HORUS Intelligence Platform (Master)

AI platform master plan: the HORUS product with 7 live map lenses, the intelligence-kit substrate.

11 min read diagramsUpdated 2026-05-30docs/architecture/horus-intelligence-ai-platform-master.md

Status: The Horus product — 7 live map lenses — is built and shipping on origin/main. The AI platform described in this doc (Parts A & B) is design / NOT built. Marks what exists today (deterministic lenses), what is shippable now (statistical), and what is a future-data promise (learned), plus the autonomous continuous-learning service that matures the latter over time.

Read first: ai-training-corpus.md (the data foundation), llm-platform.md (services/llm Ollama+RAG), the Horus source on origin/main at web/packages/intelligence-kit/src/.

0. TL;DR

Horus is the multi-lens situational-awareness map shell (@ever-medos/intelligence-kit): one facility geography, many analytical “lenses” over it. As of origin/main it ships seven live lenses — 3D Atlas (facility footprints, the shared map), Surveillance (SEIR disease + เวชภัณฑ์ supply readiness), Disease (real ICD-10/SNOMED cases by registered address + progression), Capacity (bed occupancy), Queue (OPD load), FP&A (revenue/margin + catchment) and Security (RUDS threat map). Today their “intelligence” is mechanistic + rule-based: a deterministic SEIR compartmental simulation plus keyword/ICD string matching. There is zero learned AI in them yet — the Disease lens’s “progression” panel is the natural first home for it.

This doc lays out two things:

Part A — Disease Pattern Recognition (3 tiers): how Horus graduates from deterministic → statistical → learned, ordered by data maturity so each tier is honest about what it needs.
Part B — The Autonomous Continuous-Learning Service: a new microservice (the MLOps control plane) that watches newly ingested data and, once there is enough, retrains → evaluates → gates → promotes models on a loop — so Horus (and the other AI surfaces) keep improving without a human kicking off every training run.

One honesty rule threaded through both: the loop may train and evaluate itself autonomously; it may not promote a model that influences a clinical or surveillance decision without passing guardrails. Autonomous training: yes. Autonomous promotion to a decision surface: gated. This mirrors the house posture everywhere else (RUDS “AI cannot block”, kardex “AI cannot hide alerts”, navigation abstain-first, revenue-platform recommender-first + evidence-based promotion + kill switch).

Part A — Disease Pattern Recognition, by data maturity

The detection itself is statistics / ML; the Ollama LLM classifies and narrates on top. Do not conflate “Ollama” with “outbreak detector.”

Tier	Capability	Technique	Data needed	LLM or stats/ML
0 — now	Aberration detection	CUSUM / EWMA / Farrington-style excess vs. rolling baseline	Day-one accumulating counts (no training)	stats
0 — now	Syndromic extraction	Pull syndrome vector (fever+rash+retro-orbital pain) from free-text before an ICD code exists	none (prompt-only)	LLM
0 — now	Dx classifier	Replace keyword/ICD matching in `disease-keywords.ts` with semantic classification	none (prompt-only)	LLM
1 — months	Spatiotemporal clustering	SaTScan-style scan statistics → auto-discover emerging geographic clusters (not the pre-defined `seir-nodes.ts`)	a few months of geolocated encounters	stats/ML
1 — months	Seasonal baselines	Learn per-disease/per-province seasonality so excess is judged correctly	~1–2 yrs for full seasonality, degrades gracefully	stats/ML
2 — corpus	Hybrid forecasting	Mechanistic SEIR = prior; ML corrects it from observed trajectories (`lab_results_ts` hypertable + `observations`)	trained corpus + real volume	ML (+ mechanistic anchor)
2 — corpus	Co-occurrence / comorbidity mining	Association-rule / n-gram mining over encounter sequences (same template as navigation-next-best-action.md)	trained corpus	ML
2 — corpus	Novel-pattern detection	Flag clusters matching no known disease profile	trained corpus + governance preconditions	ML

Tier 0 is the defensible “we can ship pattern recognition soon” story — it needs no training data, works on the counts the surveillance hook (useSeirSurveillance.ts) already produces, and fails open to today’s keyword matcher.

Novel-pattern detection (Tier 2) is the genuinely exciting one and the most governed — it is exactly where the kardex doc deliberately moved the “novel-pattern proposer” out into a governed analytics workstream over re-identification + cohort risk. Do not ship it casually.

