Asghar and Chung, writing recently in this journal, describe a near-future in which ‘cancer patient digital twins’ integrate molecular information, pharmacological response and imaging into in silico representations that dynamically adapt to new data1. The examples they give, tumour growth models, virtual clinical trials, multiscale simulation of whole-body physiology, share an implicit institutional topology. The data are held by hospitals, the models are built by academic centres or commercial partners, the inferences are returned to clinicians, and the patient experiences the twin only as the downstream recipient of a treatment recommendation. In this architecture the patient is, paradoxically, both the source and the beneficiary of the twin, yet never its custodian.
This omission is neither accidental nor recent. It reflects the deeper pathology of oncology as currently practised, in which the asymmetry of knowledge between patient and institution is treated as a feature of the medical encounter rather than a defect to be engineered away. A patient diagnosed with pancreatic ductal adenocarcinoma (PDAC) in 2026 does not typically receive a machine-readable copy of their whole-exome sequencing file, their RNA-Seq counts, their OpenCRAVAT variant annotation, their Signatera minimal residual disease (MRD) trajectory, or their Epic FHIR Observation bundle, even though all of these now exist about them, are trivial to export, and would not exist at all without their tissue, their plasma and their consent. The asymmetry is preserved not by any single bad actor but by a composition of data silos, proprietary report formats, non-interoperable electronic health records, and a tacit assumption that the patient is the wrong place to aggregate data. The result is that when two separate institutions generate findings about the same tumour (as occurred in the case described here, with Caris Life Sciences, AUGenomics, Invitae/LabCorp, Natera and UCSF Health all holding pieces of the disease), only the patient is topologically positioned to unify them, and only the patient is structurally forbidden from doing so.
This commentary argues, drawing on a working system implemented for a stage III PDAC patient, that the digital twin envisaged by Asghar and Chung will not achieve its predicted impact unless its ownership model is inverted. The most powerful consequence of this inversion is that patient-owned digital twins can materially improve survival odds. In PDAC, where a 90-day window following diagnosis or resection dominates prognosis, the ability to rapidly integrate mutation profiles, biomarkers and trial eligibility data can accelerate acceptance onto life-saving or life-prolonging therapies by weeks, a difference that is often measured in months of additional survival. The case below illustrates this mechanism in practice.
The theoretical architecture of the Patient-Owned Digital Twin is natively realized on production BioFS Protocol v3.18 and Sequentia L1 Blockchain (Chain ID 15132025). Storage routing is decoupled across 58+ protocol command verbs using ROSA (Read-Only Storage Architecture) sub-chunk streaming over QUIC transport via biofs-node (v0.4.7). On-chain access rules and patient-signed licensing terms are enforced by four core smart contracts:
0x6Fb51DB12AE422F8360a31a27B3E960f4DC0004b): Content-addressed storage manifests and sha256 payload digests.0x6474485F6fE3c19Ac0cD069D4cBc421656942DA9): Purpose-bound licensing and time-delimited research grants.0x2ff3FB85c71D6cD7F1217A08Ac9a2d68C02219cd): On-chain consent tracking and GDPR Art. 17 right to erasure enforcement.0xe95f101dcBe711Ba9252043943ba28f7D9aE8014): Automated USDC micropayment settlement (95% patient / 5% network treasury split).Theoretical framing. The pDT is best understood through the lens of human-centric artificial intelligence, whose design goal is not autonomous machine cognition but a system that keeps the human in the loop and in control. Gill’s trimodal account of human-centric AI is directly applicable: it extends the fast, intuitive reasoning of a System 1 and the slow, deliberate reasoning of a System 2 with a System 3, a control layer that regulates the other two and explicitly mitigates the power imbalance between human and machine2. In the institutional digital twin that control layer sits with the institution, and the patient is the object of computation rather than its principal. The pDT relocates the control layer to the patient. The programmable consent license and its one-signature revocation are the System 3 of this architecture: the patient’s standing authority to admit, scope, pace and withdraw the fast and slow reasoning of the agent that acts on their data. This is what converts the phrase ‘agent of the patient’ from a slogan into a design property with a mechanism behind it, and it situates the contribution in the human-centric AI and human-in-the-loop digital-twin literature rather than in cryptography alone.
