Analysis Compute Engine: Addi Architecture Disclosure

Overview · Modules · Analysis Compute Engine

What it is

Cache the data, compute the meaning

The analysis compute engine is the deterministic service that turns a verified address into evidence. It sits behind one seam, in its own failure domain, separate from the reactive backend that owns transactional work. The backend dispatches an analysis through one async entry point; the engine resolves the address once into the geographic identities its sources require, queries every data source in its native geography, serves what it can from our pre-cached reference layer, computes meaning in deterministic code, and returns four reports plus structured findings through one signed callback.

We call the governing idea "cache the data, compute the meaning." Reference data is pre-cached nationally and served locally at analysis time, cache-first with freshness tiers that vary by data kind, because a fact drawn from public government and open-data sources ages differently from a fact about the live market. Interpretation is deterministic code throughout. There is no language model anywhere in the data producers. We considered the obvious alternative, generative analysis, and rejected it: a report a customer underwrites against must be reproducible, explainable value by value, and stable under re-run. The agent owns synthesis and grading on top of the engine's output; the engine itself never guesses.

The skeptical reader will ask why this is a separate service at all rather than in-process analysis. Two reasons. First, failure isolation: analysis reaches out to external sources that can be slow, wrong, or down, and none of that may ever degrade the transactional backend a user is clicking on. Second, the work is genuinely different in kind. The backend stays TypeScript and reactive, shaped for transactional work. The engine is a deterministic service in its own failure domain behind the seam, and it offloads the genuinely heavy work, source document retrieval, spatial joins, and document parsing, to a serverless Python tier, since that is Python work and has no business inside a reactive backend. The seam is where the engine meets the transactional backend, and keeping it to one async entry and one signed callback is what keeps the meeting honest.

The questions it answers

For the investor or operator

This unit answers: what is this property, what is it worth against real comparable sales, what is the market around it doing, what does the zoning actually permit, and how much can each of those answers be trusted. Every value in the four reports carries provenance and confidence, in words, so the reader knows whether a number came from an authoritative record or an inference over coarser geography.

Scope and boundaries

What it owns, and what it does not

In scope: resolving the address into the geographic identities its sources require, source querying in native geography, the pre-cached reference layer read path, deterministic computation of the four report types (comparable-sales valuation, market read, zoning, property snapshot) plus structured findings, and delivery through the signed callback. External access is rate-gated through one governor, and a failing route degrades the analysis instead of stalling it.

Out of scope: report storage and versioning (the reports unit owns the folder of artifacts), the projection of findings into editable fields (the deal workspace and reports units), underwriting math (the calculator), and agent synthesis (the agent surface). All reference data is reached through one access module; producers never touch storage directly. That boundary is what the designed storage swap counts on: the swap is designed, not yet run in anger, and the boundary is what would keep it a one-module change rather than a rewrite.

What it is NOT

It is not a report renderer (it returns structure; presentation lives upstream), not a data warehouse (it reads through the warehouse boundary like everything else), not an AI service (no model in any producer), and not a general job runner (it does one thing: analysis of a verified address).

Withheld by design Tier 3

The identity of any external data source, producer internals, freshness tier values, and per-run economics are held at Tier 3, as is the source-level walkthrough.

Withheld by design Tier 2

Deeper interface and controls detail is held at Tier 2.

The contract

The unit's public shape

What it is responsible for, the one door in, the facts it announces, what it guarantees, and what it refuses. No fields, no schemas, no payloads; those live below contract shape and are held at Tier 2.

Responsibilities

Resolve a verified address once into the geographic identities its sources require, so that every downstream source can be queried in its own native geography rather than forced through a lossy translation.
Gather evidence cache-first from the pre-cached reference layer, with freshness tiers that vary by data kind, reaching outward only through the one rate governor and degrading rather than stalling when a route fails.
Compute the four reports (comparable-sales valuation, market read, zoning, property snapshot) and their structured findings deterministically, with provenance and confidence carried on every value.
Deliver results through one signed callback, and nothing else. The engine initiates no other writes into the platform.

The write door

The seam is the door, and it is deliberately a single async entry point: the backend dispatches a verified address, and the engine acknowledges and works asynchronously.

That the door admits one action is the design, not a simplification for this document. A compute engine that accepts many entry shapes accumulates many failure shapes. Re-runs arrive through this same entry; the reports unit turns each completed run into a new artifact version, so the engine never needs an "update" verb.

Events announced

Analysis completed. Delivered as the signed callback, carrying the four reports and the findings, with the tenant identity echoed for verification, and marked for idempotent ingestion so a replayed delivery cannot double-land.
A completed analysis states its own coverage honestly: when a producer failed soft, the result says so through reduced confidence rather than through silence.

