MAX4 and MARA: The Ladder Starts at Off

Contents12 sections

What MAX4 is

MAX4 is MAX moved out of the browser and into his own Windows app. From 15 October 2026 all new MAX work goes into the desktop build, and on 17 October the owner named it MAX4 everywhere it appears: the window, the tray and the installer. MAX3, the web version, is frozen as the source he's ported from. MAX4 runs standalone. He never looks for the old backend on port 8000, and one PC holds one MAX.

When it's finished, the installer will move an existing MAX in: export him, import him, verify the copy, then remove the old one. That move is deferred while the app is under construction. Until then MAX3 keeps running untouched beside the new build, and MAX4 grows his own backend in his own install folder.

He's also where MARA (Medical Agentic Resident Assistant) gets proved. "MAX: The AI Resident, and the Road to MARA" set out what she inherits from MAX's core. What it left open was what MAX4 has to show before she's built, and how that showing is kept honest. Terms are explained where they first appear, and the glossary at the end collects them.

Today MAX4 is a preview with nothing behind it. Thirty-nine screens were designed and approved in a Matrix theme, and a Tauri 2 window (Tauri is a small Rust framework for desktop apps) renders them with a tray icon and an installer. Every number on them is sample data. So is every reply. Porting MAX into the app hasn't started, and the first phase, the shell, is scheduled from 20 October 2026; after that, each phase starts only when the one before it is done, so the later dates are a working sequence rather than a commitment.

Why the trials come first

MARA is built after MAX, and the order is the point. She'll deal with real patient lives. A recommendation built on her core has to be defensible before anyone leans on it, and the project's requirements file writes that bar down as ten things MAX must show in a working system first.

Table 1. The ten things MAX must prove before MARA is built; the first two columns follow the project's requirements file.

That file is careful about what the list is for. It's the proof that the discipline holds, which is all it is: it gives MARA no licence to act on a patient, and MAX makes no claim to clearance by the FDA.

This month the proving ground also got smaller, and sharper with it. On 15 October the owner postponed home power and home devices indefinitely and took them out of the design, so the trials no longer cover cameras around the house or the solar system that keeps the PC alive. His own webcam on the PC stays. It opens on demand to tell who's in front of it, closes after, and never watches continuously.

What's left to prove is what a clinic would actually rely on: a resident that hears, grades what it knows, acts only through a gate, and keeps each person's data apart.

How MAX4 is built

Five processes run on one PC, and the jobs are split so that the part that reasons isn't the part that enforces.

• Rust shell: the Tauri window, the tray, microphone capture through WASAPI (Windows' native audio interface), the webcam and the audit gate.
• WebView2: the screens, drawn by a small Preact runtime straight from the approved design files. WebView2 is the browser engine Windows 11 already ships.
• Python helper: grading, the ingestion workers, calls to the local model and writes to the stores. The shell starts it inside a Job Object, Windows' way of capping what a process may use, and restarts it once if it dies; a second death is reported rather than looped.
• Ollama: the local models, on 127.0.0.1:11434.
• Qdrant: a vector store on 127.0.0.1:6333 for similarity search. It finds things that look alike and decides nothing; the graph, in DuckDB, is where truth lives.

Nothing listens off the machine. Screens and helper talk over a named pipe restricted by an access list, carrying length-prefixed JSON with a version handshake and a token per session, so no network port exists for anything else to reach.

Voice moved into the shell too. Voice activity detection (Silero VAD) and the wake word (openwakeword) run in Rust and arm before Python starts, which means MAX hears his name while the helper is still cold. Speech-to-text is whisper.cpp streaming in Rust. His voice is Kokoro, with Piper as the fallback, and all of it is local.

For MARA, the split that matters most is the gate. Python grades a claim and proposes what to do with it. Rust checks the trust ladder and writes the audit entry, and decision D5 binds the two into one transaction, so a write that fails takes its audit row back with it. How one transaction spans two processes took a second decision: Rust writes the entry when the pipe acknowledges the change, and the helper commits after that. Two of the phase notes still list it as open.

