Onyx BillS

Time is billed in tenths of an hour. Minutes are floored to a six-minute tenth — never less than one — the gross line is taken in minor units (truncated toward zero, so the firm never over-bills), and any discount is subtracted to a floor of zero. Value-added tax is computed on the rounded base in basis points and reconciled so the minor-unit residuals of subtotal, VAT and total all agree. The whole computation is integer arithmetic on minor units; there is no floating ambiguity to drift, and the result reproduces under recomputation by hand.

FIG. I·aMac · timesheet — tenths capture & sealed ledgerprint surface

FIG. I·bMac · billing — proforma to finalised invoiceprint surface

FIG. I·cMac · timer ready to startreal capture

FIG. I·dMac · running timer with stop controlreal capture

Every event embeds the hash of its predecessor and contributes its own; the sequence, the previous-hash links and the truncation of the tip are all checkable, so any break is detectable rather than assumed. The store blocks mutation outright: immutable SQLite triggers abort update and delete, and the sequence is unique, so the chain cannot fork. Each hash is an HMAC-SHA256 over canonical content under keys derived through HKDF from the vault key, so a record cannot be silently rewritten and re-signed.

Retrieval is hybrid: a reciprocal-rank fusion of a BM25 lexical leg and a brute-force cosine vector leg, with a fusion constant of k = 60 (the active default weights the two legs equally; a protected-retrieval profile weights the lexical leg higher to harden exact-token recall). Above the fusion, a floor holds: under the protected guard, exact tokens — UTBMS codes, clause references, dates, AED amounts, percentages — are pinned into the top results with recall 1.0, so semantic ranking may only add on top of the floor, never regress it. The guarantee is enforced as an evaluation gate: a new method must beat the floor with no exact-token regression, measured against a Wilson 95% lower bound alongside Recall@k and nDCG@k.

The default network policy is no inbound, no outbound, and an empty allowlist — the billing core consults this contract before it ever reaches the network. At rest the database is sealed with SQLCipher, the cipher version checked on open; backups travel in AES-GCM envelopes under an Argon2id-derived key, and vault blobs are content-addressed by a keyed SHA-256 hash. The recovery key is minted once, returned for a printed sheet, and never persisted, logged, or written to the audit chain. Where an off-device feature is enabled, every send passes a single audited gate that refuses secrets, records a payload hash, and fails closed when offline; vault sync itself is opt-in, default-disabled and ciphertext-only.

Where a model assists, it is a small, frozen, on-device classifier — no cloud, and no client matter in its training. Its corpus is synthetic: 440 constructed legal narratives across the 22 phases, built with deliberate hard-negatives, so the model learns the shape of the work without ever seeing a real client. A new model is admitted only after it clears an offline evaluation gate bound to its own weight-hash; until those weights are vendored the classifier runs rules-first, adding nothing it cannot prove. When it does assist, it scores a suggested UTBMS code by cosine behind a five-clause confidence margin and, below margin, declines rather than guesses — and it only ever proposes: a draft becomes a record solely by passing back through the deterministic workflow with a step-up, with conflicts, AML, sanctions and payment outcomes refused outright.

FIG. V·aMac · AI Assist — refusalprint surface

FIG. V·bMac · assistant chat proposalreal capture

Invoices are gap-numbered as OL-INV-YYYY-NNNN and, once finalised, carry a re-verifiable SHA-256 economic seal over identity, lines, VAT, subtotal and total — the document attests to its own totals. A proforma advances through separated, audited steps — create, review, approve, finalise — with a step-up before a final invoice issues. Voiding requires a reason; write-offs carry minutes, value, description and an enumerated reason. The billing-item taxonomy is fixed: three kinds — fixed-fee, external-at-cost and disbursement — and no more.

FIG. IX·bPDF · invoice templatereal capture

FIG. IX·cPDF · timesheet templatereal capture

The vault opens by biometrics. Step-up re-authentication is built on one-time proofs that are bound to their target and expire — a proof cannot be replayed, reused, or aimed elsewhere. A companion device joins through a signed pairing ceremony: import an invitation, create a device response, save the signed handoff; the verification code is the first eight characters of a SHA-256 over the pairing secret, responses are HMAC-signed and compared in constant time, and the secret never leaves the Keychain. Capture surfaces are privacy-clean by construction: the running timer and its Live Activity carry only a non-secret matter code, never the client’s name — so a glance at a lock screen can’t reveal who the work is for.

FIG. X·aiPhone · biometric unlockprint surface

FIG. X·biPhone · capture · MAT-2231print surface

FIG. X·ciPhone · pairing QRprint surface