DIOGENES DOCKET — Court Notification System (CNS)
| Document | Product Requirements Document (PRD) |
| Version | v0.10 — Draft (structural re-sequence) |
| Status | For internal review / partner circulation |
| Author | Redwin Tursor and Rhombus Ticks |
| IT Consulting | TC Ricks |
| Imprint | Red Anvil Creative |
| Date | June 18, 2026 |
0. Intake and provenance
This document came out of a model pipeline. DeepSeek generated the first draft and the simulated panel. Versions 1.0 through 1.3 ran adversarial review and several multi-model passes that caught real design flaws, grounded the numbers in the published literature, and added a degraded mode for jurisdictions in counsel crisis. Version 1.4 integrates two legal-panel reviews and, importantly, a direct reading of the actual Roberts opinion, which corrected a conclusion that both panels had drawn from a real footnote but read in the wrong direction.
A note on method that has earned its place by now. Statistics supplied by reviewing models drifted between runs, which is the clearest sign they were generated rather than retrieved. Every number here is cited to a named source, and the one legal claim the whole strategy turned on was checked against the primary text before it was trusted.
1. Executive summary
Diogenes Docket is an AI-assisted court-date reminder system that reduces failure-to-appear (FTA) warrants. It resolves defendants to their hearings from public court dockets and sends reminders by email, with a physical-mail fallback. A secure feed surfaces unreachable, high-risk clients to their own counsel, never to volunteers or third parties.
One rule governs the design. AI does the work where being wrong is cheap and reversible, which means resolution and reminders. Humans do the work where being wrong is costly, which means advice, judgment, and contact about the case.
The MVP stays small: enroll, resolve, remind, and surface the unreachable. Community logistics, SMS, multi-county expansion, and a private-counsel protocol all wait behind proof that the core loop is safe and works.
Three facts shape everything below, and each is stated plainly because each one decides whether the pilot is worth running.
First, reachability runs opposite to risk. The people who drive FTA warrants are the hardest to reach, and self-sign-up enrollment makes that worse by selecting the stable and the organized. So enrollment runs through an authorized party on an opt-out basis for the channels where that is legal.
Second, the lawyer is the gate, but the gate assumes a lawyer exists. Where indigent defense functions, routing contact through counsel solves the hardest ethics problem. Where it has collapsed, the gate has no one behind it, and the system has to say what it does in that case instead of pretending it has a safety net.
Third, the operator is the defense team's agent, not a neutral vendor. That decision, explained in §1B, is what makes the privilege, the consent posture, and the loyalty all line up.
1B. Who the operator is
Every legal question in this document bends around one prior question that the earlier versions left open: when the system contacts a defendant or logs a fact about them, is the operator acting as the defense team's agent, as an arm of the court, or as an independent third party? The answer changes the privilege, the immunity, the consent analysis, and whether the data can ever be pointed at the state. Here are the three paths and the one v1.4 takes.
As an arm of the court. This buys a plausible claim to governmental immunity and makes the court the sender of record, which cleans up consent. But it makes the data a court record, which is more discoverable and often presumptively public, not less. It also forbids the operator from ever being adverse to the state, which kills the aggregate-evidence strategy in §13. This path makes the worst problem in the system worse.
As an independent third party. Rule 4.2 may not bind it at all, since the rule reaches a non-lawyer only when acting at a lawyer's direction, and it is free to be adverse to the state. But it has no privilege, no immunity, naked liability, and the weakest consent footing, because an unrelated company scraping dockets and contacting strangers is the unsolicited-contact problem in its purest form.
As the defense team's agent. This is the path v1.4 takes, for the represented population. Under United States v. Kovel, 296 F2d 918 (2d Cir 1961), privilege extends to a third party a lawyer retains to help deliver legal services. Retained by the public defender office to help it keep clients informed and present, the operator's resolution decisions about represented clients become work product the prosecution cannot simply subpoena. It also makes the Rule 4.2 worry largely disappear, because contacting the office's own clients is not third-party contact at all. And the loyalty sits where it should, with the defendant, which is exactly what the aggregate strategy in §13 needs.
The honest costs. Kovel needs an attorney-client relationship, so this protection covers only the represented. The unrepresented, the pro se, and the privately retained get the benign reminder and nothing more (see §5.3). The operator also gives up any claim to court immunity, so liability is contained another way (see §9.4). And Kovel protects communications made to enable legal advice, so an operational record has to be framed and held as part of that function, not as a generic database, or a prosecutor will argue it is an ordinary business record. The short-retention rule in §5.4 backstops this.
This is a strategic choice with real tradeoffs, not a settled legal fact. If you would rather chase court immunity, or keep the operator fully independent, say so and the architecture changes accordingly.
1A. What this is, and what it is not
This is not a robot lawyer. It is a tool that fills gaps that were never the lawyer's job.
The system only does work where an error is cheap and reversible, which is surfacing information and sending reminders. It refuses the work where an error is costly, which is advice, judgment, and representation. By construction it cannot be a lawyer, because the lawyer's function is the costly-error work the system is built to stay away from. The whole unauthorized-practice analysis in §9.1 exists to mark the line where advice begins and to stop short of it.