Every action MAX applies on his own records who, what, why and how to undo it in a hash-chained log, then waits 30 seconds for someone to override it, and in that window the change can be held, vetoed or released. A bug in the reasoning layer would have to get through a second process to widen what MAX may do. That second process doesn't run his reasoning.

Every claim gets a rung

Before MAX uses a claim, it gets a grade, and the grade decides what he may do with it. These grades are called rungs, after the epistemic ladder MAX3 already carries.

Table 2. The five rungs a claim can sit on, and what each one lets MAX say and do.

A second source agreeing moves a BELIEF up to FACT, and a contradiction moves it back down. Each source is graded on its accuracy, corroboration, coverage and recency, and a citation inherits its source's grade. Another AI model's opinion is capped at 0.5 confidence. A peer model can raise a question and never settles one, and it never overwrites what MAX learned from a source.

WRITTEN_TEXT is the rung a clinic needs most and notices least. A statute, a guideline or a drug label can each be quoted exactly, and the quote is checkable; what the text means for one patient is a reading. MAX keeps the two apart. A reading never passes for its source.

The ladder starts at off

A rung says how far MAX trusts a claim. Whether he may act on a skill is a separate question, and the trust ladder answers it. Each skill is an edge in the graph with its own record, and every skill begins at off, where MAX does nothing with it.

A skill moves to probation once it's been right on 9 cases in 10 that it wasn't tuned on, over at least 8 such cases. That figure is held-out accuracy. On probation, and on monitored above it, which a skill reaches by holding with no miss in its window, MAX may use it for a reversible action, audited, with the 30-second override. Below probation he doesn't act on it.

Each skill's window holds its last 20 outcomes, each a hit or a miss. Two things demote it one rung. A drop of 0.05 from the best score it has reached fires at once. So does a mean under 0.8, but only across a full window of 20. A demoted skill stays demoted until it strings together 20 straight hits, and then it returns to off, the floor it started from. In the design file's words: "Off is not a reward. It is the absence of trust."

Decay runs on evidence rather than on time. A skill nobody uses for 30 days freezes where it stands, losing nothing, while a missed one loses ground at once — which is the property a clinic wants from anything acting beside it.

Competency is tracked beside trust, on its own scale of five stages:

1. Heard: MAX was told about the skill or read it, and a citation exists.
2. Tried: he did it once, and the outcome was recorded.
3. Held: he did it again, correctly.
4. Trusted: it held on unseen cases, at the same 0.9 over 8.
5. Autonomous: it's Trusted and the trust ladder is at probation or higher.

A miss drops competency one stage, never to zero, and every drop is audited. An OPINION is never a skill. Neither is the reading of a WRITTEN_TEXT, since only the quote can be checked.

The predictor, off until proven

Of everything planned, the last thing built is the one most likely to look impressive and be wrong. Phase 8 adds a forward predictor: given the people, facts and open gaps in a turn, MAX scores the candidate edges in his graph and picks a move. A strong, recent edge scores well, and so does a thin or contradicted node worth checking, a source that has been right before, or a worker inside its budget.

Each prediction is a record, written before he acts. It names the edge, the worker, what he expects to find or to happen, and how confident he is. Then he acts. He either calls a source worker or applies a reversible action, and proves the prediction against what came back.

A second source agreeing — or an action that succeeded and wasn't overridden — counts as held. A contradiction counts as missed, and so does an action that was overridden or failed; a contradiction also opens a gap instead of overwriting anything. When the budget is spent and nothing comes back, the outcome is partial and nothing changes. A hit raises the edge's learned weight. A miss with no action decays it toward its prior, and a miss after he acted adds an inverse edge, which unlearns without deleting the history. Each step goes to the audit log with its rollback recipe.

Its bounds are tight on purpose. It starts at off. It makes one prediction per turn, never acts on a HYPOTHESIS (on one of those it can only go and look), and can't promote any claim to FACT by itself, because promotion still takes a second source agreeing with the first.

Its accuracy is computed from rows of held-out samples and stored as a fact in the graph, with those rows as its citations. In the design's words, "it is not a number the model asserts." For MARA that's the difference between learning from outcomes and claiming to. Every prediction she makes would be a row written before the act and checkable against what happened after it, so a reviewer reading her record a year later sees what she expected, what she did and whether she was right, in that order.

