Euthyna

The problem

In project finance, capital is released in tranches against milestones, but 'verified progress' is often a PDF and a signature. Investors and operators need capital movement to depend on evidence that meets a stated policy, with a record that explains every decision months or years later.

What we built

• An append-only, hash-chained audit ledger. Plans, milestones, evidence, approvals, exceptions, holds and certificates are events; the entire governance state is a projection of that ledger and can be rebuilt bit-for-bit by replay.
• A deterministic policy engine: tranche eligibility is a pure function of the approved plan version, the evidence graph, approvals, exceptions and policy version. Every evaluation stores its full per-predicate trace, the standing answer to 'why was this eligible, or not'.
• The Andon principle applied to capital: any abnormality raises an exception, scoped holds propagate through the dependency graph, and capital stays held until remediation is verified.
• Evidence handled as three separate concerns: artifact integrity (content-addressed, re-verified on every download), provenance authority (what class a source may claim), and policy sufficiency (whether verified evidence actually meets the criterion).
• A multi-tenant cell where each project has its own isolated ledger and roster, an operator console that rewords the engine's refusals into plain business language, and an investor assurance view recomputed from the verified ledger.

Where AI fits

• AI can observe and raise: an AI finding lands as a typed state the rule engine cannot consume as evidence, and it can trigger an exception that stops capital.

Engineering discipline

• The governance core has zero runtime dependencies, guarded by a CI check that fails the build if it ever gains one.
• The database enforces the ledger's own invariants: triggers reject every update, delete and truncate, and every insert must extend the hash chain. A tampered ledger is refused at startup.
• Segregation of duties in code: submitter, verifier and approver must differ; a change-order author cannot approve it. Two hundred and thirty-eight tests plus browser end-to-end runs and written runbooks that replay full synthetic projects, refusals included.

What it is worth

• Investors see the capital waterfall, milestone health and the reasoning behind each tranche, not a summary someone typed.
• Auditors reconstruct any decision by replay. Operators get refusals explained in business terms instead of stack traces.