Skip to main content

​
Releases

Every entry here is a merged pull request across the two GreatBook repositories, dated by its merge.
Status legend: 🟢 Live · 🟡 In Development · ⚪ Planned · 🔵 Future
Most of these are labelled fix, and that is not a sign of instability. Each one is an adversarial review or a live run finding a way the book could be wrong while balancing, which is the only class of defect a ledger cannot detect for itself.

​
2026-08-09 - honest finance surfaces and canonical settlements 🟢

web #55–#58 - smallest-scope refusal, exact list authority, and a read-only settlement record
  • one shared trusted-response layer now keeps malformed evidence unavailable at field, row, cluster, page or view scope instead of inventing, hiding or reassuring around it
  • Typewriter Documents, Review, Accounting Analysis, Audit, Files, Planning and Ledger consume server-owned totals, deterministic ordering and continuation, preserve unreadable rows, and require request-bound evidence before accepting a mutation
  • /books/settlements reads the canonical payment/receipt register, immutable journal link, matching, allocations and provenance; it deliberately publishes no browser approval or execution path
  • contradictory authorization evidence is quarantined without hiding the settlement, and valid cross-currency mismatches remain readable with the reason they cannot be totalled
Documented on Trusted responses and Canonical settlements.

​
2026-08-09 - bounded public MCP transport 🟡

backend #108 - harden the transport without activating it
  • a 256 KiB limit is enforced against both declared and streamed request size before authentication work proceeds
  • synchronous tools run in a bounded eight-worker pool under one default 30-second end-to-end deadline, with sanitized overload and timeout failures
  • rate limits are process-shared and the deployment runs four Uvicorn workers
At that release cut, the code was merged but public ingress, OAuth clients, identity bindings, provider trust and production ChatGPT/Claude connections were not active. Public ingress was activated later and initially advertised registry 1.8.0. Registry parity was then restored at 1.14.1; provider behavior remains unexercised. See MCP ingress and client status.

​
2026-08-08 - bounded Clerk retrieval, Files continuation and the capability safety survey 🟢

backend #105–#107
  • At this release cut, Clerk procedural retrieval read structured Cognee chunks under one bounded deadline; backend #133 later replaced that SOP path with the deterministic Git-rendered in-process index
  • Files publishes server-owned offsets so every row remains reachable without a browser-invented continuation
  • all 59 registry-blocked capabilities are classified against six guarantees, leaving 10 adapter candidates, 41 requiring named work and 8 explicit must-not-build outcomes at the survey’s evidence cut
Documented on The Clerk, Files and Why blocked capabilities stay blocked.

​
2026-08-03 - fail-closed reads and registry-projected MCP prompts 🟡

backend #100–#102
  • statement failures are typed unavailable results rather than zero-valued reports, and customer-facing lists carry server-derived totals and continuation
  • MCP prompts/list and prompts/get project only current, capability-executable and role-authorized skills from the authoritative registry; they do not create a second command catalogue
  • Claude joined ChatGPT in the closed provider allowlist and exact-provider evidence gates
The provider migration deliberately created zero OAuth clients and zero trusted bindings. Neither provider connection nor any connector was activated by these changes. Documented on Trusted responses and MCP ingress and client status.

​
2026-07-31 - final GreatBook accounting release 🟢

backend #78–#84 · web #39–#41 - exact replay, complete business mechanics, serialized Close, typed reversals and schema-owned currency
  • a journal source key now replays only exact immutable facts; versioned checksums preserve historical interpretation and current entries are permutation-invariant over complete line facts
  • every owned AP/AR control writer pairs the control leg with its canonical obligation; foreign loan movements retain exact journal-line base evidence; factoring, PIT remittance and inventory adjustments keep their native business truth
  • Close and supported accounting mutations share one organization lock, and a successful close certifies the exact journal tail, workpaper state and Books/finance authority fingerprint it rechecked under that lock
  • a named human can use the checksum-bound HTTP reversal boundary for supported AP/AR, settlement, inventory/costing, payroll, loan, tax/VAT and adjustment events; unsupported or partial native state writes no GL-only mirror
  • all 27 currency-bearing document schemas use the same 307-value uppercase ISO 4217 contract in Typewriter create/revise and staged review
  • the final UI treats a lost decision response as unknown until canonical reread, exposes audit-read errors instead of false-empty evidence, keeps money in its reported currency and surfaces revision filing outcomes
The exact backend and UI cuts are live on GreatBook’s canonical production target after the reset, demo reseed, accounting controls and UI cutover passed their release gates. At that release cut no web UI action or MCP tool was claimed for typed business reversal; later web PRs #48 and #51 added source-screen staging and the registry v1.8.0 release added typed MCP staging through the shared staged-workspace resource, while production ChatGPT/Claude activation remains separate. Documented on Immutability and typed reversals, Fiscal periods and closing, Money and supported currencies and GreatBook workspaces.

