Section 1:Thesis
The record over the machine.
A model can help a firm write. It cannot, by itself, preserve the record of what the firm relied on, checked and allowed to leave.
BRON is the system of record for a litigation matter. It connects drafts, citations, dollars and decisions to an append-only, externally anchored record, with gates that decide what may leave. The thinking — research, drafting, summarising — is the part better models make cheaper for everyone, including us. Custody is the part that has to be built into the record: who saw what, what was checked, what was refused, and how a stranger re-derives the answer without trusting the firm or trusting us.
So when a choice comes down to making the machine cleverer or making the record more provable, the record wins. That rule is written into the repository, and this page is what it looks like from outside.
Section 2:Why now
The court sees the filing. Someone signs their name.
Generating a draft is one step. Deciding what can leave, and keeping the evidence for that decision, is another.
Before it leaves
Check the source. Record the decision.
As it leaves
Carry the evidence with the filing.
After it leaves
Let the recipient re-derive the result.
A plausible citation can look finished on the page. BRON makes the unresolved status visible and puts a gate between that draft and the send. An attorney can review the source, correct the filing, or make an explicit, recorded override.
The record has to survive the moment of drafting. A recipient should be able to check the exported manifest against the filing and its sources. A firm should be able to see what was grounded, what was refused and what changed.
Section 3:Mechanisms
What makes the record provable
None of these is a feature you take on faith. Each is a mechanism with a code path, and a way to watch it refuse.
The send gate throws.
A document relying on an unresolved authority cannot leave. The gate raises rather than warns, and every override is logged before it is honoured.
backend/src/lib/research/citationVerifier.ts
The manifest travels with the filing.
Every cited passage carries its source hash, span and verdict under a published specification. The verifier is MIT-licensed and runs offline, so the recipient re-derives the result without contacting anyone.
verifier/SPEC.md
ungrounded is a status, not an apology.
A fact the record cannot support is labelled so in the artifact itself, and a roll-up inherits the status of its weakest member.
backend/src/mcp/reads/factRecord.ts
Removals are disclosed inside the chain.
When rows leave a ledger, the disclosure is written into the same hash chain and anchored, so a shortened ledger never renders the same green.
backend/src/lib/ledgerDisclosure.ts
The scoreboard refuses.
Predictions are committed to an anchored chain before outcomes are known. The public page publishes nothing below ten resolved matters — and today it publishes nothing, because there are none.
backend/src/routes/publicCalibration.ts
The write verb cannot act.
A firm's own AI reads the record over MCP with provenance on every answer. Its one write verb files a proposal and mints no token.
backend/src/mcp/proposeAction.ts
A deadline is minted from a rule and a trigger.
Never from today's date. The engine computes from a cited rule plus an attorney-confirmed trigger, stores the derivation beside the date, and names the forums it refuses.
backend/src/lib/deadlines/derivation.ts
Trust arithmetic runs in SQL.
Three-way reconciliation returns the pair (matched, discrepancy). A missing bank statement is a refusal, never a zero that reads as reconciled.
backend/src/lib/compliance/trustReconciliation.ts
Section 4:Market
Market
Who
Litigation boutiques of five to fifty attorneys.
Teams that run the whole matter themselves — intake, discovery, drafting, the client, the money — and whose partners sign what goes out. The partner who signs is the person the sanctions record is about.
What one record replaces
Four to six tools.
Case management, research, drafting, e-signature, valuation and a separate citation checker, each holding a slice of the same matter and none able to check the others. Reconciling them is unpaid work. One record ends it.
The second audience is the other side. A verifier that opposing counsel and clerks run without an account is how the format is meant to travel: one filing at a time, from the recipient's desk, with nothing to buy.
Section 5:Proof you can check
Nothing on this page asks for trust.
Four things you can do now, without an account.
Run the verifier.
Drop a manifest on the verify page. The check runs in your browser, and the same code is published to run from a local file with the network off.
Open the manifest checkCheck a signed document.
Paste the fingerprint from an electronic-signature certificate to check the sealed document bytes and the tier of timestamp proof behind them.
Check a signature fingerprintWatch the calibration page refuse.
It publishes nothing below ten resolved matters, and says so in place of a number.
See the refusalWalk the test corpus.
Matter Zero is a fictional Florida test corpus of 355 authored documents with 33 planted contradictions. The public tour separately opens a fictional demo-tenant matter; the landing scenarios illustrate selected mechanisms from the test corpus.
Open the demo matter
export · check
$ sha256sum manifest.json $ ots verify manifest.json.ots
Section 6:What we refuse to claim
What we refuse to claim, and why.
The honest version of a pitch carries a list like this. Ours is short, and each line is checkable in the repository.
- We do not say:A hit rate for the valuation.
- The calibration ledger holds zero scorable outcomes. A forecast without a known result cannot be scored, and no figure is published until ten resolved matters exist on the anchored chain.
- We do not say:That the record is whole.
- A one-off anchor proves an artifact existed at a time. It cannot prove that nothing was withheld, and the attestation route refuses to say so. Removals are disclosed instead.
- We do not say:A comparison with any named product.
- The repository contains no competitor, no benchmark against one and no customer outcome. Every market verdict in our own assessment reads not assessed.
- We do not say:That a cited authority is settled law.
- The strongest verdict the treatment scan returns is that no negative signals were found, and it says so with a timestamp.
Built, and shipping off
Three surfaces exist in code and ship OFF. Each is labelled that way wherever it appears. Turning one on is a decision made in the open, not a default.
- Egress attestationPROVENANCE_EGRESS_ATTESTATIONoff
- Public calibrationPUBLIC_CALIBRATIONoff
- Live co-editingCOLLAB_EDIToff
Talk to the founder.
A working demo on the fictional matter, the code paths named above, and the list of what is not built yet.