A frontier model gives one engineer a team’s throughput, but a ledger that has to survive a tax audit cannot take a non-deterministic output as truth. Let the model write to the books and every figure in them becomes unverifiable.
Approach
Draw the boundary at the books. The model proposes inputs — classified transactions, matched sources, entries pulled from messy evidence — and the deterministic engine regenerates the ledger from them. A wrong proposal is deleted and rebuilt, never patched.
A frontier model gives a single engineer a team's throughput, but not a team's trustworthiness — and the core of this work is an audit-grade, multi-chain ledger. The resolution is not to trust the model more carefully. It is to put it on the other side of a boundary: the model reasons over messy evidence and proposes inputs, and a deterministic engine regenerates the books from those inputs plus rules. Everything the model produces is a proposal that the engine can reject.
inputproposalpasses both gatesfails a gate → rebuild
The model proposes; the deterministic engine decides. A proposal that fails either gate is discarded and the ledger regenerated from inputs and rules — never patched in place. That is how non-deterministic reasoning coexists with books that have to survive an audit. The same harness pattern, pointed at web development instead of accounting, built this site.
Why the loop matters
The rebuild edge is the part that does the work. A conventional pipeline would let a bad classification be corrected in place, which leaves the ledger holding a figure whose provenance is now a patch rather than a rule. Here a proposal that fails either gate is deleted and the ledger is regenerated from its inputs — so every number in the committed ledger traces to an event and a rule, and none of them trace to a model's confidence. That property is what lets a non-deterministic component sit inside a system that has to survive a tax audit.
The longer version — how the same pattern runs the engineering itself, with plans and decisions as the immutable inputs — is in the build log.