EingangsLotse reads an inbound item - a structured form or a free-text
letter, scanned or born digital - and prepares the decision about whether
a human has to look at it. It never takes that decision itself.
Two planes, and only one of them decides. The evidence plane is
allowed to be probabilistic: extraction, a zero-shot unit classifier, an
anomaly scorer. The decision plane is a versioned decision table that
reads only what is proven. Same evidence plus same configuration equals
the same decision, every time.
The valve only opens one way. Uncertainty can add oversight and can
never remove it. That is not a convention: it is proved on every commit
against the real decision table and the 101 evidence records of the
frozen gold set.
Identity is sealed at ingest, before a journal event exists.
Identity-classed fields go into a vault and the working copy carries
randomized placeholders from a reserved alphabet; a post-redaction sweep
computes whether the item is clean instead of asserting it. Re-hydration
happens once, at render time, in the one module that reads the vault.
No model-written sentence reaches a citizen. Notifications render
from templates in versioned configuration and prepared decisions wait for
a human. A language model may read; it may never write to an applicant.
The journal is the only truth. Every event is append-only and
version-stamped; queues, metrics and the case view are folds over it. A
correction appends, and a second confirmation is refused rather than
overwritten.
Three statutory-pension procedures are configured: old-age pension,
reduced-earning-capacity pension, and the employment-status determination
under par. 7a SGB IV. The last one deliberately ships no clear-cut
criteria, because its decision is a statutory overall appraisal: a
formally complete application still ends at the highest review tier, by
design.
This is a prototype with a complete pipeline, not a production
system. There is no authentication, no database, the vault's
development backend writes plaintext JSONL, and every measured number
comes from a synthetic corpus. The public demonstration instance accepts
no submissions from outside.