LLM ↔ stats/ML ↔ vision — division of labor

Job	Owner
Classify free-text dx → disease profile (+ confidence)	`services/llm` (Ollama)
Extract syndrome vector from notes	`services/llm` (Ollama)
Narrate the dashboard (“why did this move”)	`services/llm` (Ollama)
NL query → map filter (“dengue rising AND platelets critical”)	`services/llm` runner read-tools (no gate)
Aberration / clustering / forecasting (the detection)	stats/ML worker
Imaging-derived signals (if wired)	`services/vision` (YOLO)
Deciding to act on any of it	human — recommender-only output

Part B — The Autonomous Continuous-Learning Service

B.1 What it is

A Continuous Training (CT) / MLOps loop delivered as an AI service in the microservices architecture. Proposed name: services/intelligence-trainer (pairs with the existing services/llm and services/vision).

Honest split of responsibility:

Control plane = the microservice (NestJS/Moleculer, consistent with the rest of the mesh): data-readiness monitor, trigger, model registry, evaluation harness, promotion gate, drift monitor, kill switch, audit. This is request/response + event-driven and lives happily as a Moleculer service.
Compute plane = a dispatched worker (Python / GPU / the Ollama fine-tune API): the actual training run. Heavy + async — the service dispatches and tracks it, it does not run training inside the request thread.

So “an AI that continuously loops and trains itself” = the control-plane service orchestrating the compute-plane worker on a loop. That is real and standard; the nuance is the promotion gate, below.

B.2 The loop

                 ┌──────────────────────────────────────────────────────────┐
                 │                                                          ▼
   ┌─────────────────────┐   enough?    ┌──────────────┐   trained   ┌──────────────┐
   │ DATA-READINESS       │──── yes ────▶│ TRAIN        │────────────▶│ EVALUATE     │
   │ MONITOR              │              │ (worker:     │             │ vs. champion │
   │ • new Gold examples  │              │  Python/GPU/ │             │ + frozen     │
   │   since last train   │◀── no ───┐   │  Ollama FT)  │             │ golden eval  │
   │ • drift detected?    │          │   └──────────────┘             └──────┬───────┘
   │ • quality + consent  │          │                                       │
   │   gates pass?        │     (wait / cron tick)                    beats champion
   └─────────▲───────────┘          │                              on guardrail metrics?
             │                      │                                  │        │
             │                      │                              no  │        │ yes
   ingested data (medallion)        │                          discard │        ▼
   Bronze → Silver → Gold           │                          + log    │   ┌──────────────┐
   (ai-training-corpus.md)          └──────────────────────────────────┘   │ PROMOTE GATE │
                                                                            │ shadow →     │
   ┌──────────────┐   serve    ┌──────────────┐   champion    ┌────────────┤ canary →     │
   │ DRIFT        │◀───────────│ SERVE        │◀──────────────│ promote     │ (auto if     │
   │ MONITOR      │  (telemetry)│ services/llm │   registry    │             │  low-risk;   │
   │ → re-trigger │            │ or edge fn   │  ml_model_     │             │  human if    │
   └──────────────┘            │ or surveil-  │  versions      │             │  clinical)   │
                               │ lance hook   │  (immutable)   │             └──────────────┘
                               └──────────────┘                │  KILL SWITCH → rollback to
                                                                │  previous champion (instant)

B.3 Trigger — “when new ingested data is enough”

The readiness gate is not just volume. A retrain fires when, per model / per use-case:

Volume: new consent-eligible Gold-layer labeled examples since last successful train ≥ threshold.
Coverage / balance: minimum class coverage met (don’t retrain a dengue model on 99% COVID rows).
Drift OR cadence: input-distribution drift / concept drift detected, or the scheduled safety-net cadence elapsed (registered in cron-jobs-registry.md, so no schedule is invisible).
Quality: data-quality checks pass (don’t train on garbage / a broken ingest).

Event-driven (threshold crossed) plus a scheduled floor. Both routes go through the same gate.

B.4 Promotion gate — the safety boundary

Stage	What happens	Who approves
Shadow	New model runs in parallel, predictions logged only, never shown	automatic
Canary	Shown behind a per-tenant flag to a small slice	automatic, guardrail-bounded
Promote	Becomes champion in `ml_model_versions`	auto for low-risk recommenders within guardrails; human sign-off (named clinical owner) for anything clinical / surveillance-decision-impacting
Rollback	Kill switch → instant revert to previous champion	automatic on guardrail breach

Guardrail metrics gate every promotion: must beat the incumbent on a frozen golden eval set (not just the latest data), must not regress on safety metrics (false-negative rate for surveillance, abstention discipline for recommenders), must clear minimum confidence.

