cashcrown // wiedza
How we build and how we verify — in the open. Each standard is a promise paired with the practice that enforces it. NO FAKE-DONE is a method, not a slogan.
A step is “done” only when it passes a hard gate with proof — a green test, a log, or a screenshot. We don't claim completion on our word.
How we enforce it: Every phase leaves an evidence artifact. We reconcile acceptance criteria to the code, never bend the criteria to fit the code. A red gate means the phase stays open.
Our process →The data model, API contracts and validation rules come before the visual layer. The interface reflects a solid core, not the other way round.
How we enforce it: Typed contracts (strict TypeScript / Pydantic v2), versioned migrations, validation that fails closed by default. A gate rejects any model↔migration drift.
When a feature's convenience clashes with privacy or security, privacy and security win. Secrets never enter the repository.
How we enforce it: Consent before tracking, data minimisation, real erasure on request. A compliance-audit gate blocks non-compliant actions; hooks guard against secret leaks.
Our GDPR →We process sensitive data locally. Embeddings and vector search run on our own infrastructure — content never leaves the server.
How we enforce it: A local BGE-M3 model computes embeddings, a local Qdrant holds the vectors. Only a masked prompt reaches the cloud — a deliberate data-residency choice.
Data residency →All AI traffic goes through one router. No piece of code calls a provider directly — so control is enforceable in a single place.
How we enforce it: The OpenClaw router masks PII before the cloud, picks the model per task with a fallback chain, enforces concurrency limits and records telemetry — all at one ingress.
LLM router →Every page works with a keyboard, a screen reader, and without JavaScript for its content. Accessibility is a requirement, not an add-on.
How we enforce it: Content rendered server-side (indexable, no-JS), an axe WCAG 2.2 AA gate on pages, contrast and focus verified automatically.
You cannot govern cost or quality without measuring it. Every model call is countable and debuggable.
How we enforce it: Prometheus-format metrics, request-id-correlated logs, distributed traces, and cost budgets with throttling plus a kill-switch.
The assistant's answers are grounded in our materials and cite sources. When confidence is low we hand off to a human instead of guessing.
How we enforce it: RAG with a confidence threshold and citations, guardrails on input (anti-injection) and output (price ranges, hedged deadlines), escalation on a weak match.
Hallucination →Related: process · RODO · AI glossary