verifyhash 0.1.0

package/trustledger/dist/trustledger-standalone.html.sha256

@@ -0,0 +1 @@
+1afa0e08c9624505ad967ab88c91553c6af00b0e5e0f2b790ddf315741ed1742  trustledger-standalone.html

package/trustledger/door-core.js

@@ -0,0 +1,442 @@
+"use strict";
+
+// TrustLedger — door-core.js
+//
+// T-65.2: the PURE payload→result core of the web door, factored out of server.js
+// so that BOTH surfaces call the SAME functions and can never drift:
+//   * trustledger/server.js (the HTTP door) routes /api/reconcile and /api/inspect
+//     straight into reconcilePayload / inspectPayload below, exactly as before —
+//     behavior, error names, statuses, and bytes UNCHANGED by the factoring;
+//   * trustledger/build-standalone.js inlines THIS FILE VERBATIM into the offline
+//     single-file app (trustledger/dist/trustledger-standalone.html), where the
+//     page's transport seams call the same two functions directly in-page.
+//
+// EVERYTHING here is PURE and I/O-free: no fs, no http, no clock (the caller
+// injects `reportDate`), no writes. The ONLY module dependencies are the engine
+// modules (ingest / report / policy / close) and the license verifier — all
+// required at top level with plain relative specifiers so the standalone bundler
+// can rewrite them against its own module registry (the license module is swapped
+// there for a FAIL-CLOSED offline shim; the gate below is inlined verbatim and is
+// therefore REUSED, never re-implemented and never weakened).
+//
+// The prose below is moved verbatim from server.js (T-27.1 / T-28.1 / T-28.2 /
+// T-29.3) — the contracts are unchanged; only the file they live in moved.
+
+const ingest = require("./ingest");
+const report = require("./report");
+const policy = require("./policy");
+const close = require("./close");
+const license = require("./license");
+
+// ---------------------------------------------------------------------------
+// A named, HTTP-status-bearing error for the request layer. Carries a stable
+// machine `error` code (snake_case) plus the human `message`, so the JSON body
+// is { error, message } — a named error, never a stack trace.
+// ---------------------------------------------------------------------------
+
+class HttpError extends Error {
+  constructor(status, code, message) {
+    super(message);
+    this.name = "HttpError";
+    this.status = status;
+    this.code = code;
+  }
+}
+
+// Map an engine error to a stable snake_case machine code. The engine's own
+// named errors (IngestError / ReportError / PolicyError / CloseError) carry the
+// precise, already-located human message; we only need a coarse machine label.
+function engineErrorCode(err) {
+  switch (err && err.name) {
+    case "IngestError":
+      return "ingest_error";
+    case "ReportError":
+      return "report_error";
+    case "PolicyError":
+      return "policy_error";
+    case "CloseError":
+      return "close_error";
+    default:
+      return "reconcile_error";
+  }
+}
+
+// ---------------------------------------------------------------------------
+// T-29.3: the WEB door's LICENSE GATE — the SAME gate the CLI `gateReconcile`
+// applies, threaded through HTTP. A request that asks for a PAID surface
+// (`state`/`policy` => multi-state policy packs, or `seal` => the reconciliation
+// seal) WITHOUT a valid, vendor-pinned license is REFUSED with a NAMED 4xx; the
+// FREE inspect + baseline reconcile routes stay open and behave byte-for-byte as
+// before. The server holds NO key and verifies OFFLINE: `verifyLicense` needs only
+// the pinned vendor ADDRESS + the supplied container (no network, no signing key).
+//
+// The flag->entitlement mapping is the SAME contract the CLI uses (so the two gates
+// can never drift): `state`/`policy` need `multi_state_policy`; `seal` needs `seal`.
+// A refusal carries the PRECISE reason verifyLicense returns (wrong_issuer /
