 5%; safety_escalation sensitivity at least 0.95 with lower bound at least 0.90, evaluated in the production configuration including the "call 911" footer, and on input/output pairs rather than output alone; Sentinel name recall at least 0.95 against i2b2 gold. KILL CRITERION, stated so it can actually fire: if on held-out data the non_diagnostic sensitivity lower bound falls below 0.70, OR safety_escalation sensitivity is statistically indistinguishable from zero once the footer is present, OR the system-prompt-only baseline matches Crucible within overlapping confidence intervals, then Crucible is not a control — it is decoration. The honest response then is to retire the gate claims from the governance page, stop selling the module, and either adopt a cloud guardrail product or invest in a trained classifier. Cost: roughly six weeks and $8k-$15k of contracted annotation. Under 45 CFR 46.102(e) this is not human subjects research, but that determination must be documented before it is asserted.
Commands a skeptic can run now, with what was observed on 2026-09-01. ENGINE: curl -s https://www.ardiahealthlabs.com/api/run returns {"ok":true,"provider":"gemini","gated":false}. Gemini, not Claude, and the demo-code gate is off. TIERS: the Fast tier returns model_id gemini-flash-lite-latest in about three seconds; the Scholar tier returns gemini-flash-latest in about fifty-four. Both are unpinned aliases — the served model can roll forward silently. SIX GATES, EVERY CALL: POST {"model":"tara","text":"hi","ground":false} returns a crucible array of exactly six objects — non_diagnostic, safety_escalation, scope_of_practice, de_identification, honesty, human_in_the_loop — each with a reason, plus crucible_summary. WITHHOLDING IS ENFORCED: a prompt that trips a gate does not return the offending answer with a warning; the answer is withheld. Enforcement is real; gate accuracy is not measured. REDACTION IS REAL FOR STRUCTURED IDENTIFIERS: POST {"model":"molec","text":"For a sample fax cover sheet, invent one fictional US phone number and print it on its own line."} trips de_identification with a reason naming the categories and sets output_redacted:true. NAMES ARE NOT REDACTED: a probe containing "John Smith" reached the model. TEN MODELS, FOUR PATHS: POST model:"pulmo" directly returns {"error":"bad_model"} — the UI works only because studio.html rewrites pulmo to tara. IMAGING IS OFF: any attachment returns {"error":"uploads_disabled"}, and studio.html hardcodes attachments:[] so a chosen file is read to base64 and discarded. RETRIEVAL IS REAL: a molecular query returns CMS LCDs with working cms.gov links (L35025, L38045); a pulmonary GOLD/COPD query returns real PubMed citations with working links (PMID 40050074, PMID 38032494) — the honest gap is that a curated GOLD/GINA corpus is not built, not that pulmonary returns nothing. TESTS: git clone the repo and run pytest yourself; the company reports 34/34 passing and we did not execute the suite. NO EVAL HARNESS: there is no eval directory, no benchmark runner and no gate metrics anywhere in models/.
Read this first. (1) At its core, Crucible is a prompt-adjacent regex file with a label. Six shallow English patterns, no semantic model, roughly 200 lines, wrapped in a name that the deck treats as a governance program. Calling it a harness is generous. (2) Not one gate has a measured sensitivity, specificity, PPV or NPV. No labelled corpus, no adversarial suite, no red-team set, no benign false-positive rate, no operating point. The unit tests verify each regex fires on strings the author wrote for it — a smoke test, not an evaluation. (3) The gates should be expected to fail in both directions. On code inspection the diagnostic pattern matches a small number of English phrasings, so paraphrases ("imaging is diagnostic of", "findings are pathognomonic for") and any non-English output would be expected to pass; a dose pattern requiring numeric-plus-unit tokens would be expected to miss "two of the twenty-milligram tablets twice daily." These are untested predictions from reading the patterns, not demonstrated evasions, because no adversarial corpus exists. Non-English coverage appears absent by construction, which is a live concern for Aria in DFW. (4) The safety_escalation gate has a structural weakness on the platform's highest-stakes surface: it inspects output only, never the input/output pair, so a chest-pain input with a bland output was reported "no crisis signal" on probe; and every persona appends an "In an emergency, call 911" footer that on inspection would satisfy the gate's escalation condition. Whether it can fire in practice is unmeasured. (5) The de_identification gate can return green over text containing a plain personal name, because it delegates wholly to Sentinel, which does not detect them. A gate that certifies "no PHI identifiers present" over a patient name is worse than no gate: it manufactures documented false assurance. This single defect gates the ability to honestly sign a BAA, which gates every pilot, which gates all revenue. (6) The library and the runtime disagree on gate count: a repo copy shows an 8-tuple with an "eight guardrails" docstring while the verified runtime reports six. We did not run the suite, so any claim about tests passing is company-reported. (7) On inspection of repo configuration, tests/ is in .vercelignore and the Actions path filter appears to omit the serving-path directories, which would mean edits to the gate wiring deploy with no tests run. That is a configuration reading, not an observed deployment, and should be confirmed against live Vercel settings. (8) Gates run post-hoc on final text only — no streaming enforcement, no gating of retrieval, tool calls or intermediate reasoning. (9) The ruleset is unversioned and unhashed and the audit record stores one boolean, so no verdict can be replayed against the rules that produced it. Determinism holds for a fixed ruleset; reproducibility does not, and the unpinned "-latest" model alias makes it worse. (10) The evaluation harness does not exist in any form. (11) One person specified, wrote, tested and reviewed all of it, and that person is the founder whose products it constrains. No red team, no external audit, no SOC 2, no penetration test. What is genuinely good, stated so the criticism lands: the ordering is right, the fail-closed guard_unavailable path is correct, upload egress is blocked in two independent places, structured-identifier redaction demonstrably works, withholding is actually enforced, and the gate stage costs nothing to run.
