MIZ OKI 3.5 Intelligence Compendium

Every conversion classified caused or anticipated under the Rubin potential-outcomes framework. CATE estimation via the meta-learner family (S/T/X-Learner, DR-Learner/DML), hardened by automated refutation (placebo-treatment collapse, random-confounder invariance, subset stability), and triangulated against Bayesian MMM and geo experiments. Estimates that fail refutation are flagged, never shipped. The credit rule: a conversion is incremental only if experiment lift excludes zero AND the model had not already scored the customer in-market at exposure.

X-Learner heterogeneous treatment-effect estimation for uplift-quadrant targeting — budget on persuadables, first-class suppression of sure-things and sleeping dogs. Live-verified: run 31495398264, serving revision cell26-causal-uplift-00001-672, BigQuery connected.

Holdout registry (randomized, ghost-bid, matched-geo), deterministic arm assignment, lift with Wilson/bootstrap confidence intervals. Ghost bids log the counterfactual auction without spending on placebo ads (Johnson, Lewis & Nubbemeyer, JMR 2017). Geo experiments use Meridian-GeoX-class synthetic control — publisher-agnostic because platform lift studies are the platform grading itself.

Structured discovery of activation points in platform delivery algorithms. Spend concentration strategies validated against causal measurement — not platform-reported metrics.

Rectified-linear uplift gate (uplift > 5%, confidence > 0.70 — the Signal ReLU gate) driven by iROAS from the credit ledger. Per action class: authority_c = min(cap_c, max(0, DEL_score − threshold_c)). Flat zero below threshold = deterministic denial. Covenant cap = saturation. Platform sets floor thresholds; customers may raise but never lower.

Statistical decline forecasting + rotation strategies. Frequency-adjusted response decay detection; intent-stage → message-archetype fit. Winners determined by causal NCM lift, not CTR. Creative generation out of GA scope (brand-safety liability); formal revisit trigger post-Phase 3.

Multimodal feature extraction — copy length, promotional framing, layout structure, imagery class, CTA placement — via vision-language embeddings. Doubly Robust ML (DR-Learner / DML) isolates the independent causal effect of each creative component from overall asset performance. The Clipped-ReLU DEL gate applies: component-rotation recommendations below threshold get zero authority. Lands on the CreativeSemanticProfile lane (I-03) and writes to Decision Memory. Effect estimates labeled provisional until pilot-scale creative volume exists; generated-creative deployment retains human approval.

X-Learner heterogeneous effects identify persuadables. Predictive audiences upgrade lookalikes — expansion candidates carry calibrated intent, not demographic resemblance. Measurement live; activation partial.

Enhanced Conversions (Google), Meta CAPI with shared event-ID 48-hour dedup, GA4 Measurement Protocol, offline conversions, house attribution-window recompute, drift monitoring at 20% divergence over three consecutive days. Value writeback to platform bidders behind hard-off flags, dry-run by default.

SearchStream extraction, GoogleAdsFieldService validation with caching, MCC traversal, canonical normalization, Firestore/BigQuery persistence, full-funnel mapping. Plans generated only after reasoning over evidence; mutate actions only under approval and eligibility. Default autonomy: observe/recommend.

Senses bid requests, win/loss notices, buyer/seat metadata, device signals, price floors, currency, and consent. Reasons about inventory quality, auction duplication, floor effects, win-rate changes, fraud indicators, exchange performance, and supply-path optimization.

Normalizes sends, opens, clicks, bounces, unsubscribes, complaints, conversions, suppression, segments, and campaign metadata. Reasons about deliverability, fatigue, segment quality, creative performance, send-time effects, revenue contribution, suppression risk, and cross-channel attribution. Actions tightly gated because email affects trust, compliance, and deliverability. SendGrid mapper live; Klaviyo proposed.

Validates and consent-gates behavioral micro-signals: dwell, scroll velocity, viewport deceleration, partial-watch depth, tab-focus transitions. Consent check runs before persistence and fails closed; deny-listed categories discarded at ingest, not stored. Hard prohibitions: no audio, no keystroke dynamics (owner ruling O-1), no gaze, no fine-grained geolocation. IAM-locked, dispatch-only deploy.

Sub-100ms intent scores with calibrated probabilities (Brier-scored), intent stages (awareness → consideration → in-market → purchase-imminent), purchase-timing windows, and explanation paths — no score delivered without its reasoning. Hourly single-writer batch scoring. Two-tower embeddings for candidate generation; session-sequence transformer serving behind default-off flag. Shadow since 2026-07-31; model quality gate open (fv2 model: 0.6967 AUC / 0.1845 Brier mean — blocked on real forward labels).

Durable intent subgraph on Firestore with boot rebuild, DSAR/erasure leg (live-verified 2026-08-10). Customer/Household/Topic/Product/Campaign nodes; SHOWED_INTEREST edges with decay, PRECEDES sequence edges with lift/support/confidence. Household links labeled deterministic vs. probabilistic; probabilistic edges excluded from all causal math. 321 tests at merge.