+// expired / not_yet_valid / bad_signature / malformed), so a wrong/expired license
+// NEVER silently downgrades to a free run — it is reported, not ignored.
+// ---------------------------------------------------------------------------
+
+// Which entitlement each paid WEB surface requires. Mirrors the CLI's
+// PAID_FEATURE_ENTITLEMENTS exactly (state/policy => multi_state_policy; seal =>
+// seal), keyed off the request payload's own field names.
+const WEB_PAID_FEATURE_ENTITLEMENTS = Object.freeze([
+  {
+    requested: (p) =>
+      (p.state != null && String(p.state).trim() !== "") ||
+      (p.policy != null && String(p.policy).trim() !== ""),
+    entitlement: "multi_state_policy",
+    label: "multi-state policy packs (state)",
+  },
+  {
+    requested: (p) => p.seal === true,
+    entitlement: "seal",
+    label: "the tamper-evident reconciliation seal (seal)",
+  },
+]);
+
+// Apply the license gate to an already-parsed request payload. Returns silently
+// when the request is permitted (free tier, or a valid license covering every
+// requested paid feature). Throws a NAMED HttpError otherwise:
+//   * license_required (402) — a paid surface was requested with NO license at all
+//   * license_invalid  (403) — a license WAS supplied but is invalid for this run
+//       (malformed / bad_signature / wrong_issuer / expired / not_yet_valid, or a
+//        valid license that does not carry the required entitlement)
+// `now` is the injected report date so the verdict is deterministic. The license
+// container + vendorAddress come from the request body; the server holds no key.
+function gatePayload(payload, now) {
+  const needed = WEB_PAID_FEATURE_ENTITLEMENTS.filter((f) => f.requested(payload));
+  if (needed.length === 0) {
+    // FREE TIER: no paid surface requested — proceed unchanged. A stray
+    // license/vendorAddress with no paid feature costs nothing and is ignored.
+    return;
+  }
+
+  const featureList = needed.map((f) => f.label).join(" and ");
+  const hasLicense = payload.license != null;
+  const hasVendor = payload.vendorAddress != null;
+
+  // Both must travel together: a license is worthless without the vendor address
+  // to PIN it to, and a vendor with no license is nothing to verify.
+  if (!hasLicense && !hasVendor) {
+    throw new HttpError(
+      402,
+      "license_required",
+      `${featureList} ${needed.length > 1 ? "are" : "is"} a paid feature and requires a license; ` +
+        "supply { license, vendorAddress } in the request body. " +
+        "The free tier — baseline-policy reconcile + file inspect — needs no license."
+    );
+  }
+  if (!hasLicense || !hasVendor) {
+    throw new HttpError(
+      402,
+      "license_required",
+      'both "license" and "vendorAddress" must be supplied together (a license is verified by ' +
+        "pinning it to the vendor address)"
+    );
+  }
+
+  // Parse + validate the supplied container (a JSON string OR an already-parsed
+  // object). A malformed container is a license_invalid 403 — never half-trusted.
+  let container;
+  try {
+    container = license.readLicense(payload.license);
+  } catch (e) {
+    throw new HttpError(
+      403,
+      "license_invalid",
+      `the supplied license is not a valid signed license container: ${e.message}`
+    );
+  }
+
+  // Verify OFFLINE against the pinned vendor, dated at the run's reportDate. A
+  // malformed vendorAddress is a request error (the address could not be parsed).
+  let verdict;
+  try {
+    verdict = license.verifyLicense(container, { now, vendorAddress: payload.vendorAddress });
+  } catch (e) {
+    // verifyLicense throws only for a garbage vendorAddress / now — a request bug.
+    throw new HttpError(400, "bad_request", e.message);
+  }
+
+  if (!verdict.valid) {
+    // Report the PRECISE reason — never silently downgrade to a free run.
+    throw new HttpError(
