Capstone C: the document-intake swarm

The same platform, dials turned toward throughput. Documents arrive in bulk, claims, invoices, KYC packets, contracts; extraction agents fan out per document; judge agents score each result against a rubric; low-confidence items route to humans while the rest flow straight through. Where Capstone B was a small fleet with dangerous reach, Capstone C is a large fleet with mundane reach and a continuous, unforgiving stream, and the engineering is about volume that flows rather than floods.

The job and its shape

This realizes the document-intake use case: real documents are messy enough that extraction plus self-checking beats one-shot extraction, and the human-in-the-loop tail is a budgeting decision (how much confidence justifies auto-approval) rather than a hardcoded workflow. The topology is a pipeline: extract, then judge, then route, each stage a different role. Unlike A's overnight batch, this is a continuous stream, documents land at their own pace, which changes the fan-out choice.

Dominant gates: 5 (Failure semantics), 8 (Evals via the judge), 9 (Observability). Throughput at volume lives or dies on how failures and duplicates are handled.

The platform, configured for a stream

The event-driven queue is the star, and the capstone is where its contract earns its keep:

  • Event-driven intake (Chapter 47). An S3 event fires when a document lands, EventBridge routes it, and it queues on SQS, which absorbs a hundred documents arriving at once into a steady queue the fleet drains at its pace. This is the backpressure that turns a burst into queue depth rather than a failure. Because intake is continuous, the SQS-plus-fleet bundle, not distributed map's batch shape, is the right dispatcher.
  • Idempotency is non-negotiable (Chapter 47). At at-least-once delivery, a document can be delivered twice, and an extraction that files a duplicate claim or double-charges is a production incident. Every effect carries the operation id that makes it exactly-once, and the queue-contract lab was rehearsing exactly this failure. Poison documents (a corrupt scan that crashes every extractor) dead-letter after N attempts for a human, instead of retrying forever. Gate 5.
  • Honest confidence is the product (Chapter 35). The judge agent scores each extraction against a rubric, and the score's calibration matters more than the extraction prompt: does 0.9 mean 90% correct? The eval discipline calibrates the judge against human labels so the auto-approve threshold is trustworthy, because the whole economic model, auto-approve the confident majority, route the uncertain tail to humans, rests on the confidence being real. Gate 8.

The build (T2)

S3 event notifications into SQS; Lambda extraction workers (each document is short, so Lambda fits, with Fargate for the heavier ones); the judge fleet on the batch tier where latency allows; DynamoDB for per-item state keyed by document id; and an arbitration queue with a small UI for the human tail. The model portfolio shines here: a small model extracts and a small model does the first-pass judging at volume, escalating only the uncertain items to a stronger judge, which is the portfolio pattern applied to the highest- volume job in the book.

Costed and torn down. The throughput economics are the design: at D documents a day, the auto-approve rate (set by the calibrated confidence threshold) determines both the human cost and the token cost, and the cost gate guards the per-document token budget so a prompt change cannot silently multiply the bill across a million documents. Tagged lab:capstone-c; teardown drains the queue, removes the workers, the tables, and the notifications. The lesson C adds to the platform: at stream volume, the boring machinery, delivery semantics, idempotency, dead-letter queues, calibrated confidence, is the difference between a pipeline that runs itself and one that pages someone every hour.

What Capstone C proves

That the throughput and failure machinery holds under a continuous stream. A platform that processes a bursty flood of documents without double-filing, without retrying poison forever, and without trusting an uncalibrated confidence score is a platform whose Part 4 skeleton and Part 9 evals were built right. The same planes as A and B; the weight has moved to the queue contract and the judge's calibration, which is what a high-volume, human-in-the-tail job demands.

👉 Next: Capstone D, the last, where the product is open-ended and the verification mesh returns as the star: a research service whose value is the difference between claims that are checked and claims that merely sound right.