Architecture review · v0.1 · August 2026
Every assessment
must survive an audit.
edudigital Campus is designed as a compliance-aware Campus Management System with deterministic AI at its core, and human judgment at every decision point. This page translates that thesis into explicit system boundaries, data movement, human controls, and diligence questions.
Current Build now Target
01Current + build now
System context + deployment topology
One institution. One explicit trust boundary.
Meta Ads Lead formsGoogle Workspace Calendar + appointmentsTwilio SMS · telephony · WhatsAppInstitutional roles Students · staff · leadership
Current · Institution ASingle-tenant Frappe site
Private benchBuild now · Phase 2 sidecarGoverned intelligence boundary
Institution-scopedDataHub AI service Explanation or draft from verified facts onlyDataShield Append-only version and action evidence
No cross-tenant path Records, features, model artifacts, and credentials remain institution-scoped.Bounded AI The LLM cannot change an assessment, status, eligibility result, or staff decision.Auditable outcome Every material output resolves to source evidence, versions, authority, and action history.
02Build now
Compliance data flow
The number and the narrative travel separate paths.
01Capture operational event ↓
Lead, appointment, enrollment, grade, credit, attendance, document, or staff action
02Validate and reconcile ↓
DataSync applies schema checks, source mapping, idempotency, and batch reconciliation
03Build versioned context ↓
Institution-scoped features carry provenance, missing-data checks, and cohort context
04Produce governed assessment ↓
Validated rules and models generate the assessment, confidence, policy checks, and SHAP trace
05Route evidence packet ↓
Confidence gates send the assessment and source evidence to the correct authorized review queue
06Explain or draft ↓
The DataHub AI service may explain structured facts or draft language; it cannot alter the assessment
07Decide and act ↓
Authorized staff verify context, make the decision, and commit the permitted workflow action
08Preserve the evidence chain
DataShield records inputs, versions, assessment, explanation, staff action, and rationale
Structured assessment packetAssessment + confidence + explanation + policy version
Authoritative pathStaff review surface
Shows the assessment, evidence, flags, and source-record links. Authorized staff decide and act.
Communication pathLLM narrative shell
Explains verified facts or drafts language. Cannot modify an assessment, status, or decision.
03Build now
DataCore build layers
Four services. One evidence chain.
DataCore
Predictive models, deterministic policy rules, confidence scoring, and SHAP explainability.
- XGBoost SAP risk model
- Model + feature versions
- CPU-first inference
DataSync
Controlled movement between Campus modules and the intelligence layer.
- Transactional outbox pattern
- Idempotent event handlers
- Batch reconciliation
DataHub AI service
Provider-agnostic language interface around verified structured facts—not the edudigital Hub module.
- Schema-constrained input
- Retrieval with citations
- Governed feature proposals
DataShield
Evidence, policy, model, and human action recorded as one audit packet.
- Append-only log
- PII minimization
- Override reason capture
04Target
Trust boundaries
Controls that must be structural.
Separation
Minimize what leaves Frappe. Use opaque identifiers and purpose-limited feature payloads.
Bounded authority
Rules and validated models produce assessments. Authorized staff make decisions; the LLM explains or drafts.
Reproducibility
Persist model, feature, and policy versions with inputs required to reproduce an assessment.
Recoverability
Define backup, restore, incident response, key rotation, and observability before broad rollout.
Founder working session
Decisions still open to shape
Service boundary: what stays in Frappe?Event delivery and replay semanticsFeature-store lifecycle per institutionModel approval and rollback workflowAudit-store tamper evidenceObservability and incident ownership
Return to the startup overview →