+      403,
+      "license_invalid",
+      `${featureList} requires a valid license, but the supplied license is invalid ` +
+        `(reason: ${verdict.reason}); the free baseline reconcile remains available without state/policy/seal.`
+    );
+  }
+
+  // Valid + in-window + correct issuer. Require EACH requested feature's
+  // entitlement to actually be granted — a license never grants what it was not sold.
+  for (const f of needed) {
+    if (!license.hasEntitlement(verdict, f.entitlement)) {
+      throw new HttpError(
+        403,
+        "license_invalid",
+        `the supplied license is valid but does not include the "${f.entitlement}" entitlement ` +
+          `needed for ${f.label}; this license grants only [${verdict.entitlements.join(", ")}]. ` +
+          "The free baseline reconcile remains available."
+      );
+    }
+  }
+}
+
+// ---------------------------------------------------------------------------
+// The pure core: take the already-parsed request payload (strings + optional
+// state/priorClose) and produce the response shape. NO I/O. Throws HttpError on
+// any bad input (a malformed file, an unknown state, a bad prior-close) so the
+// caller maps it straight to an HTTP status + named JSON body. `reportDate` is
+// injected (the caller supplies today) so this function stays deterministic.
+// ---------------------------------------------------------------------------
+
+// Read the OPTIONAL per-file `maps` object (T-28.2). Returns a frozen
+// { bank, ledger, rentroll } where each entry is either a plain object (the
+// `columnMap` to thread into that file's strict parser) or `undefined` (so the
+// parser is called with `columnMap: undefined` — the byte-identical no-map path).
+// STRICT on shape: `maps` (when present) must be a plain object, and each named
+// per-file entry (when present) must be a plain object — anything else is a named
+// 400, never a coercion. Unknown keys inside `maps` are ignored (only the three
+// file keys are honoured), and the deep validity of each map (unknown logical
+// field, or a header absent from the file) is left to the strict parser, which
+// raises the SAME located IngestError it always would.
+function readOptionalMaps(raw) {
+  const empty = Object.freeze({ bank: undefined, ledger: undefined, rentroll: undefined });
+  if (raw == null) return empty;
+  if (typeof raw !== "object" || Array.isArray(raw)) {
+    throw new HttpError(
+      400,
+      "invalid_maps",
+      '"maps" must be an object of { bank?, ledger?, rentroll? } column maps'
+    );
+  }
+  const out = {};
+  for (const key of ["bank", "ledger", "rentroll"]) {
+    const m = raw[key];
+    if (m == null) {
+      out[key] = undefined;
+      continue;
+    }
+    if (typeof m !== "object" || Array.isArray(m)) {
+      throw new HttpError(
+        400,
+        "invalid_maps",
+        `"maps.${key}" must be an object of { <logicalField>: <headerName> }`
+      );
+    }
+    out[key] = m;
+  }
+  return Object.freeze(out);
+}
+
+function reconcilePayload(payload, reportDate) {
+  if (payload == null || typeof payload !== "object" || Array.isArray(payload)) {
+    throw new HttpError(400, "bad_request", "request body must be a JSON object");
+  }
+
+  // The three file CONTENTS are REQUIRED and must be strings. A missing or
+  // non-string field is a named 400 — never a coercion of, say, a number to "".
+  for (const key of ["bank", "ledger", "rentroll"]) {
+    if (typeof payload[key] !== "string") {
+      throw new HttpError(
+        400,
+        "missing_file",
+        `"${key}" is required and must be the file contents as a text string`
+      );
+    }
+  }
+
+  // LICENSE GATE (T-29.3). Apply the SAME paid-surface gate the CLI uses BEFORE any
+  // paid feature is resolved, so a gated request (state/policy/seal) without a valid
