Copy that ships only after a human says yes.

• -runs recorded
• -drafts audited
• -violations caught
• -of them by the deterministic checks
• -median time per run, from the node timings in the trace
• $0.00marginal cost: free models, free tiers

Six recorded scenarios show that the pipeline does what it says, not how often a model gets the copy right first time. The briefs were written for the scenarios; the responses were not edited.

Six nodes, one cycle, one breakpoint. The graph is compiled with interrupt_before=["webhook_dispatch"], so every thread stops on a checkpoint before the only node that touches the outside world.

1. 1

   Supervisor

   Validates the request (SKU code, channels, brief, revision budget), resets the revision counter and routes: to the inventory agent on a fresh thread, straight to synthesis when the inventory is already loaded, to END when the request is invalid.

   graph/nodes.py

2. 2

   Inventory SQL Agent

   One parameterized, read-only lookup of the SKU. No model writes SQL: the tool's arguments are validated by Pydantic and the query is fixed. An unknown SKU or a stock of zero ends the run here, before any model is called.

   graph/tools.py

3. 3

   Copy Synthesis Agent

   A model drafts every field under a strict JSON schema, grounded in the licence data. On a revision it receives the previous draft and the exact violations to fix. The brief travels in tags with a random suffix and is declared untrusted.

   graph/prompts.py

4. 4

   Compliance Validator

   A model audits the draft against the rules, then Python checks what can be checked deterministically: the NPN is shown, no prohibited claim appears, amounts next to an ingredient are the licensed ones, every mandatory risk statement is there word for word. A finding from the checks is a violation whatever the model said.

   compliance/rules.py

5. 5

   Human Approval Gate

   Marks the thread as waiting; the graph stops right after it on a checkpoint in PostgreSQL. The thread can be resumed by another process, hours later: the API reads the checkpoint, applies the reviewer's decision to the state and continues.

   graph/builder.py

6. 6

   Webhook Dispatch

   Refuses to send unless the review status is approved or edited, validates the copy once more, signs the body with HMAC-SHA256 over the timestamp and the bytes, delivers with retries on 429, 5xx and timeouts, and records every attempt. A rejection is written as if this node had run, so it never executes.

   services/webhook_dispatcher.py

The two agents call free OpenRouter models through an ordered chain: the next model is tried only when a call fails (a rate limit, an upstream error, a withdrawal, output that does not validate), never on a wrong answer. Free models are withdrawn often, so with no models named in the settings the service looks after the chain itself. At startup it reads the chain this project's scheduled test published (one small file on a branch of the repository, no key needed). After a request that a model of the chain did not answer, it asks OpenRouter's own page for that model; if the answer is "Model not found", the model leaves the chain and the free place is filled by a test of the free models with this project's own three cases: a draft, an audit that must catch planted violations, and an audit that must pass a compliant draft. The scheduled test runs the same cases on GitHub Actions and publishes what passes. Three rules: repair, never rank; a chain holds at most three places; a model must pass every case.

The public demo is deliberately closed in three ways: runs are rate limited per visitor and capped per day, the number of self-correction loops is capped, and the webhook can only reach the service's own receiver.

Read the README How it is deployed Phase 1: Invoice Extraction Service Phase 2: Compliance Retrieval Engine