CRIX v3.1.0

Overview

CRIX v3.1.0 is a stateless credit-risk intelligence system with two deliberately separated layers. The live Fastify + TypeScript `/api/v3` service performs bounded application-time decisioning with a calibrated real-data champion model and versioned policy. A separate Python research stack handles heavier time-dependent and portfolio analysis: lifetime PD, delinquency migration, empirical LGD/EAD, correlated loss simulation, macro-conditioned stress, IFRS 9-style ECL, economic-capital research, challenger governance, and constrained portfolio optimisation. The research layer does not silently change the production-facing v3 score semantics.

Live v3 decisioning runtime

The deployed champion is CRIX-MonoBoost 2.0.0, a monotonic XGBoost model exported to a compact JSON artifact and evaluated directly inside the TypeScript runtime. Its `pd` output means final-loan-resolution default risk — not a silently relabelled 12-month PD. CRIX also returns challenger disagreement, confidence, out-of-distribution signals, deterministic LGD/EAD/expected loss, score and grade outputs, governed reason codes, and an independent CRIX-Policy 3.0 decision of APPROVE, REVIEW, or DECLINE.

Real-world training and out-of-time validation

The v3 champion is trained from the LendingClub/Zenodo loan dataset. The source contains 1,347,681 rows and 1,269,389 remain after harmonization. Training uses loans from 2007 through 2015, calibration uses 2016, and the primary out-of-time evaluation uses 2017; 2018 is excluded from the primary reported evaluation to reduce maturity bias. The champion uses only application-time debt-to-income, loan-to-income, FICO-derived credit score, and employment tenure, with monotonic risk constraints.

Point-in-time governance and integrity

CRIX now treats temporal correctness and reproducibility as first-class model contracts. Feature provenance is machine-checkable, unknown provenance fails closed, historical joins are backward/as-of only, and training/calibration statistics are scoped to the correct cohort. The system explicitly records that the main LendingClub evidence is conditioned on granted loans rather than pretending rejected-applicant outcomes are known. Model Registry manifests bind model identity, feature contracts, training windows, source locks, metrics and SHA-256 artifact digests; readiness fails if the deployed champion and manifest do not match.

Lifetime PD and delinquency migration research

The offline research stack adds censoring-aware discrete-time survival modelling with cumulative and marginal PD term structures at 3, 6, 12, 24 and 36 months, plus survival probabilities. A separate delinquency-state model estimates movement between Current, 30, 60, 90 and Default states with cure and backward transitions preserved rather than forcing every account through one-way deterioration.

Empirical LGD and EAD research

Loss severity and exposure are no longer treated as one universal formula in the research stack. LendingClub lifecycle data supports empirical installment EAD and recovery/LGD analysis, while the UCI Taiwan revolving-credit panel is kept as a separate CCF-style research path. Product and target-horizon separation is explicit so incompatible datasets are not pooled into a synthetic universal credit model. The live `/api/v3` deterministic LGD and requested-amount EAD semantics remain unchanged until institutionally validated replacements exist.

Portfolio Monte Carlo and tail risk

CRIX v3.1 adds an offline one-factor correlated-default Monte Carlo engine with deterministic replay and bounded-memory chunking. It produces expected and unexpected loss, variance, supported VaR/expected-shortfall levels, independent-default comparison, and tail contributions that reconcile to portfolio tail loss. The research gate exercises 100,000-scenario portfolio runs while keeping heavy simulation away from the Fastify event loop.

Empirical macro stress research

The existing `/api/v3/risk/stress` endpoint remains explicitly classified as deterministic borrower sensitivity. A separate point-in-time macro research layer uses a frozen, provenance-tracked U.S. unemployment-rate series aligned to the historical LendingClub vintages. Committing the exact macro snapshot makes the result reproducible and prevents CI or research conclusions from depending on a live FRED request.

IFRS 9-style ECL and Basel-style capital research

The offline accounting layer supports Stage 1, Stage 2 and Stage 3 research classification, SICR and days-past-due backstops, cure/probation semantics, marginal-PD conversion, scenario-weighted ECL and EIR-style discounting. A separate capital module keeps expected loss distinct from unexpected/tail capital and provides IRB-inspired and economic-capital analytics. These are deliberately labelled IFRS 9-style and Basel-style research outputs — not accounting approval, regulatory compliance, or production capital certification.

Challenger governance and portfolio optimisation

The embedded real-data logistic challenger is evaluated against CRIX-MonoBoost on the same calibration and out-of-time cohorts using discrimination, calibration, Brier score, log loss, PSI/stability, bootstrap uncertainty, segment evidence and deployment context rather than “highest AUC wins.” The deterministic portfolio optimiser then supports bounded allocation under explicit budget, expected-loss and concentration-style constraints, returning infeasibility instead of silently relaxing limits.

API surface

Security and runtime hardening

The live API uses strict Fastify/AJV schemas, finite-number guards, a 64 KiB request ceiling, request and connection timeouts, UUID request IDs, Helmet headers, bounded CORS, route-specific rate limits, optional timing-safe API-key protection, log redaction, sanitized errors, bounded tree traversal, artifact-integrity verification and fail-closed readiness. Heavy research workloads remain offline rather than competing with request-time scoring CPU.

Production verification

CRIX v3.1.0 is released on GitHub and deployed from main to Render. The release commit passed the repository CI gate, and Render rebuilt the exact release, ran 23/23 runtime tests, bundled the Node 22 service, started `credit-risk-intelligence-api@3.1.0`, returned HTTP 200, and promoted the deployment live. The separate full model/governance gate contains 57/57 tests covering the advanced research stack and reproducibility contracts.

Model-risk boundary

CRIX is a public engineering and model-risk research system, not an approved lending, accounting or regulatory-capital platform. Its main real-world evidence is historical granted-loan data; reject inference remains an explicit limitation. The research LGD/EAD, macro, IFRS 9-style and Basel-style outputs require representative institution-specific data, independent validation, fairness/proxy analysis, exact accounting/regulatory policy interpretation, governed adverse-action reasons, audit retention, authentication/authorization, monitoring, and formal model-risk/legal/compliance approval before institutional production use.

Architecture signal

Technical profile

Engineering focus

Technical note

CRIX v3.1.0 is intentionally split between a compact live decisioning service and a heavier offline research stack. That separation keeps the production API inspectable and bounded while allowing lifetime credit risk, migration, correlated-loss, macro, accounting and capital research to evolve without pretending those methods have already been institutionally validated or silently changing what a live `pd` response means.