Layered architecture · examiner-grade
A hexagonal skeleton for CU back-office automation — lending is the worked example on this page. The same skeleton (a pure domain kernel at the foundation, one SDK boundary onto the Go.Abacus substrate, a posture-aware Document Intelligence Gateway as the crux) is constructed for each vertical: lending, deposit ops, member experience, and the rest of the back office. The same signed artifact runs on-appliance (Go1) in a member's server room or in cloud / VPC — the deployment posture re-routes the gateway between on-device (zero-egress) and external vendors. Press ▶ Explain every step for a slow, narrated walkthrough: it spotlights each part of the stack in order while a balloon explains exactly what happens to one origination — auto-advancing every few seconds, with pause and click-through at your own pace. Switch the posture mid-tour and the story re-routes live. Open any + details drawer for the real contracts, thresholds, tiers, routing rules, and state machines.
originate() runs one identical pipeline; matrixFor + policyFor supply the only product-specific config.
The one place everything meets: builds the gateway + valuation providers from the injected posture & host ports.
Originates one auto and one HELOC application through the identical shared flow.
INCOME — paystub / W2 / bank stmtAUTO_INSURANCE — carrier · vin · coverageStartRESIDENCE — proof of residenceIDENTITY — driver's licenseINCOME — paystub / W2 / tax returnHOMEOWNERS_INSURANCE · FLOOD_INSURANCE (SFHA only)FIRST_MORTGAGE · VALUATION · TITLEIDENTITY — driver's licensebuildGateway() — register OnDevice + 3 vendor adapters under the posture's egress + routingmatrixFor(product) → run clearStipulations() through the gatewayincomeVerified = INCOME stip CLEAREDcollateralValue → resolveCollateralValue() via valuation providersevaluate(input, policyFor(product)) → deterministic DecisionbuildAdverseAction() from reason codes (only on DECLINE)host.audit.append("clp.decision.recorded") — outcome + policyVersion + reasonCodes{ product, posture, stipulations[], allStipsResolved, decision, valuationSource?, adverseAction? }apiKeyRef → host secret store (secret://…), never keys in codeNotices render purely from deterministic reason codes; the optional LLM rephrase never alters a reason.
buildAdverseAction(decision, ctx) → AdverseActionNotice | null (null unless DECLINE). ECOA up to 4 principal reasons + FCRA score disclosure.
| ReasonCode | ECOA principal-reason text |
|---|---|
CREDIT_SCORE_BELOW_MIN | Credit score did not meet our minimum requirement (triggers FCRA disclosure) |
DTI_EXCEEDS_MAX | Debt-to-income ratio exceeded our maximum |
LTV_EXCEEDS_MAX | Requested amount exceeded allowable loan-to-value |
CLTV_EXCEEDS_MAX | Combined loan-to-value exceeded our maximum for this property |
INSUFFICIENT_COLLATERAL_VALUE | Value of the collateral was insufficient |
INCOME_NOT_VERIFIED | Unable to verify income from documents provided |
COLLATERAL_VALUE_MISSING | A collateral valuation was not available |
draftNarrative(notice, narrator) uses the Go.Abacus model port to rephrase the body into warm prose — reasons stay fixed.
The examiner-defensible core. The credit decision is versioned rules — never an LLM.
evaluate(input, pack) → { outcome, tier?, aprBps?, metrics{dti,ltv}, reasonCodes }. Any reason ⇒ DECLINE; else tier match ⇒ APPROVE, else REFER.
clearStipulations() maps each gateway verdict onto the state machine: PASS→CLEARED · FAIL→FAILED · REVIEW→MANUAL_REVIEW.
First supporting provider wins → LTV/CLTV. Manual is zero-egress (conf 1.0) so air-gapped still underwrites.
auto-2026.07 — minScore 580 · maxDTI 0.50 · maxLTV 1.25| Tier | min score | APR |
|---|---|---|
| A | 740 | 5.99% |
| B | 680 | 7.99% |
| C | 620 | 11.99% |
| D | 580 | 16.99% |
heloc-2026.07 — minScore 660 · maxDTI 0.43 · maxCLTV 0.85| Tier | min score | APR |
|---|---|---|
| A | 760 | 7.49% |
| B | 720 | 8.99% |
| C | 660 | 10.99% |
POST /v1/vehicle/value (NADA/JDPower-class) · Bearer · conf 0.9 · ASSUMED shapePOST /v1/avm · Bearer · conf from response (~0.75) · ASSUMED shapeOne contract, swappable adapters. route() + verify() audit every choice; below the confidence floor a PASS is forced to REVIEW.
