statementproof 0.1.1__tar.gz → 0.2.0__tar.gz

{statementproof-0.1.1/statementproof.egg-info → statementproof-0.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: statementproof
-Version: 0.1.1
+Version: 0.2.0
 Summary: Extract transactions from bank statement PDFs -- and prove the extraction is right, or say it isn't.
 License: MIT
 Project-URL: Homepage, https://github.com/OrbitalKeyAi/statementproof
@@ -71,9 +71,31 @@ statementproof statement.pdf --csv transactions.csv
 
 # layout report you can share — contains no financial data
 statementproof statement.pdf --diagnostic
+
+# a whole folder of statements, one summary
+statementproof ./january-statements/
+
+# write a reconciliation record you can file
+statementproof ./january-statements/ --record january.html
 ```
 
-Exit code is `0` when verified, `1` otherwise, so it drops into a script.
+Exit code is `0` when verified, `1` otherwise, so it drops into a script. In batch mode a
+file that could not be opened also exits non-zero — **unreadable is never counted as
+passing.**
+
+## The reconciliation record
+
+`--record` writes a document recording *which exact file was checked, by whom, on what
+date, and what the check found.* It opens in any browser and prints to PDF.
+
+The load-bearing field is the **SHA-256 of the source PDF**. A record that names a file
+proves nothing — filenames change and statements get re-exported. The hash binds the
+record to one exact document, so if the PDF is later altered by a single byte, the record
+visibly no longer describes the file it is attached to.
+
+In batch mode the record also names every file that *could not* be read, in the printed
+copy as well as the JSON. A record that quietly omits the statements it choked on would
+assert a clean review of a folder it never finished reading.
 
 ## Three verdicts, and it will not bluff
 
@@ -154,14 +176,47 @@ python statementproof/tests/make_real_derived.py    # build real-bank-derived la
 python statementproof/tests/score.py                # score extraction vs ground truth
 python statementproof/tests/test_failure_modes.py   # validator behaviour
 python statementproof/tests/test_privacy.py         # privacy promises
+python statementproof/tests/test_record.py          # reconciliation record guarantees
 ```
 
 Current: **7/7 layouts extracted exactly · 9/9 failure-mode tests · 8/8 privacy checks ·
-0 false assurances.**
+13/13 record guarantees · 0 false assurances.**
 
 "False assurance" — reporting `VERIFIED` on a bad extraction — is the number that
 matters. A validator that green-lights an error is worse than no validator.
 
+## Commercial licence
+
+The tool is free and MIT, and every figure it produces is real whether you pay or not.
+
+What a licence changes is one thing: **it puts your firm's name on the record.** Without
+it the record is stamped `UNLICENSED` — the numbers are still correct, but no one is named
+as having performed the review, and an unsigned document is not evidence that anyone did.
+
+**[Buy a licence — $39, one-time, perpetual](https://buy.stripe.com/4gM8wRe6NdON50s2kjgA802)**
+· unlimited statements · unlimited machines · no subscription
+
+Then set it once per machine:
+
+```bash
+setx STATEMENTPROOF_LICENCE "Your Firm Name"        # Windows
+export STATEMENTPROOF_LICENCE="Your Firm Name"      # macOS / Linux
+```
+
+There is no key server, no activation call, and no check-in — the package still contains
+no network code of any kind. The licence is an attestation, not a lock. Since the source
+is public, any check could be deleted in seconds; pretending otherwise would be exactly
+the kind of bluffing this tool exists to refuse. Editing the stamp out would produce a
+record naming a licence holder who did not buy one, which is forging your own audit
+evidence, and no payment system prevents that either.
+
+## Related
+
+**[sqliteproof](https://github.com/OrbitalKeyAi/sqliteproof)** — the same idea for SQLite
+databases. `PRAGMA integrity_check` tells you a page number; sqliteproof tells you which
+tables survived, how many rows were lost, and what is safe to export. Free, MIT, no
+dependencies.
+
 ## License
 
 MIT.

