What makes this a real product.

Press ⌘K anywhere → modal that searches every page, action, and recently-viewed report. Up/down navigation, enter to open. Single biggest 'this feels modern' upgrade.

Replace alert() calls with non-blocking toasts. Success, error, warning, info variants. Auto-dismiss with manual override. Action affordances ('Undo', 'View').

Press ? anywhere to see all keyboard shortcuts. ⌘K palette, G then H to home, etc.

Content-shaped skeleton placeholders (animate-pulse) stand in while data hydrates across the app, instead of spinners. Live.

Subtle fade/slide route transitions + staggered list reveals with cubic easing, and a route progress bar — reduced-motion respected. Live.

Light + dark themes with OS-preference detection and a one-click toggle in the header; your choice persists and there's no flash on load. Live everywhere.

Friendly empty states with an icon + clear call-to-action across the workspace (transactions, forecast, watchlists, team) instead of blank cards. Live.

Polished hover + focus states across buttons, cards, menus, and nav throughout the app. Live.

Custom font weights (Inter Display for hero), proper rhythm, optical-size adjustments at larger sizes.

Header bell with a dropdown of recent notifications + mark-as-read. Live — now fed by real data alerts (anomalies, watchlist matches, uncategorized backlog, cash runway) computed from your books, with a full view at /app/alerts.

Drag-and-drop widget grid. Pick from: cash balance, KPI tiles, recent transactions, top vendors, upcoming deadlines, audit score trend.

Star a Q&A question or a report; it appears in your sidebar. Re-run with one click.

Select transactions in the live workspace (with select-all) → set a category for all at once (teach-once learning applies), export the selection to CSV, or delete them in one move. Live at /app/live.

Every change in the live workspace — categorize, delete, bulk edits, import, clear — is undoable (and redoable) with visible Undo/Redo buttons and Ctrl/Cmd+Z. Live at /app/live.

Right-click any transaction in the live workspace for a context menu — set a category, select, or remove it (all undoable). Live at /app/live.

Drop a bank CSV anywhere on the live workspace and it's imported + categorized instantly — no file dialog. Live at /app/live; PDF/receipt routing is the next step.

Pin a report in one pane, browse data in another. Like Notion or Linear's split view.

Click a transaction's date, description, or amount in the live table to edit it in place — Enter or click-away saves, no modal (and every edit is undoable). Live at /app/live.

Typeahead in the app bar across your transactions (description, category, amount, date) and every page/report — instant, client-side over your live books. Live in the /app nav.

Watch a vendor, a category, or any charge over a dollar amount; every matching transaction is surfaced live, per company. Live at /app/watchlists; matches are pushed into the alerts bell + /app/alerts.

Invite teammates to a client with an access level — accountant, auditor, or read-only. Invites are single-use, bound to the invited email, revocable, and read-only enforcement is checked server-side. In dev: every invited role is view-only today (no write-capable Admin/Finance role) and per-feature permissions aren't configurable yet.

Threaded comments on a generated report with @mention highlighting, edit/delete, and resolve/reopen — live on the HUD reports at /gov/reports. In dev: threads are stored per-user in the browser, so teammates don't see each other's comments and @mentions don't notify anyone yet.

Configure: 'AP > $10K needs 2-approver sign-off.' Routing, notifications, audit log.

Generate a URL for a single report. Expires in 7/30/90 days. Optional password. Audit trail of accesses.

See who else is viewing the same report. Cursor positions like Figma/Notion.

Limited-scope external access, partially built: a CPA can be sent a 30-day read-only statements link from /app/books, or invited as an 'Auditor (view)' at /app/team and shown read-only books (enforced server-side). Still missing the portal itself — auditors can't comment or request documents.

Curated dashboard for board members. KPIs, audit status, compliance score. No transaction-level data.

Tenant-facing portal for PHAs: rent ledger, payment history, recert forms, work-order requests.

Vendor self-service: W-9 collection, ACH details, 1099 retrieval. Reduces year-end chase.

Per-user 'who did what when' log at /app/changes — every server write with actor, action, target, timestamp, and a one-click restore of any prior snapshot; plus the category-filterable event feed at /app/activity. Live. No CSV export yet; the change log is durable once DATABASE_URL is set and names the actor once AUTH_SECRET is configured.

Persistent chat panel — floating launcher (⌘/) on every page outside the splash and auth screens, backed by a deterministic intent router so figures are never hallucinated. Today it answers about a selected demo company, not your own imported books; grounding it in your /app/live transactions is the remaining work.

Drag a receipt image → extract merchant/items/total. We have the package (@ledger/receipt-extractor); needs Vision API + UI.

Click 'Why?' on any flagged item to get a plain-English reason it was flagged plus the recommended next step — grounded deterministically in the transaction context. Live at /app/live.

Deterministic cash-balance projection over 30/60/90/180 days from your real transactions: recurring-charge detector + smoothed baseline, weekly confidence band, lowest-balance date + cash runway. Live at /app/forecast.

