Helix — Personal Health Intelligence (PHI)

Your entire body — every record, signal, and result — assembled into one living dossier. Private. Continual. Visual. And built so it can't make things up.

_{↑ the screenshots are clickable — they open the live demo (real Rust pipeline in WebAssembly)}

▶ Live demo · the UI runs the real Rust pipeline compiled to WebAssembly

Helix is a mobile-first "functional-medicine specialist in your pocket." It ingests everything a person can know about their own body — EMR records, pharmacy history, phone and wearable telemetry, genome, lab panels, sleep, recovery, nutrition, subjective logs, and always-on ambient sensing — normalizes it into a single longitudinal personal health knowledge graph, and puts a conversational, multi-agent analyst on top of it.

The differentiator is not "another health chatbot." Every answer is grounded in the user's own data, traceable to its source, graded for evidence quality, and bounded by an explicit refuse-when-unknown policy.

Built on the ruvnet stack:

• RuVector — self-learning vector + GraphRAG memory DB (the substrate of context).
• Ruflo — multi-agent meta-harness with PII-gating, learning loops, and audit trails (the substrate of reasoning).
• Cognitum Seed — always-on, contactless mmWave edge sensing (the continuous signal).
• MetaHarness / Darwin Mode — the whole stack is minted as a branded harness that self-optimizes toward faithfulness while the underlying model stays frozen.

Repository layout

helix/
├── README.md                          ← this file
└── docs/
    ├── Helix-PHI-ADR-Product-Spec.md  ← the full product spec (v1.0.0, with diagrams)
    └── adr/
        ├── README.md                  ← ADR index
        └── ADR-001 … ADR-019          ← 19 detailed Architecture Decision Records

Start here

1. The product spec — vision, capability wish list, reference architecture, anti-hallucination design, roadmap, and the differentiation vs. ChatGPT Health.
2. The ADR index — the 19 load-bearing architecture decisions, each researched and evidence-graded.

The three decisions that make or break a product in this space: anti-hallucination / data-grounding (ADR-005–008), privacy & data ownership (ADR-001, 011, 013), and clinical safety (ADR-009, 010).

What's built

This is no longer just a spec — the testable core is implemented in Rust and validated.

• 31 crates · 232 tests · 43 ADRs · clippy/fmt clean · cargo audit and cargo deny clean.
• Anti-hallucination core: provenance grounding (helix-provenance), deterministic numerics (helix-numeric), evidence tiering (helix-evidence), red-flag escalation (helix-escalation), verifier (helix-verifier), the grounded-answer pipeline (helix-pipeline), and a real AEAD vault (helix-vault).
• On-device AI on the local GPU (Rust, never Python): the LLM analyst narrates grounded facts via ruvLLM with a number-guard (helix-llm), real MiniLM text embeddings (helix-embed), and a layout-only visual encoder (helix-vision) — each GPU-validated.
• ruvnet-ecosystem integrations: WiFi-CSI sensing (helix-sensing/RuView), genome + pharmacogenomics (helix-genome/rvDNA), OCR ingestion (helix-ocr), semantic retrieval (helix-retrieval), visual RAG (helix-visual/rupixel), privacy-preserving cohort (helix-cohort), FHIR connectors (helix-connect), and federation transport (helix-fed).
• Local clinical-text privacy: OpenMed 1.9 ONNX candidate detection is wrapped by the fail-closed helix-openmed Rust/WASM gate with artifact pinning, complete-document coverage, deterministic identifier rules, Unicode-safe offsets, and HMAC-only receipts. See the integration guide.
• Verified NeuroSleep qEEG research ingestion (helix-neurosleep): accepts only signed derived nightly features from rUv Neural — never raw EEG — and verifies the signature itself against a separately enrolled key, so a bundle carrying its own trust root is rejected. Consent, study/subject binding, replay protection, and atomic sealing under participant-opaque identifiers all sit on that path. Interpretation abstains below the compatible-night floor rather than showing a provisional trend, and nights recorded with incompatible methods are never pooled. The research visualisation is a physically separate WASM artifact (helix-neurosleep-wasm) whose entire dependency tree is serde + serde_json — it links no attestation or key-custody code at all. All four research flags default to off. See ADR-051.
• Web console + WASM mobile app running the real pipeline in-browser — live demo.

Every integration keeps the discipline: the LLM narrates (never reasons), embeddings/visual are recall (not grounding), genomics/cohort data is privacy-gated, and nothing diagnoses.

That last point is enforced, not just stated. A fail-closed static gate fails the build if diagnostic or therapeutic language appears in the NeuroSleep crates or their UI, and a second gate rejects any dependency from that rail onto the score, Focus Area, escalation, LLM, retrieval, or actuation crates. The NeuroSleep features are associated with a preclinical APP/PS1 mouse study and are not a validated human clinical marker: nothing estimates Alzheimer's disease, amyloid burden, or microglial activity. Numeric parity with the reference implementation is still unproven, which is why the upstream contract is pinned at an exact alpha (ruv-neural-core =0.2.0-alpha.1) and the first deployment is an offline research build.

Status

v0.1.0 — implemented core, Proposed ADRs. The Rust core is built, tested, and GUI/GPU-validated. The ADRs are grounded by multi-source research but have not been ratified by regulatory counsel or a clinical advisory board. Genuinely out of scope for this workspace (and flagged in docs/COVERAGE.md): live partner-API auth, the federation aggregator network, physical sensing hardware, the 3D WebGL twin, and clinical/regulatory sign-off.

---

Prepared by ISO Vision LLC. This repository provides architectural and product guidance, not legal, regulatory, or medical advice. Engage regulatory counsel and clinical governance before building any diagnostic or treatment-recommending features.