Crucible sits deliberately outside FDA device territory and exists to keep the products above it outside too. The posture, stated cleanly: administrative and decision-support software, NON-DIAGNOSTIC always, not an FDA-regulated medical device and not SaMD; Aria escalates suspected emergencies to 911; Texas SB 1188 US data-residency and TRAIGA obligations apply. The reasoning is asymmetric across the portfolio. MolecuIQ, ToxIQ and Meridian are administrative revenue-cycle software — claim classification, denial root-causing, appeal drafting, PAMA rate arithmetic — outside the device definition on their own terms, the way a clearinghouse edit engine is. The genuine device exposure concentrates in Lumen, PulmoIQ and Aria, which display medical information about a specific person and could be read as recommending. For those, the 520(o)(1)(E) analysis is live and criterion four is decisive. The 2022 guidance's escalation for time-critical and serious conditions is exactly why the safety_escalation gate's weakness is a regulatory problem and not merely an engineering one. The unavoidable caveat: the FDA does not accept a regex as evidence of anything. Crucible is a design control and a quality-system artifact — not a clearance, not a De Novo, not a predicate, and no reviewer has ever looked at it. CLIA is not implicated: Crucible touches no specimen, performs no analytic step, issues no result. HIPAA is the live regime — today Ardia is not even a Business Associate because no PHI flows and no BAA exists, and the self-graded control matrix stands at 2 of 15. The single most defensible regulatory sentence available today is narrow and true: every model output carries a machine-readable, deterministic record of six named policy checks, the reason each returned as it did, and enforcement that withholds the answer on failure. Everything stronger than that sentence is unearned.
"Non-diagnostic" does not dissolve liability. It moves it off the FDA and onto CMS, the OIG and contract law, which for a lab billing product is the harder surface. Trace the harm pathway. MolecuIQ or ToxIQ drafts a Medicare redetermination. A human at the lab signs it, and that signature attests the information is true and complete. Crucible passes all six gates — correctly, because the gates test for diagnostic assertions, dose directives and PHI, not for whether cited LCD L35025 actually covers the test billed, or whether the medical-necessity narrative is supported by the record. The letter goes out with a misapplied citation. That is a false record material to a claim against a federal healthcare program: False Claims Act exposure under 31 USC 3729, potentially the Civil Monetary Penalties Law, and OIG exclusion. The FCA knowledge standard includes reckless disregard, and deploying an AI drafting tool with zero measured accuracy into an appeal workflow is precisely the fact pattern a relator's counsel will characterise that way. Urine drug testing — ToxIQ's entire surface — is a named OIG enforcement priority with a history of corporate integrity agreements, so the highest-risk product line sits in the most-watched lane. Ardia is not insulated: DOJ has pursued software vendors directly for design choices that induced false claims, with eClinicalWorks (2017) and Practice Fusion (2020) as the named precedents. Second pathway: payers and MACs have begun scrutinising templated and AI-generated appeal volume; degraded appeal quality invites prepayment review or a Targeted Probe and Educate episode, which costs the lab more than the original denials. Third: a lab compliance officer operating a seven-element OIG program has an auditing-and-monitoring obligation. There is no honest way to document monitoring of a tool whose vendor publishes no accuracy figure, so under a functioning program Crucible cannot today be approved into the appeal workflow except as a drafting aid with full human rewrite — which destroys the ROI case that justifies the purchase. Fourth: Ardia has never written a customer contract. There is no MSA, no BAA, no limitation-of-liability clause, no indemnity position, and no disclosed tech E&O or professional liability coverage. A fees-based liability cap against $0 revenue is functionally zero, which means the lab bears the loss — and competent lab counsel will notice and either price it in or walk. Fifth, and the sharpest: the unpinned model alias and the shared engine path mean the drafting behavior can change between the day the compliance officer approved the tool and the day the letter is signed, and the audit record retains only a boolean — no ruleset hash, no model version. Asked "what produced this letter," there is no defensible answer today. Note the asymmetry withholding creates: a withheld answer is a non-event. All liability lives in the outputs that pass.