{statementproof-0.1.1 → statementproof-0.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "statementproof"
-version = "0.1.1"
+version = "0.2.0"
 description = "Extract transactions from bank statement PDFs -- and prove the extraction is right, or say it isn't."
 readme = "statementproof/README.md"
 requires-python = ">=3.9"

{statementproof-0.1.1 → statementproof-0.2.0}/statementproof/README.md

@@ -46,9 +46,31 @@ statementproof statement.pdf --csv transactions.csv
 
 # layout report you can share — contains no financial data
 statementproof statement.pdf --diagnostic
+
+# a whole folder of statements, one summary
+statementproof ./january-statements/
+
+# write a reconciliation record you can file
+statementproof ./january-statements/ --record january.html
 ```
 
-Exit code is `0` when verified, `1` otherwise, so it drops into a script.
+Exit code is `0` when verified, `1` otherwise, so it drops into a script. In batch mode a
+file that could not be opened also exits non-zero — **unreadable is never counted as
+passing.**
+
+## The reconciliation record
+
+`--record` writes a document recording *which exact file was checked, by whom, on what
+date, and what the check found.* It opens in any browser and prints to PDF.
+
+The load-bearing field is the **SHA-256 of the source PDF**. A record that names a file
+proves nothing — filenames change and statements get re-exported. The hash binds the
+record to one exact document, so if the PDF is later altered by a single byte, the record
+visibly no longer describes the file it is attached to.
+
+In batch mode the record also names every file that *could not* be read, in the printed
+copy as well as the JSON. A record that quietly omits the statements it choked on would
+assert a clean review of a folder it never finished reading.
 
 ## Three verdicts, and it will not bluff
 
@@ -129,14 +151,47 @@ python statementproof/tests/make_real_derived.py    # build real-bank-derived la
 python statementproof/tests/score.py                # score extraction vs ground truth
 python statementproof/tests/test_failure_modes.py   # validator behaviour
 python statementproof/tests/test_privacy.py         # privacy promises
+python statementproof/tests/test_record.py          # reconciliation record guarantees
 ```
 
 Current: **7/7 layouts extracted exactly · 9/9 failure-mode tests · 8/8 privacy checks ·
-0 false assurances.**
+13/13 record guarantees · 0 false assurances.**
 
 "False assurance" — reporting `VERIFIED` on a bad extraction — is the number that
 matters. A validator that green-lights an error is worse than no validator.
 
+## Commercial licence
+
+The tool is free and MIT, and every figure it produces is real whether you pay or not.
+
+What a licence changes is one thing: **it puts your firm's name on the record.** Without
+it the record is stamped `UNLICENSED` — the numbers are still correct, but no one is named
+as having performed the review, and an unsigned document is not evidence that anyone did.
+
+**[Buy a licence — $39, one-time, perpetual](https://buy.stripe.com/4gM8wRe6NdON50s2kjgA802)**
+· unlimited statements · unlimited machines · no subscription
+
+Then set it once per machine:
+
+```bash
+setx STATEMENTPROOF_LICENCE "Your Firm Name"        # Windows
+export STATEMENTPROOF_LICENCE="Your Firm Name"      # macOS / Linux
+```
+
+There is no key server, no activation call, and no check-in — the package still contains
+no network code of any kind. The licence is an attestation, not a lock. Since the source
+is public, any check could be deleted in seconds; pretending otherwise would be exactly
+the kind of bluffing this tool exists to refuse. Editing the stamp out would produce a
+record naming a licence holder who did not buy one, which is forging your own audit
+evidence, and no payment system prevents that either.
+
+## Related
+
+**[sqliteproof](https://github.com/OrbitalKeyAi/sqliteproof)** — the same idea for SQLite
+databases. `PRAGMA integrity_check` tells you a page number; sqliteproof tells you which
+tables survived, how many rows were lost, and what is safe to export. Free, MIT, no
+dependencies.
+
 ## License
 
 MIT.

{statementproof-0.1.1 → statementproof-0.2.0}/statementproof/__init__.py

@@ -1,2 +1,2 @@
 """statementproof - verifiable bank statement extraction."""
-__version__ = "0.1.0"
+__version__ = "0.2.0"

{statementproof-0.1.1 → statementproof-0.2.0}/statementproof/cli.py

@@ -99,17 +99,85 @@ def build_diagnostic(pdf_path, txns, diag, opening, closing, res):
     }
 
