Scribeski: visit notes for social workers, written on the Mac.

The obvious fix is an AI scribe, and the obvious way to build one is to send the session to a hosted model. For some agencies that is fine. For others, a client's worst week on someone else's server is exactly what the privacy officer is there to prevent. I wanted to see how much of the job one Mac could do on its own.

Scribeski is the result. It is free, open source under the MIT license, and version 0.1.0 is out today.

It captures two tracks: the worker's voice from the microphone, and the client's from the call app alone, never the whole Mac. Speaker labels come from which track the audio arrived on, not from a model guessing who spoke. Echo is cancelled on the microphone, so a worker on speakers does not have the client's words attributed to them. If a second voice turns up on the client's line, it is flagged rather than relabelled.

Parakeet transcribes on the Neural Engine during the call, with Apple's own speech engine as the fallback, so the transcript is ready seconds after the call ends.

Scribeski then writes the draft into the EHR through Safari. Before every write it checks that the page still shows the bound client's record number as a whole token, so a session bound to AB-11432 never writes into the chart for AB-114322. It never presses submit. A review panel lists every field with its status and the quote behind it. The worker can edit a field, jump to it in the form, or undo everything, and only then confirms.

It learns each EHR form once. Pointed at a blank form, it reads the structure, meaning labels and choices but never values, and works out which fields a session can answer. On our mock EHR it mapped 107 fields, and its mapping agreed with a hand review on 98 of them. Agencies can share learned forms as form packs.

By default, no audio is kept. It is held in locked memory for seconds and wiped as soon as it is transcribed, and a zero-recording session will not start unless FileVault is on. That should be checkable, so the repository ships the check: an end-to-end script runs a synthetic session through live capture and fails if the bytes written look like audio rather than text, or if any file over 64 KB appears in the app's data, temp or cache folders. A 45-minute synthetic run wrote 0 bytes.

Transcripts and notes are sealed with a per-session key in the Mac's data-protection keychain, and kept out of Time Machine and Spotlight. Deleting a session destroys its key. I say that makes the data unreadable, not erased, because APFS snapshots can keep the encrypted files for a while. The audit log records events and counts, never text, and names the client only by a keyed hash.

Agencies that want audio can keep it encrypted until the note is confirmed, or for a set number of days, and can lock these settings with a configuration profile.

The note model is not yet as accurate as I want. In the latest held-out run in the repository, on two synthetic transcripts it was never tuned on, it got 84% and 88% of the clearly answered fields right, against a gate of 90%. Most misses were blanks left for the worker, but it also answered a few fields it should have left blank. That is why nothing reaches the chart without review.

The security review in the repository lists the risks we accepted. The largest is that Scribeski's script shares the EHR page's JavaScript environment, so it trusts the EHR's own page. Hiding client text from screen sharing is best effort, so workers should not share their screen while reviewing.

The code, the design, the build plan and the security review are all public. If you run an agency and want to pilot it, or you find something it gets wrong, I would like to hear about it.