Month-End Close

Architecture

Key specifications

What it does for you

Month-end close at a large entity group is a recurring operational burden: many interdependent recurring journal entries, each with its own logic, spread across multiple operating entities and separate accounting databases. Run from memory or a static spreadsheet, errors accumulate and the close extends for days. The failures that hurt most are the silent ones — a recurring accrual that quietly stops posting, a fully depreciated asset that keeps depreciating, an allocation driven by a cumulative balance instead of the month's activity. Each looks exactly like a clean close until someone finds it quarters later.

A clean March close⁷. Running the close for 2026-03 posts all nine recurring entries balanced, ties every schedule to the GL (prepaid 8,100.00, fixed-fee 62,250.00, insurance 10,950.00, and postage account 1460 clearing to 0.00 in each entity), lands the trial balance at Dr 3,603,311.50 = Cr 3,603,311.50, and Sentinel reports zero findings — close status CLEAN, exit 0.

Prove the controls with injected faults⁸. The guardrail demo first runs a clean baseline (zero findings), then injects twelve classic close errors one at a time — an unbalanced opening, an ended asset still depreciating, a one-sided intercompany entry, a missing accrual, a rounding drift, a single-cent shadow tamper, a rewritten locked period, and more — and asserts each is caught by exactly the control designed for it. Verdict: ALL GUARDRAILS HELD (12 faults, baseline clean), exit 0.

Autonomous remediation of a drifted close⁹. Given a close contaminated with a drift profile (19 initial findings), the Autonomous Close Loop resyncs four drifted categories from the seeded sub-ledger of record over four turns (criticals fall 18 -> 1), quarantines the tampered locked prior period it has no authority to overwrite, and posts the current period on its own authority — verdict AUTO-POSTED (PARTIAL), exit 0, with a byte-identical settled register.

Functional block diagram

Instruction set

Benchmarks

Control characteristics

• All money is integer cents; tie-outs are exact (money.py).
• Every JE balances debits == credits AND each entity leg self-balances, or it is refused (model.Ledger.post raises OutOfTieError).
• Allocation weights must sum to exactly 10000 bps (100.00%) or the entry is refused, never coerced (money.allocate_by_ratio; engine refuses invalid splits).
• Largest-remainder (Hamilton) allocation and split_evenly: parts sum exactly to the total, with no penny lost or created (money.py).
• C9 shadow recompute: a second implementation importing nothing from the engine must agree to the cent before the close stands (sentinel/shadow.py).
• Byte-identical settled register: the autonomous loop's output matches a clean engine run; it never invents a number (loop.py).
• Period lock (C10): each closed register is sealed with a hash, so a later mutation of a locked period is detected on recompute.
• Fully seeded and reproducible for a given seed; refused entries are reported, not silently posted.
• Non-zero exit code on any refused entry, failed schedule tie, unbalanced TB, or CRITICAL finding — so it can gate a pipeline (cli.py).

Authoritative close (posting). CloseEngine.run() computes and posts the nine recurring JEs, writes the register / TB / report, and Sentinel gates the exit code (cli.py).

Read-only preflight (validation). 13 validation-only modules validate an external JSON package and return PASS / NEEDS REVIEW; they never create a JE, import payload, or posting action (recurring_register.py and siblings).

Guardrail demo (proof). --demo-guardrails injects 12 seeded faults and asserts each is caught by its mapped control at a qualifying severity (faults.py).

Autonomous close loop (remediation). loop.py drives a drifted close back to a certifiable state (observe -> remediate -> re-verify -> gate) with a deterministic, logged gate policy. It is always offline and deterministic, with no model calls.

Operating limits

• Single functional currency only — there is no FX translation layer, and no control asserts anything about rate selection or translation differences.¹⁴
• The 13 validation-only preflights never create a journal entry, import payload, posting action, or source-system mutation — a clean result is only 'READY FOR HUMAN REVIEW'.¹⁵
• The autonomous loop refuses to post on a broken opening carryforward (HALT / C1) and never auto-overwrites a signed-off locked prior period (QUARANTINE / C10); it invents no numbers and its settled register is byte-identical to a clean run.¹⁶
• C9 proves dataset-to-register translation, not dataset truth: if the raw sub-ledger is wrong, both independent implementations agree on the same wrong number, and offsetting shifts within one (entity, category, account) GL cell are invisible to GL-level controls.¹⁷

See it run

Integration

Distribution: public repository, MIT license.