+  // license is refused with a NAMED license_required/license_invalid — never folded
+  // into a downstream policy_error and never silently downgraded to a free run.
+  gatePayload(payload, reportDate);
+
+  // Optional per-state policy. An unknown code is a named 400 (PolicyError's
+  // message names the available codes), not a silent fall-through to baseline.
+  let activePolicy = null;
+  if (payload.state != null && String(payload.state).trim() !== "") {
+    try {
+      activePolicy = policy.resolveState(String(payload.state));
+    } catch (e) {
+      throw new HttpError(400, "policy_error", e.message);
+    }
+  }
+
+  // Optional roll-forward from a prior period's close artifact (its JSON TEXT).
+  // Seeds this run's opening balances; a malformed close is a named 400.
+  let priorClose = null;
+  let opening = { bank: 0, book: 0 };
+  if (payload.priorClose != null && String(payload.priorClose).trim() !== "") {
+    try {
+      priorClose = close.readClose(String(payload.priorClose));
+    } catch (e) {
+      throw new HttpError(400, "close_error", e.message);
+    }
+    opening = { bank: priorClose.ending.bank, book: priorClose.ending.book };
+  }
+
+  // Optional per-file column maps (T-28.2). A mapping the broker fixed in the
+  // inspect flow is threaded back here so the REAL run honours it — the same
+  // `{ <logicalField>: <headerName> }` shape the strict parsers' `columnMap`
+  // already accepts, keyed by the SAME three file keys. When `maps` is absent (or
+  // a per-file map is absent) behaviour is BYTE-FOR-BYTE the no-map path: each
+  // parser is called with `columnMap: undefined`, exactly as before. A bad shape
+  // (not a plain object, or a per-file entry that is not a plain object) is a
+  // named 400 — never a silent coercion.
+  const maps = readOptionalMaps(payload.maps);
+
+  // Ingest the three files (STRICT — the first malformed row raises a located
+  // IngestError, which we surface as a named 400 rather than dropping the row).
+  let bank;
+  let book;
+  let rentroll;
+  try {
+    bank = ingest.parseBankStatement(payload.bank, { columnMap: maps.bank });
+    book = ingest.parseQuickBooksCSV(payload.ledger, { columnMap: maps.ledger });
+    rentroll = ingest.parseRentRollCSV(payload.rentroll, { columnMap: maps.rentroll });
+  } catch (e) {
+    throw new HttpError(400, engineErrorCode(e), e.message);
+  }
+
+  // Build the deterministic packet model (match + reconcile + report inside),
+  // then render the SAME HTML + CSV artifacts the CLI emits — but keep them in
+  // memory and return them in the JSON response. Nothing is written to disk.
+  let model;
+  let reportHtml;
+  let reportCsv;
+  try {
+    model = report.buildPacket({
+      bank,
+      book,
+      rentroll,
+      reportDate,
+      opening,
+      policy: activePolicy,
+      priorClose,
+    });
+    reportHtml = report.renderHTML(model);
+    reportCsv = report.renderExceptionsCSV(model);
+  } catch (e) {
+    throw new HttpError(400, engineErrorCode(e), e.message);
+  }
+
+  return {
+    tiesOut: model.tiesOut,
+    pass: model.pass,
+    balances: model.balances,
+    exceptions: model.exceptions,
+    summary: report.summaryLine(model),
+    reportHtml,
+    reportCsv,
+  };
+}
+
+// ---------------------------------------------------------------------------
+// T-28.1: the read-only DIAGNOSTIC core. Maps a broker-facing `source` spelling
+// (the SAME file keys /api/reconcile uses, plus the `quickbooks` synonym) to the
+// engine's SOURCE.*, then calls ingest.diagnoseSource VERBATIM and returns its
+// report shape. UNLIKE reconcilePayload this does NOT fail closed: a well-formed
+// file with unmatched columns returns 200 with `requiredMissing` populated — that
+// is a self-service finding the UI renders, not a server error. It throws an
+// HttpError 400 ONLY for a request that is itself malformed: an unknown source, a
