Photograph capture
The client makes photographs in their own system a condition of payment. SplicePilot holds nothing of theirs; a crew's own photographs are evidence we could hold and do not yet.
Platform
Everything here exists, is deployed, and is exercised by a test.
Where a capability is a subset of what the plan asked for, the gap is stated. The list below is the project's own features document, not a brochure written beside it.
Source: docs/features.md · 9 September 2026
Sheets and drawings
The plan set, read and made queryable
Nine pilot packages, 387 pages, 216 plan sheets. Sheet space is the primary coordinate system: footage is measured through each sheet's own ground metric, read from its viewport or its printed scale.
- Reads a plan package: title block, page kinds, sheet numbers, numbering sets, key-map neighbours, drawn scale, geographic viewport.
- Tiles every plan sheet into a PMTiles archive, served by HTTP range, pannable and zoomable to the handhole number.
- Reads the spans the engineer named — 1,421 callouts across the pilot, each with its printed footage.
- Reads the structures the engineer named, in two identifier schemes, and checks the count against each sheet's own legend: 1,595 proposals.
- Flags what it could not read: index pages, sheets whose legend disagrees, packages whose labels run along the route and arrive as fragments.
Recording work
A phone in a trench, with no signal
The crews work underground. A phone has no signal for most of a day and sometimes for a week, and everything recorded in that time is real work that must survive the gap.
- Field client, bilingual English and Spanish, built for a phone in a trench.
- Claims are held on the phone and reach the office when there is signal. Identifiers are minted on the device, so nothing waits.
- Claims against a span the drawing names; the span becomes real on first claim. A crew never waits for someone at a desk to trace a route.
- One tap for the whole span, using the engineer's printed footage.
- Reel counter arithmetic — in, out, pipe, tail — checked against the drawn or printed length at entry, where a transposed digit is caught.
- The four conditions that make a span payable, attested at the moment of claiming.
- Work past the seven-day window is accepted with a mandatory reason rather than blocked.
- Sync is idempotent: a retry after a dropped signal cannot bill twice. A bad event is refused by name and the rest of the batch lands.
Field client · offline first
0 on this phone·0 stored at the office
Field client no signal signal
nothing held
on this device
SPAN 02646 ft
SPAN 03509 ft
SPAN 04582 ft
Reached the office
SPAN 02646 ft
SPAN 03509 ft
SPAN 04582 ft
The same batch, sent a second time. Three events already stored, three acknowledged, nothing inserted. The phone deletes nothing either way: its queue is the only copy of that work.
SPAN 02646 ft
SPAN 03509 ft
SPAN 04582 ft
01 — No signal
A crew records work in a trench with nothing to send it to. Identifiers are minted on the device, so nothing waits for a server.
02 — Signal returns
The batch goes when the phone can go. Until then it is held, and the crew keeps working.
03 — The retry
The likeliest route to double billing is a phone that syncs, loses signal before the receipt, and sends again. An event already stored is acknowledged, not inserted.
Accountability
Append-only, hash-chained, forward-only
A correction is a new event. Nothing is edited or deleted, and a gap or an altered row breaks the chain.
- The project log in both interfaces: who did what, on which device, when it happened, when it reached the office, and the hash.
- Click a line to open the sheet it is about.
- Reversals and amendments carry reasons.
- Recording on someone else's behalf carries a reason.
One claim’s chain · forward only
sha256 chain
#1Claimed, 646 ft
Crew lead
sha256 9f2c…41ab
#2Four payable conditions attested
Crew lead
sha256 c740…8e19
#3Quantity amended, reason attached
Office
sha256 21d6…b0f5→ 4b7e…9911 does not match
#4Recorded on the crew's behalf, reason attached
Office
sha256 8a03…7c62
#5Outcome applied
Office
sha256 e5b1…2d84
There is no edit path and no delete path. A gap or an altered row breaks the chain, which is the point: the log is evidence rather than a view.
01 — Append only
Every claim carries its own chain, and each event in it carries the hash of the one before. Nothing is edited and nothing is deleted.
02 — Alter one row
Change a figure after the fact and its hash no longer matches, so every link after it stops verifying.
03 — Corrections are events
A correction is appended with a reason, and the record of what was claimed on the day survives it.
The daily report
The client's own form, filled exactly
DPR Form V2 is a fillable PDF with 232 fields. SplicePilot fills it exactly as a person does today, rather than asking the client to accept a new document.
- The email carries the plain text, a designed HTML body, and the filled form as a PDF attachment.
- Nothing sends itself. A person releases the report; who and when is recorded.
- A second report for a day supersedes the first and says so.
- Every report that left the building is listed, with recipients, releaser and the mail id that proves it.
- The report is readable back by the same code that reads the typed ones, so a generated report and a hand-made one can be compared field by field.
Daily production report · DPR Form V2
0 / 4,476 ft claimed
| Unit code | SPAN 02sheet 09 | SPAN 03sheet 11 | SPAN 04sheet 12 | SPAN 05sheet 12 | SPAN 06sheet 14 |
|---|---|---|---|---|---|
| Fiber | 646 | 509 | 582 | — | — |
| LI_47 | — | — | — | 478 | — |
| LI_53 | — | — | — | — | 524 |
| Muletape | 646 | 509 | 582 | — | — |
Released
A named person, at a recorded time. A second report for the same day supersedes the first and says so.
