Twelve rules the software is not allowed to break

Every figure in a rendered deliverable comes from a computation line produced by the deterministic engine. The drafting layer writes prose about figures; it does not originate them.

A number appearing in drafted prose with no line behind it is a blocking error rather than a paragraph to proofread, and it is demonstrated against a case deliberately prompted to produce one. A rule that depends on somebody catching it in review is not a rule, because the week it matters is the week nobody has time to read carefully.

Every table the engine produces is cross-footed before anything is drafted, rendered or exported. A deliverable whose figures do not add up is not produced.

A job whose figures do not tie ends naming the account and the amount, and no document is written. The gate has no bypass — not a parameter, not a setting, not an exemption for one kind of job — and the build parses the source and fails if one appears. A deliverable that does not add up is worse than no deliverable, because somebody will sign it.

A failure is something that went wrong inside this system. A block is this system working: the arithmetic was checked, it did not hold, and the deliverable was refused.

The two carry different states, because a practice needs to tell them apart — one is a support ticket and the other is a correction to make in the books. Collapsing them would make the block look like our defect, and the fastest way to make a control unpopular is to let it be mistaken for a bug.

Not skipped, not partially completed, and not returned with the figures absent.

A failed computation ends the job rather than producing a document with the numbers missing and a status of complete. That combination is the worst possible outcome: it looks finished, so it gets reviewed as though the arithmetic happened.

Slabs, surcharge bands and depreciation rates are effective-dated rows keyed by assessment year, from one reviewed and checksummed source per year.

An assessment year with no reviewed rate set is refused rather than computed with the previous year’s numbers, and every computation records the checksum of the set that produced it. Rates in code means the software is only correct for the year somebody last edited it, and it fails by producing an answer rather than an error.

Every monetary figure is an exact decimal in the database, in the engine and in the browser, rounded once at the boundary rather than at each step.

The arithmetic layer raises when handed a float rather than coercing one — by then the precision is already gone, so the fix belongs upstream. A 5,000-row reconciliation ties to exactly zero where the same rows in floating point leave a residual, and a reconciliation that ties to approximately zero teaches everybody to write off real differences.

Every imported row is accounted for. Parsed plus rejected plus duplicate must equal the rows submitted, and every rejected row is kept as the file wrote it.

That equality is a database constraint rather than a convention, and the rejected rows are a screen rather than a log line. An unrecognised format is an error, and a truncated export names the offset where it stopped — a parser that returns an empty ledger produces a reconciliation that balances perfectly over nothing.

In the schema. Clearing a reconciliation item without an explanation is not possible.

A cleared item with no explanation is indistinguishable from one somebody deleted because it was inconvenient, and it is the first thing a peer reviewer checks. As a required field it cannot degrade into a list of items closed for reasons nobody wrote down, which is exactly what a comment column becomes in a busy March.

Role and identity are two separate controls. An articled assistant may not approve at all; a manager may approve, but never an adjustment they proposed.

It is a database constraint rather than a rule in a controller, so it holds for every path that ever writes an approval rather than only the one somebody remembered. A separation of duties enforced in a screen is a separation of duties until the next screen.

The firm sits on every row and is applied where the query is built, so scoping has one place it can be forgotten rather than one per endpoint.

A cross-firm read, list, search or download answers as though the record does not exist, and a build in which any firm-data function can be called without a scope fails — printing every declared exception with its written reason on each run. A refusal would confirm the record exists, and a real engagement id is a fact about another firm’s client list.

Tax numbers, registration numbers, account numbers and client names are redacted before anything is written to log storage.

An operational log is otherwise a client list with a timestamp, held for longer than anybody intended and read by more people than the records themselves. Client-supplied text is also treated as hostile in all three places it travels — parsed on the server, rendered as text in the console, and neutralised on the way into a spreadsheet.

Preparation, review and signature are three different acts. A partner signs, and only with no review note left open.

An unsigned export carries a draft watermark, and the watermark fails closed: an export arriving without a status is treated as unsigned rather than assumed final. An assistant reaching the signing endpoint is refused on role before anything else is checked, because that attempt is the failure worth refusing earliest.