 
+def run_batch(args):
+    """Validate every PDF in a folder, then emit one record covering all of them.
+
+    A firm processes many clients' statements a month, and the free single-file path makes
+    that a hundred terminal invocations nobody keeps a trace of. What matters here is that
+    **a file that fails to open is reported, not skipped silently** -- a batch summary that
+    quietly omits the statements it choked on is precisely the false assurance this whole
+    tool exists to refuse.
+    """
+    from . import record as _rec
+
+    pdfs = sorted(os.path.join(args.pdf, f) for f in os.listdir(args.pdf)
+                  if f.lower().endswith(".pdf"))
+    if not pdfs:
+        print("error: no PDFs in %s" % args.pdf, file=sys.stderr)
+        return 2
+
+    if not args.quiet:
+        print(BANNER)
+        print("  %d statement(s) in %s\n" % (len(pdfs), args.pdf))
+
+    records, failed_to_read = [], []
+    for p in pdfs:
+        name = os.path.basename(p)
+        try:
+            opening, closing = find_balances(p)
+            txns, diag = parse(p, balance_hints=(opening, closing))
+            res = validate(txns, opening, closing)
+        except Exception as e:
+            failed_to_read.append((name, "%s: %s" % (type(e).__name__, e)))
+            if not args.quiet:
+                print("  %-38s COULD NOT READ  (%s)" % (name[:38], type(e).__name__))
+            continue
+
+        records.append(_rec.build(p, txns, res, opening, closing, diag))
+        if not args.quiet:
+            print("  %-38s %-13s %3d txns" % (name[:38], res.verdict, len(txns)))
+
+    batch = _rec.build_batch(records)
+    if failed_to_read:
+        batch["summary"]["unreadable"] = [{"file": n, "error": e} for n, e in failed_to_read]
+
+    if not args.quiet:
+        print()
+        for verdict, n in batch["summary"]["by_verdict"].items():
+            print("  %-13s %d" % (verdict, n))
+        if failed_to_read:
+            print("  %-13s %d   <-- not validated; they are not counted as passing"
+                  % ("UNREADABLE", len(failed_to_read)))
+
+    if args.record:
+        _rec.write(batch, args.record)
+        if not args.quiet:
+            print("\n  wrote batch reconciliation record to %s" % args.record)
+            if batch["licence"]["status"] != "licensed":
+                print("  (UNLICENSED -- set %s to name the reviewer.)" % _rec.LICENCE_ENV)
+
+    # Non-zero if anything failed or could not be read, so it drops into a firm's scripts.
+    bad = batch["summary"]["by_verdict"].get("FAILED", 0) + len(failed_to_read)
+    return 1 if bad else 0
+
+
 def main(argv=None):
     ap = argparse.ArgumentParser(
         prog="statementproof",
         description="Validate bank statement PDF extraction. Runs locally; uploads nothing.")
-    ap.add_argument("pdf", help="path to a bank statement PDF")
+    ap.add_argument("pdf", help="path to a bank statement PDF, or a folder of them")
     ap.add_argument("--csv", metavar="OUT", help="write extracted transactions to CSV")
+    ap.add_argument("--record", metavar="OUT",
+                    help="write a reconciliation record (.html or .json) -- the artifact "
+                         "recording which file was checked, by whom, and what was found")
     ap.add_argument("--diagnostic", action="store_true",
                     help="print a shareable layout report containing no financial data")
     ap.add_argument("--quiet", action="store_true", help="verdict line only")
     args = ap.parse_args(argv)
 
+    if os.path.isdir(args.pdf):
+        return run_batch(args)
+
     if not os.path.isfile(args.pdf):
         print("error: no such file: %s" % args.pdf, file=sys.stderr)
         return 2
@@ -173,6 +241,17 @@ def main(argv=None):
         if not args.quiet:
             print("\n  wrote %d rows to %s" % (len(txns), args.csv))
 
+    if args.record:
+        from . import record as _rec
+        r = _rec.build(args.pdf, txns, res, opening, closing, diag)
+        _rec.write(r, args.record)
+        if not args.quiet:
+            print("\n  wrote reconciliation record to %s" % args.record)
+            if r["licence"]["status"] != "licensed":
+                print("  (UNLICENSED -- the figures are real, but no licence holder is named,")
+                print("   so it does not record who performed the review. Set %s.)"
+                      % _rec.LICENCE_ENV)
+
     if args.diagnostic:
         d = build_diagnostic(args.pdf, txns, diag, opening, closing, res)
         print("\n" + "=" * 68)

