Article · for the AI-governance community · by Robert Domondon
We ran three-vote adversarial verification against our own research program. Twenty-four of twenty-five claims survived. The one that didn't was in our marketing — so we corrected the marketing. This article is about what a small, domain-specific AI harness can teach the governance conversation, starting with that habit.
The implementation examined here was a bounded personal-AI harness assembled around Hermes Agent, an independent open-source runtime from Nous Research. Under Directive v1.1, Nurse AI OS is now defined as the governed professional environment; Hermes is a provisional, replaceable substrate rather than the product or authority. The public Community experience remains D0/D1 only, no PHI, and human-reviewed. What remains useful in this historical evidence is the habit of treating claims as a governed surface.
The research program behind the architecture works like this: fan-out searches across five angles → 23 primary sources fetched → 114 falsifiable claims extracted, each with a direct quote → the top 25 claims ranked by importance and source quality → three independent adversarial verifiers per claim, each prompted to refute, with two refutations killing a claim and uncertainty defaulting toward refutation.
Results: 24 of 25 claims confirmed unanimously. One claim was refuted 0–3: the assertion that U.S. nursing has no AI-specific guidance — a "regulatory vacuum" our early framing leaned on. The verifiers were right: the American Nurses Association has a board-approved position statement on AI ethics (2022, revised 2025), NCSBN's regulatory journal has published clear positions, and the American Academy of Nursing has formal policy and active regulatory engagement. So the positioning changed, in the report and in public: Nurse AI OS does not fill a regulatory vacuum; it operationalizes existing professional guidance. The mechanical layer is the contribution — the guidance existed; the working system that turns it into daily practice did not.
Every claim in our literature carries one of three marks: verified (survived adversarial verification), source-reported (quoted from a primary source, not yet verified), or design judgment (labeled architectural reasoning). Readers can tell which is which on every page. We think this should be table stakes for anyone publishing AI-governance claims — including about their own products.
The confirmed claim set converges on something the governance community will recognize: the professional bodies have already written the requirements document. ANA: AI is adjunct to, never a replacement for, nursing judgment; nurses remain accountable even in technology failure; those who integrate AI carry an ongoing duty to verify validity and reliability. NCSBN: human clinical judgment stays the final arbiter; guard against algorithmic overreliance. AAN: test before deployment, fund post-market surveillance. ANA again, on leadership: nurse leaders must establish responsibility-and-accountability measures for AI use.
Each requirement maps to a component: human-approval tiers and review gates ("AI drafts, humans judge, nurses steward"); a deferred-integration tier that keeps unvetted capabilities gated; skill vetting as a 90-day re-review lifecycle rather than one-time approval; a leader module whose deliverable is a signed, unit-level AI accountability charter; and an anti-anchoring pattern that elicits the human's own assessment before showing any AI draft.
The design bet, stated plainly: standing instructions are necessary and insufficient. The forensic literature on the NEDA/Tessa chatbot failure (source-reported) found a strict refusal-first system prompt blocked only a fraction of adversarial prompts, while a fail-closed post-generation self-audit caught what the prompt missed. Accordingly, wherever the runtime allows it, the redlines here run on enforcement that isn't prose: agent-authored skill changes land in a staging queue for human approval; memory prohibitions are refused at intake rather than cleaned up afterward; and the installer verifies a pinned key fingerprint, a signed manifest, and per-file checksums before executing anything it downloaded — any byte change fails closed until a human re-signs.
And one honesty note, because precision is the point of this article: the yellow-tier self-audit footer — a machine-checkable verdict every risky skill must append, with instructions to withhold its own draft on failure — is model-followed rather than runtime-enforced in the current kit; no separate verifier withholds a response after generation. Its verdict line is auditable at the human approval gate it always travels with (a missing or failing verdict is treated as a discarded draft at that gate), and a delivery-gating verifier is the next hardening step on the roadmap. We would rather tell you that than let you assume otherwise.
One more, because agent runtimes are converging on self-modification: Hermes autonomously writes and improves its own skills and curates its own memory. We treat that as a supply-chain surface — the agent is a contributor to its own codebase, and it gets a reviewer like any other contributor.
Discipline cuts both ways, so: the entrepreneur module and the named healthcare-deployment comparables rest on source-reported evidence, not verified claims. The system makes no patient-outcome, safety-outcome, or compliance claims — its outcome measures are adoption and learning signals, self-reported. It is a personal, non-HIPAA-covered tool by design, and it says so prominently rather than implying otherwise. And the pedagogy patterns it encodes from the literature are marked feasibility-grade where that's all the evidence supports.
If you work in AI governance, the takeaway we'd offer is small and portable: run adversarial verification against your own claims, publish the refutations as corrections, and give every safety property a mechanical enforcement point. A nursing-shaped system arrived at those habits because nursing already had them — the checklist, the second signature, the incident report without blame. The professions that have been managing risk for a century are not the audience for the governance conversation. They're a source of it.