​
2026-07-31 - Accountant Wave D/F and read surfaces 🟢

  • the period-scoped close_gated Auditor family and monthly last_closed job preserve open/missing/unevaluable periods as inconclusive and keep findings scoped to the period that produced them
  • DEPR-COVERAGE requires one in-period charge for each positive-cost asset in service and still inside its useful-life window; dateless assets remain named inconclusive coverage
  • Accounting Desk Allocations, Costing and Adjustments reads preserve exact decimal strings, stable journal links, paging and explicit empty/partial/error states
Documented on The Accountant, GreatBook workspaces and The Close checksums.

​
2026-07-31 - the comprehensive GreatBook capability ontology 🟡

backend #73 plus the typed reversal release, superseded by registry 1.14.1 - 116 stable outcomes across 26 domains in the pinned source
  • 98 current, seven experimental, one queued, two deprecated and eight forbidden capability records
  • current product behavior, executable MCP adapter, declared Apps resource and ordinary deep link recorded as separate facts
  • 46 outcome records executable through 32 shared typed tools, distinct from the 50-tool release-source transport and 18-resource inventory (17 MCP Apps plus the JSON skill registry)
  • deterministic coverage against DevCenter routes, five agent workflows, GreatBook web navigation and the pinned public documentation
  • generic SQL, HTTP, route and finance writers plus model-selected authority remain explicit forbidden outcomes
The registry and MCP foundation are merged; transport hardening later merged in backend PR #108, while promotion, external identity, scope and administrator inputs remain release gates. Public OAuth/MCP ingress initially advertised registry 1.8.0 and is now current at 1.14.1; ChatGPT and Claude behavior remains unexercised end to end. Documented on Capability lifecycle and anti-drift and GreatBook through MCP.

​
2026-07-31 - typed staged-domain adapters 🟡

backend #72 - commit reviewed outcomes through named canonical services
  • W3 Matching accept/reject/undo
  • Typewriter approve/submit
  • adjustment approve/reject
  • fiscal close/reopen
  • the existing guarded workflow resume
Every adapter binds an exact target version, verified human/organization/role, canonical validation, idempotency, audit evidence and reversal or compensation to the staged workspace’s exact-revision single-use confirmation. No generic writer was introduced. At that release cut, merged code was not a claim that the production MCP connection was active. Public ingress was activated later, initially advertised registry 1.8.0, and is now current at 1.14.1. It has not been exercised through ChatGPT or Claude. Documented on GreatBook workflows and guarded actions.

​
2026-07-27 - one model of the same transaction 🟢

backend #14 - the reconciliation knowledge graph and the recon check family GreatBook’s records for one transaction live in several systems at once, and nothing in a relational schema said those rows were one thing. So “is this the same bill, and which copy is the document of record” had no query behind it.
  • a generated concept ontology - 16 concepts and 13 relations, built from the document registry rather than authored twice - checked into git and pinned to the database’s own CHECK constraints by a test
  • an instance graph in Postgres under org-scoped RLS, projected from the GL and intake every three hours, idempotent by fingerprint and never deleting
  • asserted edges and proposed links kept in separate tables: an edge is a fact a writer already committed, a link is a proposal that names the rule which made it
  • a fourth Auditor check family, recon, which reports inconclusive rather than clean over a graph older than six hours
  • the control-account tie reuses the Accountant’s own AP-CONTROL / AR-CONTROL Close checksums rather than re-deriving the comparison
Documented on The reconciliation ontology and The Auditor.