The trial order

Eight phases make up the build, with packaging alongside from the first and a capabilities phase after the last. Each has a short "done when" list and its own tests.

Table 3. The eight build phases, what closes each one, and what each shows MARA's reviewers.

Read in order, the phases carry their own argument. Nothing else has a window until the shell exists. Voice comes before data because he should hear before he's moved. Grading comes before the personas because both of them need the grades to talk to him. Scout is MAX's own code reviewer, and Muther is the owner's separate resident who looks after the PC and approves any cloud budget. Last comes the predictor. It stays off until everything under it is real.

Packaging runs beside the phases from the first: an install that works on a clean PC, downloads that resume and are checksummed, and signed updates with a preview and a rollback. Phase 10, after the predictor, adds the answer pipeline and an exam with a report card, which gates the release. That release gate is still a proposal — drafted on 12 October, before the home work was cut — and it would measure MAX by exams on a transcript rather than by demos. Its numbers haven't been confirmed.

Where patient data may sit

MAX4 holds no patient records. A person in his graph is a local user, never a patient; a claim stays a HYPOTHESIS until it's proven; and voice and face are stored as encrypted templates, never as the raw recording. He builds the method, and MARA applies it.

MARA will hold patient data, and the owner settled how on 17 October. Her graph takes de-identified data by default, and identifiable data where the law allows it.

Under HIPAA, the US health privacy law, data that has been de-identified stops being protected health information (PHI). Its Privacy Rule offers two routes there in 45 CFR 164.514(b). Safe Harbor removes 18 kinds of identifier — from names and street addresses to every element of a date except the year — and requires that the provider has no actual knowledge that the rest could still identify someone. Expert Determination has a qualified expert apply statistical methods and document that the risk of re-identification is very small. HHS, which enforces the rule, notes that the risk is very small and still "not zero", which is why MARA's cohorts keep a minimum size.

Identifiable data is allowed for narrower purposes. A provider may use PHI for treatment, payment and health care operations (45 CFR 164.506). Operations include quality assessment and improvement, "including outcomes evaluation and development of clinical guidelines", provided gaining generalizable knowledge isn't the primary purpose (164.501).

That proviso draws MARA's line. Learning from one provider's outcomes to improve care there can use identifiable data. Learning meant to produce general findings is research, and research needs the patient's authorization, a waiver from an institutional review board (IRB) or privacy board, or data that's de-identified or reduced to a limited data set under a data use agreement.

Table 4. Where each kind of record may sit, from MAX4's household graph to MARA's learning cohorts.

Whoever runs MARA for a provider, whether a vendor or an operator, would be a business associate, bound by a business associate agreement and by the minimum-necessary standard. That standard limits most uses and disclosures to the least data the task needs, though disclosures to a provider for treatment are among its exceptions. Her store hasn't been chosen yet. All of this is the plan's reading of the rule, and counsel signs off before any real record enters it.

Where MARA sits beside other clinical AI

Most clinical AI being sold now writes into the record. Ambient documentation tools listen to a visit and draft the note into the electronic health record (EHR) for the clinician to sign; Microsoft announced Dragon Copilot on 3 March 2025. In June 2025 Abridge announced an early pilot with Epic design partners that surfaces the medications mentioned in a visit inside Epic, so the clinician can place the orders. More gets written into the chart, faster.

MARA goes the other way. She reads the chart through the standards it already speaks — FHIR (Fast Healthcare Interoperability Resources), authorised by SMART on FHIR — and she cites and recommends. A draft of hers stays inert until a person signs it, and the signature is the person's. She gives up some speed for a record a reviewer can follow.

Her rules moved this year. On 6 January 2026 the FDA issued revised guidance on clinical decision support (CDS) software, replacing the 2022 version. Its four statutory criteria stand, and MARA is designed around the fourth: the clinician must be able to review the basis for a recommendation independently rather than rely on it. Three of the changes matter to her.

