Personalized go / no-go agent

One step beyond a verdict: a personalized recommendation per pseudonymous user. The deterministic physical score is computed first and unchanged; a separate personalization layer then blends it with that user's learned behavioral preferences, archetype priors, and a recent-cohort signal of who else is going.

What it is

Where /v1/score is "what's the modelled suitability?", /v1/decision is "should THIS user go?". The engine combines four signals:

• Calibrated score: the deterministic verdict.
• Personal behavioral model: a small per-user MLP trained nightly from the user's outcome history. This ML sits in the personalization layer, outside the deterministic physical scoring path. Starts contributing at 5 outcomes, ramping linearly to full weight at 30+.
• Archetype model: per (archetype × spot-tier) priors from k-anonymous aggregates. Activates as soon as ≥10 distinct users contribute per cell.
• Recent-cohort signal: operator outcomes from the same spot + window in the last 2 hours (k≥2 distinct, n≥3 floor).

Request

{
 "user_pseudonym": "f9c8b3e2a1d4...5c6e", // hex, ≥32 chars, you compute this
 "activity": "kitesurfing",
 "spot": { lat, lng },
 "window": { from, to },
 "user_profile": {
   "experience": "intermediate",
   "risk_tolerance": "moderate"
 },
 "training_consent": false
}

user_pseudonym is the SHA-256 hash you compute from internal_user_id + your_secret, so Goable never receives the real user id. A pseudonym can still be personal data under GDPR Recital 26, and Goable processes it as a processor on your behalf. user_profile is optional (weight_kg, experience, owned_gear, risk_tolerance); the server derives the user's archetype from it internally, there's no archetype field you pass directly. training_consent defaults to false; set it true to let this (request × outcome) pair feed the per-user model's nightly retrain.

Response wraps score, verdict, confidence (same as /v1/score) plus a decision block: recommendation (go / no-go / borderline), confidence (decision-specific, distinct from the score confidence above), reasoning (LLM-generated narrative bounded to 300 chars), key_factors (which signal drove the call), personal_score / archetype_score / personalization_weight / n_outcomes_seen (provenance of the blend), alternatives (nearby spots scored higher, up to 3), and safety_notes. The response also carries a top-level degraded_mode boolean (true when the LLM step fell back to the deterministic template) and an advisory_notice disclaimer string on every call.

Personalization blend

For brand-new users with no outcome history, the call falls back to the archetype prior (or a neutral 0.5 if neither exists yet). As outcomes accumulate per pseudonym, the personal model's weight against the archetype prior ramps linearly from 5 outcomes (0% personal) to 30 outcomes (100% personal); above 30 the personal model fully replaces the archetype prior. This is a different ramp than /v1/recommend-spot's discovery blend, which caps at 50% by design.

Hard physics gates always win

Lightning, hazardous AQI and storm gates short-circuit the entire decision pipeline. The reasoning LLM never sees the request when a gate fires: the response is forced to recommendation: "no-go" via the deterministic template, and personal_score, archetype_score are dropped to null with personalization_weight: 0. Personalisation does not override a hard safety gate.

Privacy + deletion

Pseudonyms are tenant-private: you assign them, and the engine never receives the underlying user id, though a pseudonym can still be personal data under GDPR Recital 26 and Goable acts as processor. GDPR Article 17 deletion is available at DELETE /v1/decision/user-data/:pseudonym; it scrubs every personally-attributable row (behavioral model, decision-runs, skill posteriors, recommendation runs, non-aggregate audit) and returns 204 with five receipt headers (X-Anonymized-Rows, X-Anonymized-Decision-Runs, X-Anonymized-Skill-Posteriors, X-Anonymized-Recommendation-Runs, X-Receipt) for your compliance log. Recital 26 anonymous aggregates survive.