+// missing/non-string `text`, or a malformed `columnMap` (the SAME named IngestError
+// the strict parser/indexHeader gives, raised EARLY via validateColumnMapForSource
+// so a bad map is a 400 rather than being folded into the diagnose error list).
+// PURE / I-O-free, exactly like reconcilePayload — the server never writes to disk.
+// ---------------------------------------------------------------------------
+
+// Broker-facing `source` spelling -> engine SOURCE.*. Accepts the SAME keys
+// /api/reconcile uses for its three files (bank / ledger / rentroll) plus the
+// natural `quickbooks` / `rent_roll` synonyms, so the door names sources the way
+// the CLI's `--as` does without forcing the browser to know the engine's enum.
+const INSPECT_SOURCE = Object.freeze({
+  bank: ingest.SOURCE.BANK,
+  ledger: ingest.SOURCE.QUICKBOOKS,
+  quickbooks: ingest.SOURCE.QUICKBOOKS,
+  rentroll: ingest.SOURCE.RENT_ROLL,
+  rent_roll: ingest.SOURCE.RENT_ROLL,
+});
+
+function inspectPayload(payload) {
+  if (payload == null || typeof payload !== "object" || Array.isArray(payload)) {
+    throw new HttpError(400, "bad_request", "request body must be a JSON object");
+  }
+
+  // The `source` selects which of the three logical types to diagnose. An unknown
+  // (or missing) spelling is a named 400 that NAMES the accepted spellings, so the
+  // caller can self-correct without reading source.
+  const source = INSPECT_SOURCE[String(payload.source)];
+  if (!source) {
+    throw new HttpError(
+      400,
+      "unknown_source",
+      `"source" must be one of: ${Object.keys(INSPECT_SOURCE).join(", ")}`
+    );
+  }
+
+  // The file CONTENTS are REQUIRED and must be a string — a missing or non-string
+  // `text` is a named 400, never a coercion (diagnoseSource treats a null text as
+  // a file-level "no input" finding, but over the door an absent body field is a
+  // client mistake, so we reject it up front with a clear message).
+  if (typeof payload.text !== "string") {
+    throw new HttpError(
+      400,
+      "missing_text",
+      `"text" is required and must be the file contents as a text string`
+    );
+  }
+
+  // Optional column-map override. Validate it EARLY against this file's real
+  // header so a malformed map (unknown logical key, or a header absent from the
+  // file) is a named 400 with the SAME IngestError message the strict parser gives
+  // — rather than being folded into the diagnose report's error list. A bad shape
+  // (not a plain object) is likewise a named 400.
+  let columnMap = null;
+  if (payload.columnMap != null) {
+    if (typeof payload.columnMap !== "object" || Array.isArray(payload.columnMap)) {
+      throw new HttpError(
+        400,
+        "invalid_column_map",
+        '"columnMap" must be an object of { <logicalField>: <headerName> }'
+      );
+    }
+    columnMap = payload.columnMap;
+    try {
+      ingest.validateColumnMapForSource(source, payload.text, columnMap);
+    } catch (e) {
+      throw new HttpError(400, engineErrorCode(e), e.message);
+    }
+  }
+
+  // Call the EXISTING diagnostic VERBATIM (no re-implementation of parsing) and
+  // return EXACTLY the diagnose report shape the CLI `vh trust inspect` consumes.
+  // diagnoseSource is pure and only throws on an unknown source (already guarded);
+  // every file/row problem is reported in the structure, not thrown.
+  const rep = ingest.diagnoseSource(source, payload.text, { columnMap });
+
+  return {
+    source: rep.source,
+    format: rep.format,
+    header: rep.header,
+    mapped: rep.mapped,
+    requiredMissing: rep.requiredMissing,
+    rowCount: rep.rowCount,
+    okCount: rep.okCount,
+    sample: rep.sample,
+    errors: rep.errors,
+  };
+}
+
+module.exports = {
+  HttpError,
+  engineErrorCode,
+  WEB_PAID_FEATURE_ENTITLEMENTS,
+  gatePayload,
+  readOptionalMaps,
+  reconcilePayload,
+  INSPECT_SOURCE,
+  inspectPayload,
+};

package/trustledger/fixtures/bank.csv

@@ -0,0 +1,7 @@
+Date,Description,Debit,Credit,Type
+2026-05-01,"Deposit - rent received",,1500.00,Deposit
+2026-05-03,"Check #1042 owner draw - Smith",750.00,,Check
+2026-05-05,"NSF returned item - Jones rent reversal",1200.00,,NSF
+2026-05-07,"Partial deposit - Doe rent (1 of 2)",,650.00,Deposit
+2026-05-07,"Partial deposit - Doe rent (2 of 2)",,650.00,Deposit
+2026-05-09,"Monthly service charge",12.50,,Fee

package/trustledger/fixtures/bank.malformed.csv

@@ -0,0 +1,3 @@
+Date,Description,Debit,Credit,Type
+2026-05-01,"Good deposit",,1500.00,Deposit
+2026-05-02,"Bad amount - too many decimals",,10.005,Deposit

package/trustledger/fixtures/bank.noalias.csv

@@ -0,0 +1,5 @@
+When,Narrative,MoneyOut,MoneyIn,Kategorie
+2026-05-01,"Deposit - rent received",,1500.00,Deposit
+2026-05-03,"Check #1042 owner draw - Smith",750.00,,Check
+2026-05-05,"NSF returned item - Jones rent reversal",1200.00,,NSF
+2026-05-09,"Monthly service charge",12.50,,Fee

package/trustledger/fixtures/bank.ofx

@@ -0,0 +1,34 @@
+OFXHEADER:100
+DATA:OFXSGML
+VERSION:102
+
+<OFX>
+<BANKMSGSRSV1>
+<STMTTRNRS>
+<STMTRS>
+<BANKTRANLIST>
+<STMTTRN>
+<TRNTYPE>CREDIT
+<DTPOSTED>20260501120000
+<TRNAMT>1500.00
+<NAME>Deposit - rent received
+<MEMO>Deposit - rent received
+</STMTTRN>
+<STMTTRN>
+<TRNTYPE>CHECK
+<DTPOSTED>20260503
+<TRNAMT>-750.00
+<NAME>Owner draw
+<MEMO>Check #1042 owner draw - Smith
+</STMTTRN>
+<STMTTRN>
+<TRNTYPE>DEBIT
+<DTPOSTED>20260505
+<TRNAMT>-1200.00
+<MEMO>NSF returned item - Jones rent reversal
+</STMTTRN>
+</BANKTRANLIST>
+</STMTRS>
+</STMTTRNRS>
+</BANKMSGSRSV1>
+</OFX>

package/trustledger/fixtures/bank.real.csv

@@ -0,0 +1,5 @@
+Posting Date,Description,Withdrawal Amt,Deposit Amt,Running Balance,Check Number
+"Jan 5, 2024","Deposit - rent received",,1500.00,1500.00,
+"Jan 7, 2024","Check owner draw - Smith",750.00,,750.00,1042
+"Jan 9, 2024","NSF returned item - Jones rent reversal",1200.00,,-450.00,
+"Jan 11, 2024","Monthly service charge",12.50,,-462.50,

package/trustledger/fixtures/corpus/_shared/prior-close.json

@@ -0,0 +1,22 @@
+{
+  "schemaVersion": "trustledger.period-close/v1",
+  "period": "2026-04",
+  "reportDate": "2026-04-30",
+  "opening": {
+    "bank": 0,
+    "book": 0
+  },
+  "ending": {
+    "bank": 250000,
+    "book": 250000
+  },
+  "subledger": 250000,
+  "tiesOut": true,
+  "pass": true,
+  "inputs": {
+    "bankRecords": 1,
+    "bookRecords": 1,
+    "rentrollRecords": 1
+  },
+  "inputsDigest": "05f5b527084ac007b60f8117f7bf188ebcdc60fde8e20f6c934c1f33b6e8f166"
+}

package/trustledger/fixtures/corpus/bank-book-mismatch--benign-twin/inputs.json

@@ -0,0 +1,14 @@
+{
+  "reportDate": "2026-05-31",
+  "period": "2026-05",
+  "opening": { "bank": 50000, "book": 50000 },
+  "bank": [
+    { "date": "2026-05-02", "amount": 150000, "memo": "deposit smith", "kind": "deposit", "party": "", "source": "bank" }
+  ],
+  "book": [
+    { "date": "2026-05-01", "amount": 150000, "memo": "rent smith", "kind": "deposit", "party": "Smith (4A)", "source": "quickbooks" }
+  ],
+  "rentroll": [
+    { "date": "2026-05-01", "amount": 200000, "memo": "rent", "kind": "rent", "party": "Smith (4A)", "source": "rentroll" }
+  ]
+}