• One answer can be enough: the FDA will use enforcement discretion for software that gives a single recommendation when only one is clinically appropriate. In 2022 a single output had read as a sign of device software.
• Time-critical moved: software meant for time-critical decisions is now weighed under the fourth criterion. Triage is where MARA works fastest, so a triage screen is where she's most likely to cross into device territory.
• Still for clinicians only: the guidance covers tools aimed at healthcare professionals, says nothing about AI, and still excludes software that analyses a medical image or signal itself. MARA's screens for patients and payers have to answer for themselves.

What the documents still disagree on

Six things in the record don't line up yet. Each has to be settled before the phase that depends on it.

A design overview drafted before this piece said in its summary that MARA never writes into a clinical record, then allowed writes "through a reversible, audited pathway" two sections later. Both can't stand. Her rule now is the stricter one: she writes nothing into the record herself, and a draft is inert until a person signs it.

That overview also kept the patient records MARA reads out of her core graph, while the earlier article gave her a patient graph. The owner's answer settles it in the earlier article's favour.

The MARA white paper says her learning uses de-identified data only. The owner's decision keeps that as the default and widens it to identifiable data inside a provider where the law allows, so the white paper needs the same change before it's read as current.

Predictor stages are drawn twice. The trust ladder file puts the 0.9-over-8 bar at the move from off into probation, and probation already allows a reversible action. The neurosymbolic design note, whose four stages the predictor's own schema also uses, calls probation "running, not trusted", lets it predict and look and nothing more, and puts the same bar one rung higher, at monitored. A predictor built from the trust ladder file would act a rung before the design note allows, so until the two agree, phase 8 should be built to the stricter.

The same design note says the predictor writes its own weight changes and audit from Python, with "Rust is not involved". Decision D5 makes Rust the only writer of the audit. D5 is the later and more general rule, and the note needs bringing into line with it.

Two architecture files still list faster-whisper and Piper as the speech stack. The decision record chose whisper.cpp and Kokoro, and it wins.

None of this changes the order. The shell goes first, on 20 October, and every skill MAX4 learns after it starts where trust starts on this project, at off.

Sources

The repository files are in the MAX3 repository, newellnarco/MAX3, read at commit c0c6af8 (17 October 2026). The desktop app lives in its desktopapp/ folder and MARA's compliance notes in mara/.

• MAX4's owner rules, the naming rule and the current state are in desktopapp/README.md and desktopapp/HANDOFF.md.
• The phases and schedule are in desktopapp/PROJECT.md, desktopapp/docs/architecture/BUILD_ORDER.md and desktopapp/docs/project/.
• The stack, the process model and the decisions D1 to D23 are in desktopapp/docs/architecture/README.md, PROCESS_MODEL.md and desktopapp/docs/rewrite/DECISIONS.md.
• The rungs, the trust ladder, competency and the predictor are in GRADING.md, TRUST_LADDER.md, COMPETENCY.md, NEUROSYMBOLIC.md and PREDICTOR_SCHEMA.md, all under desktopapp/docs/architecture/.
• The ten requirements are in mara/REQUIREMENTS_FROM_MAX.md; the clinical seam is in desktopapp/docs/architecture/CLINICAL_FOUNDATION.md and desktopapp/docs/identity/PROOF.md.
• The proposed release gate is in desktopapp/docs/reference/md/MAX4_MAX5_EVOLUTION_PLAN.md.
• HHS, Guidance regarding methods for de-identification of PHI, for Safe Harbor and Expert Determination.
  • hhs.gov · de identification
• Bricker Graydon, the definition of health care operations in 45 CFR 164.501.
  • bricker.com · hipaa privacy regulations definitions health care operations 164 501
• Covington, on the FDA's revised CDS guidance (January 2026), and Cooley, incremental updates to the CDS guidance (20 January 2026).
  • cov.com · 5 key takeaways from fdas revised clinical decision support cds…
  • cooley.com · 2026 01 20 automation bias and clinical practice fda makes…
• Abridge, inside for inpatient and an initial rollout of outpatient orders (18 June 2025).
  • abridge.com · abridge inside for inpatient and outpatient orders
• Diagnostic and Interventional Cardiology, Microsoft debuts Dragon Copilot (3 March 2025).
  • dicardiology.com · microsoft debuts new ai assistant clinical workflow

Glossary