Architecture

The pipeline has two metered stages and a deterministic spine. For a scanned contract, perceive-scan (OCR) runs first — a vision read of the page. For every format, analyze-clauses then runs over the clause set. The format gate is the cost lever: a digital PDF or Word file never enters the OCR stage, so it costs strictly less than a scan. Everything after the model read is deterministic: clause risk is authored, the composite score is min(100, high×28 + medium×12 + jitter), the confidence and triage band are computed, and the amendment register is derived from the high-risk clauses.

Both stages run dual-mode. OCR uses Cloud claude-haiku-4-5 vision or the OSS qwen2.5vl:7b model recorded on local M4 hardware; clause analysis uses Cloud claude-haiku-4-5 or the OSS qwen3:8b model recorded on local M4 hardware. Cloud is cost-capped and fail-closed — over the cap it falls back to the recorded OSS path at $0 — and the prototype default is OSS-only (no API key). The deterministic clause-risk and confidence floor is authoritative; the model read informs the confidence, it does not override the rule. Each stage writes a cost_ledger row through the shared store, visible only in the dark inspector.

The app owns the demo_eco_c6_contract table — partner, title, kind, format, signed date, extracted commission, the clause array with per-clause risk, confidence, risk score, triage band, the amendment list, and the analyzed flag. Partners are derived from the shared properties' partnerId. It emits contract.analyzed (consumed by #13 scorecards). The data invariant holds: an owner's analysis is canonical; a viewer's is credential-scoped, ephemeral, and reset-clearing, and a setWhere guard means a viewer run can never clobber a seeded canonical contract. In Stage-2 the in-memory adapter is swapped for the Drizzle repository behind the same method surface.

All contract text is synthetic authored boilerplate — there is no real or copyrighted contract, no real partner, no PII. The model read is downscaled and recorded; the figures are representative. Nothing here moves money or sends a message; the settlement and refund money rails are simulated in their own apps (#34, #21) and labelled there.