How this workpaper works

The core idea: every number is a claim with its proof attached

A traditional workpaper is a stack of spreadsheets that describe the return. Here the return is the workpaper: each of the 627 lines the engine produced is a claim, and the proof travels with it — the rule that built it, its inputs, the exact field on the exact page it was read from, how a person verified it, the independent checks that agree or disagree, every change made on top, and who signed it. Click any underlined figure anywhere to open that proof.

Three layers, never mixed:

The packet — what the machines said (documents, extracted values, the engine's three versions, agency records, prior year). Loaded exactly as delivered; never edited.
Independent checks — recomputations from the documents' printed text, the IRS/FTB records, the client's own words and last year. They don't trust the engine; when they disagree they propose an adjustment with its tax effect.
The ledger — everything people do, as an append-only list of events: verifications, adjustments, approvals, notes, questions and answers, judgment calls, sign-offs, time, filings. Undo is a new event that cancels an old one.

Every screen — the overview, an area, a document, the client portal, the notice response — is a projection: packet + ledger → workpaper. That's why the same record serves the preparer today, the reviewer tomorrow, next year's preparer and an IRS examiner in 2028.

Data model

Ref         any pointer the packet uses: ev-0123 · D14 · D31#page32 · qa-25 · msg-07 · py:/… · agency:/… · asset:… · line key
Claim       line key → engine value (v1/v2/v3) + rule + inputs[Claim] + sources[Ref]
Evidence    Ref → document page + field position (simulated page now; real PDF drops in, same Ref)
Check       recomputation → status, expected vs engine, evidence[Ref], proposals[Adjustment draft]
Event       id · season time · wall time · actor · kind · target Ref · data · batch      (append-only)
  verify       {method ∈ firm verification types, note, evidence}
  adjust       {old, new, reason, evidence, authority, base change × engine rate | exact what-if}
  adjust_review{approve|reject, level}         → partner if tax effect > threshold
  note / question / answer                     → review notes block filing; answers are evidence
  decision     {judgment | election | penalty | variance | outside filing, authority}
  signoff      {level, fingerprint of every value + document in scope}  → reopens on any change
  filing       {freeze snapshot, submit, agency response, amend}
  revert       {event ids}                     → undo / bulk undo, nothing deleted
Projection  effective value = last live adjustment on top of the engine value
            sign-off current ⇔ fingerprint unchanged · blockers = open checks + notes + steps …

Why it's trustworthy

Provenance is structural: a figure without a source shows as such; a document that landed nowhere shows as unaccounted.
Sign-offs are fingerprints, not checkmarks: if a value, an adjustment or a document in scope changes, the sign-off reopens and tells the signer what moved.
Rules are enforced, not suggested: no self-review, partner approval over the threshold, open review notes block filing, judgment calls need authority, uncleared staff never see SSNs, every unmasked view is logged.
Frozen at filing: the snapshot sent to the IRS never changes; amendments are layered on top.

What's simulated

The engine cannot be rerun, so adjusted totals are the engine's numbers plus each adjustment × the engine's per-dollar tax-effect rates (or the engine's own what-if result where one exists) — marked as estimates. Document pages are rebuilt from printed_content. E-file responses are scripted from the packet but depend on what you actually submit.