The gaps it fills belong to no one right now. Telling someone when their hearing is, which is a calendar fact the court already owes and which the lawyer does not track to the day for every client. Telling a public defender which of their clients are about to fall through, which the PD has the duty to handle but lacks the bandwidth to see. And telling the court and the state how many people have no lawyer and no notice, which is accountability data, not representation.
The harder criticism is not that this is a robot lawyer. It is that filling the gap makes the absence of a lawyer easier to live with and takes pressure off the state to fix it. The answer is a distinction, and it has to be stated rather than assumed. The delivery gap falls on everyone, including the well-represented, so filling it is plainly good. The no-counsel gap exists because the state failed, so filling it carelessly normalizes that failure. The system therefore fills the gaps that were never the lawyer's job, refuses the one that is, and where a person has no lawyer it does not pretend to be one. It caps itself at a reminder and turns the gap into a demand on the state for counsel, through the aggregate data in §13, rather than a quiet substitute for it.
2. Problem statement
Every year, courts issue millions of arrest warrants for missed court dates, and the burden falls hardest on low-income and minority communities. The causes are usually ordinary: a forgotten date, a changed address, no ride. Notification is unreliable, and counsel have no proactive way to see which clients are drifting toward a warrant.
What the evidence establishes, and why it shapes the design:
Reminders work, and the effect size is known. The flagship New York City RCT (Fishbane, Ouss, and Shah, Science, 2020) found that a redesigned summons form plus text reminders cut FTA by 13 to 21 percent and eliminated roughly 30,000 warrants over three years. The text-specific effect was about 26 percent (Cooke et al., ideas42 and University of Chicago Crime Lab). Practitioner syntheses cite up to about 40 percent in the best programs. A 20 percent reduction is therefore at the top of the demonstrated range, which means it is achievable but optimistic, and the metrics in §7 treat it that way.
Baseline FTA is roughly 15 to 25 percent on a defendant basis in functioning jurisdictions, higher in summons-heavy contexts. New York City criminal court fell to about 15 to 18 percent over time, Philadelphia runs about 18 to 26 percent, felony defendants about 17 percent, and Kentucky 14.8 percent. This range is an input to the power calculation in §11.
Enrollment method decides reach, and self-sign-up is the wrong choice. Automatic enrollment reaches 72 to 90 percent of eligible cases (New Mexico and Arizona). Opt-in reaches as little as 2 percent (Pennsylvania) and as much as 30 percent (Alaska) (Pew, 2025). The ideas42 Essential Guide (2025) recommends automatic enrollment with easy opt-out, because opt-in produces low participation and widens equity gaps. That finding drives the channel-specific consent model in §5.1.
Timing and message content already match the evidence. The 7-3-1 cadence is best practice. Plain-language messages that prompt the recipient to make a plan and that state the consequence of missing do better than bare notices.
A standing caution. Several figures supplied by reviewing models in earlier passes (warrant-disparity ratios, contact-invalidation rates, per-warrant cost) were uncited and shifted between runs. None are used here. Local baselines still have to be confirmed against the pilot county's own data before any number goes into a pitch.
3. Vision and core principles
Vision. Every defendant gets a timely, accurate reminder unless they decline it, and every public defender can see which of their clients are unreachable and at risk before it is too late.
Governing principle. AI where being wrong is cheap. Humans where being wrong is costly.
Design pillars.
- Informed default, free exit. Eligible defendants are enrolled through an authorized party on the channels where opt-out is legal, with clear disclosure and a one-tap exit honored at once. The operator never scrapes and cold-contacts strangers. Enrollment is an act of the authorized party, which is what makes the default legitimate (see §5.1).
- The lawyer is the gate, with a defined fallback when there is no lawyer. No one contacts a represented defendant about their case except their own counsel. For the unrepresented, Rule 4.2 does not apply and unauthorized-practice law is the binding limit, so the system sends a reminder and nothing that resembles advice (see §9.1, §13).
- Auditable completeness, with no dangerous residue. The ledger proves who should have been notified and who was, using hashes. It does not keep the substantive "this person was unreachable" content (see §5.4).
- Cheap failures, fast corrections, never silent. Errors are caught by human review, by aggregate anomaly detection, and by an urgent correction loop. A safety freeze announces itself rather than going dark (see §5.2).
4. User personas
| Persona | Core need | Why they matter |
|---|---|---|
| Defendant, represented | Tell me my court date so I do not catch a warrant. | Primary beneficiary, and the only population the privilege in §1B covers. |
| Defendant, unrepresented | I have no lawyer and no one is tracking my dates. | Highest-stakes case. Reminder only, with no counsel behind the gate (§13). A defendant can move between these two states mid-case (§5.6). |
| Public defender / appointed counsel | Show me which clients are unreachable and at risk. | Secondary beneficiary. The feed is their force-multiplier and the system's reach into the high-risk tail. |
| Authorized enrolling party | Enroll people at intake without adding burden. | The legitimacy of opt-out and the high enrollment numbers both depend on this actor. |
| System operator | Monitor accuracy, delivery, and safety, and pause instantly on trouble. | Holds the integrity of the whole thing. |
| Community volunteer (v1.5) | Help with transport or childcare for a de-identified person. | Deferred. Token-based, never sees identity. |
5. MVP scope and features
5.1 Enrollment, by channel
Opt-in self-sign-up reaches 2 to 30 percent of eligible cases and widens the equity gap. Opt-out reaches 72 to 90 percent and is more equitable. So the MVP enrolls by default through an authorized party, on the channels where that is lawful, and uses opt-in only where the statute demands it.
