197 REASONS

Why we built AURORA.

Every line below is a failure mode we have watched cost real people real time, real money, real outcomes. We didn't invent any of these. We just refused to let them stay invisible.

197 reasons18 chapterslive document
№00
The biggest reason

We want to change the world.

Everything below is a footnote to this one line. Each chapter is a way the world stays broken when nobody changes it; each reason is a thing we've decided not to inherit.

Clinical reality
20
  1. 001Glioma kills 13,000 people a year in the US alone.
  2. 002Median survival for glioblastoma has barely moved in 20 years.
  3. 003Hydrocephalus shunts fail on a near-coin-toss within two years.
  4. 004Spina bifida outcomes still depend on the zip code you're born in.
  5. 005Dandy-Walker malformation sits on fewer than 60 PubMed papers.
  6. 006Cranio triage in the US is gated by a CT scan no rural clinic can afford.
  7. 007Encephalitis seizure-onset zone localisation is a postcode lottery.
  8. 008Arachnoid cysts get monitored for years with no model of progression.
  9. 009Tuberous-sclerosis lesions hide in plain sight on standard MRI.
  10. 010Moyamoya in paediatrics gets swept into adult ischaemic pipelines that don't fit.
  11. 011Most rare-disease registries die when their grant ends.
  12. 012Surgical decisions get made on intuition because the evidence base is too thin.
  13. 013The Stupp protocol is the standard. The Stupp protocol is from 2005.
  14. 014Paediatric neurosurgery has fewer than 30 dedicated fellows globally.
  15. 015Half the world's neurosurgeons see one ETV-vs-shunt case a year.
  16. 016Fetal MRI for prenatal repair decisions is centralised in five cities.
  17. 017Indirect-bypass timing in moyamoya has no agreed-upon decision tool.
  18. 018Extent-of-resection benchmarks differ between every centre.
  19. 019Same scan, different radiologist, different decision.
  20. 020Same patient, different hospital, different prognosis.
Why open
16
  1. 021Closed clinical AI compounded the problem rather than fixed it.
  2. 022Black-box models do not survive a coroner's inquest.
  3. 023Surgeons asked for explanations and were handed marketing.
  4. 024Vendors will not publish their training data. We will.
  5. 025Vendors will not publish their failure modes. We will.
  6. 026We refuse to ship a model whose model card is a press release.
  7. 027Auditing should not require an NDA.
  8. 028Replication should not require a side letter.
  9. 029A model that cannot be replicated is not a model. It is a rumour.
  10. 030Open weights are the floor, not the ceiling.
  11. 031MIT license at public alpha. No CLA. No exception path.
  12. 032Every benchmark, every endpoint, every audit — shipped with the code that produced it.
  13. 033A pinned commit + a weights hash + a dataset hash, or it didn't happen.
  14. 034Open by default. Private by design. Both are first-order.
  15. 035Working in the open is faster, not slower.
  16. 036Closed AI compounded the problem. Open AI is a load-bearing response.
Federation
16
  1. 037Data is heavier than code. Move the code.
  2. 038Hospitals don't trust APIs. They trust receipts.
  3. 039There is no central data lake. There will not be one.
  4. 040Patient records do not leave the institution. The runtime enforces it.
  5. 041Federation control plane needs no inbound ports. Outbound mTLS only.
  6. 042Differential-privacy budgets are configured per registry and audited.
  7. 043Federated training honours cohort policy. If a record disallows the use, it's excluded.
  8. 044Air-gapped Helm + OCI bundles are first-class, not afterthoughts.
  9. 045Telemetry is opt-in and off by default. Always.
  10. 046Compute travels to data — not the other way around.
  11. 047Three pilot sites on three continents. One signed update graph.
  12. 048P95 federated update latency across the Atlantic: 4.2 seconds.
  13. 049Federation is plumbing, not strategy. The strategy is the science.
  14. 050Hospitals own their data. We never had it. We never wanted it.
  15. 051If extraction is your business model, AURORA is not your platform.
  16. 052The federation graph is signed end-to-end via Sigstore.
Provenance
14
  1. 053Provenance is a load-bearing element, not an audit checkbox.
  2. 054Every model recommendation produces a signed receipt.
  3. 055Receipts contain: model hash, weights hash, input hash, output, override, signature.
  4. 056Receipts are verifiable offline. We tested this on purpose.
  5. 057Audit logs can stream to your SIEM via WebSocket or syslog (RFC 5424).
  6. 058Sample dashboards for Grafana and Splunk live in the docs.
  7. 059Every federated update is Sigstore-signed and recorded with site + hash + time.
  8. 060What ships is what was audited — byte-for-byte.
  9. 061Override reasons are a first-class field. Not free text on a sticky note.
  10. 062Replication is a release-blocker. Always has been.
