Help us prove private reciprocal matching can work at scale

Claims and evidence

How do we handle information that may be wrong, stale, contradictory, or misleading?

Our architecture answer

We do not build a lie detector.

We preserve who said what, when, for which purpose, from which source, with which confidence basis, and through which version lineage. Assertions, model proposals, bounded verifications, corrections, and contradictions remain different states. When a disputed fact matters, the system asks for the minimum clarification or stronger evidence it needs.

The boundary

No honesty, trustworthiness, or universal truth score follows a person. Contradictions may reflect change, context, uncertainty, or a bad extraction. Safety and fraud concerns go to a dedicated, accountable process; insufficient evidence produces qualification, pause, or abstention.

Proof still required

Versioned evaluation cases must measure source coverage, contradiction handling, correction propagation, unsupported-claim refusal, and abstention without turning model confidence into truth.

Bounded retrieval

How can matching stay bounded across billions of stored and derived records?

Our architecture answer

Never compare everyone with everyone.

Offline, purpose-scoped projections divide the corpus by lane, role, geography, time, policy, and model version. Hybrid retrieval searches only compatible partitions and returns a bounded union. PostgreSQL then rechecks current consent, blocks, expiry, and hard constraints before reciprocal scoring reduces the set again.

The boundary

Indexes and vectors help recall; they never own identity, permission, or eligibility. The online path stops at 1,000 retrieved intentions, 200 policy-eligible candidates, 50 reciprocal pairs, and 3–10 deep reviews—often producing no proposal.

Proof still required

The specified target corpus remains 100 million active intentions. Billions of stored and derived records describe an architecture pressure, not proven capacity. A versioned synthetic benchmark must prove recall, skew, freshness, p50/p95/p99 latency, resource cost, invalidation, and recovery at the stated candidate budgets.

LLM infrastructure

How do we run models we can actually depend on?

Our architecture answer

Put models inside a governed system.

NestJS services authorize each task. Mastra orchestrates approved model calls through typed AI SDK boundaries using privacy-minimized context plus versioned prompts and models. Schemas reject malformed output, Temporal owns durable retries and reconciliation, and PostgreSQL keeps canonical state. Langfuse is the approved target for privacy-minimized traces, evaluations, versions, latency, and cost evidence.

The boundary

A model may propose, classify, or abstain. It cannot turn its own output into truth, consent, policy, or a connection. If no safe model route meets the floor, the system returns an explicit unavailable or abstained result instead of fabricating success.

Proof still required

Every meaningful model, prompt, context, retrieval, provider, or orchestration change needs versioned evaluations for schema validity, groundedness, leakage, refusal, retries, latency, cost, regressions, rollback, and kill-switch behavior.