- Email and mail run opt-out. Contact information is collected at PD intake (and, where a court partner exists, at booking) and the person is enrolled by default, with disclosure and a one-tap exit in every message. CAN-SPAM is already an opt-out regime, so accurate headers, a working unsubscribe, a postal address, and transactional framing keep this channel clean. For PD clients, the operator acts as the office's agent (§1B), so this is the office reaching its own clients.
- Text runs opt-in (deferred to v1.5). The TCPA and the stricter state statutes require prior express consent, and they do not care that a message is ministerial, so SMS needs an actual one-tap "yes, text me" captured at intake. Facebook v. Duguid (2021) narrowed the federal autodialer definition, and texting a curated list of verified numbers from non-autodialer infrastructure likely falls outside it, but the state statutes did not read Duguid, so get the opt-in anyway. Carrier registration (10DLC) is paperwork, not a legal defense, and the two are not the same thing.
- Consent is scoped to the case. Enrollment ends when the case closes, and contact data is deleted then, except the hash that proves a notice was sent (§5.6, §9.3).
A note on reach and honesty. The high-yield channel runs through the PD relationship, so it serves represented clients best and the unrepresented worst, which is the same reachability gap showing up at enrollment. The MVP is, fairly stated, a represented-defendant tool first.
5.2 Resolution engine
The system runs two resolution paths because it serves two populations, and it re-runs them every cycle because the case underneath changes (§5.6).
Deterministic join, for the PD-client path. The office's roster, which carries the case number and the assigned attorney, is joined to the scraped hearing calendar by case number. High confidence by construction.
Fuzzy resolution, for the reminder path for enrollees with no roster entry.
Tier Match basis Action 1, auto-send Name plus date of birth plus verified contact, confidence at least 0.95 Automated reminder at 7, 3, and 1 days before hearing 2, human review Name plus a partial match A non-lawyer screener verifies against a second public source before mail 3, unresolved Name only or ambiguous No contact. Surfaced to the feed as a possible, unresolved client Re-resolution every cycle. Reminders are built from the current calendar and the current counsel field. A continued hearing cancels the stale reminder and schedules the new one, and a change in representation moves the case between regimes (§5.6).
Data sources. Only the county's public criminal docket, throttled to roughly one request per second with backoff, a retry queue, and a dead-letter path to manual review. No login-gated systems and no CAPTCHA circumvention. The throttle is a legal control under §9.2, not only an engineering nicety.
Represented-status detection. The resolver reads the counsel field and labels each case as attorney-assigned, placeholder or none, or unknown. A placeholder string that stands in for "no attorney available" is treated as none, which flips the legal posture and the routing (§13).
Deliverability, never a risk score. This is a hard constraint. The system records that a notice could not be delivered, which is a fact about the mail. It never computes, stores, or exposes anything that reads as a judgment that the person is likely to flee. The first fact helps the defendant. The second helps a prosecutor argue for detention, so the system does not produce it.
Pre-send cross-check. Every notice is validated against a second public source for date, time, and place, and a mismatch suppresses the send and alerts the operator.
Circuit breaker with calibrated thresholds. Aggregate anomalies freeze notice generation before a batch of wrong dates can go out. Sensible defaults, tuned to each docket's own baseline rather than fixed by fiat: an unresolved-rate spike above roughly baseline plus three standard deviations or a five percent floor, a parsed-date mismatch above about ten percent, or a new-hearing count that falls below this court's historical low for that weekday, so a genuinely quiet court does not false-trigger.
The freeze speaks. When the breaker trips, enrollees get an affirmative message: we could not verify court dates this cycle, please check directly with the court or your lawyer. A pause must not cause the harm it exists to prevent.
Disclaimer on every message. This is a courtesy reminder. Your hearing may have changed. Verify with your lawyer or the court before appearing.
5.3 The feed, which ships last
The feed is the most sensitive thing the system builds, because it is a record about defendants, so it is the last component to launch, behind the benign reminder channel (§11), and it is held to the constraints below.
- Access. Role-based login. Counsel sees only their own assigned clients.
- Content is deliverability, not risk. The feed shows that a client was unreachable, never a flight-risk judgment (§5.2). The list is "we could not reach these people," which is a fact about the operator's outreach, not an opinion about the defendant.
- CMS sync. A daily read-only export from the office's case-management system maps case numbers to specific attorneys. This ingests the office's own confidential roster under a data-sharing agreement, and it depends on the CMS being able to export at all, which many legacy systems cannot, so export capability is a county-selection go or no-go gate (§11).
- Two elements, nothing more. A list of uncontactable clients with a hearing inside seven days, and a "mark as reached" action that clears the case and feeds the ledger.
- No-counsel routing, by the recipient's duty. For a case flagged as having no counsel, identifiable data goes only to a recipient that owes the defendant a duty to assist, such as a court self-help navigator. It never goes to a recipient that owes a duty to report non-compliance, such as pretrial supervision, because that would build the surveillance pipeline this project refuses. Where no assist-duty recipient exists, the individual gets the reminder and nothing else, and only aggregate, de-identified counts leave the system, sent to the court and the state public-defense agency. That is the constructive use, and it is the opposite of feeding non-compliance to supervision (§13).