​
2026-07-26 - the currency on every line 🟢

backend #11 - state the document’s currency on every posted line A 1,000 USD bill posted 1,000 dong: balanced, hash-chained, in an open period, and tying, because the AP obligation was derived from the same wrong number. The engine could always do this correctly - it resolves the rate as of the entry date and refuses when the book holds none - it was simply never handed a currency, and an absent currency is not “unknown”, it is an assertion that the amount is already in the base currency.
  • every posted line now states its currency, and no line states a rate: the rate is the engine’s to resolve inside the posting transaction
  • a localised spelling resolves through an alias table (₫, VNĐ, đồng → VND, accent- and case-blind), an ISO-shaped code is upper-cased, and anything else raises at propose time rather than being read as the base currency
  • a bare $ was deliberately removed from that table: five currencies print it, and a guess that is right most of the time is the worst kind on a money path
  • a foreign obligation with no base-currency amount is now refused outright
Documented on FX is as-of-date and Payables and input VAT.

​
2026-07-26 - input VAT splits onto 1300 🟢

backend #9 - split recoverable input VAT onto account 1300 A supplier VAT invoice put its whole gross into inventory: no input-VAT asset, and a VAT return with nothing to declare. It balanced, so nothing caught it.
  • a payable now posts three legs: Dr <coded> net / Dr 1300 VAT / Cr 2000 gross
  • the gross is the anchor and the net is derived, so the entry balances however the document was written
  • the VAT is read from a stated amount or from gross - net, never inferred from a rate
  • a triple that does not add up raises and posts nothing
  • the tax_entries register line travels with the leg in the same transaction, so GL 1300 stays tied
Documented on Payables and input VAT and VN VAT and statutory tax.

​
2026-07-26 - a written amount is the number its schema declares 🟢

backend #10 - typewriter numerics Magnitude suffixes are refused, leading-zero grouping is fixed, and a written amount is read as the type its schema declares rather than coerced.

​
2026-07-26 - the review page tells the truth 🟢

web #12 - a review deep link opens the document it names Six defects found by an adversarial review of the usage guide on the live app, each reproduced before it was fixed. The worst was not cosmetic.
  • a /books/review deep link matched only the selected tab’s rows and fell back to the first row, so “open in review” could land on a different, real, actionable document with live Approve and Reject controls and no message anywhere. It now resolves against the whole queue, moves the tab to one that shows the row, and confirms an unknown id directly - an id the backend refuses selects nothing and shows a by-id banner
  • “Send back” was rendered enabled on every non-terminal row while the server accepts only a flagged row, so on every composed document it was a guaranteed conflict whose error named an internal verb. The control now mirrors the server’s own rules and renders disabled with a reason
  • Refresh used to re-read the list but not the record on screen; it now refreshes the selected row, posting gate and trail while preserving a half-typed rejection reason
  • the review page printed raw UTC while other pages printed the same instants in local time - one event, two times, seven hours apart
  • a bare $ appeared against dong figures, about 25,000× off at face value. Money now goes through one formatter, reads the base currency the endpoint returns, and renders BASE rather than dollars when the currency cannot be read
  • the approval trail showed a time and a dot and named nobody, on the one page whose purpose is “who signed this”. Completed steps now carry approver identity and time; the UI shows the resolved identity or the recorded stable user id rather than guessing
Documented on The review inbox and Typewriter documents.

​
2026-07-26 - the Auditor answers the whole question 🟢

backend #8 - answer every check family a multi-part request names “Run a full check of the books: hash chain, accounting invariants and orphan scan” ran two of three families and named none of them in the reply.
  • a multi-part assurance request now runs every family it names
  • an all-clear over an unverified family is refused
Documented on The Auditor and Guardrails.

