Everything shipped, by the stage of a filing’s life.

Missing Bates runs are reported on import from the load file's own records; when the set discloses document-level numbers only, the finding is phrased as a question rather than an accusation of withholding.

backend/src/lib/discovery/productionImport.ts

Referenced-but-absent attachments, broken families and numbering holes are found by deterministic passes with quoted evidence, because an accusation levelled at opposing counsel must be machine-provable.

backend/src/lib/discovery/gapHunter.ts

A model's classification and a rule-based scan are combined by taking whichever protects more; a model's 'not privileged' is a signal, not an answer, and the basis is recorded for review.

backend/src/lib/compliance/autoClassify.ts

Every production is diffed against the privilege log on a schedule; a privileged document found inside a production raises an urgent task that clears itself only when a later diff runs clean.

backend/src/lib/discovery/privilegeLog.ts

A classifier trains on the attorney's own coding decisions over existing embeddings and re-ranks the uncoded pile so review proceeds highest-predicted first; every label carries its provenance.

backend/src/lib/discovery/tarRanker.ts

Inbound productions are parsed from their load files and outbound productions are written to the same formats, so the record speaks the review platforms' interchange language in both directions.

backend/src/lib/discovery/loadFile.ts

Day counts, mail extensions, e-service and holiday calendars are modelled per forum; a forum the engine does not own gets a named refusal rather than a federal rule applied by default.

backend/src/lib/deadlines/frcp.ts

A calendared deadline keeps its trigger event, trigger date, service method, forum rule and holiday calendar as columns, so any date can be re-derived and disputed from its inputs.

backend/src/lib/deadlines/derivation.ts

When a trigger moves, every deadline derived from it is recomputed from its stored derivation; nothing is nudged by hand.

backend/src/lib/deadlines/cascade.ts

A governing local rule is researched once per forum and case type and stored as a suggestion the attorney confirms; a judge's verified individual practice may warn and link, but never move a date on its own.

backend/src/lib/deadlines/standingOrderOverlay.ts

Every intake, invite and consultation request is screened against the entity spine before anyone opens it; an errored check blocks or holds rather than passing.

backend/src/lib/conflicts.ts

A walled staff member is excluded at the access layer on every route and again by row-level security; the wall is checked on read, not once at assignment.

backend/src/lib/ethicalWalls.ts

A lawyer's prior firms and matters are recorded and consulted by the conflicts check, so a lateral hire's history reaches the screen before their first assignment.

backend/src/lib/priorAffiliations.ts

Before a filing is signed the register answers whether this lawyer is admitted in this forum — state, circuit, district or pro hac vice — not merely whether they are a lawyer somewhere.

backend/src/lib/admissions/forumAdmission.ts

A vendor export's loose party text is reconstructed into canonical legal entities and their appearances, so the firm's conflicts check on BRON can use the imported history. No screen drives it yet.

backend/src/lib/importers/entitySpine.ts

Authorities are pulled from public sources into the matter's own corpus with their fetch provenance, so a citation is checked against text the firm holds rather than a summary.

backend/src/lib/research/corpusAuthority.ts

Motions are drafted section by section against the matter's fact record and authority table, with every citation entering through the same gate as a hand-typed one.

backend/src/lib/documents/longform.ts

Every generated document type is declared in one registry that drives the generator, the editor and the export gate, so a type that exists anywhere exists everywhere.

backend/src/lib/documents/documentTypes.ts

The certificate is rendered from the audit trail and will not certify that no generative AI was used for a document the trail says otherwise about; refusing is the feature.

backend/src/lib/documents/aiUseCertificate.ts

The certificate is assembled from the real count the caller computed and never estimates or rounds it; when the count exceeds the limit the text states that the document does not comply, rather than certifying it.

backend/src/lib/documents/wordCountCertificate.ts

A comment is bound to the passage it addresses by content anchor rather than offset, so it follows the passage through revision and reports when its anchor is gone.

backend/src/lib/documents/commentAnchor.ts

An AI suggestion must quote the exact text it replaces; a quote that does not anchor, or a citation the gate blocks, is refused per suggestion with its reason rather than applied approximately.

backend/src/lib/documents/suggestEdits.ts

Before filing, the document is checked against the forum's format rules and the assigned judge's attorney-verified standing orders, and each finding names the order it comes from.

backend/src/lib/documents/preFileCheck.ts

Every cited authority in an exported document carries a real hyperlink to the held source at the cited page, so a reader lands on the passage rather than a search box.

backend/src/lib/documents/authorityLinker.ts

Each citation check run on ingest is appended with its verdict and inputs, so a later reader can see what was checked, when, and against which text. No screen renders the ledger yet.

backend/src/lib/documents/citeAuditLedger.ts

Multi-lawyer editing on one document through a collaboration server; ships OFF, and the route answers 503 with the flag's name when it is not enabled.

backend/src/lib/collab/hocuspocus.ts

Send, sign, trust and phase-change tools always confirm; an autonomy policy may lower other tools to draft-to-review at most, and the floor is clamped again at the registry so a second path cannot reach beneath it.

backend/src/lib/chat/toolRegistry.ts

A button on a page runs the same RBAC, conflict, confirm-nonce, idempotency and audit chain as the chat copilot; the surface route adds owner scope and a nonce re-bind and reimplements nothing.

backend/src/routes/surfaceActions.ts

An agent capability is promoted only by an eval run carrying the decision-gold fields; a missing field fails the gate. Today no run carries them, so nothing has been promoted.