- Privilege, where it applies. For represented clients, the resolution data sits inside the Kovel relationship (§1B), which is a real legal shield rather than an internal policy. The duty wall and the access controls are policy, and policy does not stop a subpoena, so the privilege does the heavy lifting and the rest is backup.
5.4 Completeness and access ledger
- What it does. An append-only log of resolution decisions, state transitions, notices sent, delivery and return status, and every access to the feed.
- What it keeps long-term. Only the hash chain, with a daily Merkle root written to a write-once store outside operator control. A Merkle root is gibberish to a prosecutor, useful only to prove nothing was altered.
- What it purges. The substantive flags, meaning the "this person was unreachable" content, are deleted on a documented, content-neutral schedule, before any litigation hold can attach. You cannot produce in discovery a record you destroyed on a routine schedule. The completeness claim is satisfied by the hashes, which prove the notices went out, without retaining the content that could be turned against a defendant. The audit goal and the protection goal both survive, because they are met by different artifacts.
- Access. Attribute-based, minimum-necessary fields, never publicly reachable.
5.5 Error reporting, urgent escalation, and safety shutdown
Inbound error channel, staffed. A phone number and email on every message, with defined hours, trained responders, and an after-hours path, because a wrong-date report the night before a hearing is an emergency a 24-hour clock cannot meet.
Standard correction. Within 24 hours, investigate, correct the record, send a correction, and provide a letter the defendant can show the court.
Emergency alert to counsel. A material defect for a hearing inside 48 hours skips the dashboard and goes straight to the assigned attorney, who can take the fastest available step, which is usually calling the clerk to recall or hold a warrant rather than filing a motion. For the unrepresented, this routes to the assist-duty recipient, or to the court's emergency contact.
The breaker speaks. Covered in §5.2. A freeze sends an affirmative "could not verify" message rather than going quiet.
Returned mail escalates. Undeliverable mail moves the client to the top of the feed, flagged as digitally unreachable with mail instability. Postal returns lag by days or weeks, so this is a standing flag on future hearings, not a same-hearing rescue.
Shutdown trigger.
Element Definition Harm event (a) arrest at court after a notice that was materially wrong at send, (b) a defendant acted on our notice over a correct court communication and missed or mis-attended, or (c) a notice reached the wrong person and caused a documented adverse action. Adjudication Reviewed within 24 hours by the operator and a counsel liaison against a written rubric: was our record wrong at send, did the person act on our notice, is there a documented consequence. Classified as attributable, contributory, or unrelated. Trigger Three attributable events pause the system pending root-cause analysis. Any single systematic defect pauses it at once, regardless of count.
5.6 Case lifecycle and state transitions
A case is a process that runs for months, not a record matched once. The resolver re-checks three things every cycle.
- Hearings move. Continuances and reschedules are normal. Reminders are built from the current calendar, a continued hearing cancels the stale reminder, and the cross-check guards a superseded date.
- Representation changes. See the matrix below.
- Consent ends with the case. Enrollment is scoped to the case, and contact data is deleted at close, except the hash that proves a notice was sent.
- Everything is logged, so completeness reflects the regime in force at each send.
State-transition matrix.
| From, down / To, across | Represented | Unrepresented | Closed or dismissed |
|---|---|---|---|
| Represented | (no change) | Move to the no-advice regime, re-examine whether reminders still fit, drop from the attorney's feed scope, escalation loses its recipient (§5.3) | Stop reminders, purge case-tied contact data, keep only the send-proof hash (§9.3) |
| Unrepresented | Move to the represented regime, add to the assigned attorney's feed scope, enable counsel routing | (no change) | Stop reminders, purge contact data, keep only the send-proof hash |
| Closed or dismissed | not applicable | not applicable | (case is over) |
Every "closed" transition keeps the send-proof hash. Deleting it would break the completeness ledger.