B.5 Data foundation

Reuses the medallion already designed in ai-training-corpus.md — the service is a consumer of it, it does not invent a new pipe:

Bronze: operational hospital_events + ui_interaction_events.
Silver: ml_session_trajectories — de-identified (drop direct IDs, HMAC-pseudonymize, generalize quasi-IDs, k-anon suppression).
Gold: ml_training_examples + immutable ml_dataset_versions manifest; held-out eval split.
Model registry (new): ml_model_versions — mirrors ml_dataset_versions (immutable, versioned, every champion traceable to the exact dataset + eval it won on).

Invariants (hard rules)

Autonomous training, gated promotion. The loop retrains + evaluates itself; promotion to a clinical / surveillance decision surface requires passing guardrails + (for clinical) human sign-off.
Recommender-only output. No model in this platform acts — it surfaces a recommendation a human accepts. AI cannot gate, block, hide, demote, or auto-execute. (House posture: RUDS, kardex, navigation, revenue-platform.)
LLM classifies/narrates; stats/ML detects. The Ollama model never is the outbreak detector.
Mechanistic anchors stay. Learned forecasting augments the SEIR prior — it does not delete it. Keeps a sane floor if a model degrades.
No feedback-loop self-poisoning. Never retrain on the model’s own influenced outputs without fresh ground-truth labels. Guard against model collapse by always scoring against a frozen golden eval set and requiring real-world outcome labels where available.
PHI-safe, consent-gated, in-region. Train only on the de-identified Silver/Gold layer; ml_export_consent default FALSE; structured-only payloads to the LLM (dx text is PHI — keep it server-side, in-region, no raw identifiers in prompts); per-inference audit; named owner per tenant.
Every schedule registered. All retrain cadences live in the cron_jobs registry — no invisible cron.schedule(...).
Kill switch + instant rollback. Any champion can be reverted to the prior immutable version without a deploy.
Full provenance. Every served prediction traces to model version → dataset version → eval result.

Phased rollout

Phase	Ships	Depends on	Demo-ready?
P0	Tier-0 LLM dx classifier + syndromic extraction (`services/llm` use-case), fail-open to keyword matcher	nothing	✅
P1	Tier-0 statistical aberration detection (CUSUM/EWMA) on surveillance counts + outbreak situation-brief (LLM narration)	P0	✅
P2	Medallion build-out (Bronze→Silver→Gold) per ai-training-corpus.md + `ml_model_versions` registry	ai-training-corpus	—
P3	`services/intelligence-trainer` control plane: readiness monitor + trigger + eval harness + shadow stage	P2	—
P4	Promotion gate (canary → promote), drift monitor, kill switch; auto-promote for low-risk recommenders only	P3	—
P5	Tier-1 spatiotemporal clustering + seasonal baselines served through the loop	P4 + months of data	—
P6	Tier-2 hybrid forecasting + co-occurrence mining	P5 + corpus volume	—
P7	Tier-2 novel-pattern detection — only after governance preconditions met	P6 + compliance sign-off	—

Cold-start is handled: P0–P1 ship value on day one with no training data; the loop (P3+) lights up the higher tiers as the corpus fills. That is the credible future-data promise — not vaporware, a maturity curve with a working floor.

Honest gaps — what must be true before this is real

Volume + history. Today’s encounters are real but thin and demo-weighted. Tier 1–2 and the loop need sustained, multi-region accumulation.
Labels. Pattern recognition is only as good as ground-truth outcomes; syndromic/learned tiers need a labeling path (confirmed dx, lab confirmation, outcome).
Compliance preconditions. Consent (ml_export_consent), in-region storage, BAA/DPA, named clinical owner per tenant, per-inference audit — required before P7 and before any clinical promotion.
Compute plane. Training compute (GPU / Python / Ollama fine-tune) is a worker the service dispatches; that runner is not yet stood up.
Drift labels for concept drift. Detecting input drift is cheap; detecting concept drift needs outcome feedback, which depends on the labeling path above.

Cross-references

Doc	Why
ai-training-corpus.md	The Bronze→Silver→Gold data foundation this consumes
llm-platform.md	`services/llm` Ollama+RAG — serves LLM artifacts
cron-jobs-registry.md	Where every retrain cadence is registered
navigation-next-best-action.md	n-gram pattern-mining template (empirical-Bayes, abstain-first)
rogue-user-detection-system.md	Behavioral pattern/anomaly detection + “AI cannot block” posture
ai-recommendation-engine-validation.md	Champion/challenger validation precedent
`web/packages/intelligence-kit/src/` (origin/main)	Horus source — SEIR engine, surveillance + supply hooks, FP&A lens