Aegis Clinician: A Cockpit Where Every Safety Claim Is a Working Control

The original Aegis was a week of IA arguments — identity cockpit, results as a task queue, Draft→Review→Accept→Sign — validated only by an informal clinical review. A concept can claim anything; a working system has to survive its own claims. The 2026 rebuild kept the invariants and replaced every illustration with a control that enforces them.

Name and allergy chain persist at every scroll position, handing off into the header with zero vacuum frames. I rejected a sticky banner: it taxes every screen to protect one failure mode. The relay costs nothing until the moment identity would vanish — which is the only moment that matters.

The layout follows the examiner’s view — OD displayed left — and a “Both” state was deleted; a later Compare tool was refused on the same grounds. Whatever merging saves in clicks, it spends in laterality ambiguity, and wrong-eye errors are not a cost I was willing to price in.

Claim→Acknowledge gates feed a sign-blocking footer whose reasons deep-link to the exact unfinished item. I rejected warning-and-proceed: a warning is a liability transfer, not a safeguard. After signing, the record freezes and every frozen control explains itself; identity is re-verified at the pen.

The motion system runs on four duration tiers and three curves under one charter: no idle loops in a chart. Hotspots announce themselves with a one-time halo and then hold still; auto-rotate defaults off. I rejected showroom motion because a chart is not a showroom — attention is spent once, then the record sits still.

Why I rejected external models

A licensing investigation — an unlicensed viral repo, then a CC-BY model — ended with rebuilding the anatomy in pure code: anatomically zoned vessels with rectus insertion clusters and a perilimbal clear zone, a nasal feeder corridor into the pterygium wedge, hazel iris with collarette, glass cornea. Three hotspots each map to a charted finding with a record cross-reference; fake cross-section and layers tools were refused, because a surface model has no interior and the tool would render fiction with clinical confidence.

How I specified anatomy

Building it was its own experiment in directed AI work. I convened four specialist lenses — a color engineer, a graphic designer, a 3D modeling expert, and an ophthalmologist — and had them argue the eye into specification: exact sRGB ranges for a healthy sclera, vessel-coverage budgets with an anatomical map, corneal curvature in millimeters.

How the assertion loop failed and improved

Claude Code built to those numbers and then verified against them, screenshotting its own renders and asserting pixel ranges — sclera warmth, exactly one dominant highlight, wedge legibility at three camera angles — under a hard four-round cap. The loop caught what eyes miss and what pride hides: when a silent texture failure shipped a black eye behind a healthy-looking poster, the fix wasn’t a patch, it was doctrine — every build step now fails loudly or proves itself. When the render drifted from the style I wanted, I didn’t tune hex values; I set a new target and let the panel translate taste into assertions.

“Every build step now fails loudly or proves itself.”

sclera (lit)225–248 sRGB · R>G>B

vessel coverage6–14% · perilimbal clear zone = 0 ink

dominant glintexactly 1 · aspect ≥ 2

iris hue60–105 · collarette detectable

wedge legibilityΔR ≥ +18 vs adjacent sclera · 3 camera angles

verdict4-round cap · fail → escalate with evidence

The rebuild ran as a directed system, not a prompt-and-hope loop.

Research partner

ChatGPT worked outside the build as research and review partner: reference audits, structured critique, the master rebuild prompt.

Builder & verifier

Claude Code worked inside it as builder and verifier — driving the Figma plugin API with pixel-parity assertion loops (137 text nodes within ±3px, measured in-file) and building the demo through role-based agent teams that included a standing medical-UI reviewer, plus a visual QA protocol where the procedural eye asserts pixel ranges on its own renders.

Arbitration owner

Recurring expert panels — ophthalmology, clinical IA, motion, accessibility, color engineering, 3D, performance, compatibility — argued in the open, and I arbitrated every conflict with recorded rationale. When the 3D and motion seats wanted the eye to auto-rotate on load, the medical seat objected, and I ruled for the chart: rotation defaults off, with a one-time attention halo instead. Direction, taste, arbitration, and the clinical honesty rules stayed with me. The tools amplified judgment; they never supplied it.

ConflictThe 3D and motion seats wanted the eye to auto-rotate on load.

ObjectionThe medical seat objected.

RulingFor the chart: rotation defaults off, with a one-time attention halo instead.

“The tools amplified judgment; they never supplied it.”

26 tokens and 17 text styles in shadcn-style conventions as the design→code bridge, hardened over six system frames and two hand-tuned passes. measured, in-file One-blue doctrine — action blue is reserved for the commit action and the focus ring; even pressed toggles use ink. WCAG 2.2 depth: roving tabindex, focus-not-obscured, screen-reader parity on the 3D stage, 320px reflow.