CRIX v3.2.0

Overview

CRIX v3.2.0 is a stateless credit-risk intelligence system with a deliberately small live runtime and a heavier offline research/governance boundary. The Fastify + TypeScript `/api/v3` service keeps the same final-loan-resolution PD, CRIX-MonoBoost 2.0.0 champion and CRIX-Policy 3.0 semantics while v3.2 adds measured runtime optimization, sparse explanation rescoring, reproducible load evidence, stronger distribution-shift and explanation validation, tamper-evident lineage, Gaussian/Student-t portfolio dependence, EVT tail research, hardened authentication/proxy controls, privacy-bounded OpenTelemetry and reproducible dependency evidence.

Live v3 decisioning runtime

The deployed champion is CRIX-MonoBoost 2.0.0, a monotonic XGBoost model exported to a compact JSON artifact and evaluated directly inside the TypeScript runtime. Its `pd` output means final-loan-resolution default risk — not a silently relabelled 12-month PD. CRIX also returns challenger disagreement, confidence, out-of-distribution signals, deterministic LGD/EAD/expected loss, score and grade outputs, governed reason codes, and an independent CRIX-Policy 3.0 decision of APPROVE, REVIEW, or DECLINE.

Real-world training and out-of-time validation

The v3 champion is trained from the LendingClub/Zenodo loan dataset. The source contains 1,347,681 rows and 1,269,389 remain after harmonization. Training uses loans from 2007 through 2015, calibration uses 2016, and the primary out-of-time evaluation uses 2017; 2018 is excluded from the primary reported evaluation to reduce maturity bias. The champion uses only application-time debt-to-income, loan-to-income, FICO-derived credit score, and employment tenure, with monotonic risk constraints.

Model governance, drift and explanation fidelity

CRIX treats temporal correctness and reproducibility as machine-checkable contracts. Feature provenance, dataframe schemas and chronological split invariants fail closed; historical joins are backward/as-of only; and the primary evidence remains explicitly conditioned on historically granted loans. v3.2 adds adversarial validation plus PSI, Jensen-Shannon, Wasserstein, support-breach and quantile-movement evidence, and independently compares live-compatible local sensitivity explanations against offline SHAP. The governed historical shift run produced adversarial AUC 0.5593 with aggregate and all four champion-feature statuses passing the review bands; the fixed-seed n=512 explanation study measured 97.59% mean top-3 overlap, 95.33% sign agreement and 96.94% perturbation stability. Training lineage hashes the approved artifact, data identity, dependency environment and governance evidence so later tampering fails verification.

Lifetime PD and delinquency migration research

The offline research stack adds censoring-aware discrete-time survival modelling with cumulative and marginal PD term structures at 3, 6, 12, 24 and 36 months, plus survival probabilities. A separate delinquency-state model estimates movement between Current, 30, 60, 90 and Default states with cure and backward transitions preserved rather than forcing every account through one-way deterioration.

Empirical LGD and EAD research

Loss severity and exposure are no longer treated as one universal formula in the research stack. LendingClub lifecycle data supports empirical installment EAD and recovery/LGD analysis, while the UCI Taiwan revolving-credit panel is kept as a separate CCF-style research path. Product and target-horizon separation is explicit so incompatible datasets are not pooled into a synthetic universal credit model. The live `/api/v3` deterministic LGD and requested-amount EAD semantics remain unchanged until institutionally validated replacements exist.

Portfolio Monte Carlo, dependence and tail risk

The offline simulator keeps NumPy as the canonical deterministic backend and supports one-factor Gaussian, Student-t and bounded low-rank factor dependence without allocating a dense portfolio correlation matrix. v3.2 collapses tail attribution from repeated full scenario replays into one indexed shared replay: on the audited quick CI profile the shared path is ~0.80× the reference speed for one quantile where fixed overhead dominates, ~2.42× faster for three quantiles and ~4.03× faster for five. Empirical VaR/expected shortfall remain separate from research-only Peaks-Over-Threshold GPD/EVT extrapolation, with explicit insufficient/unstable states. An optional lazy CuPy backend is implemented for documented CUDA research runs; no GPU speedup is claimed because the release infrastructure has no CUDA device.