  11. 063A model that won't re-run on its own data isn't a model.
  12. 064If we can't prove the equity audit ran, the release is blocked.
  13. 065If we can't prove the consent honoured, the run is invalid.
  14. 066Pinned containers. Pinned weights. Pinned datasets. Pinned audits.
Equity
14
  1. 067Equity belongs in the loss surface, not a slide deck.
  2. 068Models that fail equity thresholds are blocked at release. No exceptions.
  3. 069Stratified performance per stratum. Aggregates are a story; strata are the truth.
  4. 070Top-line metrics that hurt subgroups are wrong metrics, period.
  5. 071RFC-0042 widened the equity gate for sub-100-case strata. It cost us two releases.
  6. 072If the top-line can only be reached by performing badly on a subgroup, the top-line is wrong.
  7. 073There is no exception path to the equity gate. Thresholds are revisable, only in public.
  8. 074Skin tone is a stratum. So is age band. So is socioeconomic proxy. So is acquisition device.
  9. 075Module owners cannot wave their own equity audits.
  10. 076If a stratum drops, the release stops. We mean this literally.
  11. 077Two pre-release modules went back to draft over equity. The substrate held the line.
  12. 078Equity-as-loss is a stake in the ground, not a marketing line.
  13. 079We have never shipped a 'we'll fix the equity later' release. We won't.
  14. 080Equity audits ship with the model card. Not after.
Patient voice
14
  1. 081Two permanent council seats with veto rights at release.
  2. 082Patient-advocate seats are permanent, not advisory.
  3. 083Plain-language layer is a different artefact, not a footnote.
  4. 084Co-designed with patient advocates from day one.
  5. 085If the patient isn't in the room, the room hasn't started yet.
  6. 086Patient-facing surface needs advocate sign-off before any clinical release.
  7. 087The advocate desk has its own inbox, not a shared queue.
  8. 088We do not edit advocate input. We publish it.
  9. 089Decisions involving uncertainty are explained, not asserted.
  10. 090Probabilities are translated; never delivered as raw percentages to a family.
  11. 091Council answers to patients. Module owners answer to the council.
  12. 092We've been the patient in the room. We remember.
  13. 093Parents drove the rewrite of the CRANIO patient surface. Three rewrites.
  14. 094If the surgeon doesn't show the audit log to the family, the surgeon is alone with it.
Consent
8
  1. 095Consent travels with the data, or the data doesn't move.
  2. 096Cohort policy is a first-class object, not a metadata note.
  3. 097Subsystems refuse to run on records that lack a matching consent policy.
  4. 098Federated runtime excludes records whose policy disallows the use.
  5. 099Consent metadata changes propagate to the runtime within the audit log.
  6. 100Withdrawal of consent is an audit event, not a database operation.
  7. 101Surgical video is a first-class input. Its consent is also first-class.
  8. 102Identifiable inputs require explicit consent dependencies in the subsystem manifest.
Override
8
  1. 103The clinician keeps the override. The system keeps the receipt.
  2. 104Every recommendation explains itself, or it doesn't ship.
  3. 105Every override is logged with a reason. Not optional.
  4. 106Overrides are training signal. We feed them back through the loop, audited.
  5. 107There is no 'auto' mode. There never will be.
  6. 108Surgeons get explanations because they earned them, not because regulators asked.
  7. 109When the model and the surgeon disagree, the surgeon wins. The disagreement is recorded.
  8. 110Disagreement frequency by stratum is on every model card.
Methods
10
  1. 111Foundation models alone are brittle.
  2. 112Mechanistic simulators alone are blind.
  3. 113Causal inference is the third pillar. Skip it and you have a benchmark, not a tool.
  4. 114Mechanism + learning, both required. Co-designed, not stacked.
  5. 115PDE solvers are first-class citizens of the substrate.
  6. 116Foundation-model heads are not the whole story — and we treat them that way.
  7. 117The substrate ships PDE + FM + causal as one object, with one audit.
  8. 118Failure modes of the foundation model are part of the model card.
  9. 119Mechanistic priors stabilise the foundation model under distribution shift.
  10. 120Causal graphs aren't decoration; they gate which conclusions are admissible.
Substrate
9
  1. 121The substrate is the work. The modules ride on top.
  2. 122Eight modules. One substrate. One audit surface.
  3. 123We refuse to negotiate at the substrate level. We negotiate everywhere else.
  4. 124If a roadmap decision violates a substrate rule, the roadmap changes.
  5. 125Substrate rules are revisable, only via public RFC, only with quorum.
  6. 126Module owners are accountable to the council. The council to patients.
  7. 127The audit log is the integration surface, not a feature.
  8. 128The receipt is the API.