The engine announces facts about work it finished. It does not emit progress chatter, and it does not announce into any other module's domain.

Guarantees

Determinism. The same address against the same cached data yields the same reports. There is no language model in any producer; interpretation is code.
Fail-soft completion. One missing source never blocks the analysis. The engine degrades the affected report's confidence and completes.
Isolation. The engine is its own failure domain. A slow source, a bad parse, or a dying job inside the seam cannot degrade the transactional backend.
Signed, idempotent, tenant-checked delivery. Every callback is HMAC-signed, safe to replay, and carries the tenant echo that the receiving side verifies before anything lands.
Geographic honesty. A value inherits the precision of the geography it came from and is never presented finer. Independent reads that disagree are surfaced as disagreement.
Governed egress. All external access flows through one rate governor, and a failing route degrades the analysis instead of stalling it.

Refusals

It refuses to guess. Where evidence is absent, the result says so; nothing is invented to fill a report.
It refuses direct storage access. All reference data is reached through the one warehouse access module, the boundary the designed storage swap depends on.
It refuses to be a general-purpose job runner. Work that is not the analysis of a verified address does not enter this door.
It refuses unsigned or tenant-mismatched callbacks at the seam.
It refuses to average away disagreement between sources to produce a cleaner-looking number.

What done means

The gates a change passes

Done for this unit is not "the reports render." Done is that the engine keeps its promises in the cases that would break them: sources down, records wrong, callbacks replayed, geography coarser than the question. Every load-bearing rule below is expressed as code, a typed contract, a server-side check, or a failing test, never as prose discipline; that is one of our two build gates and this unit is where it earns its keep.

The determinism gate. A build must demonstrate that the same address against the same cached data produces the same reports, and that no generative step exists anywhere in a producer. Interpretation is deterministic code or it does not ship.
The fail-soft gate. Producers are exercised with sources deliberately removed. The analysis must complete, and the affected values must carry honestly reduced confidence.
The seam gate. Callback handling is proven against the hostile cases: bad signature, replayed delivery, tenant mismatch. Ingestion must be idempotent and the tenant echo must be verified before anything lands.
The boundary gate. Reference data is reached only through the one warehouse access module. The boundary is held by the access module's contract and enforced in review; the designed storage swap is only real if no producer has quietly grown its own storage path, and that is exactly what the review looks for.
The honesty gate. Provenance and confidence are present on every value, in words, and precision never exceeds the source geography's.

The failing cases

A single unavailable source blocks the whole analysis. Fail-soft is the contract; a blocking producer is a defect even when every source is usually up.
A callback lands without a valid signature, or with a tenant echo that does not match the dispatch. Either one is a seam breach, not an edge case.
A replayed callback double-lands results. Ingestion that is not idempotent fails the build.
A language model appears inside a data producer. Synthesis belongs to the agent, above the engine; a generative step inside a producer breaks determinism and fails the build.
A producer reads or writes storage directly. The warehouse boundary is the whole point; a bypass fails the build even if it works.
A value is presented at finer precision than the geography it came from. Looking more certain than the data is a correctness failure here, not a styling choice.
Two independent reads disagree and the result shows a single averaged number. Disagreement is signal for the reader, never something to smooth away.
A failure inside the engine degrades the transactional backend. The seam exists to make this impossible; any leakage across the failure domain fails the build.
An outbound call bypasses the rate governor. Governed egress is a property of the whole engine, not of the well-behaved producers.

Honest-state behaviors

The engine's defining quality behavior is that its results tell the truth about themselves. A completed analysis states where each value came from and how much it can be trusted. When a producer failed soft, the report says less and says so, rather than saying the same amount with quiet gaps. When public records are wrong, the platform's correction mechanism (owned by the reports unit) short-circuits downstream reads; the engine's part of that bargain is never to overwrite honesty with confidence it did not earn. And when the reader asks how a number was computed, the answer is deterministic code that gives the same answer tomorrow.

Withheld by design Tier 3

The specific producer test suites, producer computation internals, and freshness tier values behind these gates are held at Tier 3.

Where it connects

The spine sections this unit realizes

Section 11, the compute engine and the warehouse seam: the full reasoning for the seam, the failure domain, and the designed storage swap.
Section 3, the failure model: the failure classes this unit is built to absorb.
Section 9, the evidence chain: where the engine's findings enter the one-way chain from artifacts to fields to underwriting.
Section 12, proprietary data assets: the reference layer and zoning corpus this engine reads.
Section 15, technology summary: the named technologies behind the compute split.