6. Post-MVP roadmap
| Version | Feature | What has to be true first |
|---|---|---|
| v1.5 | De-identified community support board | High mail failure from address instability, and a liability-shielded, token-based partner model |
| v1.5 | SMS channel (opt-in) | Email delivery below target, opt-in capture at intake, and carrier approval |
| v1.5 | Same-day missed-appearance notice on how to resolve and avoid a warrant | An evidence-based add-on that pairs with the §5.5 alert |
| v2.0 | Multi-county expansion with a reusable scraper adapter | Pilot reduction meets target, two more counties ask for it, and a per-state legal module is funded (see §9) |
| v2.0 | Private-counsel protocol | Enough private-counsel volume, and a bar consultation |
| v2.0 | Court-order program umbrella | A judicial champion, and a positive pilot. See the caution in §9.5 about what a court order can and cannot deliver. |
7. Success metrics and KPIs
| Metric | Target | Method |
|---|---|---|
| Enrollment rate | Well above opt-in's 2 to 30 percent ceiling, toward 72 to 90 percent, tracked by channel | Enrollments over eligible population, anonymized |
| High-risk-tail coverage | No high-risk enrollee, flagged by objective docket proxies, falls through both the reminder channel and the feed | Cross-tab of risk proxy with delivered reminder or feed appearance |
| Delivery rate | At least 85 percent get one reminder before each hearing, reported by reachability segment, never as a single headline | Delivery logs |
| FTA reduction | At least 20 percent relative, which is the top of the 13 to 21 percent range, and only after the power calculation in §11 confirms the pilot can detect it | Stepped-wedge design (§9.6), with a statistician, controlling for charge severity and prior FTA |
| Feed engagement | At least 50 percent of counsel log in weekly and act on a case | Login and "mark as reached" counts |
| State-transition fidelity | Continuances and representation changes propagate within one cycle, and no reminder goes against a stale date or status | Audit of transitions against sends |
| Post-delivery error rate | Under 0.5 percent of notices produce a verified error that reached the defendant | Confirmed mis-sends over total |
| Leading and guardrail | Resolution-confidence spread, percent continuances, percent representation changes, scraper uptime, breaker triggers, complaint rate | Operational dashboards |
| Harm events | Zero attributable | Incident log and the §5.5 trigger |
Two reporting rules that are not optional. First, the easiest-to-reach enrollees are the least likely to FTA, so a clean 85 percent against an unstable population is itself a sign the funnel is selecting the wrong cohort, which is what the tail-coverage metric exists to catch. Second, a result of "20 percent reduction among enrollees" must never be read as "reminders solve FTA," because opt-out broadens the sample and improves how representative the result is, but it does not make it general.
8. Technical architecture, simplified
[Authorized enrollment: PD intake (and court booking where partnered)]
| email and mail opt-out, easy STOP; SMS opt-in (v1.5)
v
[Public court portals]
| scraper (about 1 req/s, backoff, retry, dead-letter; robots respected)
| + schema assertions and a speaking circuit breaker (freeze plus notice)
v
[Resolution engine], re-runs each cycle:
| deterministic join (roster against calendar)
| fuzzy tiers 1, 2, 3
| represented-status: assigned / none / unknown
| state transitions (hearing / counsel / closure)
| deliverability only, never a risk score
v
[Ledger] [Notification service]
hash-chained, append-only email (opt-out; SPF, DKIM, DMARC; shared pool)
transitions logged mail (batch; returned-mail webhook)
substantive flags purged speaking "could not verify" notice on freeze
daily Merkle root to WORM
|
v
[Feed], ships last:
own clients only; deliverability not risk; CMS-synced attorney mapping;
no-counsel routing by recipient duty (assist gets PII, report gets aggregate only);
represented-client data inside the Kovel relationship
Email runs on SPF, DKIM, and DMARC with bulk-sender compliance, on a reputable shared transactional pool rather than a dedicated IP, because pilot volume is too low to warm a dedicated IP. The data-model entities (Defendant, Case, Hearing, Attorney, Notification, LedgerEvent, StateTransition) are a sketch here. The full schema and the API contracts belong in the technical design doc, not the PRD.
9. Legal and ethical framework
9.1 Attorney ethics, and why the operator's identity settles it
For the PD-client population, the operator is the office's agent (§1B). Contacting the office's own clients is not third-party contact, so Rule 4.2 is not implicated, and the resolution data sits inside attorney work product under Kovel. The earlier plan gated the reminder channel on a state-bar advisory opinion about the ministerial-notice theory. That gate is downgraded. A bar opinion is slow, often declined for novel prospective systems, and, more to the point, it does not reach the statutes in §9.3 that actually govern the message. The agent structure does more work than the opinion ever would.
For the unrepresented, Rule 4.2 does not apply, because there is no represented party. The binding limit is unauthorized-practice law, which means a reminder and nothing advice-like. There is a real tension here that earlier versions created and did not flag. The evidence-backed message content (make a plan, here is the consequence of missing) is more effective precisely because it is more advice-like, and delivered to an unrepresented person with no lawyer to verify with, it is the content a UPL regulator looks at hardest. So for the unrepresented, the message is stripped to the bare date, time, and place, plus a referral to an assist-duty resource (§13), and it drops the plan-making and consequence language that is fine for the represented.
Because representation can change mid-case (§5.6), the applicable rule is re-checked at each transition rather than fixed at enrollment.
9.2 Scraping, with the right body of law in view
Only public, non-login docket data is collected. After Van Buren (2021), federal CFAA exposure for public data is minimal. But the federal CFAA is not the law that governs the pilot. Two corrections to the earlier analysis. First, hiQ v. LinkedIn won on the CFAA and then lost on the contract claim on remand, so the residual exposure is breach of the portal's terms of service, not a footnote, and that is where a challenge actually lands. Second, state computer-crime statutes are frequently broader than the CFAA, some lack any Van Buren-style narrowing, and some reach terms-of-service violations directly. So the pre-launch review covers the portal's terms and the state statute, not only the CFAA, and robots.txt is respected, or the reason it is not is documented, because "where feasible" is a hedge a plaintiff will use to argue the operator knew it lacked authorization.
9.3 Consent, which is three statutes, not one ethics rule
The single biggest legal error in earlier versions was stretching one ethics concept, the ministerial notice, across three separate bodies of law. They are separate, and each is handled on its own terms.