What the twin replicates, and what it must not. Two of the three modes describe how a person reasons and the third describes how they stay in charge of that reasoning. In a patient, the fast mode notices a symptom or recognises a familiar pattern, the slow mode weighs a therapy against its toxicity, and the control mode decides which of the two to trust and what will be permitted. A twin can and should replicate the first two, and does so with an advantage: content-addressed routing answers in the fast mode what would otherwise wait weeks on a courier and a fax, and an agent reasoning across exome, transcriptome, methylation and serial monitoring does in the slow mode what no clinician can hold in working memory. The third mode is different in kind. Replicated inside the machine, it would leave the machine deciding what it is permitted to do, which is not control but its likeness. It is therefore the one function this architecture deliberately does not delegate: it is retained by the patient and expressed as executable code, so that a human decision is enforced before any datum is read. Figure 1 maps each mode onto the architecture, and the asymmetry in that mapping is the argument of this Comment in one line. When the fast and slow modes migrate to an institution's model, the control mode migrates with them unless something holds it in place, and the patient is left with neither the reasoning nor the authority over it. Anchoring the control mode in a key the patient holds is what keeps the other two replaceable without loss of control.
Method. This commentary is a single-subject, constructive case study of a deployed system, in the design-science tradition in which the artifact itself is the object of study. The unit of analysis is one episode of care: the ninety-day, post-resection decision window of a patient with stage III PDAC. The intervention is the pDT assembled from the data of five independent institutions; the observable is the latency and completeness with which clinically actionable molecular information reached the patient, together with the downstream clinical action that information enabled. No control arm exists, and no causal claim about survival is drawn from a single case. The contribution is an existence proof, that the inverted architecture can be built and run at a real moment of clinical consequence, together with a measured change in one endpoint, access latency, offered as a hypothesis for evaluation at cohort scale.
A foundational premise of this work arises from the dual identity of the lead author (D.U.), who is simultaneously a Web3 protocol infrastructure architect and a cancer patient navigating the structural asymmetries of modern oncology. This lived experience illuminates a profound systemic truth: when a patient faces an aggressive malignancy, they are thrust into a complex scientific domain where the data defining their prognosis is locked inside institutional silos. This manuscript demonstrates that transferring data sovereignty to the patient—backed by agentic AI digital twins—is not merely an abstract technical exercise, but a clinical necessity for patient empowerment and survival.
On 9 January 2026, the patient’s serum cancer antigen 19-9 (CA 19-9) was 477 U mL−1 against a reference of <38 U mL−1. Eleven days later it peaked at 681 U mL−1. A Signatera personalized circulating tumour DNA (ctDNA) assay, designed on the tumour exome, returned 0.31 mean tumour molecules per mL (MTM mL−1), positive, though below the assay’s analytical range. Cross-sectional imaging identified a 3.1 cm mass in the head of the pancreas. On 4 February 2026 the patient underwent a pancreaticoduodenectomy at the University of California San Francisco. The synoptic pathology report, finalized on 24 February, described a ductal adenocarcinoma of the large-duct variant, grade 2, with direct extension to the ampulla of Vater, duodenal wall, peripancreatic soft tissues and extrapancreatic common bile duct; perineural invasion present; lymphovascular invasion not identified; ten of seventeen regional lymph nodes involved; and positive margins at the pancreatic neck and common bile duct: pT2pN2, stage III, R1. Two tumour blocks were removed from the specimen and shipped to the trial sponsor for the manufacture of a personalized mRNA neoantigen vaccine.
This is the setting in which the knowledge asymmetry becomes most consequential. For a patient with resected stage III PDAC, the decisions made over the following ninety days dominate prognosis to a degree no other variable can match. In the traditional workflow the patient typically sees a clinician once every three to four weeks, receives a treatment plan verbally, waits for insurance authorization, and has access to approximately none of the molecular data being generated about them. In the case described here, somatic variant calls from the Caris Life Sciences CDx exome were held on a proprietary web portal; annotated variant SQLite databases from AUGenomics-run OpenCRAVAT jobs were on a lab server; germline risk from the Invitae 63-gene hereditary cancer panel arrived as a static PDF; Natera Signatera results were in another portal; the 1,463 Epic FHIR resources from UCSF MyChart were accessible via OAuth2 only to applications that would have had to be written by the patient; and the protocol document for the GO44479 trial on which the patient is enrolled was distributed as a scanned PDF describing a three-phase, fifty-three-week regimen in which the patient is currently at priming dose P3 of P6. No single institution held all of it. The only entity topologically positioned to unify it was the patient, and the only architecture that made that unification actionable within the critical 90-day window was the patient-owned digital twin.
