A privacy-first command center for bills, cards, and financial notices — deterministic rules decide, no bank links, and the one place a model reads a bill, code checks it field by field before you see it. Four diagrams on how it keeps your facts and forgets your documents — and where the model is allowed in. One visual language throughout: amber is the live path, dashed amber is planned.
Live intake is three doors — paste an email, snap a bill on your phone, or bulk-paste a batch — plus more planned ones. They funnel into one normalized intake_item, get their fields pulled by a deterministic pattern-matcher, and stop at a single review gate. Nothing auto-commits: you approve every field before it reaches the ledger, or reject it to the archive.
The raw pasted text is held only until you approve the structured fields — then raw_body is nulled out. LedgerLamp keeps the amount, the due date, the biller; it does not keep the document. Photos never reach the server, full card numbers are never stored, and you choose how long anything lives. With one exception, named here rather than buried: the extraction audit trail keeps the short snippet the model cited for each field — the evidence that makes a proposal checkable after the fact — and those rows are not yet covered by the retention setting. Found in our own audit, ticketed, and disclosed while it is still true.
Account fields run a fixed gauntlet of rules — no external calls, no model — and come out as a severity-sorted to-do list, each item expandable into plain-English "why this matters" and a recommended action. The engine's smartest move: it separates due date from statement-close date, the distinction most people conflate.
Every replaceable part sits behind an interface, so a later version can swap in without a rewrite. The headline upgrade keeps the spine — facts in code, judgment in the model: an LLM extractor reads each field, and a separate deterministic auditor scores it against the source and routes anything low-confidence back to the same human gate from chapter one. The auditor only flags; it never writes. That split is now live and running in production. The five interface sockets below it are still planned — drawn dashed to say so.