Questions.

Treat each table as a record, with the locked dataset's digest, the table program as the pinned rule and the claimed table, then recompute it before submission. The open verifier reruns the computation offline and returns OK only when its own output matches the claimed table. Any edit to the dataset or the table after lock shows up as a REJECT. OK confirms the table follows from the locked data under that program; whether the program was the right analysis stays a statistician's call.

Audit can re‑check all of them, because the recompute is offline and automatic. Assigning codes is model judgement, so each claim carries a show-its-work receipt: the chart sources used and the codes included and excluded. The deterministic part, from codes to billed amounts under the fee rules, is recomputed from its committed inputs. Audit gets OK, REJECT or ERROR on every amount and reads the receipts on the exceptions.

Pin the documented matching rules, have the agent emit a record for each reconciliation, and recompute every one the next morning. Each record carries the ledger and statement extracts as committed inputs, plus the claimed matches and breaks. The open verifier recomputes the reconciliation and returns OK only when its result matches the agent's. OK proves the reconciliation followed the pinned rules over those inputs; it does not say the rules were complete.

Recompute each settlement from the committed meter reads and the pinned tariff rules, and post only on OK. Today the open verifier re‑checks each record after the act; the gate that holds an action is in build. Until the gate ships, the re‑check runs as its own step between settlement and posting, and anything that returns REJECT or ERROR is held. OK confirms the settlement follows from those reads under those rules, never that a meter was calibrated.

Ask for the batch as a record: activity data and emission factors as committed inputs, the methodology as the pinned rule, and the claimed figure. The open verifier recomputes the figure offline and compares; any difference is a REJECT with a reason code. OK confirms the figure follows from those inputs under that methodology, never that a sensor was calibrated or a factor correct. Any step a model performed, such as classifying activity data, carries a show-its-work receipt.

Encode the task card rules as the pinned rule and re‑check every pack against them before a certifying person signs. Each pack becomes a record: task cards, completed steps and parts data as inputs, and the claimed pack. The open verifier returns REJECT for a missing step or a broken rule, and ERROR when it cannot conclude, which never becomes OK. Release stays with the certifying person, who sees which packs hold and which do not.

Weight and balance is deterministic, so every calculation can be recomputed from its inputs: the load sheet, the aircraft's basic empty weight and arms, and the pinned limits. The agent emits a record per calculation, and the open verifier recomputes the totals and centre of gravity with its own code. A mismatch returns REJECT; a missing input returns ERROR and never passes. OK confirms the output follows from those inputs, never that the loading data was true.

Write the refund policy as rules over trusted records, such as the order, the delivery date and the return receipt, and re‑check every adjustment against them. Each adjustment lands on approved, refused or on hold. Approved means every rule holds over those records; refused names the broken rule; on hold means no record could check a rule. Only held and refused cases reach a person.

Split each entry: the classification is judgement and gets a show-its-work receipt, while the duty and value calculations get recomputed. The receipt records the product descriptions used and the headings considered and ruled out, so a broker reviews the reasoning. Duty, value and totals are recomputed from the committed invoice data under the pinned rate rules, and a mismatch returns REJECT. Today the open verifier re‑checks each record after the act; the gate that holds an action is in build.

Pin the approved plan as the rule, recompute the intended configuration from it, and compare with what the agent pushed. Any line the plan did not produce is a REJECT, and so is a file no manifest declares. Today the open verifier re‑checks each record after the act; the gate that holds an action is in build. Until the gate ships, the re‑check runs right after each push and anything other than OK is rolled back.

Recompute every customer's charge from the committed usage records and the pinned tariff tables, then compare with the agent's run. The open verifier does this offline and returns OK, REJECT or ERROR per record, so audit covers the full population. A REJECT carries a reason code that names the failing check. OK confirms each charge follows from that usage under that tariff, never that the tariff was right.

Check each clearance against the licence records it cites, with territory, term, media and usage limits as the pinned rules. Reading a contract is model judgement, so each clearance carries a show-its-work receipt naming the licences used and the terms included and excluded. The rule checks over those licence records are recomputed, and a clearance outside its term or usage returns REJECT. A clearance with no licence record to check returns ERROR and is held for a person.