Go LLM + Indexer. Prompt → grounded JSON. PASS/REVIEW only — never FAIL. Always the last-resort fallback (never egresses).
Injectable HTTP transport + host-resolved secret refs.
resolvePosture(env CLP_POSTURE) — defaults airgapped. Sets egress policy + per-doc routing.
on-device | informed-iq | infrrd | landing-ade · on-appliance | external-vendor{ docType, confidence }{ fields[]: {name, value, confidence, grounding{page,bbox}}, minConfidence }{ stipulationCode, status, reason, evidence[] }| doc type | BEST_OF_BREED order (vpc / hybrid) |
|---|---|
| PAYSTUB · W2 · BANK_STATEMENT · AUTO_INSURANCE · PROOF_OF_RESIDENCE | informed-iq → on-device |
| MORTGAGE_STATEMENT · HOMEOWNERS_INSURANCE · FLOOD_INSURANCE | infrrd → on-device |
| PROPERTY_APPRAISAL · TITLE | infrrd → landing-ade → on-device |
| TAX_RETURN · DRIVERS_LICENSE | landing-ade → on-device |
| posture | host | allowExternal | conf. floor | routing |
|---|---|---|---|---|
airgapped | appliance | false | 0.85 | on-device only |
vpc | cloud / VPC | true | 0.80 | best-of-breed |
hybrid | appliance + cloud | true | 0.82 | best-of-breed (primary) |
parse → extract · grounding from extraction_metadata.references · VERIFIED · api.va.landing.aiupload → submit → poll → result · shapes ASSUMED (enterprise API)Audit events: dig.route.selected · dig.route.refused · dig.verify.completed. Below-floor PASS → REVIEW "(confidence below floor)".
Every host call passes through here as a typed port, so the pure core never sees the SDK — and never knows whether it's on an appliance or in the cloud.
GoOsHost aggregates the host ports; helpers bind identity & secrets into the audit trail.
GoOsHost { model, indexer, audit, identity, secret, agent }os.model.complete — Go LLM (assistive only)os.indexer.search — policy / guidance / historyos.audit.append / list — hash-chainedauditSinkFrom(host) · secretResolverFrom(host) · nowIso() · Go1osError (typed, HTTP status)Entities and state machines with no I/O and no SDK import — the foundation both verticals and every engine plug into.
Product-agnostic types. Money = integer minor units, USD, never float. Prefixed IDs (app_ who_ loan_ doc_ stip_). Doc bytes stay on the host (sha256).
Transitions are data, not scattered ifs — auditable, diffable, identical for both products. assertLoanTransition() throws IllegalTransitionError.
loanTransitions(product)RESCISSION_WINDOW (Reg Z) is HELOC only — inserted between CLOSING and FUNDED via config; auto funds directly. Terminal branches: DECLINED WITHDRAWN. Gate: enter UNDERWRITING only when allStipulationsResolved().
FAILED → REQUESTED (re-submit) · MANUAL_REVIEW → CLEARED | FAILED | REQUESTED.
vin · year · make · model · bookValue?address · appraisedValue? · existingLiens? · inFloodZone? (SFHA gate)code · requiredDocTypes[] · status (7 statuses)On-prem AI OS. One signed artifact runs on either target — the posture selects which, and the confidence floor.
member's server room · true air-gap
NVIDIA Blackwell appliance in the credit union's own facility. Zero data egress; on-device extraction only. The compliance moat.
dedicated private cloud · elastic
Managed, single-tenant deployment with geographic data residency. Governed, audited routing to external vendors permitted within the VPC boundary.
manifest/go1pkg.json → signed .go1pkg · ed25519 publisher key · host verifies signature + payload digest before install — on appliance or in cloudmodel · indexer · audit(rw) · agent · identity — "denials are evidence"