The Systems Lab.

CREATE OR REPLACE FUNCTION verify_journal_voucher_balance()
RETURNS TRIGGER AS $$
DECLARE
  v_sum_debit NUMERIC(12, 2);
  v_sum_credit NUMERIC(12, 2);
BEGIN
  -- Sum all debits and credits for the pending transaction voucher
  SELECT COALESCE(SUM(debit), 0), COALESCE(SUM(credit), 0)
    INTO v_sum_debit, v_sum_credit
    FROM journal_lines
   WHERE voucher_id = NEW.voucher_id;

  IF v_sum_debit <> v_sum_credit THEN
    RAISE EXCEPTION 'Ledger Invariant Violation: Total Debits (%) do not equal Total Credits (%) for voucher %',
      v_sum_debit, v_sum_credit, NEW.voucher_id;
  END IF;

  RETURN NEW;
END;
$$ LANGUAGE plpgsql;

CREATE CONSTRAINT TRIGGER trg_verify_voucher_balance
AFTER INSERT OR UPDATE ON journal_lines
DEFERRABLE INITIALLY DEFERRED
FOR EACH ROW EXECUTE FUNCTION verify_journal_voucher_balance();

import { z } from 'zod';

export const SupplierInvoiceSchema = z.object({
  invoiceNumber: z.string().min(3).max(50),
  vendorTaxId: z.string().regex(/^[A-Z0-9-]{8,20}$/),
  invoiceDate: z.string().refine((d) => !isNaN(Date.parse(d)), {
    message: 'Must be a valid ISO date string',
  }),
  lineItems: z.array(
    z.object({
      description: z.string().min(1),
      quantity: z.number().positive(),
      unitPrice: z.number().nonnegative(),
      totalAmount: z.number().nonnegative(),
    })
  ).min(1),
  subtotal: z.number().positive(),
  taxAmount: z.number().nonnegative(),
  totalAmount: z.number().positive(),
}).refine(
  (data) => {
    // Deterministic arithmetic assertion
    const calculatedSum = data.lineItems.reduce((acc, item) => acc + item.totalAmount, 0);
    return Math.abs(calculatedSum - data.subtotal) < 0.01;
  },
  { message: 'Line item total does not reconcile with subtotal' }
);

export function sanitizeAgentInput(rawInput: string): { safeText: string; flagged: boolean } {
  // Disallowed injection patterns
  const injectionPatterns = [
    /ignore\s+all\s+previous\s+instructions/i,
    /system\s*:\s*you\s+are\s+now/i,
    /bypass\s+(security|rules|guardrails)/i,
    /print\s+all\s+environment\s+variables/i,
    /<\|im_start\|>/i,
    /<\|endoftext\|>/i,
  ];

  for (const pattern of injectionPatterns) {
    if (pattern.test(rawInput)) {
      return { safeText: '', flagged: true };
    }
  }

  // Strip excessive markdown delimiters and invisible unicode control chars
  const sanitized = rawInput
    .replace(/[\u200B-\u200D\uFEFF]/g, '')
    .trim()
    .slice(0, 15000);

  return { safeText: sanitized, flagged: false };
}

#!/usr/bin/env bash
set -euo pipefail

echo "=== 1. Starting Isolated PostgreSQL Sandbox ==="
docker run -d --name pg-restore-test -e POSTGRES_PASSWORD=drill_pass -p 5439:5432 postgres:16-alpine
sleep 3

echo "=== 2. Restoring Encrypted Snapshot ==="
gunzip -c latest_backup.sql.gz | docker exec -i pg-restore-test psql -U postgres -d postgres

echo "=== 3. Executing Deterministic Checksum Assertion ==="
BALANCE_DRIFT=$(docker exec -i pg-restore-test psql -U postgres -d postgres -t -c "
  SELECT COALESCE(SUM(debit) - SUM(credit), 0) FROM journal_lines;
")

if [ "$(echo "$BALANCE_DRIFT == 0" | bc)" -eq 1 ]; then
  echo ">>> DRILL SUCCESS: Trial balance balances to the cent (Drift = $BALANCE_DRIFT) <<<"
else
  echo ">>> DRILL FAILED: Ledger imbalance detected! Drift = $BALANCE_DRIFT <<<"
  exit 1
fi

docker stop pg-restore-test && docker rm pg-restore-test