statementproof-0.2.0/statementproof/record.py

@@ -0,0 +1,275 @@
+"""The reconciliation record — the artifact a firm files as evidence of review.
+
+Sentius, reviewing the pricing plan, identified which half of the paid tier is actually
+the product:
+
+    "That last part is the actual product: not the batch processing, the artifact a
+     bookkeeper can staple to a file as proof they looked."
+
+That is what this module produces. Batch mode is convenience; the record is the thing worth
+money, because it answers a question the free tool cannot: *who checked this, against which
+exact file, on what date, and what did the check find.*
+
+## Why the source hash is the load-bearing field
+
+A record that names a file proves nothing — filenames are trivially changed and a statement
+can be re-exported. The SHA-256 of the source bytes binds the record to one exact document.
+If the PDF is later altered by a single byte, the hash no longer matches and the record
+visibly does not describe the file it is attached to. That is the difference between a
+report and a record.
+
+## Licensing, stated plainly rather than enforced by theatre
+
+This package is MIT and its source is public, so any license check in it could be deleted
+by the person it applies to in about four seconds. Building a cracked-in-a-minute key
+validator would be pretending otherwise, and dishonest engineering in a tool whose entire
+pitch is that it refuses to bluff.
+
+So the licence is **not enforced, it is attested.** An unlicensed run produces a complete,
+fully functional record stamped UNLICENSED. Every number in it is real. What it lacks is a
+named licence holder — and a record with no one's name on it is not evidence that anyone
+reviewed anything, which is the only reason a firm wants the artifact in the first place.
+
+The mechanism and the value are therefore the same thing, which is why it needs no
+enforcement: removing the stamp by editing the source would produce a record asserting a
+licence holder who did not buy a licence, and that is the user forging their own audit
+evidence. Nothing in a payment system prevents that either.
+"""
+
+from __future__ import annotations
+
+import datetime as dt
+import hashlib
+import html
+import json
+import os
+
+from .validate import fmt
+
+LICENCE_ENV = "STATEMENTPROOF_LICENCE"
+
+
+def source_hash(path: str, chunk: int = 1 << 20) -> str:
+    h = hashlib.sha256()
+    with open(path, "rb") as f:
+        while True:
+            b = f.read(chunk)
+            if not b:
+                break
+            h.update(b)
+    return h.hexdigest()
+
+
+def licence_holder() -> str | None:
+    """The name recorded on the artifact, or None for an unlicensed run.
+
+    Read from the environment rather than a config file so it survives in CI and cron
+    without a file to lose, and so a firm can set it once per machine.
+    """
+    v = (os.environ.get(LICENCE_ENV) or "").strip()
+    return v or None
+
+
+def build(pdf_path: str, txns, res, opening, closing, diag=None, holder=None) -> dict:
+    """One record for one statement. Pure data; rendering is separate."""
+    now = dt.datetime.now(dt.timezone.utc)
+    holder = holder if holder is not None else licence_holder()
+    skipped = list((diag or {}).get("skipped") or [])
+
+    return {
+        "record_type": "statementproof.reconciliation_record",
+        "record_version": 1,
+        "generated_utc": now.isoformat(timespec="seconds"),
+        "tool": {
+            "name": "statementproof",
+            "version": __import__("statementproof").__version__,
+        },
+        "licence": {
+            "holder": holder,
+            "status": "licensed" if holder else "UNLICENSED",
+        },
+        "source": {
+            "filename": os.path.basename(pdf_path),
+            "bytes": os.path.getsize(pdf_path),
+            # Binds this record to one exact document. See the module docstring.
+            "sha256": source_hash(pdf_path),
+        },
+        "statement": {
+            "opening_balance": fmt(opening) if opening is not None else None,
+            "closing_balance": fmt(closing) if closing is not None else None,
+            "transactions_extracted": len(txns),
