ProductThe operator terminal
for finance data ops.
One disciplined surface — inbox, reconciliation, source health, runbooks, audit trail — sitting on top of a signed trust layer.
Operator inbox
Every finding, ranked, cited, ackable.
Findings, recon mismatches, source-health degradations, and agent proposals — one ranked stream with the lineage refs already attached. Ack, resolve, or forward; the ack-by-whom and ack-when land in the audit trail automatically.
Ranked by severityLineage refs inlineSimilar-incident matcherAck + resolve audit
Findings
Integrity, cross-source, continuity, dataset-health, predictive freshness — five deterministic engines feeding one stream.
Recon mismatches
Broker vs internal vs market — every diverging field shows which source contributed which value.
Agent proposals
Copilots surface here too: every proposal has an evidence card and an accept-as-deterministic-action button.
Reconciliation
Cross-source, signed, replayable.
Brokers as canonical, market-data sources as explicit opt-in fallbacks. Every reconciliation run is hashed into the lineage chain — auditors can replay a run end-to-end weeks later and verify nothing was tampered with.
Broker = canonicalHash-chained runsReplayableDiff-on-divergence
Position recon
IBKR / Alpaca exports normalized into a unified account schema, compared against the internal book.
NAV recon
Custodian NAV report vs internal — grace windows, freshness checks, missing-file detection.
Tax-lot recon
Cost-basis and tax-lot differences surfaced before the next adjustment is applied.
Source health
Every connector, scored for reliability.
Time-weighted uptime per connector. Reliability tiers (canonical / fallback / advisory) drive which value wins in a tie. Cache-fallback semantics on disconnect so a vendor outage doesn't silently change your golden values.
Time-weighted uptimeTiered reliabilityCache fallbackTrend lines
Uptime DAO
Tracks every connector for uptime and bucket-shifts the reliability tier when trends move.
Failed refresh detection
Continuity engine flags a refresh that should have happened but didn't, before downstream alerts fire.
Schema drift
When a source changes its shape, the schema-drift signal lights up before findings cascade.
Audit trail
Every event, signed, exportable.
Reconciliation runs, incident acks, resolutions, root-cause notes, downstream notifications, agent proposals, approvals — logged with prompt + response fingerprints (sha256), model ids, token costs. Exportable as a signed evidence packet.
SHA-256 hash chainSigned evidence packetsExportableCompliance-ready
Every action logged
Deterministic actions enter the hash chain; LLM calls are logged separately as advisory traces.
Per-call fingerprints
Prompt fingerprint, response fingerprint, model id, token cost, decision id (when a call led to a proposal).
Replayable packets
Auditors replay the chain at a point in time, verify the hash, and confirm no row was tampered with.
A day on the desk
One hour of trust work,
before the market opens.
Open the morning inbox. The recon ran at 08:45. Three findings: a missing custodian NAV file, a divergent qty on a single row, and a reliability dip on Yahoo. Each one has its lineage refs and a proposed action — ack, accept, or escalate. By 09:00 you know what you're acting on.
08:30Recon scheduled — broker vs internal book.
08:32Missing custodian NAV — grace window opens.
08:45Recon complete. Three findings posted.
08:46Anomaly explainer drafts narrative for AAPL qty divergence.
08:52Operator acks two findings. NAV escalated to cash team.
09:00Headline bar green. Audit trail signed.
The trust layer that makes this possible
is the moat.
