Process engine · phase 2
Rutter runs your regulated processes, keeps a hash-chained ledger anyone can recompute and drafts its own improvements. A person approves every change.
What we will not show you
No invented logos · no invented quotes · no invented stats. Rutter has no customers yet, so this page earns trust with arithmetic you can recompute.
01 — The timesheet
The mechanism retires each of these tasks. Each is tied to a shipped capability, and none is rolled into an invented savings number.
Deleted by: evidence binding
Steps declare what they need. A submission attaches to a requirement, verification binds the result to the step, and an unbound document satisfies nothing. The chase becomes a query.
evidence.submittedevidence.verified · checks: 11Deleted by: the ledger
Every run writes hash-chained, append-only events as it happens. There is nothing to rebuild afterwards: the trail exists because the work ran, and anyone can recompute it.
fb82d723…aa9c1faa…7b240e00…Deleted by: compile targets
A published revision compiles deterministically into runbook, checklist, decision tree, training guide and agent instructions, with no model call anywhere in the compiler.
runbookchecklistdecision-treetrainingagentDeleted by: recorded approvals
Approvals record a distinct actor, enforced down to the database: the engine rejects an approval from the actor who performed the step. The answer is a lookup, not an interview.
approval.recorded · sod: distinct-actorDeleted by: the proposal loop
Drafted changes cite exact ledger events and may only tighten a control. No machine can publish one; the guard is enforced three layers down, to the database.
cites (run, seq, hash)no-auto-publish
02 — The ledger
A complete vendor-onboarding run. Each row's hash is computed from the previous row's hash concatenated with that row's payload.
Telling you to check and not handing you the inputs would be the same assurance-without-evidence this page argues against. Here are the exact payloads and the script. Paste it into Node.
const c = require('crypto');
const payloads = [
'{"kind":"run.started","process":"vendor-onboarding","rev":7}',
'{"kind":"step.started","node":"collect-w9"}',
'{"kind":"evidence.submitted","requirement":"w9-form"}',
'{"kind":"evidence.verified","checks":11}',
'{"kind":"tool.started","op":"sanctions.screen"}',
'{"kind":"tool.succeeded","receipt":true}',
'{"kind":"approval.recorded","sod":"distinct-actor"}',
'{"kind":"run.completed","outcome":"approved"}',
];
let prev = '0'.repeat(64);
for (const p of payloads) {
prev = c.createHash('sha256').update(prev + p).digest('hex');
console.log(prev.slice(0, 16));
}It prints the eight hashes in the table, in order. If it does not, this page is wrong and we would like to know.
Checking the ledger means recomputing each link and comparing. A break identifies the first event whose recorded hash disagrees with its recomputed value, which bounds the damage: everything before that index is intact.
The chain detects modification. It does not, by itself, prevent it; see what this does not claim.
03 — The loop
The process improves from its own evidence. Each stage of the loop retires a different scale of drudgery.
weeks
Five deterministic targets from one published revision: runbook, checklist, decision tree, training guide and agent instructions. Stop rewriting the training guide every quarter.
days
A read model keyed to the revision's content hash: durations, failure edges, evidence outcomes across runs. Stop hand-building metrics from exported spreadsheets.
months
Drafted changes cite exact ledger events, may only tighten a control and can't publish themselves. Stop re-litigating process changes.
04 — Limits
05 — How it is built
A gate that has never failed proves nothing. Each phase ships negative controls: deliberate defect patches applied to real source, which the suite is required to catch.
If the suite passes with the defect in place, the gate fails, because the tests aren't watching what they claim to watch. Each phase also emits a machine-written evidence file; a claim without a corresponding entry in it does not count as met.
Rutter is pre-production and pre-attestation. The most useful conversation right now is with someone who'll try to break the threat model.