Brücke OS by TreuLink

An AI-assisted consulting operating system (Consulting OS) for the Germany–Türkiye corridor of migration, employment, and education. Core principle: every answer it gives is grounded in an official source and a verifiable proof.

Trust is not a promise — it is an auditable system property.

At a Glance


What	AI-assisted consulting platform for the Germany–Türkiye corridor (institutional demo / MVP)
My role	Founder and sole developer — product, architecture, design, content
Brand	Brücke OS (product) · TreuLink (parent brand) — Treu (German: trust/loyalty) + Link (connection, bridge). Brücke = German for "bridge."
Stack	Next.js 16 · React 19 · TypeScript 5.9 · Tailwind 4 · Drizzle + PostgreSQL 16 + pgvector · Redis · Vercel AI SDK · next-intl
Architecture	Single TypeScript monolith · Turborepo + pnpm monorepo · 5 core primitives + legal-guard
Scale	~32,500 lines of TypeScript · ~364 files · ~35 database tables · 22 unit + 23 end-to-end tests · 3 languages (TR/DE/EN)
Languages	Every user-facing string in Turkish, German, and English simultaneously
Target hosts	treulink.com (landing) · bruecke.treulink.com (app) · briefing.treulink.com (protected briefing room)
Status	Release-ready; running in institutional demo mode (cost-safe, curated-answer consultation)

Story & Problem

Migrating to Germany, finding work there, and navigating education pathways are complex processes: information is scattered, its currency is uncertain, and the consulting market often fails to inspire trust. Candidates frequently don't know which visa path fits them, whether their documents are complete and up to date, whether their consultancy is trustworthy — or even whether an official application was actually filed on their behalf. This uncertainty costs time, money, and psychological resilience.

This project was born from exactly that gap. During my own migration and employment process in Germany, I experienced a serious harm; a period of roughly 700 days of loss (time, money, effort, and psychological wear) became the project's founding motivation. The goal is not to blame people or institutions, but to show at a systemic level why such harms are possible — and to propose a digital structure that protects candidates, reassures institutions, and brings order to consulting processes.

That is why the platform is built end to end on a principle of honesty: guarantee language is forbidden. Phrases like "visa guarantee" or "certain result" are used on no layer (interface, data, AI prompt, presentation). The standard stance is: "does not replace official institutions; it prepares you for the process."

What It Does

Brücke is more than a website or a chatbot. It organizes the multi-actor processes along the Germany–Türkiye line with the logic of a case operating system: candidate profile, documents, goal, process status, consultant notes, employer matches, expert referrals, and institutional checkpoints all become trackable in one secure system.

Architecturally this is designed as a domain-agnostic core + domain packs — the "Consulting OS" vision. Brücke's de-tr-corridor pack is the first implementation of that core; the same engine can be carried over to other consulting domains.

The system is layered around six roles; each stakeholder sees their own experience:

Candidate — profile, document vault, goal, process status, CV, matching.
Consultant — case queue, document, task, note, and risk operations.
Employer — positions, candidate pool, match score, readiness, contact.
Institution/NGO — beneficiary tracking, cohort/program management, impact reporting.
Expert — referred cases, document review, legal/translation follow-up.
Admin — audit panel, audit log.

Key Features

Source badge (Prüfsiegel). Every information-bearing answer carries a source badge: source name + official URL + check date + confidence level. An AI answer without a badge is, by definition, a bug. If the data is more than 14 days old it shows amber, and over 30 days red — the user always sees how fresh the information is.

Legal-guard (legal boundary layer). Every AI answer passes through a legal boundary check before reaching the user. General information is provided; individual legal advice is not (the RDG boundary in Germany). Risky topics such as appealing a visa refusal, litigation, or contract validity are caught before the model is even called, and route to an expert-handoff screen (human-in-the-loop) — recorded in the audit log. This design rests on the German Federal Court's Smartlaw ruling: a deterministic calculation is RDG-safe, an LLM interpretation is not.

Deterministic rule engine. Thresholds, dates, and calculations are never left to the LLM; they are computed in separate, pure functions. For example, EU Blue Card (Blaue Karte EU) salary thresholds, Chancenkarte points, the §81a fast-track procedure, or Sperrkonto amounts — 14 distinct tools, each carrying its source and validity date. The same input always yields the same output; this is critical for both correctness and legal safety.

§81a verification module. The heart of the presentation: fraud resistance. The status of documents, the trail of steps taken in the candidate's name, and their verifiability are made transparent through a checklist.

Matching pool. A human-reviewed system that connects candidates and employers through an open score breakdown (occupation/language/readiness/experience/location) and a consent flow.

SABEV Exposé wizard. A client-side generator of introduction profiles with PDF/DOCX export in three languages; it explicitly states that the data never leaves the device and that no placement guarantee is given.

Trust Showcase & guided tours. A showcase that demonstrates live SHA-256 hashing, versioned consent, and audit trail; plus guided tours that explain the roles as clickable journeys, and the protected Briefing Room sent to officials ("who/what/how in 60 seconds" + live demo).

