Here is the failure mode that should scare anyone who ships clinical decision support: a drug-interaction checker that, when it doesn't know, quietly returns nothing. No alert. No flag. Silence. And silence, to a clinician moving fast, reads as "no interaction — you're clear."
That's not a safety system. That's a system that fabricates safety.
The commercial interaction databases are curated pair lists. When a drug pair isn't in the list, the answer is an absence — and an absence is indistinguishable from a cleared pair. The open-world problem (that not knowing is different from knowing it's safe) is exactly the problem these tools paper over. Worse, they're black boxes: a clinician can't interrogate why the alert fired, so they override it. Alert fatigue is the number-one reason CDS alerts get dismissed, and opacity is why.
We built the opposite, and we gave the property a name: never-launder.
What never-launder means
An approximate, uncertain, or unknown input is never allowed to launder into a confident output. Concretely:
- Unknown drug → abstain, out loud. Not "no interaction." The system says "I don't have grounded facts about this" — a loud abstention, not a silent clear.
- Every asserted interaction carries its proof. If the system can't produce a derivation back to a source, it doesn't emit the claim.
- Absence is never safety. No edge in the graph is an open-world "no," not a denial that the interaction exists.
This isn't a mitigation we bolt on after the model speaks. It's structural: a language model can propose, but a symbolic engine has to prove, and a Proven/Unproven gate decides what ships. Unproven never reaches the clinician as a confident answer.
The evidence (this is the part I care about)
Our brand is honesty, so I'm not going to tell you it works — I'm going to tell you the number and where it lives.
Across every scale we've measured — the proof-carrying reasoner, the standing regression gate, the emit path, the hygiene censuses — the count of fabricated proofs is zero. false_proofs = 0. false_assert = 0. Unknown drugs abstain; contested pairs the system can't ground emit nothing rather than guess. When we run the reasoner on a genuinely ambiguous case — two enzyme inhibitors with no shared substrate — it abstains instead of over-proving a hub that isn't there.
Every one of those numbers regenerates from cargo test. Nothing is asserted in a slide; it's asserted in a test that either passes or fails in front of you.
The honest part
We do not out-cover the commercial incumbents, and we don't claim to. Our asserted graph is a growing corner of the interaction surface, not a 1.6-million-pair catalog. What we offer instead is a database where the safety model is correct: it would rather tell you "I don't know" than tell you "you're clear" when it isn't sure.
If you've ever had to trust an alert you couldn't audit, you already understand why that trade is the right one.
Coverage is labeled growing, never parity. Public naming and launch timing are decisions we haven't made yet. Every number here traces to an on-disk evaluation (research/shared/eval-data/) that regenerates from cargo test.