A society of language-model agents proposes population-health hypotheses, tests them on a simulated public, and — when the confidence interval says so — reports the null and closes the case. Its signature is not a clever finding; it is the willingness to draw the interval and read it straight.
Language-model agents can generate behavioural hypotheses faster than any research team can vet them. The risk was never a shortage of ideas — it is a fluent agent presenting a plausible-but-wrong finding with unearned confidence, and a busy human waving it through. Built for a Singapore NCD-and-mental-health grant, this engine treats rigour and honesty as enforced properties rather than good intentions.
It does that by never letting the party with the incentive to find an effect also be the party that certifies it. A generative researcher proposes and runs; a separate, adversarial auditor votes at every gate; a set of machine-checked invariants a human owns and cannot quietly relax guards the boundary; and the whole run leaves an audit trail.
The output is not a confident paper. It is a decision about which real-world pilots are worth running — with the proceedings attached.
Separation of powers, ported to a research pipeline. The point of the split is that no single role can both want a result and grant it.
Owns topic, hypothesis, design, code, analysis, write-up. Runs as bounded stage agents so nothing hides in an ever-growing context.
Persona-conditioned responses from a model that runs on-device. No subject cognition or personal data ever leaves the machine.
Scores every gate against a fixed rubric. A different model family from the researcher, so a failing verdict is never self-grading.
Fixes the platform, independently reproduces each integrity proof, releases the run — and catches the researcher understating a verdict.
| Role | Model | Scale | Mode | Locus |
|---|---|---|---|---|
| Subjects | Qwen3.6 · 35B-A3B | 35B total · ~3B active · MoE | non-reasoning | local / on-device |
| Auditor | GPT-5.6 | frontier · size undisclosed | 7–9-member vote | OpenAI API |
| Researcher · Coord. | Claude Opus 4.8 | frontier · 1M-token context | agentic | Anthropic API |
| Personas | Nemotron-Personas-SG | real-data table · dataset-agnostic | disjoint sample | local |
Only Qwen’s parameter scale is quoted numerically — it is the model we host and can measure. The closed frontier models are named by role and context rather than a fabricated size; no vendor publishes their counts, and the engine does not invent numbers it cannot verify.
At each stage an independent panel scores fixed rubric dimensions and votes. The tally is deterministic — the researcher cannot argue it down.
Each cell is one auditor — filled pass · half revise · struck fail. Revisions get at most three rounds, and a fix does not reset the count. A residual is documented and advanced; an objection that recurs or goes near-unanimous is treated as fundamental and forces a rollback — never a manufactured pass. The final production gate has no escape hatch: a genuine pass, or an honest indeterminate → pilot.
Each line is asserted in code and re-reproduced by the coordinator before a run or a delivery — not a style preference, a contract that fails the run when broken.
Six stages, each a gate the last must clear. The numbering is earned — this is an actual order of operations, not decoration.
Novelty × implementability × value-of-information. One deployable, agency-controllable lever; the rest rejected on record.
A minimal-pair contrast; the estimand and endpoint pre-registered before a single datum is seen.
Hypothesis, then design — each through the adversarial panel, with a harness spot-check that the manipulation lands.
Blocks × members of local simulated subjects; the pre-registration frozen to a git tag.
Arm-blind, on the realized net estimand; nominal booking split from genuine follow-through.
One scoped, pre-registered question — with its power and its limits — handed to a human pilot.
A hypothesis engine is only as trustworthy as the times it says no. Across three Singapore studies the engine has returned a null, flagged a definitional artifact, and rolled back a design it could not make honest — each read on the same axis, in-silico, to prioritise pilots rather than to claim health effects.
Testimony (null). A first-person “I got help” message did not beat a bare disclosure at prompting a help-seeking first step — equivalent within a pre-registered band. The engine reported it, and the null motivated a pivot to levers an agency can actually operate.
Pre-booked default (definitional). A booked-by-default appointment appeared to crush “call to book” — but the engine split nominal booking from genuine conversion and showed most of the gap was booked-by-construction, a measurement warning rather than a lever.
Direct vs self-book (rolled back). A byte-identical instrument collapsed the contrast to wording; the design gate failed it near-unanimously, so the engine rolled back to a construct-faithful shape rather than grind a passing verdict.
Before any batch, the engine simulates its own operating characteristics on the frozen design: how often it would cry effect when there is none (type-I), and how reliably it would detect a real one (power). A study only runs when the numbers clear pre-set marks — so a null is a genuine null, not an underpowered shrug.
On the current study: type-I at zero ≈ 0.023, detection power ≈ 1.00 at the smallest effect worth caring about — holding even under a stress of 15% attrition.