+            "rows_skipped": len(skipped),
+        },
+        "verification": {
+            "verdict": res.verdict,
+            "checks_run": list(res.checks_run),
+            "problems": [
+                {"kind": p.kind, "row": getattr(p, "row", None), "detail": str(p)[:200]}
+                for p in res.problems
+            ],
+        },
+        # Said in the record itself, not only in the docs, because a record that
+        # overstates what it proves is worse than no record.
+        "scope_of_assurance":
+            "A VERIFIED verdict means the extracted transactions reproduce this "
+            "statement's own opening and closing balances. It does not certify that "
+            "descriptions or dates are correct, and it does not detect errors that "
+            "leave the totals unchanged.",
+    }
+
+
+def build_batch(records: list) -> dict:
+    now = dt.datetime.now(dt.timezone.utc)
+    counts = {}
+    for r in records:
+        v = r["verification"]["verdict"]
+        counts[v] = counts.get(v, 0) + 1
+    holder = records[0]["licence"]["holder"] if records else licence_holder()
+    return {
+        "record_type": "statementproof.batch_reconciliation_record",
+        "record_version": 1,
+        "generated_utc": now.isoformat(timespec="seconds"),
+        "tool": {"name": "statementproof",
+                 "version": __import__("statementproof").__version__},
+        "licence": {"holder": holder, "status": "licensed" if holder else "UNLICENSED"},
+        "summary": {
+            "statements": len(records),
+            "by_verdict": dict(sorted(counts.items())),
+            "transactions_total": sum(r["statement"]["transactions_extracted"] for r in records),
+        },
+        "statements": records,
+    }
+
+
+# --------------------------------------------------------------------------- rendering
+
+_CSS = """
+:root{--ink:#1b1b1f;--mute:#5c5f66;--rule:#d8d6d1;--bg:#fff;
+      --ok:#1c6b3c;--bad:#9c2b21;--warn:#8a6114;--paper:#faf9f7}
+*{box-sizing:border-box}
+body{margin:0;background:var(--paper);color:var(--ink);
+     font:14px/1.55 "Iowan Old Style","Palatino Linotype",Georgia,serif}
+.sheet{max-width:52rem;margin:2rem auto;background:var(--bg);padding:2.6rem 3rem;
+       border:1px solid var(--rule)}
+h1{font-size:1.35rem;margin:0 0 .15rem;letter-spacing:-.01em}
+.sub{color:var(--mute);font-size:.82rem;margin:0 0 1.6rem}
+h2{font-size:.72rem;text-transform:uppercase;letter-spacing:.12em;color:var(--mute);
+   margin:1.9rem 0 .6rem;padding-bottom:.3rem;border-bottom:1px solid var(--rule)}
+dl{display:grid;grid-template-columns:11rem 1fr;gap:.4rem 1.2rem;margin:0}
+dt{color:var(--mute);font-size:.82rem}
+dd{margin:0;font-variant-numeric:tabular-nums}
+.hash{font-family:ui-monospace,"SF Mono",Menlo,Consolas,monospace;font-size:.74rem;
+      word-break:break-all;color:var(--mute)}
+.verdict{display:inline-block;padding:.18rem .6rem;border:1px solid currentColor;
+         font-size:.76rem;letter-spacing:.09em;text-transform:uppercase}
+.v-VERIFIED{color:var(--ok)} .v-FAILED{color:var(--bad)} .v-UNVERIFIABLE{color:var(--warn)}
+table{width:100%;border-collapse:collapse;margin-top:.4rem;font-size:.86rem}
+th{text-align:left;font-weight:600;font-size:.72rem;text-transform:uppercase;
+   letter-spacing:.08em;color:var(--mute);border-bottom:1px solid var(--rule);padding:.35rem .5rem}
+td{padding:.35rem .5rem;border-bottom:1px solid #efedea;font-variant-numeric:tabular-nums}
+.scope{margin-top:1.8rem;padding:.85rem 1rem;background:#f6f5f2;border-left:2px solid var(--rule);
+       font-size:.82rem;color:var(--mute)}
+.unlicensed{margin:0 0 1.4rem;padding:.7rem 1rem;border:1px solid var(--bad);color:var(--bad);
+            font-size:.83rem}
+@media print{body{background:#fff}.sheet{border:0;margin:0;padding:0;max-width:none}}
+"""
+
+
+def _e(v) -> str:
+    return html.escape("" if v is None else str(v))
+
+
+def _one(rec: dict, heading: bool = True) -> str:
+    v = rec["verification"]["verdict"]
+    s, src, st = rec["licence"], rec["source"], rec["statement"]
+    L = []
+    if heading:
+        L.append("<h2>%s</h2>" % _e(src["filename"]))
+    L.append("<dl>")
+    L.append("<dt>Verdict</dt><dd><span class='verdict v-%s'>%s</span></dd>" % (_e(v), _e(v)))
