The case steward. A donor case is 24 to 72 hours of continuous authored work — notes, entries, orders, offers, labels — passed between rotating, exhausted coordinators, into systems that only check the work after it's committed. STEWARD is a resident mind on your own machine that rides one case from referral to recovery: it holds everything, checks every field and sentence against the source record as it is typed, and says one word — wait — before the error propagates. Coordinators sign out. It never does.
FREE FOREVER. NO ACCOUNT, NO CLOUD, NO TELEMETRY, NO PHONE-HOME. SOURCE YOU COMPILE YOURSELF, WEIGHTS YOU DOWNLOAD YOURSELF, ON SILICON YOU OWN — AND NOTHING IT SEES EVER LEAVES THE BUILDING.
Somewhere past hour thirty of a case, a coordinator sits down to transcribe a forty-page hospital chart into the allocation record — field by field, lab by lab, by hand. Blood type. Serologies. This morning's creatinine. Every transplant center in the match run will read those fields as truth, and the system they're typed into checks them against nothing. It validates formats at commit time. It has no idea what the source document says.
The field being filled: creatinine — 1.4.
The source chart, page 33: 1.4 was yesterday's 06:00 draw. This morning's landed at 04:15: 2.1, and trending.
Formats are valid. Every box goes green. Every accepting surgeon downstream now plans a kidney around a number that stopped being true a day ago.
STEWARD, the instant the field completes: wait — 1.4 is the 08/11 06:00 draw. The record's latest is 2.1 at 04:15 today, source page 33. This field is stale.
This is the transcription class of error — the one with a name every transplant professional knows, the one policy answers with two-person verification: a second set of human eyes, required for a handful of the deadliest fields, when a second human is free, at 2 a.m., mid-surge. The check is right. The supply of eyes is the problem.
Policy already says the deadliest fields deserve a second set of eyes. STEWARD is a second set of eyes that never blinks — for every field, every sentence, the whole case.
STEWARD is not a chatbot and takes no prompts — most of the time you will forget it exists. It is a resident: an open-weight AI living on your own Windows machine that attaches to a case the hour the referral lands and stays until the last organ is recovered and the file closes. Two lanes stream into one continuous attention state: the source record as it accretes — hospital chart, labs, call notes, logistics — and the coordinator's authored output as it is typed — entries, notes, orders, responses. At every completed thought it silently asks one question: does what was just written contradict what the case establishes? Almost always: hold, and you hear nothing. When it's wait, a thin banner cites the exact source line it stands on. One key dismisses it.
The entire case, continuously — every source page, every lab, every phone note, every entry anyone authored, from the referral call to the OR. Nothing is re-read or re-fetched; the case accretes into a mind that is simply never behind.
Declared against actual: every field and sentence the coordinator authors, against what the source record establishes, at the boundary of every completed thought — while the cursor is still in the field, not after commit.
Coordinators rotate every twelve hours; the case doesn't. STEWARD is the one participant whose memory rides the whole arc — what was promised, what's pending, what was said on a call eighteen hours and two handoffs ago.
A case passes through distinct kinds of authored work, and each is a place a stale or contradicted fact can enter the record. STEWARD takes them as seats — the same mind, the same single question, pointed at each moment of authorship. In order of catch-class value:
The allocation-record keyboard: the coordinator transcribing the hospital chart into the fields every match-run center will trust. Wrong blood type, stale serology, yesterday's lab entered as today's. Pure declared-vs-actual on documents — no clinical judgment anywhere in the loop, and the verification horizon is seconds: source page versus entered value, resolvable by a glance at the citation.
Active orders and titrations read against the management goals and the case's own history: wait — that vasopressor order contradicts the echo resulted at 06:40. The order that was right at noon and wrong by the 18:00 labs.
The seat that catches silence: a provisional acceptance quietly aging out, the match sequence stalled, cold time accruing while the record sits idle. No event fires, so no alert exists — but nothing happening was the emergency, and a resident perceives elapsed time as world-state.
Packaging and labeling, read back against the case one final time before anything ships. Lowest frequency of error anywhere in the process — and the highest catastrophe when it happens. The last moment a wrong label is still just a piece of paper.
The case record assembling toward regulatory review: the missing attestation, the unsigned form, the gap in the timeline — flagged while the case is warm and the person who knows the answer is still in the building, not eighteen months later at the audit.
The reference build ships the entry desk; the other four are the identical mechanism pointed at more of the case, staged in as their adapters land. One mind takes all five seats — because it's one case, and the seats share everything the case has established.
Here is the asymmetry no staffing model fixes: the case runs three days; every human on it runs twelve hours. Each handoff compresses a shift's living context into a few minutes of sign-out, and whatever doesn't fit — the hospital contact who prefers the back line, the family's timing concern, the pharmacy callback still owed — falls off the case forever. The relief coordinator starts from the note, not from the case.
