# TRIPOD Desk

> Paste the methods and results of a clinical prediction model, plus the table of what it scored on
> each split, and find out whether it is reportable. A free in-browser read does the arithmetic and
> the coverage; four metered lanes do the judgement.

Live at https://tripod-desk.skillsafe.ai/ · API tutorial at https://tripod-desk.skillsafe.ai/api.html

## What it is for

The people who need this are the ones who have just finished a prediction model and have to write it
up: for a journal that asks for TRIPOD+AI, for a regulator, for a clinical governance committee, or
for themselves before anyone else sees it. The failure mode is not usually a bad model. It is a good
model described in a way that a reviewer can take apart — an undefined index time, a predictor that
is only knowable after the outcome, an accuracy figure on a 7% outcome, a sensitivity with no
threshold beside it, a SHAP ranking written up as a set of causes.

This app is a methods and reporting aid for the model's own authors. It is not a clinical device, not
a regulatory submission, and not a substitute for a statistician, an ethics committee or a
prospective evaluation. It never interprets a real patient's risk.

## What the browser does for free, before any sign-in

All of this runs on the page with no account and no credits. Nothing you paste leaves the browser
until you deliberately run a metered lane.

- **TRIPOD+AI coverage across 47 items**, in **three states** rather than two: `stated`,
  `declared_none` (the report says there is none) and `missing` (never mentioned). The distinction
  matters in both directions — "missing data: none" is a complete answer and is counted as reported,
  while "external validation: none" is a confirmed gap and counts against the report more heavily
  than silence would.
- **Events per candidate predictor**, from the event count and either the declared predictor count or
  the predictor list, with the two cross-checked against each other. Below about 10 the coefficients
  are unstable; between 10 and 20 a shrinkage factor belongs in the report. If neither number can be
  read, the ratio is reported as unassessable — never as zero.
- **Outcome prevalence**, both as stated and as derived from events over sample size, with a flag when
  the two disagree.
- **A leakage screen** over the predictor list: 35 variables that are normally only knowable at or
  after the end of the episode, graded blocking where they encode the outcome itself (a mortality
  flag, a time to death, a cause of death) and high where they are merely recorded late (a discharge
  disposition, a length of stay, a goals-of-care order). If the report gives no predictor list, the
  screen reports that it did not run — not that it passed.
- **Procedural leakage detection**: an imputation model, a scaler, a selection screen, a resampler or
  a tuning loop described in the same sentence as the whole dataset; and any choice — a threshold, a
  hyperparameter, a predictor set — described as having been made on the held-out set.
- **Bayes-rule consistency**: the reported positive and negative predictive values against the
  sensitivity, specificity and prevalence on the same row of the metrics table.
- **A Brier check against the base rate**: a constant prediction of the prevalence itself scores
  p(1−p), so a model that loses to that has no clinical utility at any threshold.
- **Interval checks**: a confidence interval that excludes its own point estimate, limits printed the
  wrong way round, and an interval too narrow for the sample it is quoted on.
- **Calibration checks** on the slope, the calibration-in-the-large and the observed-to-expected
  ratio, with the direction of the miscalibration named — a slope below 1 means the predictions are
  too extreme, which is the signature of overfitting and is not fixed by a better AUC.
- **The accuracy paradox, quantified**: what predicting no event for everyone would have scored on
  this cohort, against the accuracy the report claims.
- **An optimism check**: apparent performance against the best validated split.
- **An attribution screen**: a tree-path-dependent explainer named beside a model that is not a tree
  ensemble, and every sentence that turns a feature attribution into a cause.
- **Text against table**: a report that says calibration was not assessed while a calibration figure
  is supplied, or says no subgroup analysis was done while the table carries subgroup rows.

Every one of those findings goes into the run input with a stable uid, and every lane must account
for every uid in its `reconciliation` array. That is what keeps the model answerable to the
arithmetic rather than to an impression.

