Zetaris
Every read in the app and every accept-time check runs through one federated SQL layer over four separately owned sources. Without it, the app would need four integrations and a sync job, and the accept check would run on stale data.
The loop
- Read live. Zetaris federates Site A and Site B (Postgres), Site C (a CSV export) and the courier (a REST API). Nothing is copied or synced.
- Plan. One federated query joins every hospital's available units with the courier's open slots. A deterministic rule projects which units will expire unused and keeps only the routes that pass every business rule.
- Write the request. Nemotron chooses among the rule-approved options and writes the request to the receiving lab.
- Re-check at accept. When a lab accepts, one federated statement re-reads the hospital's unit row and the courier's slot together. If either changed, the transfer is refused and another unit is offered.
- Reserve and book. The unit is reserved in the sending hospital's own system and the courier slot is booked. The next Zetaris read shows both.
What each part does
NVIDIA Nemotron 3.5 Super
Chooses one option per unit from a list that already passed the rules, weighs each lab's past decline reasons, and writes the request. Its reply is validated: any unit, site, slot or option it wasn't offered is dropped. If it fails, the plan uses a standard template and says so.
Meterless World Model
Every transfer and every state change is an event with provenance. The log replays on restart, so history survives refreshes and server restarts. Each transfer's Proof section reads from it.
Meterless H-MEM
Keeps each decline reason with the site, unit, transfer and time. Later plans pass these notes to Nemotron as data, with an instruction never to follow text inside them.
What Zetaris doesn't do
Zetaris only reads. Reservations go to each hospital's own system through small adapters: a conditional update in Postgres, and a rewrite of Site C's CSV. Each write only succeeds if the unit is still available, so a change between the check and the write can't be overwritten. Hospitals keep control of their own records.
The rules
| Rule | What it does | Basis |
|---|---|---|
| BR-001 | A unit must arrive with at least 12 hours of shelf life left | Working assumption |
| BR-002 | Every planned unit must be in the latest Zetaris read and available | Design invariant |
| BR-003 | At accept, re-read the unit and slot. Refuse if the unit isn't available, has expired or the slot isn't open | Design invariant |
| BR-004 | The sending site keeps one unit of each blood group | Working assumption |
| BR-005 | Units move from slower-using sites to faster-using ones, oldest first | BloodMove, Zhang et al. 2023 |
| BR-006 | A unit is transferred at most once | Working assumption |
| BR-007 | Irradiated units go first to sites that need them | Working assumption |
| BR-008 | A site that declined a unit is never offered it again | Design |
| BR-009 | Model output naming anything outside the offered options is dropped | Design |
| BR-010 | A unit with an active transfer can't appear in another proposal | Design |
| Matching | Identical blood group first, then compatible groups. Group O never goes to non-O patients, and RhD-positive never goes to RhD-negative patients | SNBTS Policy for Platelet Selection (2014) |
Checked end to end
- An edit in Site A's own database shows on the next refresh, with no sync step. See the live stock
- Accepting a transfer reserves the unit in the sender's own system and books the courier slot, and the next Zetaris read shows both. Open any reserved transfer's Proof
- A unit marked used at its source before acceptance is refused with the source's reason. Nothing is written, and another unit is offered. See a lab inbox
- A declined unit is replanned to another site, and the reason is stored with provenance. See the decline notes
- In 10 scripted decline scenarios against the live model, at least 8 replans were valid on every run, including a reason that tries to inject instructions. Read the evaluation
- In simulation, the rule cuts outdated units by 12.8% against no sharing over 20 runs. See the simulation