EingangsLotse

EingangsLotse reads an inbound item - a structured form or a free-text letter, scanned or born digital - and prepares the decision about whether a human has to look at it. It never takes that decision itself.

Two planes, and only one of them decides. The evidence plane is allowed to be probabilistic: extraction, a zero-shot unit classifier, an anomaly scorer. The decision plane is a versioned decision table that reads only what is proven. Same evidence plus same configuration equals the same decision, every time.

The valve only opens one way. Uncertainty can add oversight and can never remove it. That is not a convention: it is proved on every commit against the real decision table and the 101 evidence records of the frozen gold set.

Identity is sealed at ingest, before a journal event exists. Identity-classed fields go into a vault and the working copy carries randomized placeholders from a reserved alphabet; a post-redaction sweep computes whether the item is clean instead of asserting it. Re-hydration happens once, at render time, in the one module that reads the vault.

No model-written sentence reaches a citizen. Notifications render from templates in versioned configuration and prepared decisions wait for a human. A language model may read; it may never write to an applicant.

The journal is the only truth. Every event is append-only and version-stamped; queues, metrics and the case view are folds over it. A correction appends, and a second confirmation is refused rather than overwritten.

Three statutory-pension procedures are configured: old-age pension, reduced-earning-capacity pension, and the employment-status determination under par. 7a SGB IV. The last one deliberately ships no clear-cut criteria, because its decision is a statutory overall appraisal: a formally complete application still ends at the highest review tier, by design.

This is a prototype with a complete pipeline, not a production system. There is no authentication, no database, the vault's development backend writes plaintext JSONL, and every measured number comes from a synthetic corpus. The public demonstration instance accepts no submissions from outside.