Everything a program needs, reading one record.
Six systems that exist elsewhere as separate purchases. Here they read and write the same learner record, which is what makes the daily loop coherent — and what makes the accreditation output fall out of it.
Adaptive QBank
A daily queue built from your institution’s blueprint, not a generic bank — and one that can always tell a learner why an item appeared.
Explainable item selection
Four weighted signals — weakness, blueprint debt, staleness and desirable difficulty — decide the next item, and the “why this item” popover names the one that dominated. Adaptivity that cannot explain itself is indistinguishable from a shuffle.
Timed, tutor and exam modes
Block builder with saved presets, per-item timing, flagging and annotations. A ten-minute post-call session is a first-class unit of work, not a degraded one.
Offline practice with conflict-free sync
A 40-item block survives hospital Wi-Fi dropping twice. Every answer carries a client-generated id, so a retry after a lost connection cannot be counted, carded or scored a second time.
Calibrated score prediction
A predicted exam score with a confidence interval and its top three drivers, refreshed after every block — and it refuses to give a point estimate until it has enough responses to mean one.
Post-item discussion, moderated
A thread that opens only once you have answered, closes while a secure assessment is running on that item, and is filtered deterministically rather than by a model reading learner text.
Learner-reported item errors
A “report an error” action that opens a ticket in the same faculty queue as psychometric flags. It never edits the live item — a correction goes through the versioned review workflow.
Spaced repetition
Anki’s retention, without Anki’s setup — and tuned against the exam date.
Cards from misses, automatically
Every missed item becomes a card the same night, traced back to the response that produced it, so “why am I seeing this?” always has an answer.
Exam-countdown scheduling
A modified SM-2 that compresses intervals against your exam date, caps them so nothing disappears for a year, and surfaces leeches rather than burying them.
Due-load negotiation
A backlog is never dumped on a learner. The daily plan takes what fits and carries the rest forward without penalty, because a wall of due cards is how people stop opening the app.
Clinical case simulation
A simulated patient who answers what you ask and volunteers nothing — the same as a real one.
Five-stage encounter
History, examination, workup, diagnosis and management, then a debrief. The stage lives on the server; the model plays a patient inside it and never holds the state.
Findings you have to elicit
Hidden findings unlock only on the terms that would elicit them, computed from your actual words before the model is called. Ask nothing and you learn nothing — which is what makes the transcript worth scoring.
Rubric-cited scoring
Around two thirds of marks are computed from the transcript by arithmetic. The rest are judged, and every judged mark cites the turns it rests on — a mark whose evidence does not exist is withheld.
Reasoning-gap classification
Anchoring, premature closure, missed red flags, over- and under-investigation — each with a definition the transcript either meets or does not, and each citing what in the record says so.
Authoring & psychometrics
Faculty draft with AI, a deterministic linter catches the flaws, and a named human signs before anything reaches a learner.
AI item drafting
An objective in, an NBME-style draft out: vignette, homogeneous options, keyed answer and a rationale per distractor. It lands in the editor badged AI-drafted, and the badge clears only at reviewer approval.
Deterministic flaw linter
Absolute terms, longest-option cueing, grammatical cues, negative stems, word echo between stem and key. Rules, not opinions — so a finding cites a rule id an author can argue with.
Versioned review workflow
Draft, in review, published, retired, with a changes-requested loop. Nobody approves their own item, and a published version is immutable — editing means a new version, because responses reference the one they were answered against.
Blueprint auto-tagging
Tag suggestions drawn from your own blueprint, matched exactly rather than fuzzily. A suggestion is never applied on its own — coverage reporting is computed from these tags, so a person chooses.
Nightly psychometrics
p-value, point-biserial discrimination against rest score, distractor analysis and median time, recomputed nightly. Flags open faculty review tasks; nothing is auto-retired.
Rationale drafting for legacy banks
Imported items that have a key but no teaching get drafted explanations — and if the model believes the key is wrong, it says so and withholds the rationale rather than defending it.
AI layer
One gateway, one ledger, one rule: AI drafts and flags; only named humans publish, rate and certify.
Gateway with budgets
Every model call goes through one door that enforces pseudonymisation, per-tenant budgets and routing, and writes a ledger entry on success, failure and refusal alike.
Inspectable AI history
An institution can read every run made in its tenant: the task, the model, the prompt version, the tokens and the cost. “What is the AI doing with our data” is a screen, not an assurance.
Eval harness and red-team bank
Prompt-injection, PII smuggling, patient-advice bait, rubric fishing and jailbreaks, most of them defended before a token is spent. A regression blocks the prompt change.
Study planner
A deterministic solver does the arithmetic — due cards, mastery gaps, exam proximity, your stated minutes — and the model only orders it and writes one honest sentence per task. It cannot add, resize or remove work.
Ask your own library
Natural-language questions over your institution’s published content, answered with citations that are validated against what was actually retrieved. “Your library does not cover this” is a first-class answer.
Cohorts & curriculum
What an institution buys that a per-seat question bank cannot sell.
Cohort analytics and heatmaps
Blueprint-by-cohort heatmaps that show where a class is thin before the exam does, with drill-down and an assign-remediation action. Small groups are suppressed server-side.
Curriculum mapping
Map objectives to the content that teaches them and the assessments that test them. Coverage is computed from the map, never asserted in a spreadsheet.
At-risk detection
A daily scan against each learner’s own baseline, not a class curve. A flag opens a human intervention task and never messages the learner automatically.
Milestones & CME
Accreditation output as a first-class artifact, assembled from work learners already did.
ACGME milestone evidence
Sub-competency evidence accumulates continuously from practice, cases and assessments, so the CCC packet is assembled rather than transcribed the week before.
CCC packets
A review workflow, AI-drafted narratives that cite specific evidence rows, and a signed export with a checksum in the audit event. The program director edits and signs; the model never rates.
CME credit model
The data model ships in V1 — activities, completion rules, an append-only credit ledger and disclosure state — so the engine can follow without a migration.
Platform & trust
The layer procurement asks about before it asks about features.
Row-level tenant isolation
Every tenant table carries a policy, forced so that even the table owner is subject to it. A failed cross-tenant isolation test blocks the deploy — not a warning, the pipeline stops.
Cloud or your own tenant
One codebase, two modes. Sovereign deployment runs inside the institution’s own Azure tenant, so learner records, question-bank IP and case content never leave it.
SSO, MFA and SCIM
Azure AD SAML and OIDC, TOTP second factor with single-use recovery codes, and SCIM provisioning alongside nightly SIS roster sync.
Immutable audit trail
Append-only by trigger, not by convention. Every grade-affecting write, rating and packet export records before and after with an actor, and exports as an audit binder.