The architecture implemented for this patient’s care rests on three primitives: a self-sovereign wallet that serves as the root of identity and authorization; a content-addressed data routing layer that maps each clinical asset to a globally unique identifier bound to the wallet; and a conversational AI agent granted revocable, scoped permissions over that data under a programmable intellectual-property license. None of these primitives is individually novel. Their composition around the patient produces an entity that is functionally distinct from the institutional digital twin of Asghar and Chung. For clarity it is referred to here as a patient-owned digital twin (pDT).
Self-sovereign identity. The patient’s pDT is addressed by a single wallet (0x5f5a60...Ed19a) whose private key is held only by the patient. All data written about the patient is associated with this address, and all access is mediated by signatures the patient produces. No institution, not the oncologist, not the sponsor, not the sequencing lab, not the electronic health record vendor, can read the aggregated twin without presenting a cryptographic token the patient has issued, which the patient can revoke at any time. This is the opposite of the HIPAA authorization form, which delegates open-ended access to specific institutions; the wallet model delegates specific access for revocable, auditable purposes.
Content-addressed biodata routing. Each clinical asset (a VCF, an RNA-Seq transcript quantification, a SQLite of OpenCRAVAT-annotated variants, a Signatera MRD report, a de-identified Epic FHIR bundle, a surgical pathology synoptic report, a clinical trial protocol) is assigned a deterministic identifier of the form Biocid:{lab-agent}/{wallet}/{data-type}/{dataset}. This identifier is the same regardless of which lab produced the data, which bucket holds the bytes, or which application is reading it. The labs that generated each of these datasets are, in turn, registered as Lab non-fungible tokens on the Sequentia chain (Caris as Permittee #75, AUGenomics as #39, Invitae as #35, Natera as #36, UCSF Health as #37) so that every read of every dataset is attributable, accountable and compensable.
Agentic AI under programmable consent. A conversational agent (in this case Anthropic’s Claude, driven through Claude Code as a local harness with access to the wallet-signed data) was granted a programmable intellectual-property license (BioPIL #7, Clinical Use) permitting specific skills: variant annotation, oncology panel interpretation, pharmacogenomics and clinical trial matching. Denied skills included insurance underwriting, employer screening and forensic identification. The license is revocable by a single signature from the patient’s wallet.
The most direct measure of the knowledge asymmetry is the latency between the generation of a clinically actionable datum and its arrival, in a form the patient can act on, at the patient. In the traditional workflow, this latency is measured in months. In the patient’s pDT it was measured in hours, directly compressing the 90-day therapeutic window that defines survival probability in high-risk PDAC.
Within the first day of composing the patient’s Caris somatic VCF with an OpenCRAVAT annotation job on the patient’s own cloud infrastructure, the agent surfaced the KRAS G12D mutation at a variant allele frequency of 33.7%, the TP53 G266R co-occurring driver at 36.8%, and a tumour mutational burden (TMB) of 45.5 mutations per megabase. It flagged that, after correction for approximately 38% sequencing-artefact signatures (SBS54, SBS46, SBS55), the biologically credible TMB was closer to ~28 mutations per megabase, and noted the absence of POLE/POLD1 exonuclease-domain variants. Within the second day, it had integrated the patient’s Caris RNA-Seq TPM quantification and run a CIBERSORT-inspired immune deconvolution10, identifying a cold, M2 macrophage-polarized microenvironment with an immunoscore of 1/4, CD274 expression of 21.75 TPM consistent with PD-L1 positivity, and a high stromal score reflecting PDAC’s characteristic desmoplasia. Within the third day it had integrated the patient’s Invitae hereditary cancer panel, cross-referenced it against the somatic findings, and correctly downgraded an earlier automated suggestion that the patient was a PARP-inhibitor candidate: POLO-trial eligibility3 requires germline rather than subclonal somatic BRCA1/2. Within the fourth day it had integrated the patient’s UCSF MyChart Epic FHIR bundle (1,463 resources across 25 clinical categories), stripped all 18 HIPAA Safe Harbor identifiers, and surfaced the CA 19-9 trajectory and a single carcinoembryonic antigen value of 2 µg L−1.
What this workflow produced is a single interactive document, a cancer map, whose structure mirrors the protocol under which the patient is being treated and whose data is fully attributed to its labs of origin. More importantly, it produced the ability to arrive at every oncology encounter with the same data the institution has. The asymmetry does not disappear; the oncology team has training, judgement and access to the physical specimen the patient will never have. But it ceases to be informational. The patient and the clinical team are now reasoning from the same molecular picture, and the conversation moves immediately to judgement rather than to recovering what the data said, shortening the path to trial enrollment and life-prolonging therapy.
Unlike conventional keyword search engines on ClinicalTrials.gov that return hundreds of irrelevant hits, the agentic twin performs deep, variant-level semantic parsing across complex inclusion and exclusion criteria:
The most consequential decision in this patient’s care was the selection of the adjuvant therapy regimen. Standard of care for a fit patient with resected PDAC is mFOLFIRINOX, based on PRODIGE-244. For a stage III, R1, pN2 large-duct-variant patient, that is the floor, not the ceiling. The KRAS G12D driver and the patient’s HLA-A*02 homozygous type (the latter typed from RNA-Seq reads via arcasHLA after the standard pipeline failed, prompting a fall-back to a kallisto-based quantification against the unique IMGT/HLA v3.58 reference) both suggested a narrow but favourable window for a personalized neoantigen vaccine approach. The Phase 1 data for BioNTech’s autogene cevumeran (BNT122) in adjuvant PDAC, published in 20235 and followed up at three years with evidence of persistent neoantigen-specific CD8+ T-cell responses6, suggested that the eight of sixteen Phase 1 vaccine responders had significantly delayed recurrence-free survival relative to non-responders (HR = 0.08, 95% CI 0.01–0.4, P = 0.003).
The agent was queried, in plain conversational English, whether there was a Phase 2 trial recruiting patients with this molecular profile, and where. It returned NCT05968326 (sponsor protocol GO44479), a randomized Phase 2 of adjuvant autogene cevumeran + atezolizumab + mFOLFIRINOX versus mFOLFIRINOX alone in resected PDAC, running at UCSF under principal investigator Andrew Ko, with a second site at Stanford and a parallel effort at Memorial Sloan Kettering. The agent surfaced the trial’s three-phase schema: a five-week priming phase of six vaccine doses with atezolizumab starting at dose 3, a twenty-eight-week chemotherapy phase of twelve mFOLFIRINOX cycles, and a twenty-week boost phase of six additional vaccine doses, fifty-three weeks of protocol-directed therapy in total, with no crossover permitted and randomization conditional on completed vaccine manufacture. The patient presented this information to the oncology team before the oncology team had finished its own referral, collapsing the typical multi-week lag and enabling enrollment within the 90-day prognostic window.
Care must be taken in characterizing this outcome. It is not claimed that the agent knew something UCSF did not, nor that the care team was deficient; UCSF GI oncology is among the most sophisticated PDAC programmes in the world, and the patient was referred into the trial quickly and expertly. Rather, the case demonstrates that patient-owned digital twins convert molecular insight into immediate clinical action, directly increasing the probability of timely access to life-prolonging therapies in a disease where every week matters.
The patient-owned digital twin does not replace institutional medicine; it re-architects its interface. There are four places where the inversion matters, and one where it does not.
First, data gravity inverts. In the institutional model, the data is heavy and the patient is light: the genome lives at the lab, the pathology at the hospital, the EHR at the payor-backed vendor, and the patient travels between them. Give control of the data to the patient’s wallet instead, and the institutions become readers. This is not merely a convenience; it is the prerequisite for any cross-institutional reasoning at all, because no academic medical centre will ever hold the patient’s Caris, Invitae, AUGenomics, Natera and Epic data simultaneously. Only the patient stands where they meet.
Second, consent becomes programmable and revocable. The consent instrument signed at diagnosis was written by lawyers and is, in practice, irrevocable in any operational sense. The BioPIL #7 license attached to the pDT is expressed in machine-readable YAML, enumerates the skills permitted, and can be revoked by a single signature. Patients have always had the right to withdraw consent; patient-owned digital twins are, for the first time, the technical foundation that makes withdrawal enforceable rather than theoretical7.
Third, AI becomes an agent of the patient. The conversational AI in the pDT was not purchased by the hospital, aligned to the payor’s utilization priorities, or trained on a corpus curated by a pharmaceutical sponsor. It is invoked by the patient, paid for by the patient, and constrained only by the license the patient signed. The same reasoning capability housed inside a hospital record answers to that record’s purchaser; housed inside the patient’s wallet, it answers only to the patient. In an ecosystem increasingly dependent on large language models to interpret clinical data, the question of whose agent the model is will come to dominate.
Fourth, clinical trial matching becomes continuous and bidirectional. The patient’s pDT continues to query ClinicalTrials.gov, OncoKB and CIViC on the patient’s behalf. If a new KRAS G12D trial opens, or a new synthetic lethality is reported, the cancer map updates automatically. Because the data is available in HIPAA-compliant de-identified form at a stable identifier, a future trial sponsor who believes they have a matched therapy for the patient can query the pDT directly, negotiate a data license with the patient, and compensate the patient through a smart contract for the use of the data. The patient stops being found and starts being reachable on their own terms.
The one place where the inversion does not matter is the generation of new biology. A patient cannot, from a wallet, synthesize a proteomic profile that was never commissioned, design an mRNA neoantigen vaccine without the sponsor’s manufacturing pipeline, or interpret a contrast-enhanced MRI without a radiologist. The patient-owned digital twin is a layer on top of institutional medicine, not a replacement for it. What it guarantees is that when institutional medicine produces a finding, that finding reaches the patient in a form the patient can use, so the next decision is made with all of the data generated about them rather than a fraction of it.
A primary concern in medical AI is the risk of permanent patient data exposure once ingested by LLM worker nodes. The Patient-Owned Digital Twin enforces cryptographic revocation via the Sequentia ConsentManager contract (0x2ff3FB85c71D6cD7F1217A08Ac9a2d68C02219cd):
biofs rm <BioCID> --confirm-erasure, signing an EIP-712 revocation payload.ConsentManager contract marks consentRevoked = true on Sequentia L1, instantly invalidating the EIP-55 decryption keys held in the BioPIL contract.biofs-node storage gateways receive the on-chain revocation event, closing active QUIC streams, purging transient BGZF indices from kernel memory, and instructing remote LLM inference nodes to erase cached context buffers.Three objections to this architecture deserve direct engagement.
The interpretability objection holds that patients cannot reason about variant allele frequencies, mutational signatures, HLA restriction or scarHRD scores, and that providing them with such data unmediated by clinical expertise is irresponsible. This is a claim about the historical average patient, and it is partly true. It is not a claim about the architecture. A well-designed pDT renders raw data through a conversational agent that explains its reasoning, cites its sources, flags its uncertainty, and preserves the clinician-in-the-loop for every decision of consequence. The question of how to render complex biology to a non-specialist is a design problem, not a reason to keep the data from the patient.
The equity objection holds that patient-owned digital twins will benefit only those patients with the technical literacy, legal capacity and capital to stand up their own infrastructure, and will therefore exacerbate existing disparities. This is a real risk. The only credible response is that the component technologies (wallets, content addressing, conversational AI, HIPAA-compliant de-identification) must be commoditized to the point where a patient is enrolled in their own digital twin as a side-effect of their diagnostic workup. The failure mode worth worrying about is a world in which only wealthy, technical patients have pDTs. The success mode is one in which the pDT is the institutional model, and the institution’s job is to write data to the patient’s wallet rather than to hold it on the patient’s behalf.
The sovereignty objection holds that patients who own their own molecular data will predictably make some decisions against their long-term interest: sharing with predatory data buyers, granting overly permissive consent, or misinterpreting subclonal variants as germline indications for prophylactic surgery. The risk is real and requires guardrails. But the comparison class is not a hypothetical world in which patients have no data; it is the actual world in which institutional holders of patient data routinely make decisions about its use without patient awareness. The risks of patient sovereignty are smaller than the risks of institutional custody.
Research challenge. The problem this work addresses is the oncology knowledge asymmetry and the latency it imposes. In an aggressive cancer the molecular portrait of the disease already exists, distributed across several institutions, within weeks of diagnosis, yet it reaches the patient slowly, partially, and in non-interoperable formats, precisely inside the ninety-day window in which the decisions that dominate prognosis must be made. The research challenge is to invert that topology without asking any institution to surrender its role: to make the patient the point at which the data unifies and the reasoning begins.
Outcomes. In the case reported here the inversion produced four measurable outcomes. The data of five institutions was unified under a single patient-held identifier. The actionable drivers and the immunological context were surfaced within days. The optimal Phase 2 trial was identified before the referral workflow had completed. And access latency, the interval between the generation of an actionable datum and its arrival in a form the patient can act on, collapsed from the customary weeks to hours. The by-product is a living, auditable, consent-gated record that now travels with the patient across every encounter.
