Invariants
Invariants — the standing assertions
Section titled “Invariants — the standing assertions”One assertion running in production would have caught the worst outage this system ever had (the comps engine silently valuing homes against the wrong neighborhood’s sales) on day one. Assertions are therefore release gates, not optional tests. The offline CI suite is active; the public production-canary streak remains open.
Status
Section titled “Status”Current working-tree state (2026-07-12): the hermetic suite runs against the real Worker with frozen fixtures and is merge-blocking. This is not a production-green claim; a public live endpoint and 14-day green streak remain open.
| ID | Assertion (plain words) | Why it exists | Status |
|---|---|---|---|
| INV-1 | Comp scans stay inside the declared radius/subject tract context and artifact evidence matches the valuation. | Wrong-neighborhood sales previously reached valuation. | active in CI |
| INV-2 | Identical subjects match across API/MCP/property surfaces. | Five same-address inconsistencies were found in the audit. | active in CI |
| INV-3 | No code path assumes a unit count. Missing units = explicit error. | The engine used to underwrite single-family homes as duplexes. | active in CI |
| INV-4 / stop-loss | Gated strategies cannot rank top-decile; range/area/suppressed evidence cannot emit exact economics or scores; suggested offer cannot exceed ask. | A losing flip ranked #1 and non-property ranges drove offers. | active in CI |
| INV-5 | Every valuation has method/confidence/date; Tier 3 renders no property value. | Every estimate ships with uncertainty or does not ship. | active in CI |
| INV-6 | A failed data batch never touches serving tables. | A partial ingest was presented as complete. | active in CI |
| INV-7 | Pricing constants match the versioned registry. | Hand-set multipliers caused systematic overvaluation. | active in CI |
| INV-8 | Fifty golden subjects stay within locked structural/value envelopes. | Regression tripwire across geography/type/taxonomy. | active in CI |
| INV-FH | Income/crime proxy perturbations cannot change public opportunity/risk outputs and restricted fields cannot reach public tract payloads. | Proxy exposure can create steering and liability even when the formula appears predictive. | active in CI; fairness regression still fails separately |
| INV-ID | Canonical subject facts cannot come from nearest-comp context; artifact subject parity and hash sensitivity hold. | Adjacent-sale facts previously became the subject’s GLA/year/beds. | active in CI |
How this page will get its data
Section titled “How this page will get its data”Planned public endpoint: GET /api/metrics/invariants —
{ "as_of": "ISO timestamp of last full check", "green_streak_days": 0, "invariants": [ { "id": "INV-1", "status": "green|red|unknown", "last_checked": "…", "detail": "violation summary when red — specific, machine-readable" } ]}Rules the endpoint will honor: unknown is a real status (a checker that didn’t run is not green); a single red resets green_streak_days to zero; red statuses page the operator and stay publicly visible while red — no grace-period hiding.
Relationship to the rest of the trust pages
Section titled “Relationship to the rest of the trust pages”Accuracy measures how wrong the numbers are; this page proves the plumbing can’t lie about them. Changelog records every release that moved numbers. Together they are the whole trust argument — error rates, integrity checks, and history.