A privacy-first command center for bills, cards, and financial notices — built on deterministic rules, with no bank links and no AI in the loop. Four diagrams on how it keeps your facts and forgets your documents — and how it's built to add AI safely later. One visual language throughout: amber is the live path, dashed amber is planned.
Live intake is three doors — paste an email, snap a bill on your phone, or bulk-paste a batch — plus more planned ones. They funnel into one normalized intake_item, get their fields pulled by a deterministic pattern-matcher, and stop at a single review gate. Nothing auto-commits: you approve every field before it reaches the ledger, or reject it to the archive.
The raw pasted text is held only until you approve the structured fields — then raw_body is nulled out. LedgerLamp keeps the amount, the due date, the biller; it does not keep the document. Photos never reach the server, full card numbers are never stored, and you choose how long anything lives. With one exception, named here rather than buried: the extraction audit trail keeps the short snippet the model cited for each field — the evidence that makes a proposal checkable after the fact — and those rows are not yet covered by the retention setting. Found in our own audit, ticketed, and disclosed while it is still true.
Account fields run a fixed gauntlet of rules — no external calls, no model — and come out as a severity-sorted to-do list, each item expandable into plain-English "why this matters" and a recommended action. The engine's smartest move: it separates due date from statement-close date, the distinction most people conflate.
Every replaceable part sits behind an interface, so a later version can swap in without a rewrite. The headline upgrade: an LLM extractor proposes, a separate deterministic auditor disposes — it scores each field against the source and routes anything low-confidence back to the same human gate from chapter one. The auditor only flags; it never writes. That split is now live and running in production. The five interface sockets below it are still planned — drawn dashed to say so.