The evidence binder that can prove what the auditor received.

Audit support is a logistics problem wearing an accounting costume.

The Financial Education & Research Foundation's audit fee survey put the average public company audit fee at USD 3.01 million, up 6.4% year on year, with ICFR effort the leading driver. Practitioner surveys in the same territory find 57% of companies saying audit support gets harder every year, and PBC delays are repeatedly cited as the top cause of reporting timeline slippage. Behind those numbers sits a workflow that has barely changed in twenty years. The auditor emails a PBC spreadsheet. The controller forwards line items to process owners. Owners email back attachments of assorted periods, entities and versions. Someone maintains a tracker that drifts from reality within days. Then, deep into fieldwork, the auditor re-requests items already sent, because on their side the attachment landed in a different inbox, or an older version, or nowhere.

• the missNeither side can prove a delivery. An email with an attachment establishes that something was sent, and says nothing about whether it was the right period, the right entity, or the version now sitting in the auditor's file.
• the costEvery disputed item restarts a multi-day loop: locate, re-check, re-send, re-log. Fieldwork slips, the overrun becomes billable hours, and the fee conversation happens with no turnaround evidence on either side.
• the fixBind every request to hash-verified artifacts through gates that run in code, or park it in Open Items by name. Make the manifest, with per-request turnaround from ledger timestamps, the artifact both sides negotiate from.

Handing the model the binder makes the dispute worse, and politer.

The obvious 2026 move is to point a language model at the document store and let it answer the PBC list. That fails in a specific, predictable way. A model asked to find "the Q3 bank reconciliations" will find something: a Q2 reconciliation with a similar filename, last year's Q3, the right file for the wrong entity. Matching is exactly the kind of plausible-similarity task models are fluent at, and audit evidence is exactly the domain where plausible similarity is the failure mode. A near miss delivered with a confident cover note is worse than a gap, because the gap gets chased this week and the near miss gets discovered in March.

The three seeded defects in this demo are the three classic near misses. A covenant certificate renamed "as at 31 December" whose content is dated 30 September. An inventory listing labelled SGP02 whose entity field says SGP01. A fixed asset register that misses the trial balance by S$4,820.00 because a disposal was never removed. A retrieval model matches all three happily, since it reads labels. The gates read content, and content is where evidence lives.

Locate is a suggestion. Deliver is a decision. Code sits between them.

Every system on this site draws the same boundary: deterministic code computes and decides, the model only locates facts and phrases language, and a named human gates anything consequential. Applied to the auditee-to-auditor handover, the pipeline looks like this:

Two design choices carry the weight. First, the abstention rule is absolute: if no artifact meets the request's period, entity and scope, the model outputs "no matching artifact in binder" and the item moves to Open Items. It may not offer a near miss, because a visible gap gets chased and an invisible substitution gets audited. Second, a failed gate has no override. The controller's Deliver button simply does not exist for a binding the code refused, which converts "please just send it, we are late" from a pressure point into a non-event.

Deliverable is a computed property, so it is written as a computation.

This is the gate function from the shipped file, minus the display strings. Every proposed binding runs through it, the visitor's typed requests included. Note what is absent: no confidence score, no weighting, no way for eloquence to move the outcome.

// gates 1-3: pure decisions over the ARTIFACT'S ACTUAL FIELDS (the model
// matched on the claimed label; defects live in the gap between the two)
function runGates(req, a, tb) {
  const period = a.actual.p0 >= req.w0 && a.actual.p1 <= req.w1;
  const entity = a.actual.e === req.e;
  let tie = "n/a";                     // only when a TB linkage is declared
  if (a.tb === "0000") tie = Math.abs(rowSum(a.rows)) <= TIE_TOL;   // a TB ties to zero
  else if (a.tb) {
    const target = Math.abs(tb[req.e][a.tb].b);     // control account, cents
    tie = Math.abs(rowSum(a.rows) - target) <= TIE_TOL; // TIE_TOL = 100 = SGD 1
  }
  return [period, entity, tie];        // gate 4, SHA-256, is awaited by the caller
}
// a binding is deliverable only if no gate is false; there is no override arm
const deliverable = gates.every(g => g !== false);

Seventy-four requests in, seventy-four accounted for.

The seeded run processes the full register: 74 requests against a binder of 76 artifacts across two entities. The engine delivers 65 requests (73 artifact hashes on the manifest, since the quarterly bank reconciliation requests each carry three monthly files), blocks 3 where a gate failed, and abstains on 6 where the binder holds nothing responsive. The 422-entry ledger chains every step, and the median request-to-evidence time computes to 58 seconds from the ledger's own timestamps.

• PBC-39, the renamed certificate. The model matches the covenant certificate whose label says 31 December. The period gate reads the content date, 30 September, and blocks it. That is the Q3 file re-sent with a new name, an entirely ordinary accident, caught in milliseconds instead of at the audit committee.
• PBC-17, the wrong company. An inventory listing labelled SGP02 carries SGP01's entity field, and its rows tie to SGP01's trial balance. Two gates fail independently. One glance at the gate panel tells the controller which process owner to call.
• PBC-20, the register that does not tie. The fixed asset register recomputes to S$4,820.00 above the TB control account. The tie-out gate shows the exact difference, which is the starting point of the fix rather than the end of a three-email argument.
• Six abstentions, named. The valuation report, the actuarial report, the second circularisation batch and three others sit in Open Items with the reason spelled out. An honest gap list is a chase list; a padded delivery list is a time bomb.
• The dispute. Six weeks later: "we never received the Q3 bank reconciliations." One click replays the chain, recomputes SHA-256 for the three files still in the binder, and lands on the delivery event: timestamp, approver, acknowledgement, hashes matching the manifest. Measured in the browser, the whole replay takes about five seconds.

True by construction, which is precisely the point being made.

The binder is synthetic and labelled so in the app. The 65/3/6 split exists because I seeded three realistic defects and six genuine gaps into a deterministic engine; the run reproduces identically on every load, hashes included. The 58-second median comes from simulated timestamps inside the run, so it demonstrates that turnaround becomes computable from the ledger rather than claiming any client achieved it. What the demo proves is the control architecture: zero silent gaps is a property of the mechanism, since every request terminates in exactly one of two visible states.

The honest limits are worth stating flatly. The matching model here is a deterministic stub over a small in-browser corpus, standing in for retrieval against a real DMS or SharePoint, where matching is harder and abstention thresholds need real tuning. The hash manifest proves integrity and sequence within the app, and it is nothing like legal non-repudiation: there are no trusted timestamps and no counterparty signatures, so a production version would want both. Real PBC lists run to hundreds of items with multi-entity scoping this demo only sketches at two entities. And the request-list shape borrows from a published PBC template (NAIHC's Prepared-by-Client list), with artifact row schemas modelled on the State of CT Open Expenditures ledger fields, both cited in-app; the figures inside are generated.

Kill the dispute yourself, then try to sneak a near miss past the gates.

Click the dispute button and watch the proof replay. Then type your own request: watch it bind with the gates going green one by one, or hit the renamed covenant certificate and watch a gate go red, or ask for the valuation report and watch the model abstain instead of improvising. Tamper with an artifact and let the recompute find it.