# LedgerCovenant

One canonical identity. Human page: https://www.insightits.com/products/ledgercovenant.html

| Field | Value |
|-------|-------|
| Slug | `ledgercovenant` |
| Status | published |
| Family | research |
| Infra category | — |
| Record type | product |
| Parent | — |
| JSON | https://www.insightits.com/catalog/ledgercovenant.json |
| Markdown | https://www.insightits.com/catalog/ledgercovenant.md |
| GitHub | — |
| PyPI | — |
| Install | `Hosted API — log in → dashboard.html#ledgercovenant, or POST /api/ledgercovenant/v1/decide with a JWT. Entry engagement is a $25,000 retrospective evidence audit over 10 historical facilities.` |
| Version | 0.2.0 |

## What it is

a bitemporal covenant compliance engine for credit facilities. It resolves which provision governed a test date through amendment lineage, resolves the defined terms that provision depends on, resolves competing reported figures by source authority, computes the ratio in scaled integers, and signs the decision onto a hash-chained ledger whose checkpoints are timestamped by an RFC 3161 authority. Extraction is analyst-tagged spans verified against the document text; a deterministic pattern matcher proposes candidates and writes nothing, and its confidence is the precision measured in-sample against those analyst tags or 0.0 — there is no OCR and no language model in the path, and /policies publishes what is wired and what it was measured at.

## Problem

A leverage covenant is arithmetic over a definition that three amendments have rewritten, using a figure two sources report differently. Spreadsheets answer that in a way nobody can reconstruct two years later when the lender disputes it, and the reasoning was never written down.

## Alternatives

- **Spreadsheet covenant models** — A spreadsheet records the number, not which amendment produced the definition behind it or why one of two audited figures was used. LedgerCovenant makes the resolution the artifact and signs it.
- **Portfolio monitoring platforms** — Those track covenant results across a book. LedgerCovenant establishes and proves a single result, and refuses to produce one when the documents are ambiguous rather than defaulting to the most recent clause.

## Features

- **Which clause governed, on that date** — Precedence runs on amendment lineage, temporal narrowness, document authority, then specificity. Two survivors means AMBIGUOUS with the candidates, not a guess at the most recent.
- **Defined terms, not just clauses** — Consolidated EBITDA is amended three times and every covenant referencing it changes meaning. Lineage is resolved as-of, with cycle detection that distinguishes a cap from a circular definition.
- **Add-back caps that cap themselves** — "Not to exceed 20% of Consolidated EBITDA, calculated after giving effect to such add-backs" has no closed form. It is settled as a least fixed point, every pass recorded, and refused rather than truncated if it does not settle.
- **Basket capacity with no stored balance** — Builder capacity is folded from dated events on every read, as of a date and as of a knowledge time. A restated investment changes today’s answer without changing what the deal team saw in April.
- **Breach timelines, not just breach flags** — Identified, notice, cure period, cured or asserted default — hash-chained, because the dispute is usually about the notice date. An elapsed cure window is reported; declaring default takes a signed attestation.
- **Evidence packs verifiable without us** — Ed25519 public key, ledger from genesis, every policy inlined as data, RFC 8785 conformance vectors, integer arithmetic step by step — and a section stating what it does not prove.

## Architecture

POST /api/ledgercovenant/v1 with a JWT: register document versions with analyst-tagged spans → record assertions (the Tier 1 determinism boundary) → precedence ladder over amendment lineage, temporal narrowness, document authority, specificity → defined-term lineage with cap-versus-cycle detection → source-lattice fact resolution where the officer-signed certificate outranks the audited statements and equal-rank disagreement is a conflict rather than an average → scaled-integer arithmetic with an explicit rounding mode in the trace → confidence vector and tri-state gate → Ed25519-signed entry on a hash-chained ledger. Tier 1 replay rehydrates frozen assertion hashes under the policy versions pinned at decision time and never calls an extractor; Tier 2 re-reads resubmitted documents and is explicitly non-binding. Corrections happen by supersession with a mandatory attestation, never by editing. Add-back caps that reference the amount they cap ("not to exceed 20% of Consolidated EBITDA calculated after giving effect to such add-backs") are settled as a least fixed point by iterating upward from the uncapped base to exact integer equality, with every pass recorded and a definition that does not settle refused rather than truncated. Basket and builder capacity is folded from dated events on every read with no stored balance, answerable as of a date and as of a knowledge time. The breach lifecycle — identified, notice, cure period, cured or asserted default — is a hash-chained timeline in which the arithmetic observation that a cure window elapsed is kept strictly separate from the human act of asserting a default, which requires a signed attestation. Hardening: checkpoints are anchored with an RFC 3161 timestamp authority that sees only the bare head digest, and the token is recorded only if the imprint, nonce, CMS signature, and timestamping key usage all check out; evidence packs can be written under S3 Object Lock in COMPLIANCE mode for seven years by default; Postgres row-level security backs the application-layer deal-team walls; and lcv_ machine keys carry read, decide, replay, evidence, and anchor scopes with optional facility pins, while attesting, superseding, moving an information wall, and issuing keys are permanently JWT-only because an attestation is a named person taking responsibility.

## Use cases

- Retrospective evidence audit over historical facilities that already had a covenant dispute
- Establishing which amendment governed a quarter, with the surviving candidates named when it is genuinely ambiguous
- Settling a circular add-back cap and showing the iteration that produced the number
- Answering whether a restricted payment had builder-basket capacity behind it on the day it was made
- Producing an evidence pack counsel or an auditor can verify without access to this server

## Benchmarks

No published vendor benchmark for this product. Do not invent metrics.

### Disclosures

- No published vendor benchmark for this product. Do not invent metrics.



## GitHub

_No public GitHub repository for this identity._

## PyPI

_No PyPI package for this identity._

## Documentation

- [Product landing](https://www.insightits.com/products/ledgercovenant.html)
- [Decision API](https://www.insightits.com/docs/ledgercovenant-api.md)
- [API docs on the product page](https://www.insightits.com/products/ledgercovenant.html#api-docs)
- [MCP decide tool](https://www.insightits.com/mcp_tools/ledgercovenant_decide.json)
- [https://www.insightits.com/catalog/ledgercovenant.json](https://www.insightits.com/catalog/ledgercovenant.json)
- [https://www.insightits.com/dashboard.html#ledgercovenant](https://www.insightits.com/dashboard.html#ledgercovenant)
- [https://www.insightits.com/products/ledgerlock.html](https://www.insightits.com/products/ledgerlock.html)
- [https://www.insightits.com/products/prismclinical.html](https://www.insightits.com/products/prismclinical.html)

## Is not

- Automated document reading — a pattern matcher proposes candidates, an analyst decides what becomes evidence, and offsets are verified against the text
- A data room or document store — text is hashed, never stored
- Legal advice — the pack proves what was decided on what evidence under which rules
- A calculator you point at a PDF — facility setup is deliberate work
- A declaration of default — it reports that a cure window elapsed and stops there
- SOC 2 certified

## Related products

- [ledgerlock](./ledgerlock.md)
- [prismclinical](./prismclinical.md)
- [prismmanifest](./prismmanifest.md)
- [prism-shield](./prism-shield.md)