+    L.append("<dt>Opening balance</dt><dd>%s</dd>" % _e(st["opening_balance"] or "not found"))
+    L.append("<dt>Closing balance</dt><dd>%s</dd>" % _e(st["closing_balance"] or "not found"))
+    L.append("<dt>Transactions</dt><dd>%d extracted, %d row(s) skipped</dd>"
+             % (st["transactions_extracted"], st["rows_skipped"]))
+    L.append("<dt>Checks run</dt><dd>%s</dd>"
+             % (_e(", ".join(rec["verification"]["checks_run"]) or "none")))
+    L.append("<dt>Source SHA-256</dt><dd class='hash'>%s</dd>" % _e(src["sha256"]))
+    L.append("</dl>")
+
+    probs = rec["verification"]["problems"]
+    if probs:
+        L.append("<table><tr><th>Row</th><th>Finding</th></tr>")
+        for p in probs[:40]:
+            L.append("<tr><td>%s</td><td>%s</td></tr>"
+                     % (_e(p["row"] if p["row"] is not None else "-"), _e(p["detail"])))
+        L.append("</table>")
+        if len(probs) > 40:
+            L.append("<p class='sub'>… and %d more.</p>" % (len(probs) - 40))
+    return "\n".join(L)
+
+
+def to_html(rec: dict) -> str:
+    """A self-contained record. Prints to PDF from any browser; no dependency added."""
+    batch = rec["record_type"].endswith("batch_reconciliation_record")
+    lic = rec["licence"]
+    title = "Reconciliation Record"
+
+    L = ["<!doctype html><html lang='en'><head><meta charset='utf-8'>",
+         "<meta name='viewport' content='width=device-width,initial-scale=1'>",
+         "<title>%s — statementproof</title><style>%s</style></head><body><div class='sheet'>"
+         % (title, _CSS)]
+    L.append("<h1>%s</h1>" % title)
+    L.append("<p class='sub'>Generated %s UTC by statementproof %s</p>"
+             % (_e(rec["generated_utc"]), _e(rec["tool"]["version"])))
+
+    if lic["status"] != "licensed":
+        L.append("<p class='unlicensed'><strong>UNLICENSED.</strong> Every figure below is "
+                 "real, but no licence holder is named — so this document does not record "
+                 "who performed the review, and should not be filed as evidence that anyone "
+                 "did.</p>")
+    else:
+        L.append("<dl><dt>Licence holder</dt><dd>%s</dd></dl>" % _e(lic["holder"]))
+
+    if batch:
+        s = rec["summary"]
+        L.append("<h2>Summary</h2><dl>")
+        L.append("<dt>Statements</dt><dd>%d</dd>" % s["statements"])
+        for k, n in s["by_verdict"].items():
+            L.append("<dt>%s</dt><dd>%d</dd>" % (_e(k), n))
+        L.append("<dt>Transactions</dt><dd>%d</dd>" % s["transactions_total"])
+        L.append("</dl>")
+
+        # Files that could not be opened are named in the printable record, not only in
+        # the JSON. A record that silently omits the statements it choked on is the exact
+        # false assurance this tool exists to refuse -- and the printed page is the copy
+        # that actually gets filed.
+        unread = s.get("unreadable") or []
+        if unread:
+            L.append("<h2>Not validated — %d file(s) could not be read</h2>" % len(unread))
+            L.append("<p class='sub'>These are not covered by any verdict above. They were "
+                     "not checked, which is not the same as having passed.</p>")
+            L.append("<table><tr><th>File</th><th>Reason</th></tr>")
+            for u in unread:
+                L.append("<tr><td>%s</td><td>%s</td></tr>" % (_e(u["file"]), _e(u["error"])))
+            L.append("</table>")
+
+        for r in rec["statements"]:
+            L.append(_one(r))
+        scope = rec["statements"][0]["scope_of_assurance"] if rec["statements"] else ""
+    else:
+        L.append(_one(rec, heading=False))
+        scope = rec["scope_of_assurance"]
+
+    if scope:
+        L.append("<p class='scope'><strong>Scope of assurance.</strong> %s</p>" % _e(scope))
+    L.append("</div></body></html>")
+    return "\n".join(L)
+
+
+def write(rec: dict, path: str) -> str:
+    """Write .json or .html, chosen by the extension the caller asked for."""
+    ext = os.path.splitext(path)[1].lower()
+    data = to_html(rec) if ext in (".html", ".htm") else json.dumps(rec, indent=2)
+    with open(path, "w", encoding="utf-8") as f:
+        f.write(data)
+    return path