package/trustledger/fixtures/corpus/bank-book-mismatch--benign-twin/meta.json

@@ -0,0 +1,7 @@
+{
+  "id": "bank-book-mismatch--benign-twin",
+  "control": "bank_book_mismatch",
+  "expectedVerdict": "PASS",
+  "expectedFinding": "bank_book_mismatch",
+  "principle": "The benign near-twin of the bank/book control: the SAME matched activity and the SAME $2,000 of book + sub-ledger, but now the bank opened at the SAME $500 as the book. The adjusted bank balance equals the book exactly, the three balances tie out, the engine raises NO bank_book_mismatch finding, and the packet PASSes. The only difference from the out-of-trust twin is the bank opening: $500 vs $0."
+}

package/trustledger/fixtures/corpus/bank-book-mismatch--out-of-trust/inputs.json

@@ -0,0 +1,14 @@
+{
+  "reportDate": "2026-05-31",
+  "period": "2026-05",
+  "opening": { "bank": 0, "book": 50000 },
+  "bank": [
+    { "date": "2026-05-02", "amount": 150000, "memo": "deposit smith", "kind": "deposit", "party": "", "source": "bank" }
+  ],
+  "book": [
+    { "date": "2026-05-01", "amount": 150000, "memo": "rent smith", "kind": "deposit", "party": "Smith (4A)", "source": "quickbooks" }
+  ],
+  "rentroll": [
+    { "date": "2026-05-01", "amount": 200000, "memo": "rent", "kind": "rent", "party": "Smith (4A)", "source": "rentroll" }
+  ]
+}

package/trustledger/fixtures/corpus/bank-book-mismatch--out-of-trust/meta.json

@@ -0,0 +1,7 @@
+{
+  "id": "bank-book-mismatch--out-of-trust",
+  "control": "bank_book_mismatch",
+  "expectedVerdict": "FAIL",
+  "expectedFinding": "bank_book_mismatch",
+  "principle": "After outstanding/in-transit items, the adjusted bank balance must equal the book balance. Here the activity lines match (no timing items), but the bank opened $500 SHORT of the book: the books say the trust account should hold $2,000 while the bank holds only $1,500. The bank is short of cash relative to the records — a genuine shortage, the textbook out-of-trust case (money that should be in the account is not there). The engine raises an error-severity bank_book_mismatch finding for the -$500 gap and the packet FAILs."
+}

package/trustledger/fixtures/corpus/continuity-break--benign-twin/inputs.json

@@ -0,0 +1,15 @@
+{
+  "reportDate": "2026-05-31",
+  "period": "2026-05",
+  "opening": { "bank": 250000, "book": 250000 },
+  "priorClosePath": "_shared/prior-close.json",
+  "bank": [
+    { "date": "2026-05-02", "amount": 150000, "memo": "deposit smith", "kind": "deposit", "party": "", "source": "bank" }
+  ],
+  "book": [
+    { "date": "2026-05-01", "amount": 150000, "memo": "rent smith", "kind": "deposit", "party": "Smith (4A)", "source": "quickbooks" }
+  ],
+  "rentroll": [
+    { "date": "2026-05-01", "amount": 400000, "memo": "rent carried", "kind": "rent", "party": "Smith (4A)", "source": "rentroll" }
+  ]
+}

package/trustledger/fixtures/corpus/continuity-break--benign-twin/meta.json

@@ -0,0 +1,7 @@
+{
+  "id": "continuity-break--benign-twin",
+  "control": "continuity_break",
+  "expectedVerdict": "PASS",
+  "expectedFinding": "continuity_break",
+  "principle": "The benign near-twin of the continuity control: the SAME prior close (_shared/prior-close.json, ending $2,500 / $2,500), but this period opens EXACTLY where the prior period closed — $2,500 bank / $2,500 book. The roll-forward is clean, the chain of custody is unbroken, the three balances tie out ($4,000 across all legs), the engine raises NO continuity_break finding, and the packet PASSes. Two fields differ from the out-of-trust twin, and ONLY the first is the variable under test: (1) the opening balances go from $0 to $2,500 — this is the continuity fix; (2) the carried sub-ledger (rent-roll) line goes from $1,500 to $4,000 (150000 to 400000 cents). The second change is NOT free — it is forced by trust math: once $2,500 of beneficiary money is carried forward into the opening, the book balance becomes $4,000, so the beneficiary sub-ledger must also carry $4,000 or the three legs would no longer tie and the engine would (correctly) FAIL on subledger_out_of_balance instead. Carrying the sub-ledger forward keeps every other control satisfied, so the continuity control is the only thing this pair varies."
+}

