Machines propose.
People are accountable.

Product spotlight: Riley

An AI revenue agent for private practices.

Riley answers every inquiry a practice receives, works out who the person already is, and hands the front desk one decision instead of an afternoon. Underneath it is a desired-state reconciliation control plane. It compares what a practice wants (a full book, every inquiry answered) against what is observed (an appointment feed, a lead inbox, provider hours) and emits the deltas between them. Deltas become plans, plans lower into typed sagas, and each step is a declared capability that states its own authority before it runs.

;; a capability declares its own authority before it can run
(capability book-consultation
  (kind          act_external)
  (risk-class    high)
  (approval      operator_required)
  (phi-classes   (limited_phi))
  (redaction     staff_safe_summary)
  (idempotency   required)
  (side-effects  (creates_appointment))
  (metrics       (booked_consults)))

;; omit any line above and the plan will not lower.
;; undeclared is unrunnable.

The declaration is the enforcement. A capability that has not named its risk class, its data classes, and its approval requirement cannot be lowered into a saga, so it cannot execute. That is the whole idea, and it is why a non-engineer can safely describe a workflow in plain language: the runtime refuses anything under-specified rather than guessing at the missing half.

Status, plainly. The reconciliation loop, capability registry, typed saga lowering, PHI seams, approval interrupts and audit trail run today. The outbound clinical write path is built and shipped disarmed. Iron Lake's substrate work — the general runtime PAOS is the first consumer of — is research in progress and is not claimed as a shipping product.

Product spotlight: litigation

Trial prep for the firms the market skipped.

The privilege work taught us where the ceiling actually is. A small firm's case rarely dies on the law — it dies in the reading. An ordinary dispute generates tens of thousands of emails, exhibits and filings; one side meets them with an eDiscovery platform and a floor of associates, the other with an inbox and nights. Firms already buy this work by the hour, at attorney rates. Throughput is the complaint.

So the machinery under the privilege service is growing into a trial-prep engine: the chronology, the entity map, the contradiction report, the research memo — with the case law behind it drawn from the now-open public record, and every generated claim pinned to the documents and passages that support it. It runs overnight, because nobody needs a chronology in two hundred milliseconds. They need it by morning, checked.

;; a proposition of law may not leave the system unverified
{
  "proposition": "trustee compensation must be reasonable
                  under the circumstances",
  "cite":        "Fla. Stat. § 736.0708(1)",
  "quote_found": true,  ;; the passage exists in the source
  "supports":    true,  ;; and says what the memo claims
  "still_good":  true,  ;; no negative treatment found
  "decided_by":  "reviewing_attorney"
}

;; fail any line and the memo does not export.

Courts have sanctioned lawyers for filing fluent, fabricated citations, and the profession learned the lesson: it never rejected AI, it rejected unverifiable AI. That is the failure mode this design refuses. A proposition that cannot be traced to its source passage, in a case that is still good law, does not leave the system. The standard is not "sounds right." The standard is work product that survives a judge asking how do you know that.

Status, plainly. The document-review core is deployed on a live matter — that story is on legal. The research engine and the citation-verification layer are being built against the open Florida corpus and are not claimed as a shipping product.