TALLYROOM

A merchant with two exports that never agreed: a Shopify orders file and a Stripe balance file. The commission was one served report showing monthly net revenue by channel, with refunds reconciled. The condition of payment was not that the report looked right — it was that we could recompute every number on it, ourselves, from the merchant's own two files.

The two files it was made from

Both are pinned by digest in the contract and ship inside the delivery. Open either one — the report has nothing else to work from.

• Shopify orders export · 2026-01 → 2026-06

  455 orders across 1,121 rows. It arrives one row per line item, with the order-level columns blank after the first — which is the usual reason a merchant's revenue total comes out too big.

  1,121 rows · 159 kB

  7cad32d03608…
• Stripe balance history · 2026-01 → 2026-07

  466 rows: 404 charges, 44 refunds, and 18 payout and processor-invoice rows that are balance movements rather than trade. It carries no sales channel at all, so fees reach a channel only through the order each charge paid for.

  466 rows · 68 kB

  b4aac2455b99…

What we said we would do, before we did it

Acceptance was not decided after the fact. The contract named its method for every line at quote time — how each one gets judged, what we would need from the buyer to judge it, and when it is over. The report line is the one that asks for something: we cannot recompute a total without the files the total came from, and a buyer learns that before they pay, not at delivery.

1. We measure what was handed over against what was agreed

2. We click, type, and play through it ourselves, the way you would

3. We work out every total on the report ourselves, from your own source files, and they have to match — the delivered number is never taken at its word

   we need from you — You give us the source files the numbers come from, pinned at the moment we agree, so we can work them out ourselves

This is settled when we run the agreed checks on what is delivered — you are not left waiting on anyone's opinion

contract-disclosure.json — the declaration, read out of the same module that would tell a live buyer

Then we recomputed all of it

The delivery declares every figure it displays in one file, and renders only from that file. Acceptance takes the declaration, the two pinned exports and a platform harness the seller never sees, runs them in a sealed sandbox with no network, and derives all 116 figures again from the raw rows. A stated total is not evidence.

The full figure-by-figure table — Every declared figure beside what the platform recomputed, and the penny difference between them.

And proved it could refuse

A check that cannot fail is decoration. Five deliberate damages were put through the same harness, plus one negative control that must NOT trip:

1. One displayed monthly total nudged 1% high — caught, out of tolerance.

2. Gross sales summed after a spreadsheet fill-down, counting a four-line order four times — caught.

3. A single penny changed inside the sealed orders export — caught, the pinned digest no longer matches.

4. One agreed figure quietly dropped from the declaration — caught.

5. The per-order fold removed from the sealed plan — refused loudly rather than silently summing a mostly-blank column.

6. Negative control: a 2p drift on a five-figure total, inside the agreed tolerance — passes, as it must.

6 of 6 behaved exactly as specified

Every filter, actually clicked

Seven months by four channels is 28 combinations. A real Chromium session clicked all 28, read the four headline figures off the screen each time, and compared them with the declaration — then hovered a column so the tooltip ran too.

28 of 28 combinations · 0 disagreements between screen and declaration · 0 console messages across the whole session

The decision

Three confirmed criteria compiled to six sealed checks — three public, three held back until the delivery arrived. All six passed.

6 of 6 checks pass · decision: accept

Holdout commitment

The delivered bytes

The files the buyer received, by digest. The copy running above is these exact bytes.

• index.htmld7ed8db9b6fa…
• styles.css5206956ddfef…
• app.jsa1aa3de7c83a…
• build_figures.pyd88e0b16906f…
• README.mdeaeb4e9102a0…
• data/figures.jsonec2a85c9a0f1…