​
2026-07-26 - the AP obligation a control credit stands for 🟢

backend #6 - open the AP obligation a document-posted bill’s control credit stands for Found by the first live Close run: the Bookkeeper posted Dr expense / Cr 2000 and opened nothing, so GL 2000 carried a balance no bill accounted for and the AP control tie failed on every document-originated payable.
  • the obligation is opened in the same transaction as the entry, through the backend’s own single obligation writer rather than a second insert
  • its base amount is read back off the posted control leg, so the sub-ledger and the GL cannot disagree
  • a payable that names no supplier is refused
  • party_code prefers the resolved party-master id, and the resolution outcome is recorded in the posting audit detail so fallback rows stay findable
Documented on Payables and input VAT and Settlement.

​
2026-07-26 - the Typewriter lane 🟢

backend #5 and web #10 - the propose-only document composition lane
  • a schema-driven builder over the canonical 146-type document schema, themed into the product’s own design system
  • a live preview, a stored PDF whose exact bytes are hashed, a versioned documents table where a correction is a new version naming the one it supersedes
  • an approval chain, and an idempotent hand-off into the Clerk’s intake queue
  • the agent lane is propose-only: it can draft, and it cannot file
Documented on The Typewriter, Compose a document and Typewriter documents.

​
2026-07-26 - the fifth graph is graded 🟢

backend #7 - grade the typewriter graph and close the coverage gap that hid it A served graph was ungraded, and the coverage guard did not notice - which made the eval board look complete while one lane was unmeasured.
  • the Typewriter lane gets its own dataset and evaluators
  • the coverage guard is tightened so an ungraded served graph fails the gate rather than passing quietly
  • baseline expected-failure markers are made conditional rather than blanket
Documented on The regression gate and The scoreboard.

​
2026-07-26 - duplicates are flagged, not crashes 🟢

backend #4 - flag duplicate intake documents instead of crashing, and correct money-path attribution
  • a duplicate document is flagged for a human instead of raising
  • the posting checker of record is read from the journal entry, never from the intake approver - two different people under strict separation of duties

​
2026-07-26 - per-agent SOP rulebooks 🟢

backend #3 - per-agent SOP rulebooks, plus duplicate line-item flagging Each agent’s rulebook is generated from the code that enforces it - the Bookkeeper’s account map from the posting rules, the Auditor’s families from its scope, the Accountant’s checklist from the close steps. A hand-retyped rulebook drifts, and a drifted rulebook is worse than none: the agent then cites, with a citation, a procedure the system no longer follows. Documented on The SOP store and SOP versus code.

​
2026-07-25 - the mandate-gated money path 🟢

backend #2 - mandate-gated agent money path over a canonical GL The release that made an agent able to reach the ledger at all, and the one that took five rounds of adversarial review to make safe.
  • the ledger engine, its 18 GL invariants, the per-org hash chain and the event stream over the canonical schema
  • the seven sub-ledgers and the generated Close control inventory, now 104 checksums, as live queries
  • the Bookkeeper pausing before post, and the posting mandate that makes releasing that pause unforgeable
  • source-specific separation of duties: three distinct authenticated people on document-originated postings, and a named non-agent human who did not propose an Accountant adjustment
  • database-level maker-is-not-checker constraints, head-only approval, and the revocation of anonymous read
Documented on The posting mandate, Maker-checker and The security boundary.

​
2026-07-25 - the passthrough is scoped 🟢

web #8 - scope the LangGraph passthrough to the chat’s own graphs and threads The browser could reach the agent runtime’s state API through the UI’s proxy. It is now scoped to the chat’s own graphs and threads, which is the layer above the posting mandate - the mandate is what holds if this one is bypassed.

​
2026-07-24 - the workspace 🟢

web #1, #4, #5, #6 - the UI, the Books workspace, and the review inbox
  • the product re-based on a chat UI with session authentication and server-gated finance data
  • an agent-profile switcher with per-agent threads
  • the Books workspace: Ledger, Transactions, Review, Reconciliation, Payments, Files, Actions
  • finance pages made crash-safe against a degraded backend, so a missing table renders an empty state rather than a stack trace

​
Earlier

backend #1 - the product plan, the competitive research and the adversarial review that the whole build was specified against.

​
What is not here

This page lists what shipped. Two other pages carry the rest of the honest picture: