Knowing the Cause: Structural Causal Invariants and Counterfactual Safety in Clinical Decision Support

Abstract

Part I of Volume II (the outward extensions) of the H-DKPS series on physician-governed clinical AI (知衡八法). The redacted code package is included as a separate file. Clinical problem. A patient's fasting glucose is high on the morning she arrives, and the decision support proposes a metabolic intervention. She had not, in fact, fasted; she had also slept four hours and arrived from a night shift. The reading is real. What it is evidence of is not what the recommendation assumes. Nothing in the record says so, and no safety rule is broken, because every existing rule constrains what the system may recommend, not why it believes the recommendation follows from the data. Engineering problem. Volume I bounded the authority of a clinical system — what it may cause, withhold, repeat, and report. Each bound is a property of the system's outputs. None is a property of the inference that produced them. A system can satisfy every one of them while recommending an intervention whose only support is a confounded reading, a correlation with no mechanism on the physician's own map, or evidence drawn from a population the patient does not belong to. The obvious remedy — let the kernel estimate the causal effect and veto interventions whose effect is not significant — was proposed to us and rejected, for reasons this paper sets out: it would make the kernel an arbiter of efficacy, require effect sizes that are not identifiable from a single clinic's data, and rest on causal assumptions that cannot be verified from inside the system. Approach. We specify four structural causal invariants, INV-K1–K4, that constrain the form of the system's causal reasoning rather than estimate its magnitude, and that never block the physician: (K1) every candidate intervention must have a path, on a physician-ratified time-unrolled causal graph, to the axis it is meant to act on, graded by path strength, and the absence of a path is named rather than silently passed; (K2) a reading taken under a registered confounder may not stand alone as an indication, and the confounder is named; (K3) the counterfactual "what if we do nothing" is computed by a deterministic digital twin inside the kernel, alongside the system's suggestion and the physician's actual order, and presented without authorising or vetoing anything; (K4) every piece of evidence behind a suggestion is checked against the patient's sex, age band and recorded clinical status, and a mismatch is stated with its source. All four run in shadow mode — evaluated on every committed encounter, visible to the physician, binding on nothing. This is an architecture study: every result below is computed from the ratified graph, a registry of published evidence, and synthetic records; no record of patient care was used. Evidence. The causal graph was ratified item by item by the physician: 21 intervention-to-axis edges, 62 conjugate axis-to-axis paths, 29 axis-to-indicator edges and 12 confounder-to-indicator edges across six physiological axes. An exhaustive analysis of the graph — every intervention node against every one of the 20 possible sets of three leading axes — shows that the first, binary form of K1 could not fail for three nodes, including agents in wide clinical use, whatever the patient: they reach four to six axes and therefore always touch one of the leading three. Across all 420 configurations the binary rule passed 75 per cent; grading by path strength turned those passes into information (262 primary, 53 secondary). A red team placed an abnormal same-day reading under each of the 47 confounder–indicator pairs on the graph (12 confounders, 27 distinct indicators): all 47 now trigger K2; on first run four could not, because the system held no phase-specific reference ranges for menstrual-cycle hormones — a gap the red team found and a subsequent change closed. A Simpson-structured pairing showed that excluding the confounded stratum restores the correct direction of a drift estimate (+1.0) that pooling reverses (−2.0). Of the 49 publications behind the twin's effect values, 35 (71 per cent) studied a population defined by a specific disease that the system cannot compare; run against four synthetic patient archetypes, K4's largest verdict category was in every case confirm — a question handed to the physician. Treating an unrecorded value as a mismatch, as the first rule did, produced 13 mismatches for one archetype; the amended rule produced 5, handing the other 8 to the physician. Contribution. Causal soundness in clinical decision support can be made a checkable property of the structure of inference without making the system a judge of efficacy. The invariants verify conformity to the physician's causal map, not the truth of that map; we state this as the boundary of the method rather than hide it. And a safety check whose pass rate is one hundred per cent should be read first as a question about the check. Not peer reviewed.