## The four lanes

One work object — the same pasted report and metrics table — and four things a reviewer does with it,
in the order a reviewer does them. Each lane's result panel offers the others as a one-click handoff
that carries the previous lane's conclusion forward.

| lane | the question it answers |
| --- | --- |
| `cohort` | Is the prediction problem well posed at all? The data source and design, the index time, the outcome and its ascertainment, leakage predictor by predictor, and the events-per-predictor arithmetic. |
| `validate` | Does the evidence support the performance claim? The ladder from apparent to internal to external, discrimination with its interval, calibration slope and intercept, the classification measures against their threshold, and whether net benefit was ever computed. |
| `attrib` | Do the explanations claim more than the model can support? The explainer against the model family, the reference distribution the attributions are measured against, every claim classified as associational, causal or actionable, and the overreaching sentences rewritten. |
| `report` | What has to be written before this can be submitted? The TRIPOD+AI checklist item by item with what to add and where, an abstract drafted only from numbers the report actually gives, the limitations paragraph, and an intended-use statement. |

## The output contract

Every lane returns one JSON object with the same envelope: `lane`, `title`, `verdict`, `headline`,
`summary`, `body`, `findings`, `reconciliation`, `context_notes`, `unassessable`. Only `body` differs
per lane.

`verdict` is one of `ready`, `ready_with_notes`, `revise`, `not_supported` — and the free read uses
the same four words, so a disagreement between the browser and the model is a real disagreement and
is shown as one rather than being smoothed away.

`not_supported` is reserved for one specific situation: a claim the report makes that the report's own
numbers do not support. A leaky predictor behind a performance figure, a conclusion the metrics
contradict, an external-validation claim with no external numbers.

Findings carry a `line` that is a real 1-based line number in the pasted report **or `null`**. There
is no "line 0"; a location the model does not know is left empty rather than fabricated.

## Honest limits

- A check that cannot be made from what was pasted appears in `unassessable` with the reason. That
  list is a feature: a leakage screen that did not run is not a leakage screen that passed.
- The free read is a text reader. It understands labelled lines and prose, and it will miss a fact
  buried in a figure caption or a supplementary table. Where it misses something the lane can say so.
- No number in a drafted abstract is ever invented: a missing figure is a `[placeholder]` in square
  brackets.
- The app reviews a report about a model. It does not run the model, does not see the data, and
  cannot tell you the model is safe to deploy — that is what a prospective evaluation and a
  governance process are for, and the reporting lane says so in the intended-use statement rather
  than substituting for it.

## Source skills — credited, not republished

This app is a derived work. Five SkillSafe skills define what it knows:

- `@k-dense-ai/pyhealth` — the clinical prediction task model: cohort, index time, outcome,
  prediction horizon, EHR and claims sources, the standard task family, and medical code systems.
- `@k-dense-ai/scikit-survival` — time-to-event structure: right and administrative censoring, loss to
  follow-up, competing risks, the concordance index and its dependence on the censoring distribution.
- `@k-dense-ai/scikit-learn` — the validation machinery: what must be fitted inside a fold, split
  versus cross-validation versus bootstrap with optimism correction, nested tuning, class imbalance,
  and every way a preprocessing step leaks the held-out rows.
- `@k-dense-ai/statistical-analysis` — test selection, assumption checking, interval estimation,
  sample-size justification, and structured reporting.
- `@k-dense-ai/shap` — feature attribution: tree-path-dependent versus sampling explainers, the
  decisive role of the background distribution, behaviour under correlated predictors, and the gap
  between attribution and causation.

## Pages

- `/` — the app
- `/api.html` — the API tutorial: the `{data}`/`{error}` envelope, the error table, and every step
  across cURL, Python, JavaScript, Go, Java, Ruby, PHP and C#
- `/tokens.html` — read, reveal, copy and forget this browser's token without a developer console
- `/llms.txt` — this file

## Model and cost

`gpt-terra` (currently `gpt-5.6-terra`), publisher markup 1000 bps. Runs cost the signed-in user
credits; the reservation shown before a run is a hold against the full output cap and the actual
charge is usually far lower. Every lane ships a replayable saved example that costs nothing and needs
no account, so the whole render path is visible to a guest with a zero balance.