Buy Box: Addi Architecture Disclosure

Where criteria stop being a feeling

The buy box is where an investor's acquisition criteria stop being a feeling and become explicit, typed, per-tenant data. Each tenant states what a deal must be for them, and the platform holds every deal against that statement as a living fit verdict: the verdict is computed per deal and re-evaluates as the deal's facts change, so it is always a read on the current evidence, never a snapshot that quietly went stale.

We built it this way because the alternative, a scoring model that emits a number, fails the people who have to act on it. An operator cannot argue with a number, cannot audit it, and cannot teach it. Explicit criteria can be read aloud, disputed, and revised, and a verdict built from them can always say why.

The buy box holds a position no other unit holds: it is the only automatic pipeline mover in the whole product. When a deal falls outside the criteria, the buy box may reject it automatically, and it records its reasons when it does. Everywhere else in the platform, the agent recommends and a human decides. We drew the automation line here deliberately: rejection against criteria the tenant themselves authored is the one movement where the machine is executing a human's stated judgment rather than substituting its own. Learned preferences, drawn from observed human decisions, are phased in before any further automation is considered; we extend the machine's reach only after it has demonstrably learned what this tenant actually accepts.

What it owns, and what it does not

The unit owns the tenant's criteria, the per-deal fit verdict, and the auto-reject behavior. It does not own the deal's facts; it reads them and judges them. It does not own pipeline stages or their gates; when it rejects, it announces the fact and the pipeline responds through its own door. Criteria are explicit, typed, per-tenant data: the tenant authors them, and every verdict is computed against the tenant's current statement.

What it is NOT

It is not a black-box score. It is not a valuation and it is not underwriting; it judges fit against stated criteria, it does not compute worth. It is not an autonomous deal picker: outside the recorded auto-reject, it never moves anything, and even its learned layer only shapes recommendations until humans have proven it right.

The contract

The unit's public shape

What it is responsible for, how it is written to, what it announces, what it guarantees, and what it refuses. Field lists, schemas, and payloads are held at Tier 2.

Responsibilities

Hold each tenant's acquisition criteria as explicit, typed data that an operator can read, dispute, and revise.
Maintain a living fit verdict per deal: computed against the current criteria and the deal's current facts, re-evaluated when either changes.
Always carry the reasons alongside the verdict. Fit and the argument for it travel together.
Execute the product's only automatic pipeline movement: rejection of a deal that falls outside the criteria, with the reasons recorded at the moment of rejection.
Accumulate learned preferences from observed human decisions, and keep that learned layer advisory until it has earned more.

The write door

Like every module, the buy box has one write door, and it admits a small set of business-named commands. At this altitude the door admits two kinds of action:

Criteria authorship. The tenant restates what they buy; the restatement is explicit, typed data, and verdicts re-evaluate against it.
Decision capture. A human accepting or overriding a verdict is itself a business fact; the learned layer is built from observed human decisions.

Agent writes arrive through this same door under the same rules as human writes; agents get the door, never the tables.

Withheld by design Tier 2

The command roster, with its inputs, is held at Tier 2.

Events announced

The unit announces business facts, carrying identity plus the fact, never a data dump:

A deal's fit verdict changed.
A deal was automatically rejected at the buy box, with its reasons.

The pipeline, the agent surface, and any listening module react through their own contracts. The buy box does not reach into another module's tables to make anything happen, and no module reads its.

Guarantees

Every verdict can state its reasons, in terms that map to the tenant's own criteria.
Every automatic rejection is recorded with its reasons. Where the rejected deal lands is the pipeline's contract, which owns the shared terminal outcomes; the buy box announces the fact, it does not decide the destination.
The write law is enforced at the door and exercised by tests: a machine-produced judgment lands freely into empty or machine-sourced ground and never over a human-confirmed decision; over a human's decision it becomes a proposal awaiting acceptance.
The criteria are one explicit, typed, per-tenant statement, and every verdict is computed against the tenant's current criteria.
With the module off for a tenant, it is dead server-side: writes refuse, nothing evaluates, nothing moves.

Refusals

It refuses to move a deal forward. Advancement is human territory, gated by human approval at the pipeline's stages.
It refuses to act on criteria nobody stated. There is no default worldview smuggled in as a score; the tenant's explicit statement is the entire basis of judgment.
It refuses to emit a verdict without reasons, including in the automatic path.
It refuses writes from a disabled state, and it refuses any write that would violate the write law.
It refuses to let the learned layer act autonomously. Learned preferences inform; humans decide; automation is extended only after observed decisions justify it.

The gates a change passes

Done for this unit is not "the verdict renders". Done is the unit keeping its promises in the cases that would break them, proven mechanically, on the live surface.

The spec gate. No code before the outcome and the logic are settled with an explicit go-ahead: what a fit verdict must feel like to the operator, and the rules that keep that promise in the breaking cases, are written down first.

Load-bearing rules as code. The rules that carry this unit's promises, that a verdict always has reasons, that auto-reject is the only automatic mover, that the write law is honored at the door, are expressed as typed contracts, server-side checks, and failing tests, never as prose a future change can quietly ignore.

The program review. A reviewer walks the breaking cases: criteria change under a live verdict, a deal's facts change after a human has decided, a rejection fires, the module is switched off. The code must keep every promise in each, proven by real tests, not by narrative.

The code review. A separate pass for security, understandability, and consistency with the codebase. The writer is never the auditor.

The live-surface check. Done includes the surface holding up against the real backend in all four states: loading, empty, error, and content.

The failing cases

A criterion that cannot be stated in plain business terms fails. Explicit and typed is the whole point; an opaque input does not ship.

A verdict that cannot state its reasons fails. A bare fit or no-fit with no argument behind it is exactly the black-box score this unit exists to refuse.

An automatic rejection with no recorded reasons fails. The unit's one automatic power is conditional on full accountability; an unexplained rejection is an unaccountable one.

Any automatic movement other than buy-box rejection fails. If a build lets a recommendation, a learned preference, or an agent advance or move a deal on its own, the build is wrong regardless of how useful the movement looks.

A stale verdict fails. If the criteria or the deal's facts change and the verdict does not re-evaluate, the operator is reading a fiction labeled as a living read.

A machine write over a human-confirmed decision fails. The correct behavior is a proposal; anything that lands directly is a write-law violation, whatever produced it.

A disabled module that still evaluates or rejects fails. Feature off means dead server-side; a switch that only hides the surface has not switched anything off.

Honest-state behaviors

The verdict presents itself as a fit read against the tenant's stated criteria, not as a decision. The one exception, automatic rejection, announces itself as exactly that and shows its reasons; where the rejected deal lands afterward is the pipeline's contract.

The reasons are phrased in the tenant's own criteria terms, so a skeptical operator can check the verdict against what they actually said they buy.

The learned layer is honest about its maturity: it is phased in from observed human decisions and stays advisory until those observations justify more. We do not dress early inference up as settled judgment.

Empty is a real state. A tenant who has not yet stated criteria sees that plainly, not a fabricated verdict against criteria they never wrote.

The spine sections this unit realizes

Section 7, modules and boundaries: capability ownership, including the tenant's criteria as explicit, typed, per-tenant data this unit owns; the single write door; events announcing business facts.

Section 8, provenance and the write law: why the machine's verdict can never overwrite a human's decision, and why auto-reject is the one sanctioned automatic movement.

Section 2, quality goals: agent safety by traceability, never gates, of which the reasons-recorded rejection is the concrete case.

Buy Box