Portfolio analysis built on one rule: deterministic code computes the figures and the model narrates them

The problem

A wealth report is a list of numbers, and most of those numbers arrive without a source, a date or a method. A rate may be yesterday's. A valuation may rest on a price nobody can trace. When a language model is placed in front of such a report, the risk grows: the model can produce a fluent sentence with a figure that no calculation supports.

Portfolio Horizon, described on its own page as a Private Wealth Intelligence System, was built on a rule rather than a promise: every figure has a source, a date and a method, and the language model is never asked to compute a figure, only to narrate the figures it receives.

Portfolio Horizon is not investment advice and makes no performance claim.

What was built

The public page states what the system does: live portfolio revaluation, risk analysis and probabilistic scenario reading. Its headline is "Your portfolio, with every figure traceable." It names three traits: traceable wealth, the official PTAX exchange rate and explainable AI.

Six commitments are listed on the page: source and time on the figure shown; a dated official PTAX exchange rate; horizon and limits per forecast; unavailability declared; explicit suitability; probabilistic reading. Four tiles repeat the idea in shorter form: PTAX, the dated official rate; sources, with origin and time visible; gaps, declared rather than hidden; code, meaning deterministic calculations.

The portfolio shown on the public page is an illustrative example. Its composition is labelled fictitious and the demonstration runs on synthetic data. No client portfolio is shown and none is claimed.

How it works

The repository's own rule is that every number shown comes from deterministic functions in src/quant and that the language model only narrates figures it receives. What has been measured is narrower: exposures, concentration, liquidity, parametric value at risk and the scenario engine are covered by tests to the cent (run of 31 July 2026). The language model sits after that stage: it receives the computed figures and writes the narrative around them.

The exchange rate follows a resolution chain. The GET /api/fx endpoint asks the Central Bank of Brazil for the closing PTAX of the day; if there is none, it walks back up to four previous business days; if that also fails, it serves a labelled local reference. The label shown declares what the number is, with its date and its source. On 24 September 2026 the public page showed the previous business day state, with the words "Latest available PTAX. Official close from the last available business day. Not an intraday quote."

Between the model and the reader there is an output boundary designed to fail closed. Across the documented adversarial suite executed on 31 July 2026, that boundary released zero unsupported financial numbers under the specified threat model: adversarial prompt payloads against the orchestration lane, with the model output never rendered directly to the client. The public profile interview route is outside that bound and carries no claim.

Within the scope of the operational results verified on 31 July 2026, the figure shown states where it came from: its function, provider and reference time. Within the scope verified on the same date, the figure shown in the report opens the evidence trail that produced it. Forecasts are treated with the same discipline. Within the scope verified on 31 July 2026, the forecast shown comes with a horizon, methodology and limits. The page puts it in five words: the AI justifies, you decide.

Evidence

Everything Portfolio Horizon says in public is bounded by the project's own external claims allowlist, decided on 31 July 2026, and by a withheld register that records every statement taken out and why (fact portfolio-horizon-16). The enforcement is mechanical: a lint fails if a permitted wording is missing from the allowlist or if a withheld formulation reappears on a public surface, and every reproduction command in the allowlist is re-run and its result recorded.

The numbers that survive that process are test counts, each tied to a command and a date. On 31 July 2026 the run behind the deterministic core claim passed 67 tests across 6 files; that run covers the quantitative core, the PTAX chain and the landing claims (allowlist EXT-A03, fact portfolio-horizon-14). The PTAX resolution chain on its own passed 11 tests, which are part of those 67 (allowlist EXT-A02, fact portfolio-horizon-13). The adversarial suite behind the fail closed output boundary passed 415 tests across 11 files, and the boundary released zero unsupported financial numbers under the specified threat model (allowlist EXT-B03, fact portfolio-horizon-12).

The page's own footer states the limit of what it claims: "A forecast is not a promise. Within the scope verified on 31/07/2026, the predictive screen states horizon, confidence and limits." (live page, fact portfolio-horizon-11). No performance, return or forecast accuracy figure is published, because none is in the allowlist.

Stack

Portfolio Horizon is a web application written in TypeScript: React 19 with Vite on the client, Express on the server, Tailwind CSS for styling and Zod for validation. Data lives in PostgreSQL, reached through the pg client and the Supabase client. Vitest runs the unit tests named in the allowlist and Playwright runs the end to end tests. The live site runs the same stack: the response header names Express and the page loads one Vite bundle.

What it demonstrates

Define. The task had a measurable definition before any model was chosen: a wealth reading in which every figure carries its source, its date and its method, and in which gaps are declared instead of filled.

Instrument. The evaluation exists in two layers. The quantitative core is covered by unit tests to the cent and the exchange rate chain by its own unit tests, both on a run dated 31 July 2026. The output boundary is covered by an adversarial suite with a stated threat model. Above the code, the claims themselves are instrumented: an allowlist of exact wordings, a withheld register, and a lint that fails when either is breached.

Integrate. The official PTAX rate, the provenance label on the figure shown, the evidence trail and the declared unavailability are part of the product, not of a slide about it.

Hand over. The allowlist and the withheld register are the runbook for what may be said. They outlive the build and they can be re-run by anyone with the repository, which is how NASCIA prefers to leave a system: with the tests, the limits and the words all written down.