A privacy-first command center for bills, cards, and financial notices — built on deterministic rules, with no bank links and no AI in the loop. Four diagrams on how it keeps your facts and forgets your documents — and how it's built to add AI safely later. One visual language throughout: amber is the live path, dashed amber is planned.
Live intake is two doors — paste an email, or snap a bill on your phone — plus more planned ones. They funnel into one normalized intake_item, get their fields pulled by a deterministic pattern-matcher, and stop at a single review gate. Nothing auto-commits: you approve every field before it reaches the ledger, or reject it to the archive.
The raw pasted text is held only until you approve the structured fields — then raw_body is nulled out. LedgerLamp keeps the amount, the due date, the biller; it does not keep the document. Photos never reach the server, full card numbers are never stored, and you choose how long anything lives.
Account fields run a fixed gauntlet of rules — no external calls, no model — and come out as a severity-sorted to-do list, each item expandable into plain-English "why this matters" and a recommended action. The engine's smartest move: it separates due date from statement-close date, the distinction most people conflate.
Every replaceable part sits behind an interface, so a later version can swap in without a rewrite. The headline upgrade: an LLM extractor proposes, a separate deterministic auditor disposes — it scores each field against the source and routes anything low-confidence back to the same human gate from chapter one. The auditor only flags; it never writes. Everything on this page is planned, not yet built — drawn dashed to say so.