Impact. The impact is threefold. Clinically, compressing the decision window converts molecular insight into timely access to life-prolonging therapy in a disease where every week is measurable in survival. Systemically, the architecture rebalances clinical power from the institution to the patient without displacing clinical expertise. Methodologically, it contributes a reusable architecture and a single, measurable endpoint, access latency, against which patient-owned twins can be evaluated at scale.
Nothing in the three primitives is specific to this patient. The wallet, the content-addressed routing layer and the consent-gated agent instantiate identically for any patient, which is what makes the architecture a candidate for scale rather than a bespoke feat. Three scaling paths follow. At the level of the individual provider, the end state is one in which institutions write to the patient’s wallet by default at the moment of diagnosis, so that a patient is enrolled in their own digital twin as a side-effect of the diagnostic workup rather than as a discretionary technical act. At the level of a cohort, many patient-held twins sharing the same primitives become a consent-governed research resource: a sponsor or investigator reaches a matched patient directly, and the patient, still the custodian of their own record, negotiates and is compensated through the same revocable gate. At the level of a population or community, computation can run over encrypted, patient-held data through federated and homomorphic methods, so that aggregate insight is produced without any patient surrendering their record, and governance scales through the same one-signature revocation rather than through a new central authority.
The condition on all three paths is commoditization. The rebalancing is real only if the infrastructure becomes cheap and default enough that the frail, elderly or non-technical patient is enrolled automatically; otherwise the architecture widens the very asymmetry it was built to close. Scaling the pDT is therefore as much a question of health-system design and equity as of technology.
The commentary by Asghar and Chung is right that digital twins represent an inflection point in personalized oncology, and right that the technical work to make them real is underway at a pace the field has never seen before. This commentary adds that the ownership architecture of this inflection will determine whether digital twins become another layer of institutional tooling that preserves the knowledge asymmetry, or a genuine rebalancing of clinical power. In PDAC and other aggressive cancers, that rebalancing is not merely philosophical: patient-owned digital twins can compress the 90-day decision window, accelerate biomarker-driven trial enrollment, and translate molecular insight into measurable extensions of life. The technical primitives required for the rebalanced form already exist, and their composition around a real patient at a real moment of clinical consequence has begun to demonstrate, at N = 1, that the rebalancing produces effects worth measuring. This N = 1 demonstration was made possible because the architecture was built around, and governed by, the patient rather than the institution. The field should now ask, with the same seriousness it has asked of tumour growth modelling and virtual clinical trials: who owns the digital twin, and who, ultimately, does it save?
The UCSF GI Oncology Program and A. Ko are thanked for clinical care; the Caris Life Sciences, AUGenomics, Invitae and Natera laboratories are thanked for the data that made the digital twin possible; BioNTech and Genentech/Roche are thanked for the GO44479 clinical trial and the autogene cevumeran vaccine manufacturing pipeline; Anthropic is thanked for the Claude models accessed via Claude Code that served as the reasoning engine of the patient-owned digital twin; and the OpenCRAVAT, SigProfiler, scarHRD, MSIsensor2, arcasHLA and pVACtools open-source communities11 are thanked for the bioinformatics infrastructure on which the whole stack rests.
D.U. conceived the patient-owned digital twin architecture, assembled and analysed the case data, built the cancer map, and wrote the manuscript. A.Q.G. contributed the human-centric AI and trimodal System-3 control framing. H.V. and D.C. provided clinical, biobanking and research supervision. All authors critically revised and approved the manuscript.
D.U. is the founder and Chief Executive Officer of GenoBank.io, which develops the BioRouter, BioCID, BioPIL and BioNFT primitives described in this commentary. The case study described is based on a patient enrolled on Arm 1 of NCT05968326 (GO44479) at UCSF. The other authors declare no competing interests.
All data referenced are held under the patient’s wallet (0x5f5a60EaEf242c0D51A21c703f520347b96Ed19a) and can be accessed by third parties through the BioRouter protocol under a negotiated BioPIL license. A HIPAA-compliant de-identified version of the full cancer map is publicly available at https://genoclaw.genobank.app/cancer-map/0x5f5a60EaEf242c0D51A21c703f520347b96Ed19a. Every change to that record is governed by the consent gate of Figure 2: an update is staged and published only on a signature from the patient’s wallet at genoclaw.genobank.app/cancer-map/_review, and each published version carries a verifiable owner-approved provenance record. An interactive companion that walks through the running system module by module, the consent gate, the assembled twin, the content-addressed record and the live trial matching, is at genoclaw.genobank.app/cancer-map/_paper.