backend/src/lib/agent/promotionGate.ts

Open tasks are reduced to stories by one deterministic module with no model and no clock read, so the app, the daily brief and the notification cannot tell three different stories.

backend/src/lib/proactive/triage.ts

A client sees a document only when its classification, its client-visibility flag and an attorney's publication authority all clear, checked on every read at the access layer; a portal client is refused outright on staff-only routes.

backend/src/lib/access.ts

Which vendors may receive privileged material is a reviewed list in code; a firm selects among approved vendors in-app, and an operator typo cannot open a new egress path.

backend/src/lib/llm/vendorPosture.ts

A trust posting runs under a row lock and refuses when it would take a matter or a client below zero; the guard keys off the ledger, not the request.

backend/src/lib/settlement/trustBridge.ts

Florida Rule 4-1.5(f)(5) is enforced as a 409: no contingency funds move until the client's signed closing statement is on the record, and the refusal is the response.

backend/src/lib/billing/feeArrangement.ts

Once a closing statement is shared for signature its version is pinned; a proposal against a later edit is refused rather than silently re-pointed.

backend/src/routes/settlement.ts

A per-matter Monte Carlo over an authored claim tree renders as a conformal p10–p90 range. The range expresses uncertainty in an authored model; it is an estimate, not a measured outcome.

backend/src/lib/analytics/conformal.ts

The single issue that decides the case is computed once, by one method, and persisted on the snapshot, so the strategy map, the play tree and the brief cannot name three different answers.

backend/src/lib/analytics/killShot.ts

For each pivotal issue the world where the opponent wins it is re-simulated deterministically and the valuation swing is reported; the model layer sits above, never instead of, that arithmetic.

backend/src/lib/analytics/warGame.ts

Per claim element, the opponent's strongest case is built from the firm's own production with a record cite for every thrust and the rebuttal beside it; court mode reads it live.

backend/src/lib/redbrief/generate.ts

An ESI spec, a privilege log, a redaction builder and a meet-and-confer chronology are generated from the record, and the chronology attaches to a Rule 37(a)(1) certification on a motion to compel.

backend/src/lib/discovery/meetConfer.ts

The public page publishes nothing below ten resolved matters and says so in place of a number; ships OFF, and today has nothing to publish.

backend/src/routes/publicCalibration.ts

A prediction is committed to the anchored chain when it is made, so whether it preceded the outcome is a comparison between timestamps the firm did not author.

backend/src/lib/analytics/provablePrecedence.ts

Model-extracted chronology dates are set beside the dates parsed deterministically from the record's own text; an event whose date the record does not attest is marked, not smoothed.

backend/src/lib/analytics/chronologyAttestation.ts

Signing runs in-house: ordered invitations, an attorney confirmation, a field manifest and a seal over the executed bytes, with the evidence written to the record rather than a vendor's.

backend/src/lib/esign/native.ts

Anyone holding an executed PDF hashes it locally and learns whether these bytes are the bytes the system sealed, and which tier backs it: Bitcoin-confirmed, pending, or digest only.

frontend/src/app/verify/page.tsx

Each invoice line names what it rests on — the gate receipt of the approved capability run, the time entry, the metered AI call — so a client can open the row behind the number instead of reading a narrative.

backend/src/lib/billing/attestedInvoice.ts

Bank, ledger and client balances are reconciled in the database and reported as the pair (matched, discrepancy); no bank statement is a refusal, never a zero that reads as reconciled.

backend/src/lib/compliance/trustReconciliation.ts

An outbound production is built as Bates-stamped PDFs — every page carries its true number and any confidentiality legend — zipped with its Concordance and Opticon load files and a manifest; byte work with no model in it.

backend/src/lib/discovery/productionExport.ts

One request streams every document's bytes, the canonical interchange CSVs, the audit chain, a SHA-256 manifest and an OpenTimestamps proof over it; checkable with two commands and no BRON software. No screen drives it yet.

backend/src/routes/firmExport.ts

The renewal page is counts and receipts only, each naming the table and column it counted; a failed read prints unavailable, an empty period prints no data, and a number that cannot be derived honestly is omitted with its reason printed.

backend/src/lib/standing/quarterlyProof.ts

The SwiftUI app shares one networking core and is held to the web app's action set by a parity test that fails when the two drift.

ios/Packages/BronKit/Tests/BronCoreTests/ChambersActionParityTests.swift

A live-deposition lens displays source-linked prompts or an explicit silence decision for attorney review. Includes an Even G2 display integration.

backend/src/lib/livedepo/hud.ts

The same lens over a second glasses runtime, authenticated on a per-session bearer token rather than ambient credentials; labelled beta because the hardware gate is the owner's.

backend/src/lib/livedepo/streamSocket.ts

Medical providers, liens and third-party requests are kept as a register per matter, so the closing statement's deductions trace to a row rather than a memory.

backend/src/lib/pi/providerRegister.ts

The Word add-in runs the same citation gate, Table of Authorities, authority linking and tracked-change redlining as the web editor, against the same server; there is no second gate.

frontend/src/app/word-addin/page.tsx

The Outlook add-in requests the ReadItem permission and no more; it runs the same outbound checks BRON applies to its own email — citations, unfilled placeholders, FRCP 5.2 identifiers — against the message being composed, and cannot send or read the mailbox.

frontend/public/outlook-addin/manifest.xml