{statementproof-0.1.1 → statementproof-0.2.0/statementproof.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: statementproof
-Version: 0.1.1
+Version: 0.2.0
 Summary: Extract transactions from bank statement PDFs -- and prove the extraction is right, or say it isn't.
 License: MIT
 Project-URL: Homepage, https://github.com/OrbitalKeyAi/statementproof
@@ -71,9 +71,31 @@ statementproof statement.pdf --csv transactions.csv
 
 # layout report you can share — contains no financial data
 statementproof statement.pdf --diagnostic
+
+# a whole folder of statements, one summary
+statementproof ./january-statements/
+
+# write a reconciliation record you can file
+statementproof ./january-statements/ --record january.html
 ```
 
-Exit code is `0` when verified, `1` otherwise, so it drops into a script.
+Exit code is `0` when verified, `1` otherwise, so it drops into a script. In batch mode a
+file that could not be opened also exits non-zero — **unreadable is never counted as
+passing.**
+
+## The reconciliation record
+
+`--record` writes a document recording *which exact file was checked, by whom, on what
+date, and what the check found.* It opens in any browser and prints to PDF.
+
+The load-bearing field is the **SHA-256 of the source PDF**. A record that names a file
+proves nothing — filenames change and statements get re-exported. The hash binds the
+record to one exact document, so if the PDF is later altered by a single byte, the record
+visibly no longer describes the file it is attached to.
+
+In batch mode the record also names every file that *could not* be read, in the printed
+copy as well as the JSON. A record that quietly omits the statements it choked on would
+assert a clean review of a folder it never finished reading.
 
 ## Three verdicts, and it will not bluff
 
@@ -154,14 +176,47 @@ python statementproof/tests/make_real_derived.py    # build real-bank-derived la
 python statementproof/tests/score.py                # score extraction vs ground truth
 python statementproof/tests/test_failure_modes.py   # validator behaviour
 python statementproof/tests/test_privacy.py         # privacy promises
+python statementproof/tests/test_record.py          # reconciliation record guarantees
 ```
 
 Current: **7/7 layouts extracted exactly · 9/9 failure-mode tests · 8/8 privacy checks ·
-0 false assurances.**
+13/13 record guarantees · 0 false assurances.**
 
 "False assurance" — reporting `VERIFIED` on a bad extraction — is the number that
 matters. A validator that green-lights an error is worse than no validator.
 
+## Commercial licence
+
+The tool is free and MIT, and every figure it produces is real whether you pay or not.
+
+What a licence changes is one thing: **it puts your firm's name on the record.** Without
+it the record is stamped `UNLICENSED` — the numbers are still correct, but no one is named
+as having performed the review, and an unsigned document is not evidence that anyone did.
+
+**[Buy a licence — $39, one-time, perpetual](https://buy.stripe.com/4gM8wRe6NdON50s2kjgA802)**
+· unlimited statements · unlimited machines · no subscription
+
+Then set it once per machine:
+
+```bash
+setx STATEMENTPROOF_LICENCE "Your Firm Name"        # Windows
+export STATEMENTPROOF_LICENCE="Your Firm Name"      # macOS / Linux
+```
+
+There is no key server, no activation call, and no check-in — the package still contains
+no network code of any kind. The licence is an attestation, not a lock. Since the source
+is public, any check could be deleted in seconds; pretending otherwise would be exactly
+the kind of bluffing this tool exists to refuse. Editing the stamp out would produce a
+record naming a licence holder who did not buy one, which is forging your own audit
+evidence, and no payment system prevents that either.
+
+## Related
+
+**[sqliteproof](https://github.com/OrbitalKeyAi/sqliteproof)** — the same idea for SQLite
+databases. `PRAGMA integrity_check` tells you a page number; sqliteproof tells you which
+tables survived, how many rows were lost, and what is safe to export. Free, MIT, no
+dependencies.
+
 ## License
 
 MIT.

{statementproof-0.1.1 → statementproof-0.2.0}/statementproof.egg-info/SOURCES.txt

@@ -6,6 +6,7 @@ statementproof/__init__.py
 statementproof/__main__.py
 statementproof/cli.py
 statementproof/extract.py
+statementproof/record.py
 statementproof/validate.py
 statementproof.egg-info/PKG-INFO
 statementproof.egg-info/SOURCES.txt