Limitations

The browser holds the recognizer socket directly, so word timings and per-word certainties never pass through our server; the client posts them to an unauthenticated route. Anyone with DevTools can post arbitrary words, and the gate will accept a value carrying that provenance: it checks that a value traces to words the session reported, not that those words were spoken. The route enforces bounds instead of a secret: a validated session id and caps on words per turn, turns per session and concurrent sessions. Relaying audio through our own host would fix it, at the cost of an always-on process this design deliberately does without.

What the vendor witness adds

The gate-invariant check refuses a ConfirmedValue assertion in either TypeScript syntax outside the gate, any double assertion through unknown, and any type-checker suppression in product code. The secrets check reads the path app/api, not any directory merely named api, and fails when the key is absent from it. Each exploit is kept as a test, and every ratchet has a positive control, because a check that passes when its subject is missing manufactures confidence.

Ten known weaknesses of low severity are open.

“Lisinopril, no wait, losartan” refuses lisinopril as a value the caller took back (E_RETRACTED_VALUE, entering the validator branch). The markers are “no wait”, “sorry”, “I mean”, “actually”, “scratch that” and “not X, Y”, with the replacement within four words. A correction without a marker, one spread across two turns, or one using other words such as “rather” or “make that” is not detected; there the read-back is the mitigation.

The pair rule applies the full 2023 ISMP List of Confused Drug Names, 514 pairs parsed from the published PDF with the page and row of each kept. Our measured catches and the demo rest on a hand-curated table of 20 pairs, each checked by hand against its row; the rest of the list is applied, not separately evaluated. Matching strips salt forms, because the catalogue stores tramadol hydrochloride where the pair says tramadol. The rule knows only what the list publishes: lisinopril and bisoprolol are on neither tier and get the standing read-back only.

What the rule costs on correct names

We found no open English corpus of human speech reading drug names, so every entity error rate is measured against a desktop synthesiser through the live recognizer, and every figure derived from it inherits that boundary. Deliberately not measured:

• Accuracy on human speech: no open corpus exists that we found.
• NPI existence against the live registry: our numbers are synthetic and would only add noise.
• Threshold optima: see the next entry.
• Keyterms that include drug names: it biases the recognizer toward the strings the rules check.
• Market size in money: a figure we cannot source would break the only rule this project is about.

Each threshold was reasoned from the cost of an error in its field before any audio existed and was not tuned on any set, the held-out set included. Whether a slightly different threshold would do better is not measured.

We predicted that rarer drug names would be measurably harder to recognise, and wrote the rule down before the audio existed. On the sealed held-out set the rare and middle strata are identical and every interval overlaps. The negative result stays published; what replicated is the overall error rate the product rests on.

The held-out figures

The session endpoint returns time to first audio and tool timings, but not word-level timings, so the time from a word to the gate's decision can only be measured in the browser. It is not measured yet.

AssemblyAI documents no WebSocket close codes at all. We measured 1000 and 1008 ourselves, and 1006 once; 1008 is what the rate limiter actually sends, and we have never observed the 3009 its condition is supposed to produce. 3006 comes from another team's measurement, and 3007, 3008 and 3009 from vendor prose.

The counted close codes

Both sockets stream the caller's voice to AssemblyAI: the recognizer to its global endpoint and the voice agent to its US region, pinned because stored agents live in one region and the global host sent a US server and a European browser to different stores. No data-residency choice was made or evaluated; the EU endpoints are not used. What the vendor retains, and for how long, is governed by its own terms, which we have not summarised because a summary we had not verified would be an unsourced claim. No consent screen names the vendor before a session starts. Every demonstration and evaluation run in this project used synthetic speech.

If something is wrong right now, such as an allergic reaction, a medication error already taken, or any symptom that feels like an emergency, call 911, or 988 for a mental health crisis, immediately. This application does not call emergency services, does not triage symptoms, and routes nothing to a human faster than a phone would.

A technology demonstration on synthetic data: no real patients, no real prescriptions, no clinical use and no claim of regulatory approval or review. The project quotes ISMP, the FDA, the Joint Commission and 21 CFR and is not affiliated with, endorsed by or reviewed by any of them. Do not enter real patient data.

Read-back is cited to ICAO Annex 11, the Joint Commission's verbal-order goal and 21 CFR 1306.12(a), each by clause. We have not located a sourced, current penalty or sanction figure for any of them that we can check against a primary source, so none is published.

The exact citations