The neural engine

What it decides

One multi-head network (a ReLU trunk with a sigmoid head per decision, about two thousand parameters, pure NumPy, weights shipped as a single versioned file) answers five questions:

• Features are behavioural baselines: z-scores against the person’s own 30-day history, peer-relative lateness, calendar context. Raw employee identifiers and historical override rates are deliberately excluded so the model cannot learn that a particular person is always forgiven.

Modes and bands

Every decision site logs the features, the rule’s action and, later, the outcome. That log is the training set. The effective mode is set globally and can be overridden per head and per team.

• Auto band: probability at or above 0.85 (neural.auto_threshold). Review band: 0.40 to 0.85 (neural.review_low). Below that, no action.
• Any failure in the neural path degrades to the rule’s own decision; it can never break a bot send path.

neural.mode
neural.mode_auto_approve_pto
neural.auto_threshold
neural.review_low
neural.max_actions_per_week
neural.min_tenure_days

Guardrails, enforced in code

Every automatic decision is recorded with its probability and the reason, announced to admins as done rather than asked as a question, and reversible. An admin’s approve or deny in chat becomes the ground-truth label for that decision.

• Strikes are never issued autonomously; uphold_strike caps at assist however the knobs are set.
• Nobody on the never-DM list is acted on, whatever the probability.
• At most five automatic actions per employee per week by default.
• No action on anyone with under 14 days of tenure; there is no baseline yet.
• If more than half of a person’s peers are late today, all lateness-flavoured actions are suppressed: that is an outage, not misconduct. A lone late employee never counts as their own evidence.
• Leave auto-approval is limited to sick days and half-days, never grants leave beyond the balance, never touches a backdated request, and can be blocked while the requester still has open tasks (pto.require_handover). Vacations always go to a human.
• A guardrail check that errors fails closed.

Training

• Outcomes label themselves hourly: a nudge is labelled by whether a check-in followed within 30 minutes; no-show risk by whether the day ended with a check-in; a strike is a weak positive only after 72 hours with no reversal and evidence an admin was actually active.
• Twice a day (13:00 and 19:00 UTC) history is backfilled, a candidate is trained and compared with the champion. Candidates that never got promoted retire after seven days; files stay on disk so rollback is always possible.
• The architecture is chosen by label count, not ambition: under 300 rows refuses to train; under 1500 is logistic regression; under 5000 one hidden layer; beyond that two. Splits are temporal, never random.
• A better candidate is promoted automatically only while the mode is still shadow; once the model can act, promotion is a human click. Every swap is audited.

Drift monitor

Every morning at 07:00 two health checks run. Feature drift compares the last 14 days of logged feature vectors with the champion’s training statistics; any feature whose mean moved more than half a training standard deviation is named in an admin alert. The feedback-loop watch fires when one employee absorbs more than 40% of positive decisions in 14 days, because that is a loop forming, not a bad employee.

People signals

The Neural page also carries deterministic, explainable people analytics with no model at all: real attrition labels are too rare for a trained probability to be honest. Each score is a weighted sum of evidenced factors, compared against the person’s own baseline (recent 14 days against the 6 weeks before), never against colleagues.

• Retention risk (0 to 100: low, watch, elevated, high) and a loyalty index (new, building, solid, strong, exceptional; under 90 days always reads new) each carry their factor list.
• Post-leave grace and schedule-change detection suppress the classic false positives; unconfident scores never alert.
• Admin-only and advisory: nothing here acts, messages an employee, appears on an employee report or touches pay. Alerts go to the admin notification centre, deduplicated to one per person per 14 days.

neural.drift_recent_days
neural.drift_baseline_days
neural.quitrisk_alert_band