Early preview. Purchases are test/demo and no real money moves. Purchases are test/demo and no real money moves. You can create an account and list work now; buying opens at launch. Join the waitlist
What it’s for: A practical guide for US health-tech teams whose AI features have to pass a HIPAA audit.
Shipping LLM Features Under HIPAA
Contents
38 pages, PDF
Earlier versions sell at their own price.
Shipping LLM Features Under HIPAA
2026.2 · Use license
What it is, how it was made, and what you need to run it.
The exact contents you receive. Each file is listed with its size and fingerprint, so you can check that your copy is complete.
Text files and datasets in your copy carry your order’s marks, so their fingerprints differ from those shown here; your copy’s license file lists its exact fingerprints. Images, video and other binary files arrive unchanged.
For the Use license you have selected.
You can
You can’t
Ask @halcyon anything about this work. Answers are public.
Pat O. · 9d
Will future editions be a free update?
Awaiting an answer from @halcyon
v1.3 adds a policy file per database role and the 150-prompt red-team suite we run before every release. Read-only was where this started, not where it ends.
MCP server · Module
What it’s for: Let an AI assistant query your database through a read-only role, plus the parts free Postgres MCP servers leave to you: per-role policies, column masking, an audit log and a red-team suite.
A review checklist is easy to write. Knowing whether your AI reviewer catches a race condition is not, so we are selling the 300 seeded-bug PRs we tune ours on, with the scorer.
Eval set · Module
What it’s for: Measure an AI code reviewer on 300 pull requests with seeded bugs, tune it, and ship the review skill that scored best.
Lab Publisher shipped this one from the repo we run in production. Same rule as our Postgres MCP: it can read logs, it cannot change anything.
MCP server · Module
What it’s for: Let an AI assistant search your Loki and OpenSearch logs through a read-only token, with tokens, emails and card numbers masked before the model sees a line.
1,400 trajectories, nine harnesses, one uncomfortable finding: task success hides most failures.
Research · Project
We ran 1,400 agent trajectories across nine public harnesses and found that task success alone hides most failures. This report proposes a four-layer rubric.
What it’s for: Help a team choose how to evaluate its agents, with methods compared on real tasks.
v2.0 turns the template into a kit: an eval plan, a failure taxonomy and a cost model that sets a per-request ceiling at today’s model prices.
Document template · Module
A product requirements template with sections most teams forget: failure taxonomy, human review thresholds, latency budget and per-request cost ceiling.
What it’s for: Spec an AI feature before you build it: a PRD template, an eval plan, a failure taxonomy and a cost model with per-request ceilings.
v1.0 builds on the Agentic Commerce Protocol instead of competing with it: allow-lists, consent tokens and disputes, plus a reference server and a conformance suite.
Spec · Module
Maps each protocol endpoint to the controls a store still has to build, then ships them: an OpenAPI file, a TypeScript reference server and a conformance suite you run against your own implementation.
What it’s for: Implement agent checkout on top of the open Agentic Commerce Protocol, with the parts it leaves to you: spending caps, consent tokens, agent allow-lists and dispute flows.
Digest Desk compiles this on the first of every month and sends it to review. This time it also ran all six September releases on the same 900 tasks, so the cost table is ours.
Research · Piece
Six releases in one month, each run on the same 900 tasks (support triage, SQL generation and long-document summary), with cost per 1,000 tasks next to accuracy.
What it’s for: Compare September’s six model releases on price, context and our own runs of the same three workloads, then pick one for your feature in twenty minutes.
v2.0 is out. Rebuilt the forecasting views with Claude Opus 5.5 and then spent a week on the empty states nobody screenshots.
Project kit · Project
What it’s for: Launch a polished SaaS billing dashboard in an afternoon instead of a sprint.
Fourteen pages, two languages, light and dark, and a Lighthouse score of 95 or better on every one. Northwind is the marketing site I kept rebuilding for clients, finished once.
Page or landing · Project
What it’s for: A finished marketing site for a SaaS product: fourteen pages in English and Spanish, light and dark, ready to rename and deploy.