Empirical macro stress research

The existing `/api/v3/risk/stress` endpoint remains explicitly classified as deterministic borrower sensitivity. A separate point-in-time macro research layer uses a frozen, provenance-tracked U.S. unemployment-rate series aligned to the historical LendingClub vintages. Committing the exact macro snapshot makes the result reproducible and prevents CI or research conclusions from depending on a live FRED request.

IFRS 9-style ECL and Basel-style capital research

The offline accounting layer supports Stage 1, Stage 2 and Stage 3 research classification, SICR and days-past-due backstops, cure/probation semantics, marginal-PD conversion, scenario-weighted ECL and EIR-style discounting. A separate capital module keeps expected loss distinct from unexpected/tail capital and provides IRB-inspired and economic-capital analytics. These are deliberately labelled IFRS 9-style and Basel-style research outputs — not accounting approval, regulatory compliance, or production capital certification.

Challenger governance and portfolio optimisation

The embedded real-data logistic challenger is evaluated against CRIX-MonoBoost on the same calibration and out-of-time cohorts using discrimination, calibration, Brier score, log loss, PSI/stability, bootstrap uncertainty, segment evidence and deployment context rather than “highest AUC wins.” The deterministic portfolio optimiser then supports bounded allocation under explicit budget, expected-loss and concentration-style constraints, returning infeasibility instead of silently relaxing limits.

API surface

Runtime performance, security and observability

The runtime now precompiles the approved model execution plan once, indexes trees by feature for sparse counterfactual rescoring, and keeps synchronous batch work linear and capped at 50. Recorded Batch A evidence on Node 22.23.2 / AMD EPYC 7763 measured ~536,854 compiled champion ops/s, 0.003746 ms champion p50 and 0.018628 ms full-assessment p50 versus 0.025889 ms for the reference assessment; deployed explanation work falls from 384 to 317 tree visits. Security v3.2 makes deployment posture explicit with `public-demo` and fail-closed `required` auth modes, bounded current+next key rotation, constant-time digest comparison and explicit trusted-proxy hops. Low-cardinality OpenTelemetry records operational/runtime signals without borrower IDs, raw features, credentials or exact PD labels. The governed dependency audit reported zero known Node production vulnerabilities and zero known vulnerabilities in the pinned Python research lock.

Release verification

CRIX v3.2.0 is released from the audited main branch and deployed to Render only after the full gate passes. The runtime suite contains 64/64 passing tests across eight Vitest files; the Python governance/research suite contains 98/98 passing tests with one intentionally skipped CUDA-only optional test on CPU infrastructure. CI also runs the risk-engine benchmark, real Fastify HTTP load profile, lineage verification, portfolio/tail benchmark, synthetic tail validation, dependency-lock drift proof and supply-chain audits. The release keeps API contract 3.2.0 under `/api/v3` while exposing package `releaseVersion` 3.2.0 separately.

Model-risk boundary

CRIX is a public engineering and model-risk research system, not an approved lending, accounting or regulatory-capital platform. Its main real-world evidence is historical granted-loan data; reject inference remains an explicit limitation. The research LGD/EAD, macro, IFRS 9-style and Basel-style outputs require representative institution-specific data, independent validation, fairness/proxy analysis, exact accounting/regulatory policy interpretation, governed adverse-action reasons, audit retention, authentication/authorization, monitoring, and formal model-risk/legal/compliance approval before institutional production use.

Architecture signal

Technical profile

Engineering focus

Technical note

CRIX v3.2.0 deliberately keeps the live service small: Fastify, an in-process TypeScript risk engine and one versioned JSON champion artifact. The deeper lifetime, dependence, EVT, macro, accounting, capital, SHAP and optimization work stays offline. The release focused on measured algorithmic improvement, fail-closed governance and operational evidence rather than adding Redis, queues, microservices, Kubernetes or other infrastructure that the workload does not need.