Scoring somebody's GRE or IELTS essay is a judgment call with consequences: a hallucinated band score sends a candidate into a real exam prepared against a false signal. Language models are fluent, confident, and wrong often enough that "ask nicely in the prompt" is not an engineering answer. Margin is my attempt to build a system where a probabilistic model does the hard reasoning and deterministic code decides what the learner is allowed to see.
Every response crosses a validation boundary before it renders. Eighteen normalizers in the frontend treat provider output as hostile input, the way you would treat a form post from a stranger. Scores are clamped to each exam's legal lattice, IELTS bands are recomputed in code as the weighted mean of their tasks so a headline can never contradict the numbers beneath it, and the client owns every state machine rather than trusting the model's account of where it is in a lesson. Each guard exists because I watched a real provider break that rule.
The runtime is the other half. Margin proxies OpenAI and Anthropic behind one interface with a reasoning-budget escalation ladder: a model that burns its whole token allowance thinking and returns nothing gets retried with more headroom instead of billing a credit for an answer nobody received. Truncation is caught through finish_reason, cache hits are accounted for, and every call reserves credits under a row lock, then finalizes or refunds.
On top of that sits an adaptive tutor — two-stage mastery, spaced review on a 3 → 7 → 14 → 30-day ladder, and error patterns from your last three graded essays pulling matching lessons forward.
A bank chatbot that invents an account rule doesn't produce a bad answer — it produces a compliance incident. Koronik is Graaho's no-code agent platform, and its flagship deployment runs customer service for Islami Bank Bangladesh PLC across web, WhatsApp, Messenger, and Facebook comment threads, serving 5,000+ daily users. The hard engineering was never the answer path. It was everything the model is not allowed to do.
Retrieval is the contract. Agents answer only from tenant-approved content indexed at ingestion; anything generated outside that corpus is a failure mode, not a feature. Every response carries a confidence score, and below the configured threshold the agent stops and routes the customer to a hotline, branch, or human agent instead of producing something plausible. A refusal costs a click. A confident wrong number costs a customer. That discipline is what holds >95% answer accuracy at sub-500ms latency.
Orchestration sits on Amazon Bedrock and LangChain over serverless inference — Lambda for execution, DynamoDB partitioned by tenant for session state and strict isolation, KMS at rest. In multi-tenant RAG, retrieval leakage is a breach rather than a bug, so isolation is enforced at the partition key, not in the prompt. CloudWatch traces every agent decision: tool call, retrieval hit, latency, escalation. Usage meters in tokens against a per-tenant wallet, so cost stays attributable down to the agent and channel.
Sentiment scoring escalates frustrated conversations to human agents, who receive suggested replies rather than autonomous ones — the model drafts, a person sends. Every out-of-scope query is logged against the knowledge base, so refusals become the backlog of what the agent still cannot answer. That loop is human-reviewed today; nothing retrains itself yet. Next to close.
Architectural drawings arrive as PDFs. Easymator rasterizes every page at 300 DPI, and from there all measurement happens in image space: Euclidean distance across traced points, polygon area, circle radius. The geometry is not the hard part. A pixel means nothing until you know what it is worth.
So calibration is the contract. Each drawing carries width and height scale factors mapping canvas pixels to real dimensions, validated as positive before any conversion runs, and every measured length is divided by them before it reaches a material. Get that wrong, and 7,410 catalog materials are priced against a fiction.
Recognition stays human-in-the-loop by design. The contractor traces the wall; the system measures it. Automatic detection of walls and openings was the obvious next step, and we did not take it, because a misdetected edge produces a confident wrong number nobody can see. A badly traced edge is visibly wrong.
The pipeline reports on itself, recording duration, point count, and success or failure for every calculation across a rolling window. One gap stands: when calibration is missing, the converter falls back to raw pixel units instead of refusing. Fail-open, and next to fix.