- CAN-SPAM governs the email channel. It is already an opt-out regime, so the email MVP is the least of the consent problems. Accurate headers, a working unsubscribe, a postal address, and transactional framing, and it is essentially clean.
- The TCPA governs the SMS channel in v1.5. The ministerial-notice idea is an ethics-rule theory, and the TCPA does not care about it. Duguid helps on the autodialer prong if the system texts a curated, verified list, but a prerecorded or AI voice is a separate prohibition Duguid does not touch, and Barr v. AAPC (2020) struck the government-debt carve-out, so "it is a court message" buys no federal exemption. SMS therefore runs opt-in.
- State mini-TCPAs, such as Florida's FTSA, are the real landmine. Several define autodialer more broadly than the post-Duguid federal standard, impose their own consent requirement, and carry private rights of action with statutory damages. Under a strict state statute, opt-out may not be the prior express consent the text channel needs, which is the second reason SMS runs opt-in. The multi-county roadmap therefore requires a per-state statutory review, and that cost is now in the model (§14).
9.4 Liability, named and contained
The exposure is voluntary-undertaking negligence, Restatement (Second) of Torts §323. By taking on the job of reminding people, with no prior duty to do so, the operator assumes a duty to do it with reasonable care, and is liable if its negligence either increases the risk of harm or causes harm through the person's reliance. The silent-freeze problem is the reliance prong, exactly. Disclaimers do not bar negligence, they are evidence on reliance and comparative fault, and opt-out enrollment removes the one signed artifact that might have helped, so there is no waiver to invoke. The containment is structural, in three parts.
- Additive, not replacement. Every message supplements the court's official notice and never replaces it, and it never tells anyone to rely on the system instead of the court. If the channel fails, the defendant is exactly where they would have been without it, which defeats the increased-risk prong.
- The speaking circuit breaker. A freeze that announces itself does not manufacture reliance, which answers the reliance prong (§5.2).
- A risk pool, not a policy nobody will sell. E&O for a novel, liberty-harm, criminal-justice-adjacent risk written for a thinly capitalized nonprofit may be unavailable or gutted by exclusions, so folding the program into the county's existing risk pool is a condition of the partnership. The county that pockets the savings on every averted warrant carries the risk that comes with it.
9.5 What a court order can and cannot do
A standing court order or local rule is genuinely useful. It can make the court the sender of record, which eases the consent posture, and it can carry an evidentiary shield that bars the use of program data in bail, detention, or charging decisions and makes it non-discoverable, the way mediation-privilege statutes and pretrial-services rules already do in many places. Pursue it.
But two cautions, because the earlier framing oversold it. A single judge's order may not bind other judges, prosecutors in other cases, or survive appeal, so its scope is uncertain. And it does not automatically hand a private operator the court's immunity. Immunity for private actors performing government functions is genuinely mixed: extended to a private lawyer doing government work in Filarsky v. Delia, denied to private prison guards in Richardson v. McKnight, and decided on the specific facts. So the order is leverage worth chasing, but it relocates risk rather than erasing it, and the design does not assume the immunity arrives. The privilege in §1B and the containment in §9.4 stand on their own.
9.6 Evaluation ethics, and the contamination versus power tradeoff
A withheld control would deny a beneficial reminder to some enrollees, which is a moral choice, so the pilot uses a stepped-wedge rollout where everyone is eventually enrolled. Contamination control is required but not free. Randomizing by counsel team leaks treatment, because attorneys share a bullpen and defendants share a waiting room, which biases the result toward null. The fix is a more macroscopic unit, such as separate courtrooms, branch offices, or sub-jurisdictions, rather than internal teams. But a more macroscopic unit means fewer clusters, and stepped-wedge power runs on cluster count, so it makes the power problem worse. The statistician resolves the tradeoff numerically, possibly by pooling counties to get enough well-separated clusters.
9.7 Privacy and data security
The architecture is a high-value target and a single point for subpoenas and records requests, so two things are true. First, tamper-evidence is not confidentiality. The hash chain proves data was not altered, and it does nothing against exfiltration, so a breach of defendant locations and flags is close to a worst case for safety, with breach-notification statutes and negligence exposure on top. Second, access controls govern internal users, not legal compulsion, so the real protections are the ones that change what data exists and who holds it: deliverability rather than risk scores (§5.2), short retention of substantive flags (§5.4), and the Kovel privilege for the represented (§1B). The duty wall is an ethical default, not a legal control.
