01 — The Ledger
Nobody assembles the audit trail. Because it was never loose in the first place.
Each step is written down as it happens, and nobody can quietly rewrite it later.
ledgerrun.completed · 962ac5342796e340
Process engine · phase 2 · pre-production
Evidence season,
cancelled.
The week before an audit, everyone drops everything. Not this time: your team runs the procedure, and the record writes itself. Then the improvements arrive already drafted, from the runs your team recorded. Your people decide what sticks.
You wrote the SOP. It sat in a binder. The real process lived in one person's head, until they went on vacation.
02 — Evidence
Stop chasing documents through email. Evidence lands where it belongs.
The W-9 someone swears they sent attaches to its step and gets verified. A missing one shows up the day it goes missing.
ledgerevidence.verified · 3b81ee73fd0b27d3
03 — Approvals
"Who approved this?" stops being a mystery. Or an argument.
Nobody can approve their own work. The software enforces it, down to the database.
ledgerapproval.recorded · 26369cdbcd51a547
04 — Runs
When something goes wrong, it says so. In the record, right away.
Rutter stops and shows which step didn't confirm. An honest record of a bad day beats a tidy record of a fictional one.
Said in the open, at full scale
Tamper-evident. Within a stated threat model.
Delete, reorder or edit a record and the math stops adding up, and your auditor can check it without taking our word. One limit: no system survives an attacker who controls all of it.
h(n) = SHA-256( h(n−1) ‖ payload(n) ) · recomputable by anyone
How it is built
Every phase has to fail on purpose first.
0357924680102461357908
build phases, each machine-gated
0483726950105162739408
pinned gate runs, zero-FAIL to merge
0618492750307295184603
negative controls, tightest phase
counted from the engine repo's gate roster; recount them yourself
The part that pays for everything
A system that learns your business, then does the writing for you.
Nothing takes effect until a person says yes.
Compile
Write your procedure once. Rutter writes the rest.
Runbook, checklist, decision tree and training guide, all in sync with it.
Aggregate
See where the time goes, without a spreadsheet.
Which steps drag and which evidence arrives late, counted from real runs.
Propose
Your SOP stops going stale.
Rutter drafts the update from real runs and cites them. A rejected idea stops coming back.
The rule that makes it safe
The software can suggest. Only a person can decide.
A machine-drafted change can't publish itself; three layers refuse it, the database included.
Said plainly
What this does not claim.
- Certification is on the roadmap.
- SOC 2, ISO 27001, PCI DSS and HIPAA attestation are planned. Until an auditor signs, none is claimed.
- Tamper-evident, within a stated threat model.
- The chain detects modification by a party that can't also rewrite the verification path and every stored digest. No hash chain defends against an operator who controls both.
- It is phase two.
- The ledger, evidence verification, approvals, retention, isolation and the proposal loop are built and gated. Autonomy beyond human-approved proposals is deliberately not built.
- It is not deployed.
- It has run on a local stack and its own test suites, never on anyone's regulated workload.
Bring us your worst audit story.
The 2 a.m. spreadsheet rebuild. The auditor who found the gap. We're early enough that your worst story can still shape Rutter. Tell us.
Prefer the technical cut? → The Technical Page · Read the Limits