The caused-vs-anticipated ledger. Refutation battery operational. Live-verified 2026-08-11: run 31494599562, fail-closed smoke passing, serving intent-causal-00012-j27. The one rule that keeps the crystal ball honest: prediction never grades itself.

I-01 PassiveAttentionSequence — viewport deceleration and scroll dynamics against session baselines. Ephemeral: raw sequence buffers purged on session termination.
I-02 SessionOutcomeForecast — ordered event streams to conversion probability with drift metadata. Retention: active session only.
I-03 CreativeSemanticProfile — asset embeddings mapped to session context. Retention: bounded to creative asset lifecycle.
I-04 IntentHypothesis — temporary graph bridges linking session evidence to causal hypotheses. Retention: strict TTL expiry; swept on schedule.
I-05 ValidationPassport — per-decision governance trace; ledger retention. The J-05 Executive Defensibility product.

Session-end purge jobs and retention-bound tests are part of the build, not documentation. O-1 PRIVACY LOCK is absolute and schema-enforced at both ingest and hypothesis creation.

Every order priced at what it truly nets: component COGS (bundle-decomposed), pick-and-pack, shipping, payment fees, expected return cost (actual-only until one observed cycle per SKU). Cohort net-margin computation. Value writeback hard-off until verified pilot. The bidding signal fed back to platforms is net contribution, not checkout revenue. The metric contract (NCM-v1) is versioned; any change ships as NCM-v2 with migration. IAM-locked, dispatch-only. Serving revision net-yield-00007-snj.

Dynamic treatment regimes evaluate multi-period outcome horizons: immediate conversion gain (Y_t+1) balanced against discounted multi-quarter contribution margin (Y_t+365) and the net present value of the customer relationship under each regime — so acquisition stops buying customers the P&L later regrets. The ledger gains an explicit outcome-horizon dimension. Code-level invariant: long-horizon findings publish only after ≥ 2 observed quarters of repeat-purchase data per cohort; insufficient data emits data_insufficient and blocks publication to decision surfaces.

The one intentionally public ingress. All other services are IAM-locked (unauth /health returning 403 is healthy posture).

Operator-facing orchestrator: six-domain runtime, 10 sixdomain MCP tools, eight intent tools. Mixture-of-Agents / Mixture-of-Experts / REWOO / Coding MOA. Does not bypass eligibility.

Next.js/React/TypeScript command center (not a dashboard): live knowledge graph, SRPVDAL loop monitor, decision queue, simulation console, channel intelligence pages, audit ledger. Flag-off posture; mock content labeled.

Multi-vendor LLM routing layer: role-based dispatch, governed global fallback (claude-opus-5), alert on backup-path serving. No hardcoded model strings outside the registry. IAM+locked.

Knowledge graph projection and GraphRAG serving from the Firestore-backed store. IAM-locked; callers: Boss OIDC, Cloud Scheduler OIDC, UI with buildAuthHeaders.

Mixture-of-Agents consensus (POST /moa/consensus) and Mixture-of-Experts routing. IAM-locked. The Boss serves the MOE route in-process.

THE public webhook boundary for all marketing/commerce integrations. Mounted adapters: Meta/Facebook Ads, Google Ads, GA4, LinkedIn Ads, Amazon Ads, The Trade Desk, Google Merchant Center, approved public Google Shopping feeds, and Shopify (HMAC-signed webhooks + Admin GraphQL + OAuth install). One governed ingress — every accepted record forwards to service-canonical-ingestion. No direct connector-to-KG side doors.

Dual role: (a) governed injection of non-streaming data — backfills, bulk loads, partner feeds, synthetic training data; (b) processing of external search/market sources — Google SERP/KG, Amazon Creators API, Meta platform signals, Wikidata (CC0 identity anchor), Schema.org structured data, SERP feeds. MarketSignal envelope + serp_provider / amazon_sp / shopify_inventory mappers built. External signals as corroboration only — never independently causal. Deployed 2026-08-11; SERP provider awaiting valid API key. Generic injection door: not started.

Entities, relationships, sequence, causality, evidence, uncertainty, policy, and outcomes. Relationship types: semantic, temporal, causal, financial, policy, identity, learning, and (new) interest, sequence, creative-resonance, and hypothesis-status edges. Tenant-isolated. Neo4j retired by owner decision 2026-08-09. BigQuery mizoki-prod.unified is the analytical backbone. Vector search and document retrieval as projection options.

Inventory and fulfillment telemetry joins the Growth Decision Graph as typed nodes: (:SKU)-[:STOCK_STATE] (current level, reorder point, weeks-of-cover) and (:FulfillmentNode)-[:CAPACITY_STATE] (processing capacity, backlog, geographic reach). Three recommendation vectors — throttle bidding on stockouts, accelerate on overstock clearance, geo-shift on regional capacity constraints — are logged as ValidationPassport entries without dispatching to action runner adapters until the frontier climbs the autonomy ladder. Observe-only first (owner ruling 2026-08-19). Prevents the oldest waste in commerce advertising — paying to send customers to products you cannot ship.

