Doctrine
Why it works this way
Mintmark is a bet that the interesting question about AI in personal finance is not "what can the model do?" but "what should the model be structurally unable to do?" Every principle below is a constraint, and every constraint is enforced by code, not by intention.
Zero invention
The model never fabricates a number. Not a plug to close a gap, not an estimate of a missing fee, not an inferred date. Every row in the ledger carries its source — a document id, a feed record, or an owner's explicit instruction with the date it was given. When the machinery meets a figure it cannot source, the correct output is a question, and a question with no changes attached is treated as a fully successful result.
This is the load-bearing rule: a ledger is only useful if you can stop double-checking it. One invented number taxes every other number forever.
Fail closed
The gate's whole contract fits in a sentence: a run the reviewer did not approve does not commit. Reviewer times out — no commit. Quota exhausted — no commit. Output malformed — no commit. The work is never lost; it lands on a branch with the verbatim error attached. But the mainline of the book only ever moves through an approval.
A gate that waves changes through when the reviewer is unavailable is not a weaker version of this design — it is a different design that looks similar on good days.
Documents are the authority
Aggregator feeds are fast, convenient, and occasionally wrong. Bank statements are slow, tedious, and legally answerable. Mintmark uses both and confuses neither: feeds give the book freshness, and their rows are marked provisional until a document covers them; documents give the book truth, and the balances they print become permanent validation anchors the ledger must reconcile against forever. When a feed and a document disagree, there is nothing to discuss — the document wins, and the disagreement is filed on the Exchequer's docket with a deadline.
Derive, don't accumulate
The ledger is rebuilt from its inputs every day, from scratch, deterministically. Artifacts are never edited — only inputs are, through reviewed commits, after which the machine re-derives everything. So the book cannot drift: any state it is ever in can be reproduced by replaying its inputs, and "fix it by hand just this once" is not merely forbidden but useless, because tomorrow's rebuild would erase the fix.
False versus late
Most systems have one bucket for "problems." Mintmark has two, split on a single line: is the book false, or is something merely late?
- False — an invariant is breached right now: money from nowhere, shares never bought, a document balance that doesn't reconcile. False blocks the commit, and no human can close it, because it isn't an opinion — it opens when the computation says so and closes when the computation stops saying so. The only exits are fixing the data or declaring a documented exception through the same reviewed path as any other change.
- Late — nothing is untrue, but something should have happened by now: a transfer's other leg hasn't posted, a staged branch sits unmerged, a question awaits an answer. Late never blocks: it is filed on the docket with a deadline, snoozeable to a date with a reason, and it closes itself the moment reality catches up.
Collapsing these two is how systems rot in one of two directions: either everything blocks and the operator learns to override, or nothing blocks and the operator learns to ignore. Keeping them apart is what lets the blocking set stay absolute — because it is small, mechanical, and free of judgment calls.
The human is sovereign
The machines surface; the owner decides. Every AI in the system is a subordinate office — a reviewer, a clerk, a keeper of records — and the structure makes insubordination impossible rather than discouraged. The Remembrancer cannot reach the mainline; its branch namespace is a constant in code. Its edits cite the owner's words as their authority. Policy questions — how to classify an ambiguous purchase, whether a standing discrepancy is acceptable — are never answered by default; they wait, on the record, for a ruling.
And every ruling is written down. The book carries an append-only decision journal: dated entries, newest first, never edited — a reversal is a new entry naming what it supersedes. A verdict rendered a year from now can cite the exact decision that authorized the pattern it is looking at.
Code decides; the model narrates
Wherever an AI participates, the consequential predicate is computed,
not claimed. Whether a chat session changed anything is git
status, not the model's summary. Whether its work may be pushed is
the validators' exit codes, not its confidence. Whether a run may commit is
the gate harness reading a structured verdict, not prose. The model's
judgment is genuinely load-bearing in exactly one place — is this diff
what the evidence claims it is? — and even there, its failure mode is
a branch and a message, never a commit.
The same discipline runs in the other direction: the model deserves evidence it can actually judge. When a step fails, its error text is captured and published into the reviewer's evidence; a reviewer asked to approve a failure it cannot read is being asked to rubber-stamp, and the correct answer to that is refusal.
Memory with provenance
The system's memory is not a vector store; it is three markdown files in a git repository — working memory, institution quirks, and the decision journal — versioned with the data they describe, reviewed like code, travelling with every clone. When the reviewer remembers that a certain institution posts dates a day late, that memory has an author, a date, and a diff. Memory that cannot be audited is just another way to invent numbers.
Boring on purpose
Under the AI layer, Mintmark is aggressively conventional: CSV files, git, cron, one derivation pipeline, invariants checked exhaustively rather than sampled. That is deliberate. The novel part of the system — a machine reviewer with memory and standing — only earns trust if everything beneath it is legible enough to check by hand. The exotic sits on top of the boring, never the other way around.