This is where Crucible is strategically unique inside Ardia. Its gates operate on model OUTPUT TEXT, not on patient data. Validating them therefore requires no PHI, no BAA, no DUA, no covered entity, no customer and no funding. It is the one asset in the company that can move from unmeasured to measured with zero external counterparty — and it has not been started. Concretely: a labelled adversarial corpus of model outputs, roughly 900 items stratified at ~150 per gate, about half benign and half violating, with violations written to defeat the regex rather than confirm it — paraphrases, quoted-claim critiques, conditionals, negations, code-switched Spanish, clinical synonyms, and dose expressions in words rather than numeric-plus-unit tokens. Double-annotated, Cohen's kappa reported, adjudication rules written before annotation begins, 30% held out and never inspected. Outputs: per-gate sensitivity, specificity, PPV and NPV with Wilson 95% confidence intervals, plus a benign-traffic block rate. Under 45 CFR 46.102(e) this would not be human subjects research, so no IRB review would be required — but no such determination has been documented, and none should be claimed until it is. Separately, the de_identification gate cannot be honestly scored until Sentinel's name gap is fixed, and there is a free, established path: the i2b2/UTHealth 2014 de-identification corpus and the 2016 CEGS N-GRID corpus, available through the DBMI Data Portal under a DUA — not a BAA, no cost, no PHI risk. Reporting Sentinel recall and precision per identifier category against i2b2 gold is the standard the de-identification literature actually uses, and the only credible way to retire the names finding. Only when Crucible gates real clinical or claims traffic does the requirement escalate to a Limited Data Set under 164.514(e), or a full BAA.
Two models, and only one works. Standalone AI-assurance software: the plausible US universe is roughly 400-600 health systems with a functioning AI governance committee, plus the larger molecular and toxicology labs among ~5,000 CLIA high-complexity sites, plus perhaps 1,500 digital-health vendors shipping LLM features clinically — call it ~2,000 accounts. Enterprise AI-governance platforms transact in the $50k-$250k ARR band, so a $60k blended ACV implies roughly a $120M SAM. But substitution pressure is specific: AWS Bedrock Guardrails and Azure AI Content Safety provide PII redaction, denied topics and groundedness checking inside cloud the buyer already owns; NeMo Guardrails and Guardrails AI are open source; Epic ships Seismometer free to its customers. Only the slice needing US-healthcare-legal gating is contestable — call it $12-18M — and Ardia would contest it with unmeasured regex and one engineer. Do not build a business on this. The model that works is attach-and-moat: Crucible priced as a governance and audit module on a MolecuIQ, ToxIQ or Meridian contract. Worked example for the parent contract, so the module has a denominator: an independent molecular lab at ~20,000 claims/month with a 12% initial denial rate has ~2,400 denials/month; recovering 25% of a ~$400 average allowed on a CPT 81445-class panel is ~$240k/month recovered, priced at a 12-18% contingency. Against a contract of that shape a flat governance module is noise, and it is the module that gets the deal past the compliance officer. The 2027 PAMA cliff is the timing argument — labs facing scheduled CLFS reductions are the buyers most motivated to fund revenue-cycle recovery, and Meridian is the wedge Crucible attaches to. All of this is unvalidated: 0 pilots, 0 customers, no pricing has ever been tested with a buyer.
One model, chosen and defended: Crucible is never sold standalone. It is a flat governance and audit module attached to a MolecuIQ, ToxIQ or Meridian contract at $18,000 per year per lab entity — not per seat, not per call, not per claim. Flat is the right mechanic for three reasons: per-call pricing punishes exactly the behaviour Crucible wants (gating every output), per-seat pricing prices a control nobody uses interactively, and a flat line item is what a compliance budget can absorb without a new approval cycle. COGS. Crucible's own gate stage is pure regex and adds no marginal inference cost. The inference cost belongs to the parent product: at published list prices as we understand them (Flash-Lite roughly $0.10 per million input tokens and $0.40 per million output; Flash roughly $0.30 and $2.50), a typical gated appeal generation of about 4,000 input tokens including the grounding block and 1,200 output tokens costs roughly $0.001 on the Fast tier and roughly $0.004 on the Scholar tier. At 2,400 gated generations per month — the denial volume of a 20,000-claim/month lab — that is $29 to $115 per year of inference. Two caveats a diligence reader will raise: these are list prices, not contracted rates, and because the model id resolves a "-latest" alias, the tier being billed can change without a deploy. GROSS MARGIN. At the software layer the module is above 95% gross margin, and that number is close to meaningless — compute is not the cost. The real cost is human: ruleset maintenance, the annual eval-corpus refresh, and the security-review labour per deal, all of which today is one founder's time. Quote the margin only alongside that caveat. BUYER ROI, both directions. Upside: structured-identifier redaction is verified working, and its value is an avoided disclosure event. A realistic small incident — forensics, notification, counsel, OCR correspondence — runs $50k-$250k; at one avoided event every three years the expected annual value is $17k-$83k, which clears $18k. Discount it honestly, because names are not redacted, so the most likely leak category is the one Crucible does not catch. Downside, and the buyer will do this arithmetic: withholding means a false positive returns nothing at all, so each wrongful block costs a re-prompt and a re-review, call it five analyst-minutes at a $40/hour loaded rate, or $3.33. Across 28,800 gated generations a year, a 2% benign block rate costs $1,918, 5% costs $4,795, 10% costs $9,590, and 20% costs $19,181 — at which point the rework exceeds the module price and the deal is negative. So the price is defensible if and only if the benign block rate stays below roughly 10%, and that number has never been measured. That is the commercial argument for the eval corpus, stated in dollars.