10. Risk register
| # | Risk | Likelihood | Impact | Mitigation | Owner |
|---|---|---|---|---|---|
| R1 | Enrollment too low | Medium (opt-out cuts it) | High | Opt-out at the authorized touchpoint, QR residual only, benchmark to the 72 to 90 percent evidence, instrument by channel | Bob |
| R2 | Reachability and severity skew | High | High | Feed as the tail channel, opt-out reduces the enrollment skew, segment all reporting | Eve |
| R3 | Scraper breaks or quietly corrupts data | High | High | Per-record cross-check plus a calibrated, speaking circuit breaker, daily health check | Alice |
| R3a | The feed becomes a flight-risk exhibit, subpoenable and usable against the defendant | High | Critical | Deliverability not a risk score (§5.2), Kovel privilege for the represented (§1B), short-retention purge (§5.4), ships last (§11), and an evidentiary shield in the court order where obtainable (§9.5) | Carol |
| R4 | Authorized party cannot absorb enrollment or does not use the feed | Medium | High | One field plus a checkbox at intake, co-design, embed in the existing CMS, a feed champion | Eve |
| R5 | Negligence claim (§323) when a notice is wrong, late, or missing | Medium | High | Additive design, the speaking breaker, the county risk pool, not disclaimers (§9.4) | Carol |
| R6 | Carceral-surveillance criticism | Medium | Medium | The §1A positioning, transparency, community pre-brief, the assist-versus-report wall, and the aggregate-as-evidence strategy (§13) | Carol |
| R7 | Statutory consent failure on SMS | Medium | High | SMS runs opt-in, per-state review, no reliance on the ministerial theory or on 10DLC (§9.3) | Carol |
| R8 | Biased model in future tiers | Low (MVP uses none) | High | No risk model in the MVP, any future model rule-based and audited | Carol |
| R9 | CMS sync fails | Medium | High | A data-sharing MOU in month one, a manual CSV fallback. Export capability itself is a selection gate (§11). | Dave |
| R10 | Crisis jurisdiction: no counsel to route to, and a risk of routing identified data to a report-duty actor | Site-dependent | High | Represented-status detection, the assist-versus-report wall, prefer a functioning-defense pilot county (§13) | Carol |
| R11 | Pilot underpowered, worsened by the selection-depressed baseline and by macroscopic clustering | Medium to High | High | Power calculation on the selection-aware baseline, fallback to pooling counties or a delivered-before-hearing primary endpoint (§9.6) | Carol |
| R12 | Email deliverability failure | Medium | High | SPF, DKIM, DMARC, bulk-sender compliance, shared pool, complaint monitoring | Alice |
| R13 | Stepped-wedge contamination | Medium | High | A macroscopic randomization unit, with the power cost resolved by the statistician (§9.6) | Carol |
| R14 | Stale case state, a send against a superseded date or changed status | Medium | High | Per-cycle re-resolution, the transition matrix, the fidelity metric (§5.6, §7) | Alice |
| R15 | Reliance harm from a silent freeze | Medium | High | The speaking circuit breaker (§5.2) | Alice |
| R16 | Open-records exposure on handoff | Medium | High | Hand off code only, never the dataset; the operator retains and purges the data (§14) | Carol |
R3a is the one the prior versions underrated. It is rated critical on purpose.
11. Timeline and milestones, with the sequence reversed
The earlier plan launched the feed first because it looked clean on Rule 4.2. That was backwards. The reminder channel is the benign piece, a calendar notice, and the feed is the data product about defendants. So the reminder ships first, and the feed ships last, after the hardest scrutiny.
Critical path: secure the partner county (with the CMS-export and functioning-defense checks), confirm the operator-as-agent structure with the office and its insurer, complete the power calculation, build and ship the reminder channel, then build the feed last. Legal work (Carol) runs in parallel with the build (Alice and Dave). Add a 20 percent buffer on the legal milestones, because those timelines slip.
| Milestone | Target | Owner | Gate |
|---|---|---|---|
| Partner county secured, with CMS-export and functioning-defense checks | Month 1 | Bob, Eve | Go or no-go on the feed |
| Operator-as-agent structure agreed with the PD office and its risk pool | Month 1 | Carol | Sets the privilege and the liability posture |
| Scraping review (state computer-crime law plus portal terms) | Month 1.5 | Carol | Blocks scraper go-live |
| Power calculation, on the selection-aware baseline, resolving the cluster unit | Month 1.5 | Carol, statistician | Blocks the eval design |
| Reminder channel built (resolver, opt-out email and mail, speaking breaker) | Month 2.5 | Alice, Bob | Ships first |
| Ledger MVP (hashes, transitions, purge schedule, external Merkle root) | Month 3 | Dave | |
| Reminder channel soft launch | Month 3.5 | Eve | The benign piece goes live |
| Feed built (deliverability only, CMS sync, duty-walled routing, Kovel framing) | Month 4.5 | Dave, Eve | Ships last, after scrutiny |
| Stepped-wedge design locked, macroscopic unit, statistician-confirmed power | Month 4.5 | Carol | Blocks the eval |
| UAT and safety red-team, including breaker tuning and a subpoena tabletop | Month 5 | All | |
| Full pilot data collection | Months 6 to 11 | All | |
| Post-pilot evaluation, and the handoff decision | Month 12 | All |
12. Open questions and dependencies, by gate
Go or no-go, month 1, these block the pilot.
- County selection: functioning indigent defense (not in crisis), CMS export capability, a scrapable CAPTCHA-free docket, and a willing, capable PD office, which is closer to a gate than a tiebreaker, because the agent structure, the enrollment, and the feed all depend on it.
- The operator-as-agent structure: will the PD office retain the operator as its agent, and will its risk pool take the program.
- Power calculation: plug in realistic enrollment, the selection-aware baseline, and a top-of-range effect, and pick the fallback before building if it comes back underpowered.
- CMS export capability: confirmed in writing before selection.
