Audit is built on reproducibility. A working paper that cannot be re-performed is, by SA 230 definition, not documentation. Generative AI is built on the opposite, stochastic sampling, temperature drift, prompt sensitivity. Coraa wraps the foundation model in a patent-pending deterministic execution layer so the same ledger, against the same standards, produces the same findings every time, byte-identical, hash-comparable, NFRA-defensible.
Two paths to the same audit conclusion. One leaves traces; the other doesn't.
The Universal Audit Ledger, plus the configured standards, plus the materiality memo, plus the rule weights, are hashed into a unique engagement key. This key is the input to every classification, sampling, and reporting step that follows.
Foundation model calls run inside the patent-pending deterministic wrapper, fixed seeds, fixed sampling, fixed token order. Output is a function of input only, not of time, server, or load. The wrapper logs every call's prompt, seed, and response into the engagement record.
Every classification produced is bound to an ICAI Standard on Auditing reference, an Income Tax Act section, a GST Act provision, or a Companies Act clause. Rules that do not have an anchor cannot be created, the engine refuses ungrounded outputs.
Any engagement can be re-run, days or years later, from the immutable Engagement Log. The re-run produces a byte-identical file. If the file diverges, the engine raises a deterministic-integrity alert and the audit team is notified before the partner sees it.
When NFRA or peer review pulls a file, they can re-run the engagement themselves with the published seed and compare hashes. A matching hash is the defence, not a story you tell, a number you compare.
Two parties holding the same Universal Audit Ledger can run the engagement independently and exchange hashes. If the hashes match, the audit is reproducible. If they do not, the engine pinpoints exactly which classification diverged and why.
Every sample, every classification, every threshold decision carries the seed that produced it. Re-run with the same seed = same result. The seed is part of the working paper, not metadata.
If the wrapper detects a foundation-model drift, a non-deterministic API call, or a clock-dependent output, the engagement halts and surfaces the alert. The team can choose to lock the prior deterministic version or investigate.
The deterministic method is publishable and auditable, NFRA inspectors and peer reviewers can verify the algorithm without seeing Coraa's model weights. The defence is built on math, not access.