Sent
Every report that left the building is listed, with its recipients and the mail id that proves it went.
01 — The client's own form
A matrix: a column per span with the sheet it sits on, unit codes down the side, the quantity in the cell. 232 fields, filled exactly as a person fills them.
02 — Released by a person
Nothing sends itself. A person releases the report, and who released it and when is recorded with it.
03 — Sent, and provable
The mail carries the plain text, a designed body and the filled form. Recipients, releaser and the mail id are all kept.
Release and delivery · supervisor to the client
the sender holds gmail.send only — it cannot read a mailbox
Console · today's report
DAILY REPORT FROM 9/9/26 SPRINGFIELD 2.04
- To
- Construction manager [email protected]
- Cc
- Project engineer [email protected]
- Att
- daily-report.pdf
Releasedby D. Marin · 09 Sep 16:41
/api/delivery is office-only. A crew or foreman account is refused at the door.
Inbox — construction manager
SplicePilot·DAILY REPORT FROM 9/9/26 SPRINGFIELD 2.04
16:41SplicePilot·Re: yesterday's figures
16:41DAILY REPORT FROM 9/9/26 SPRINGFIELD 2.04
| unit code | SPAN 02 | SPAN 03 | SPAN 04 |
|---|---|---|---|
| Fiber ft | 646 | 509 | 582 |
| LI_47 ft | 646 | — | 582 |
| Muletape ft | — | 509 | — |
daily-report.pdfthe filled form, attached as the document of record
message id 18f2c…a41b · thread 18f2c…a41b · recorded against the delivery
New mail · SplicePilot
DAILY REPORT FROM 9/9/26 SPRINGFIELD 2.04
01 — Nothing sends itself
The report is built and queued, but it sits there. Release is office-only: a crew or foreman account cannot reach it at all.
02 — A person releases it
One click by a named supervisor. Who released it and when are written down with the report, not inferred afterwards.
03 — It lands as mail
The subject is the client's own format, kept exactly, because it is the key their whole process turns on.
04 — And it is provable
The provider's message and thread ids come back and are stored, so every report that left the building can be shown to have left it.
Approvals
Read out of the mail thread, never assumed
The client's answers are classified with a model built from what construction managers actually wrote. Handoffs, rejections and partial approvals are told apart from approvals; a keyword search cannot.
- Outcomes are recorded against the exact claims the report asserted.
- Partial approvals and approved-with-changes are never applied to money without a person confirming them.
- Silence is a finding with a name, not nothing.
- Live: every hour the threads of sent reports are read for new answers.
Reconciliation
A resolution ladder that records how it resolved
Statement lines resolve through exact, alias, glyph-fold, rate-as-proof, then unresolved. 1,015 verified statement lines are loaded.
- Every resolution records how it was made.
- Areas resolve as of the line's work date, so a segment renamed mid-project is a non-event.
- Matching records method, confidence and evidence.
- Both unmatched lists are mandatory: claims with no line, and lines with no claim.
Reconciliation · the matching ladder
6 lines
Statement lines in
LI_47646 ftSEG4.02-B509 ftLI_S3422 ftFiber582 ftLI_53478 ft—524 ft
Five caught, one not. Every resolution records which rung caught it, so “matched” is never a bare assertion.
01Exact
the line names the span
LI_47646 ftLI_53478 ft02Alias
a known other name for the same area
SEG4.02-B509 ft03Glyph-fold
O for 0, l for 1, a stray space
LI_S3422 ft04Rate-as-proof
the rate identifies the pay item
Fiber582 ft05Unresolved
recorded, never guessed
—524 ft
01 — Lines arrive
A statement is a list of lines. Nothing on it is guaranteed to name a span the way the drawing did.
02 — The ladder
Each line is dropped through the rungs in order, and the first one that catches it records how it caught it.
03 — What nothing catches
The last rung is not a failure state. An unresolved line is recorded as unresolved and stays on a list somebody answers for.
Policy and the clocks
Every threshold is a row with a source document
Thresholds carry a validity range and the document they came from, so a number that changes is a new row rather than a code change nobody can date.
- 01
- The seven-day claim window, the 10 a.m. approval deadline, the $250-per-day penalty for a missed report.
- 02
- The four payable conditions and the four rejection reasons.
- 03
- The loss-report threshold is the ninetieth percentile of the observed pay lag — 56 days, measured over 593 lines. The median is kept for reporting only.
Standing checks
Twenty questions the current process cannot answer
Each runs on demand and every morning. Empty is the goal, and a morning digest names every check with findings.
- Approved work never billed. Reports never answered. Outcomes needing a person.
- Phones holding work. Claims past the window. Duplicate claims.
- Stale approvals. Clock skew.
- Sheets whose legend disagrees. Spans in use that nobody drew.
Not done
What is genuinely missing, named.
These are open. Nothing on this site counts them as delivered.
Offline sign-in against a device token
The schema exists; nothing issues one. A crew lead who has signed in once keeps a thirty-day cookie.
Signed builds and iOS
Certificates, a keystore and Xcode are purchases and installs, not code.