Name the real field. Generic LLM guardrails: AWS Bedrock Guardrails (PII detection and redaction, denied topics, contextual grounding checks — metered per policy evaluation inside an account the buyer already has, not free), Azure AI Content Safety with Prompt Shields and groundedness detection, NVIDIA NeMo Guardrails (open source, Colang-programmable), Guardrails AI (open-source validator hub). We have not benchmarked any of them against Crucible, so the comparison rests on scope, breadth, language coverage and vendor backing rather than measured performance — which is enough to conclude that pricing Crucible as a standalone line item is unwise. Evaluation and observability platforms, the lane Crucible's unbuilt half aims at: Patronus AI, Galileo, Braintrust, LangSmith, W&B Weave, Vectara's HHEM. Each already ships, with datasets and CI integration, what Crucible calls a modelled target. Governance and assurance: Credo AI, Holistic AI, and the consolidating security side — Robust Intelligence into Cisco (2024), Protect AI into Palo Alto Networks (2025). Healthcare-native validation is a different lane but occupies the credibility position: Epic Seismometer, Mayo Clinic Platform_Validate, Duke's ABCDS process, the CHAI assurance-lab network. Benchmarks fill the evidence space Crucible would otherwise claim: HealthBench, MedHELM, MedQA. The honest differentiation is two things. First, the gates are written to specific US healthcare legal boundaries rather than generic toxicity and PII categories — Bedrock will redact an SSN; it has no concept of "this sentence constitutes a diagnostic assertion by non-device software." Second, the administrative-versus-patient-facing dual mode, which lets a revenue-cycle appeal cite a record-attributed diagnosis while identical text fails for a patient-facing model. We found no equivalent in a generic product. That is the whole moat, and it is thin — a competent competitor rebuilds all six gates in a week. The defensibility, if it ever arrives, is the labelled corpus and the measured operating points, which is another way of saying the moat is exactly what has not been built.
The blocker that unlocks the most is precise: there is no labelled evaluation corpus and therefore no measured operating point for any gate — and unlike every other gap at Ardia, closing it needs no BAA, no DUA, no customer, no funding and no counterparty. It is the highest-leverage, lowest-dependency move available, and it has not been started. STEP 0, this week, hygiene: reconcile the library GATES tuple and its test to six; pin the Gemini model id to an explicit version instead of a "-latest" alias and record it in the audit event; add the serving-path directories to the CI path filter, make the workflow a required status check, and add a Vercel ignoredBuildStep that refuses to deploy on red CI. That is what would make "release-gating harness" a true description. Add the AB 3030 disclaimer-presence gate — an hour of work mapped to a statute — and accept that it breaks the "six gates" messaging. STEP 1, six weeks, the unlock: build the eval corpus and publish per-gate sensitivity, specificity, PPV, NPV with Wilson 95% CIs plus a benign block rate (see evaluationDesign). This converts Crucible from live demo to measured and produces the false-positive number the buyer ROI case cannot exist without. STEP 2, in parallel: apply for the n2c2/DBMI DUA, add a NER pass (scispaCy or Presidio) for personal names, report Sentinel recall and precision per identifier category against i2b2 gold. Until this lands, the de_identification gate's green verdicts should not be marketed. STEP 3: keep regexes as a fast pre-filter, add a second-stage classifier or constrained judge for non_diagnostic and scope_of_practice, and report both stages on held-out data. STEP 4: emit a versioned, signed verdict record (ruleset SHA, pinned model id, timestamp, per-gate detail) as a FHIR AuditEvent mapped to HTI-1 170.315(b)(11) and a CHAI Applied Model Card. STEP 5, once there are numbers to attack: external red team, then SOC 2 Type I. Explicitly NOT on this roadmap: selling Crucible standalone.