Design decisions, month 2. 5. The enrolling party for the non-PD population: court booking, a residual QR, or both. 6. An assist-duty recipient for the unrepresented: does the jurisdiction have a navigator or self-help program with a duty to assist. If only report-duty actors exist, identified routing is off and the design defaults to aggregate plus the reminder ceiling. 7. The stepped-wedge unit: the statistician optimizes against contamination and cluster-count power, possibly pooling counties. 8. Refresh cadence: how often to re-scrape counsel status and the calendar to keep transitions inside one cycle. 9. Breaker calibration: baseline variance per docket, tuned in UAT. 10. Mail and email infrastructure: variable-disclaimer batch printing, a returned-mail feed, a shared transactional pool, and authentication. 11. The risk-pool arrangement: the terms on which the county absorbs the program's liability. 12. Sustainability and ownership: see §14. 13. The court-order pathway: the evidentiary point to seek an order, and a realistic read of what it delivers (§9.5).
13. Stress-test case study: a jurisdiction in counsel crisis (Oregon), corrected
Why this is here. The central pillar, the lawyer is the gate, holds only where indigent defense functions. Oregon is the strongest test of what the system does when that fails at scale, and reading the actual opinion corrected a conclusion the panels got backwards.
The facts, verified against the opinion. Oregon has been in a multi-year public-defense collapse, with thousands of unrepresented defendants concentrated in a handful of counties. On February 5, 2026, in State v. Roberts, 374 Or 821 (2026), the Oregon Supreme Court held that dismissal without prejudice is required when, at any point after arraignment, the state fails to provide counsel for more than 60 consecutive days in a misdemeanor case or 90 in a felony case. Within days, more than 1,400 cases were dismissed. When no attorney is available, the trial court appoints "OPDC," the public-defense commission, as a placeholder, which the court itself held is not a real appointment, so the counsel field on the docket can read "OPDC" while meaning no lawyer.
The correction that matters. The opinion's footnote 15 says, in plain words, that dismissal is not required if, during the 60 or 90 day window, the defendant failed to appear as required. Read that against this product. To get the Roberts dismissal, the unrepresented defendant must not have missed court during the window. Appearance is the precondition for the remedy, and a missed appearance forfeits it, and adds a fresh FTA charge and a warrant on top. So a reminder that keeps an unrepresented defendant appearing protects the remedy. It does not defeat it. The earlier instinct, to switch the appearance function off in crisis jurisdictions as a matter of fiduciary care, was the opposite of fiduciary, because going dark would let the client miss court and lose the one remedy the violation hands them. The function stays on, and it is paired with a referral to an assist-duty advocate so the defendant can claim the dismissal affirmatively rather than just accruing days.
What the architecture still has to do here. The feed has no counsel to route to, so the no-counsel fallback in §5.3 applies: assist-duty recipient if one exists, otherwise the reminder and aggregate counts only. The placeholder is caught by the represented-status classifier. The legal regime is the no-advice one, so the message is stripped to date, time, and place plus the referral, per §9.1.
The pressure-valve answer, made stronger by Roberts. A reminder program that quietly props up appearance numbers where the state is violating the right to counsel relieves the pressure that produced Roberts. The answer is to point the aggregate data the other way. The scale and location of the counsel gap, documented in real time, is the exhibit the next right-to-counsel suit is built on, and the operator-as-defense-agent structure (§1B) is what makes pointing it at the state coherent rather than conflicted. Constructive use is aggregate evidence that forces counsel to be provided. The failure mode is feeding identified non-compliance to supervision, which the duty wall forbids.
Site choice. Oregon is the right place to harden the design and the wrong place to run the pilot. The Roberts dismissals pull cases off the docket for reasons unrelated to reminders, which contaminates the FTA denominator. So the pilot goes to a functioning-defense county, and the crisis-hardened mode rides along as standard, because counsel is guaranteed nowhere.
14. Sustainability and ownership
The problem. PD offices run on rigid, grant-bound budgets and rarely absorb a recurring software fee after a pilot, so who pays after the grant is the first adoption question.
Bridge funding, with a real number and honest math. The near-term argument is cost-avoidance, billed to the entity that actually bears the warrant cost, the county general fund or a justice-reinvestment line, never the PD's starved budget. The ideas42 and Pew estimate (2025) puts the cost of a missed appearance at about $1,496 in government costs, blending administration, warrant processing, and possible incarceration. Be honest about realized savings. Many warrants are never actively served, so the pilot reports warrants averted times locally verified cost components, not the national headline times a guess. Structure it as pay-for-success, paid out of realized savings.
The durable model, and a warning the earlier version missed. For a public-purpose tool whose whole pitch is a published method, public audits, and no rent extraction, a perpetual private software license is fragile and off-brand, and an algorithmic-accountability audience would smell it. So the endgame is build, prove, and open-source, with the Administrative Office of the Courts or the state public-defense commission adopting and maintaining the code, because those are the entities with a standing mandate and a budget line. Open-sourcing the code also walks past the procurement and anti-gift rules, because there is nothing proprietary to give. But here is the warning. Do not hand the operational dataset to a government owner. The moment a court or agency holds it, state open-records law may reach it, and in several states court contact data is presumptively public, so a carefully walled private dataset becomes publicly requestable. Hand off the code. The operator keeps the data, and purges it on schedule (§5.4).
Handoff criteria, decided at month 12. Transfer the code at v1.0, or after six months of stable operation and a met reduction threshold. Either way, the data does not move.