So at every handoff, STEWARD produces the one artifact only it can write: the relief brief — every open loop, every promised callback, every unresolved flag, every "they said they'd call back by four," cited to its source, handed to the incoming coordinator as a draft they glance over in ninety seconds. Not a replacement for the human sign-out — the floor under it.
And this is where the family closes its loop: VIGIL watches the sign-out being written and catches the stale sentence. STEWARD is the memory the sign-out is written from. Same moment, guarded from both sides.
Same doctrine as every AORTA tool, enforced by construction — these are not features deferred; the software has no code paths to these places:
And the boundary running the other way, as always: one keystroke overrules it. Every dismissal becomes a labeled example in your own ledger, teaching the disposition your OPO's sense of what deserves an interruption — on your machine, in a record you own.
Every judgment — every wait, every hold, every dismissal, timestamped, with the source line cited — lands on an append-only, hash-chained local log. Your QAPI team can replay an entire case after the fact and see what was caught, what was raised, and what a human decided, entry by entry.
Beneath the mind, a deterministic rule floor: a signed, human-readable policy file your compliance officer can open and edit without touching a model — the hard checks that always run, the fields that always verify, and the interruption budget as a written contract.
STEWARD installs watch-only: for its first cases it surfaces nothing and just writes the ledger. Your team reviews what it would have said, case by case, and turns the banner on when the record has earned it. Trust is a receipt, not a promise.
Default-silent, with an interruption budget measured in single digits per case-day. A supervisor that talks all night gets ignored by breakfast — so every hold is logged with its margin, and "it stayed quiet" is itself a decision on the record.
STEWARD rides the FUSOR-1 resident substrate — bench ratings measured, dated, receipted in the reference build's public runs ledger:
| Quantity | Rating | Receipt |
|---|---|---|
| Thought-boundary detection (fire the check exactly where a claim completes) | 0.97 vs 0.02 | ingest logits, free |
| Lag — completed field or clause → judgment rendered | ~327 ms | workday replay, 1× |
| Honest recall across a working context | ≥ 98,304 tok | planted multi-hop spans |
| Abort a forming conclusion when evidence lands | 13 µs | branch kill |
| Multiple seats, one attention state | 1.208× | worst-case co-decode |
| Memory fold, self-authored (a day of case held resident) | 14.8× | all planted facts survive |
SUBSTRATE RATINGS, REFERENCE BENCH: ONE RTX 4070 Ti SUPER (16 GB), 9B-CLASS OPEN WEIGHTS, WINDOWS. DATED RECEIPTS IN THE FUSOR-1 REFERENCE BUILD'S RUNS LEDGER. STEWARD HAS NO CLINICAL OR OPERATIONAL PERFORMANCE NUMBERS YET, AND THIS PAGE WILL NOT PRETEND IT DOES. EVERY DEMO IS PROOF-OF-MECHANISM ON SYNTHETIC CASES — THERE IS NO LIVE INSTALLATION TODAY, AND THIS PAGE WILL SAY SO UNTIL THERE IS. THE SHADOW-MODE LEDGER AT YOUR OWN OPO IS DESIGNED TO PRODUCE THE REAL NUMBERS, ON YOUR DATA, UNDER YOUR REVIEW.
FUSOR-1 is the open, MIT-licensed resident-kernel substrate — the loop, the bus, and the laws for minds that don't take turns. VIGIL watches the sign-out. ROUNDS watches the board — every case at one instant. STEWARD watches the case — one case, through all of time it lives. Same mind, three seats; committed, signed records can peer between them on one internal bus, so the mind on the board and the mind on the case each know what the other has established. Peering ships as a seam; STEWARD runs whole without it.
STEWARD ships the same way as the rest of the AORTA toolkit: open source under MIT, as source you build yourself — because in a domain where the software reads PHI, "trust us" is not an installer. Clone it, read every line, compile it on the machine it will run on, bring your own open weights. No license server, no account, no vendor in the loop, ever.
The synthetic case ships with it: one complete fabricated donor case — referral to recovery, forty source pages, an entry screen styled like the real thing — with errors planted in every seat: a stale lab at the entry desk, a contradicted order, an offer aging in silence, a wrong label at the cooler. Run the whole arc on your own GPU and watch every catch happen before STEWARD ever touches a real workflow.
STATUS: REV 0 · COMING SOON. THE FUSOR-1 SUBSTRATE IS PUBLIC AND MEASURED; THE ENTRY-DESK SEAT IS BEING EXTRACTED FROM THE REFERENCE BUILD AS THE BEACHHEAD, WITH THE SYNTHETIC CASE AS ITS FIRST DEMO. EVERY CLAIM ON THIS PAGE STAYS PINNED TO WHAT THE TAPE CAN BACK.
Every donor case is three days of truth scattered across charts, calls, and keyboards, carried by people who must eventually go home. STEWARD is the smallest possible thing that closes that gap: one mind on your own machine that rides the whole case, checks every claim against its source, and never signs out.
Built by OPO people. Free because the mission is the point. Honest because the ledger is the product.