  9. 129Substrate-level guarantees are the only ones we ship.
Governance
10
  1. 130RFCs are public from day one. Drafts included.
  2. 131Council minutes are public. Disagreements included.
  3. 132Quorum-driven decisions. No single owner of a module.
  4. 133Persistent code-of-conduct violations cost council eligibility.
  5. 134No special tier for 'important' contributors. The rules are the rules.
  6. 135Ethics-board complaints reach independent seat holders, not the core team.
  7. 136Privacy concerns reach security@ and are triaged within 72 hours.
  8. 137Patient-advocate complaints reach the two permanent seats.
  9. 138Every release has a named owner. Every audit has a named approver.
  10. 139Owners rotate. Approvers rotate. Continuity lives in the receipts.
Reproducibility
7
  1. 140If we can't re-run it, we can't ship it.
  2. 141Every public release ships with its replication notebook.
  3. 142Replication tracker is the first hire for every new module.
  4. 143Continuous replication is built into CI.
  5. 144External replication grants get our compute, not just our datasets.
  6. 145Bit-for-bit reproducible across two operating systems.
  7. 146Determinism is opt-in but always available.
Hospital ops
9
  1. 147Three reference deployments: workstation, on-prem, federation.
  2. 148On-prem is the default. Federation is opt-in.
  3. 149DICOM and FHIR connectors ship with the on-prem bundle.
  4. 150PACS integration is documented, not magic.
  5. 151We have one config file per pilot site, not per institution policy.
  6. 152If your IT team finds it weird, we redesign it.
  7. 153Outbound mTLS only. Inbound ports stay closed.
  8. 154Air-gapped pilots run the same code as networked ones.
  9. 155There is no licence server. There never will be.
Modules
9
  1. 156AURORA-GLIO: extent of resection, decision support, longitudinal.
  2. 157AURORA-SPINA: prenatal vs postnatal repair timing, ventricular trajectory.
  3. 158AURORA-HYDRO: ETV vs shunt, paediatric trajectories, air-gapped.
  4. 159AURORA-CRANIO: photo triage on mobile, FST-stratified equity audit.
  5. 160AURORA-DWM: rare disease, federation-first, longitudinal.
  6. 161AURORA-ENCEPH: seizure-onset zone localisation, multi-modal.
  7. 162AURORA-ARACH: progression modelling for the unwatched watchful-waiting cohort.
  8. 163AURORA-TC: tuberous-sclerosis lesion catalogue, MRI + genomic.
  9. 164Eight modules. Each with a sponsor. Each with an audit. Each with a council seat.
Education
6
  1. 165Residency decision packs are part of every module.
  2. 166BSc-level open-science packs ship alongside the PhD computational packs.
  3. 167Patient-and-family explainers are co-authored, never auto-generated.
  4. 168Every training video shows the audit log, on purpose.
  5. 169Trainees see the override field before they see the recommendation field.
  6. 170Curriculum tracks are versioned. So is the substrate behind them.
Refusals
8
  1. 171We will not silently retrain on patient overrides.
  2. 172We will not ship a confidence number without the loss surface that produced it.
  3. 173We will not ship a benchmark without its replication notebook.
  4. 174We will not pretend a federated dataset is a public one.
  5. 175We will not call calibration 'human-in-the-loop' to sell to non-clinical buyers.
  6. 176We will not partner with a vendor whose audit log is a black box.
  7. 177We will not relax the equity gate for a launch deadline.
  8. 178We will not centralise paediatric data, even if it's faster. Especially because it's faster.
Engineering
8
  1. 179Python is the default surface for scientists. The substrate ships Rust at the core.
  2. 180Containers are pinned. The build is reproducible. The release is signed.
  3. 181Tests cover the equity gate, not just the inference path.
  4. 182Continuous benchmarking is a release-gate, not a leaderboard.
  5. 183Static checks for consent metadata at compile time, not at runtime.
  6. 184Hot paths are profiled per module. Cold paths are documented.
  7. 185We write benchmarks for what we want to be true of the system in two years.
  8. 186Documentation lives in the repo. It is reviewed like code.
The argument
11
  1. 187Open neurosurgery is an infrastructure problem before it is a research problem.
  2. 188The substrate is the floor, not the ceiling. Modules sit on top of it.
  3. 189Closed clinical AI compounded the problem. The response is structural.
  4. 190Hospitals are not customers. They are members.
  5. 191Patients are not users. They are governors.
  6. 192Clinicians are not labellers. They are co-authors.
  7. 193Researchers are not extractors. They are stewards.
  8. 194The brain deserves open infrastructure.
  9. 195Every brain, end to end. From molecular origin to lifelong outcome.
  10. 196If we cannot reach the top-line without hurting a subgroup, the top-line is wrong.
  11. 197We do not negotiate the substrate. We do not delay equity. We do not bury the audit.
Changelogv0.6.0