Geo reservation engine selects representative control groups using Synthetic Control Methods (SCM) from owner-provided candidate pool (config/f4_geo_candidates.yaml). Schedules spend perturbations within declared caps, estimates realized lift, and injects ground-truth incremental lift as informative priors into Bayesian MMM — calibration becomes a system property, not a quarterly project. Because geo-holdouts alter media spend, candidate reservations must pass through L2 Human Approval flows. After two clean calibration cycles, reservations become eligible for bounded autonomy within declared spend caps.

Liquidity floors, credit availability, and debt covenants as hard constraints in VALIDATE and DECIDE. When cash reserves approach defined floors, DEL automatically reduces channel spend caps and vetoes budget expansions — naming the specific treasury constraint in the ValidationPassport. Treasury vetoes route to human review, never silently overridden. v1 (current): owner-declared constraints from config/treasury_constraints.yaml; v2: live treasury positions from the Capital division. Missing config = no constraint claimed (fail-closed, honest health). The enterprise sentence: your marketing system cannot spend money your treasury says you don't have.

OAuth app (MIZ OKI Commerce Link), HMAC-signed webhooks (orders/*, refunds/*, inventory_levels/*, fulfillments/*), bulk-operation backfill, Admin GraphQL sync. Pub/Sub delivery path provisioned (topic + DLQ + push subscription). OAuth OFF pending operator secrets. Single governed ingress — fans out to canonical ingestion, intent extender, and net-yield. ORACLE pixel collector edge (POST /pixel/collect) flag-off by default.

Downstream consumer: Cell 33 intent signals + outcomes. IAM-locked; former public webhook receiver retired 2026-08-12 (the single-ingress collapse). ORACLE /pixel/events door flag-off (Stage A capture). CI deploy path established.

NCM computation: NCM(C) = Σ [R - COGS - F - S - P - E[RL]] - AdSpend(C). Bundle-decomposed COGS, 3PL surcharges, gateway fees, expected return cost. Writeback OFF. Rows carry hashed customer keys only. Dispatch-only deploy.

Live production surface: causal-credit positioning, proof engine, field-note scenarios (composites, labeled), capability dossiers, dual roadmap previews, and the Signal Factory demo — raw connector events travel all seven SRPVDAL stages including one deliberate guardrail block. ORACLE pre-conversion perception page serving at /signal. Content QA gates enforced in CI.

Roster/flyer intake, geocoding, entity resolution, scoring, matching, submarket intelligence. Composes with the existing mizoki_cre underwriting module. Never touches a recipient. IAM-locked; operator remainder: Google Maps API key. Deployed 2026-08-17.

Email authoring via Virtuoso, validation passport, DCP authorization gate, draft deployment (auto_send: false permanent), CRM sync, follow-up scheduling, holdout/lift measurement. Split at the DECIDE boundary — never computes a match. IAM-locked; operator remainder: provider transports (Graph/Gmail/Pipedrive), scheduler SA.

Converts contracts, regulations, and internal rules into machine-checkable decision constraints. Mixture-of-Legal-Experts with IRAC reasoning. Demo engine only (fixtures, never production tenant data). Legal conclusions remain advisory-only.

Reasons over revenue, margin, cost, cash flow, CAC, LTV, iROAS, payback, and forecasts. Financial validation sits inside Validate — an action that lifts platform-reported ROAS but destroys margin is not auto-approved. Advisory-only; built, pre-benchmark.

Transforms uploaded files, reports, notes, research, competitive intelligence, and strategy documents into structured evidence, relationships, and reusable decision memory. Ownership of resulting decisions remains with the relevant operating domain.

Every governed decision produces a ValidationPassport — a complete, hashed execution trace assembled from the immutable learning ledger. Contents: (1) decision ID and tenant context, (2) input signal references (canonical event envelope IDs), (3) ranked causal hypotheses from Reason, (4) evaluated counterfactual plans including the mandatory no-action baseline, (5) DEL Score and individual gate results (identity/signature, policy alignment, context sufficiency, hard constraints), (6) assigned autonomy level and action class, (7) approval records with timestamp and principal, (8) dispatched action commands or veto reasons, (9) predicted outcomes at time of decision, (10) backfilled realized outcomes when observed. This is the J-05 Executive Defensibility product — one auditable trace reconciling conflicting channel reports.

Programmatically compares declared capability status (this whitepaper, the OFFERING_MAP, the cell registry) against live Cloud Run service registries, feature flags, and serving revisions. Prevents documentation-reality drift — the endpoint answers "is what the whitepaper says still true?" with measured evidence, not inference.