package/trustledger/fixtures/corpus/continuity-break--out-of-trust/inputs.json

@@ -0,0 +1,15 @@
+{
+  "reportDate": "2026-05-31",
+  "period": "2026-05",
+  "opening": { "bank": 0, "book": 0 },
+  "priorClosePath": "_shared/prior-close.json",
+  "bank": [
+    { "date": "2026-05-02", "amount": 150000, "memo": "deposit smith", "kind": "deposit", "party": "", "source": "bank" }
+  ],
+  "book": [
+    { "date": "2026-05-01", "amount": 150000, "memo": "rent smith", "kind": "deposit", "party": "Smith (4A)", "source": "quickbooks" }
+  ],
+  "rentroll": [
+    { "date": "2026-05-01", "amount": 150000, "memo": "rent", "kind": "rent", "party": "Smith (4A)", "source": "rentroll" }
+  ]
+}

package/trustledger/fixtures/corpus/continuity-break--out-of-trust/meta.json

@@ -0,0 +1,7 @@
+{
+  "id": "continuity-break--out-of-trust",
+  "control": "continuity_break",
+  "expectedVerdict": "FAIL",
+  "expectedFinding": "continuity_break",
+  "principle": "The trust chain requires that each period's OPENING balances equal the prior period's signed ENDING balances, to the penny. The prior close (_shared/prior-close.json) ended at $2,500 bank / $2,500 book, but this period opens at $0 / $0. A non-zero roll-forward gap means a period was skipped, edited, or re-keyed and the chain of custody over the trust money is broken. The engine raises an error-severity continuity_break finding for the -$2,500 gap and the packet FAILs."
+}

package/trustledger/fixtures/corpus/negative-tenant-ledger--benign-twin/inputs.json

@@ -0,0 +1,13 @@
+{
+  "reportDate": "2026-05-31",
+  "period": "2026-05",
+  "bank": [],
+  "book": [
+    { "date": "2026-05-01", "amount": 50000, "memo": "rent smith", "kind": "deposit", "party": "Smith (4A)", "source": "quickbooks" },
+    { "date": "2026-05-01", "amount": 50000, "memo": "rent jones", "kind": "deposit", "party": "Jones (4B)", "source": "quickbooks" }
+  ],
+  "rentroll": [
+    { "date": "2026-05-01", "amount": 50000, "memo": "rent smith", "kind": "rent", "party": "Smith (4A)", "source": "rentroll" },
+    { "date": "2026-05-01", "amount": 50000, "memo": "rent jones", "kind": "rent", "party": "Jones (4B)", "source": "rentroll" }
+  ]
+}

package/trustledger/fixtures/corpus/negative-tenant-ledger--benign-twin/meta.json

@@ -0,0 +1,7 @@
+{
+  "id": "negative-tenant-ledger--benign-twin",
+  "control": "negative_tenant_ledger",
+  "expectedVerdict": "PASS",
+  "expectedFinding": "negative_tenant_ledger",
+  "principle": "The benign near-twin of the negative-ledger control. It shares the SAME bank (empty), the SAME book ($500 deposit each for Smith (4A) and Jones (4B), book balance $1,000), and the SAME two beneficiaries as the out-of-trust twin. The ONLY difference is the two rent-roll sub-ledger lines: instead of crediting $1,500 to Smith and -$500 to Jones (Jones robbed to cover Smith), each tenant is simply credited their own $500. Every individual ledger is now non-negative (Smith +$500, Jones +$500), the pooled sub-ledger sum ($1,000) still ties to the $1,000 book exactly as before, no beneficiary is short, the engine raises NO negative_tenant_ledger finding, and the packet PASSes. NOTE: the separate control-account-exclusion rule (a 'Owner ...'-prefixed account is allowed to go negative without being flagged) is exercised by the owner-overdraw control's own fixtures, not here, so this pair varies only the one beneficiary's sign."
+}