Core Principles

The project's immutable rules are enforced by tests:

Trust = auditable system property. Every module delivers three "sensory proofs": the calculator feel (deterministic, sourced), the guide feel (step–document–duration–source), and the advisor feel (source-badged AI).
Demo honesty. Every data record is labeled (real-profile-redacted | demo-data | mock-stakeholder | official-source-sample | not-integrated-yet); a thin "Demo data" badge appears in the UI. No integration with, or endorsement by, any official institution is implied.
Redaction. National ID/passport numbers, bank details, QR codes, signatures, full addresses, and third-party contact information never enter the data, the UI, or the repository — including the founder's own profile.
No real file uploads. The document vault works only with metadata + SHA-256 hash + simulation; raw content is never stored.
Trilingual parity. Every user-facing string enters the TR/DE/EN files in the same commit; a parity test enforces this.
Evidence-layer typography. Verifiable content (source, §, hash, date, tables) is set in IBM Plex Mono — this is the brand's signature.

Technical Architecture

A single TypeScript monolith. The UI, API route handlers, and AI logic all run inside one Next.js application. No Python; heavy frameworks like LangGraph/LlamaIndex are deliberately excluded.

Stack: Next.js 16 (App Router, Turbopack) · React 19 · TypeScript 5.9 (strict) · Tailwind CSS 4 · Drizzle ORM + PostgreSQL 16 + pgvector (HNSW cosine index) · Redis (ioredis) · Better Auth (Drizzle adapter, organization plugin for B2B) · Vercel AI SDK 7 · next-intl 4. Linting with Biome (noExplicitAny: error), testing with Vitest + Playwright.

Monorepo: Turborepo + pnpm workspaces. The code is split into @brucke/* packages: web (the monolith), db (Drizzle schema + migrations), ui, types, config, the domain pack (de-tr-corridor), and the core primitives.

5 core primitives + legal-guard. The core consists of five domain-agnostic primitives; each is a separate package with a clean interface, and the LLM/retriever are injected from outside (the core never touches an API key):

Knowledge — "What is true?" — RAG interfaces (embedder, retriever, retrieved chunk).
Logic — the deterministic rule engine.
Memory — "Where am I?" — deterministically flattens user context + process state into prompt text.
Trust — source badge, SHA-256 hash, audit, eIDAS timestamp.
Orchestration — ties the above together; if there is no source, the model is not called and a safe "no information" answer is returned.

Plus the mandatory 6th layer, legal-guard: every answer passes two gates before reaching the user — one on the query (risky-topic detection, without calling the model), and one on the generated answer (advice-drift detection + a localized disclaimer).

The RAG pipeline is empirically calibrated: a minimum-similarity threshold filters out irrelevant queries, and a partial-coverage threshold triggers an "incomplete information" honesty note. The source badge's date shows not the chunk's insertion date but the date the claim was verified (the source's last scrape date).

Privacy by design. Raw queries and documents are not stored — only their SHA-256 hashes. GDPR/KVKK consent is mandatory. For document verification, an eIDAS timestamp is planned; blockchain is not used (eIDAS + SHA-256 are sufficient).

Deployment: Docker Compose (multi-stage build, Next.js standalone output) + Caddy (automatic HTTPS) → Hetzner VPS. There is also a DB-less "public demo" mode (PUBLIC_DEMO flag) and a zero-cost "curated-answer" consultation mode.

Note: some project documents (e.g. CLAUDE.md) mention an API plan for embeddings; in practice the embedding layer was developed to run on a self-hosted bge-m3 (Ollama, 1024 dimensions). The chat LLM stays provider-agnostic (Anthropic by default; Ollama as the self-host/GDPR option).

Development Process

The project advanced along two axes. The strategic roadmap spans nine phases: Phase 1 core infrastructure → Phase 2 five primitives + legal-guard → Phase 3 visa/migration MVP → Phase 4 employment/education → Phase 5 dashboard/payment/eIDAS → … → Phase 9 open-source release (engine AGPL, SDK Apache) + franchise.

The actual build history ran in lettered waves (A through I) of an institutional demo sprint: brand switch, schema + role-based access, briefing room, candidate flow, matching engine, §81a module, trust showcase, consent withdrawal and GDPR data export, legal-guard enforcement, scenario library, guided tours, and the DB-less publish mode — followed by the SABEV Exposé wizard and the pivot to a full-app deployment on VPS.

The working discipline is the same in every session: read the single authoritative source of status (HANDOFF.md) → a short plan → small commits. At the end of the day, lint, typecheck, test, and build are kept green. Every core flow gets a Playwright happy-path test; schema changes happen only via Drizzle migrations. Every user-facing string enters all three languages in the same commit.

The project was developed end to end in an AI-native way, in a pair-programming discipline with Claude Code.

Impact & Future

Near term: production deployment (Hetzner VPS + Docker + Caddy), switching the consultation to a live LLM (Anthropic Haiku/Sonnet, with GDPR-compliant options), and an eIDAS timestamp for document verification.

Mid to long term: payment infrastructure (dependent on a legal-entity decision), an appointment bot and form assistant, a §45c "Comply" B2B module, a talent marketplace, and eventually an open-source release + franchise.

Positioning: the aim is a relationship-based introduction to institutions working along the German migration system (for example, on the AMIF and "Mein Weg nach Deutschland" axis). This is done with a careful caveat, however: no integration with, or endorsement by, any official institution is implied; if the project meets the right institutions, it has the potential to grow into an infrastructure that protects candidates, reassures institutions, and generates social impact.

Closing

Brücke OS represents more than a product idea: an effort to turn a personal harm into a systemic solution. Technically, it is an end-to-end demonstration of capability — building a modern monolith architecture, separating the deterministic rule engine from the LLM, embedding legal and ethical boundaries into code, running a trilingual product with discipline from the start, and delivering all of it with AI-native productivity.

In short: a system that tries to show that trust can be not a slogan but an auditable engineering property.