🤓 Latest Submissions
Amend: Regulatory Redlines In, Verified PRs Out
Problem Regulations change and engineering inherits the work. The FTC Safeguards Rule (16 CFR 314), which covers thousands of non-bank lenders, brokers and dealers, grew from 809 words in 2021 to 5,375 today. One new sentence, §314.4(c)(5), requires multi-factor authentication "for any individual accessing any information system". Since 13 May 2024, §314.4(j)(1) requires notice to the FTC within 30 days of an event affecting 500 or more consumers. Nobody can say which lines of code just became bugs, and generic scanners do not know the rule. Solution Amend turns a regulatory redline into a verified pull request inside IBM Bob IDE, with IBM Granite on watsonx.ai as a checked assistant. 1. Screen: before any agent reads the code, Granite flags comments aimed at AI agents (prompt injection). 2. Redline: diffs dated eCFR versions clause by clause, setting aside mere renumbering. 3. Obligations: Granite drafts them from the verbatim clause text; every quote must be a verbatim span (paraphrases are rejected) and a human approver signs off. 4. Impact: a code graph follows routes, dependencies, mounted sub-apps and SQL aliases, so it sees an SSN renamed "tin" in a view and exported. 5. Fix: a failing obligation test first, then the change. 6. Audit: a canary plants a synthetic SSN and bank account, runs the app and sweeps logs, buckets and the database. 7. Prove: each obligation test must fail on the base commit and pass on the fix; existing tests are locked. 8. Evidence: a graded certificate (Verified, Partially verified, Unverified, Human review required) that never says "compliant". 9. Guard: a zero-LLM gate in CI annotates the offending line with its clause, so a later regression fails the pull request. Users and how they interact Engineers and compliance leads at regulated fintechs. A developer runs /amend in Bob, the compliance lead approves obligations and test rewrites, and the team reviews an ordinary pull request with evidence attached. What makes it different Amend treats the law as a diff and compliance as a test suite. Models propose; deterministic checks decide: verbatim quotes, fail-before and pass-after proofs, a canary that inspects stored data, and a certificate that admits partial results. Asked from memory what §314.4(c)(5) requires, Granite described an unrelated antitrust rule; given the clause text, it quoted it exactly. So Amend grounds it and never lets it approve. Results On Lendwise, a seeded fictional lender with 13 planted violations and 3 decoys, the guard and canary found 7 with 14 findings, each citing its clause, and flagged no decoys; Semgrep found none. Granite flagged 1 of 48 comments, the planted injection, in 3 of 3 runs, and drafted 15 obligations from the 2024 amendment with 15 verbatim quotes. The demo pull request fixes MFA, adds the 30-day FTC notice and removes plaintext SSNs from logs and exports: 6 of 6 obligation tests discriminate, canary hits drop from 8 to 4, and the certificate grades customer data as partially verified because the database still holds the SSN and account number in plaintext.
27 Sep 2026
CodeLoop: the voice recorder for cardiac arrests
During an in-hospital cardiac arrest the whole team works by voice. Hands are on the chest, the airway and the syringes while orders fly across the room. In filmed resuscitations only 26% of spoken orders were repeated back, and those were completed 3.6 times sooner. Someone has to stop caring for the patient to write, and no tool notices an order nobody confirmed. CodeLoop is the recorder that never looks away. A tablet on the crash cart streams the room to AssemblyAI Universal-3.5 Pro with speaker labels, Medical Mode, ACLS keyterms and Hindi and English code-switching. A deterministic grammar turns speech into events that quote the exact words they came from. Every order becomes a loop: ordered, read back, given. If nobody confirms, the card turns amber and CodeLoop says so. If a different dose is read back, it turns red and CodeLoop says "Check dose." It keeps the ACLS clock and answers "CodeLoop, last epi?" from its own record. Its voice runs on the AssemblyAI Voice Agent API: it waits for a gap and stops the instant a clinician talks over it. After the code, the Code Record scores quality against AHA targets, a second listen with async Universal-3.5 Pro re-checks every event, and a hands-free spoken debrief on the Voice Agent API quotes facts through tool calls and saves the team's lessons in their own words. Models help understand speech; deterministic code decides every state, timer and spoken number, and every entry is hash-chained. On held-out mock codes committed before measuring: precision 0.96, recall 0.88, 16 of 17 loop outcomes. Medical Mode and keyterms raised drug and dose accuracy from 78% to 96%. First market: simulation centres and mock-code debriefs. Over 290,000 adult in-hospital cardiac arrests happen each year in the US, and a 30-minute code costs about $2.66 of AssemblyAI. Try it: press "Start here" for the 80-second guided tour, or start a live code and read the six lines on screen.
30 Sep 2026