Correct a category once and the vendor rule is saved for that company — it auto-applies to every other uncategorized transaction from the same merchant and to everything you import next. Live at /app/live.

Gross-to-net with IRS Pub 15-T federal withholding, FICA/Medicare/FUTA/SUTA, state withholding tables, employer cost. Live at /payroll.

Year-end forms with real SSA EFW2 + IRS transmittal records, $600 threshold detection, and W-3/1096 summaries. Reachable at /payroll, but generated from the built-in sample roster and a demo employer — forms from your own accumulated payroll and company profile are the remaining work.

Quarterly federal return + annual FUTA built from your own payroll: every run you post to the ledger is recorded with its taxable wage bases, and /payroll/filing accumulates them into a 941 for any quarter and a 940 for the year. Deposits already made are your input. Prepared for review — transmitting still needs a configured transmitter.

Build → validate → queue → transmit, with deadline tracking + auto-file scheduling + pluggable agency transmitter. Live at /payroll/filing (dry-run; real filing needs IRS TCC / SSA BSO / Form 8655).

Destination-sourced calc with category exemptions + post-Wayfair nexus tracking across states. Live at /sales-tax.

AI scans your spend → 'You're paying $1,200/mo for X. Comparable agencies pay $850. Here's a script to negotiate.'

Quarterly + year-end. 'Your projected tax liability is $X. Strategies: accelerate Y, defer Z, harvest losses.'

Deterministic what-if today: /analysis seeds an assumptions editor from your ledger and recomputes every ratio and the health score live, and /budget projects cash and runway from editable inflow/outflow/starting cash. Natural-language questions and vendor-level scenarios ('cut vendor X') are still to build.

'Hey Ledger, what was my biggest expense last month?' for hands-free CFOs. Mobile-friendly.

Upload a contract / lease / regulation; ask questions about it. Grounded in the document.

Postgres-backed document store behind /api/store: every workspace document is tenant-scoped and written through from the browser cache, so the same signed-in user sees the same books on another device. /status shows the live backend; per-change value snapshots give versioned restore at /app/changes. Isolation is a tenant column on every query, not database row-level security — and point-in-time recovery is a hosting-provider setting, not something the app does.

Email/password sign-up, login, email verification, and password reset at /auth/signup and /auth/login, with a signed httpOnly session cookie gating /app. Google + Microsoft OIDC buttons are built and light up once their client credentials are configured. SAML and MFA are not built.

Every document-store query is scoped to a resolved tenant — the verified session user, failing closed to a per-browser session on any real deployment so a client-supplied scope can never assert another identity — plus a per-company namespace you switch from the header. Isolation is enforced in the application layer; no per-tenant encryption and no database row-level security yet.

Currently Plaid + OFX Direct. Add MX, Finicity, Tink (EU). Credit-union direct feeds.

Direct sync of payroll runs into the GL. Auto-allocates to programs/funds for PHAs.

Read API at /api/v1 (me, transactions, books, forecast) with bearer API keys + CORS, plus HMAC-signed outbound webhooks fired on data changes. Manage keys + endpoints at /app/developers. Live; write endpoints + SDKs next.

Alert on audit findings, approve transactions from Slack, daily digest in channel.

Auto-create Google Calendar / Outlook events for HUD deadlines, audit dates, recert windows.

Installable on iOS/Android. Receipt capture from camera. Mobile-optimized dashboard.

React Native build for app store. Offline-capable for inspectors in the field.

Trigger actions in 5000+ apps when audit findings / report generation / category changes happen.

Push customer/vendor data into CRM. Used by accounting firms managing multiple PHA clients.

Direct API integration with HUD's IMS/PIC. Submit, retrieve, correct. The marquee compliance feature.

iPad/iPhone app for physical inspectors. 89 defect codes, photo + GPS evidence, signed audit trail.

Auto-submit monthly VMS to HUD. Pre-validation + retry on edits.

Submit draw requests directly to LOCCS / SecureSystems.

Pull EIV income matches, reconcile against tenant reports, surface only true discrepancies.

GL with restricted fund balances per HUD program. Required for federal grantee compliance.

Capital Fund obligation (24-month) and expenditure (48-month) deadline tracking is live at /app/hud-tools (24 CFR 905.306) and feeds the alerts bell + /app/alerts. Still to build: 5-year Action Plan item tracking and expenditure-rate dashboards.

Continuously model HOTMA rule changes against tenant roster. Per-family rent delta. Newly-ineligible alerts.

SEMAP indicator #5. Auto-pull comparable rents from public sources.

PHA-Web's stronghold. Complex feature; not v1 priority. Partner with HAPPY/Bostonpost initially.

12-month observation period + audit. No auditor engaged yet — this is planned, not underway. Mandatory for enterprise deals.

9-12 months from application. Unlocks state-government procurement.

12-18 months. Unlocks federal procurement directly. Required for HUD ATO.

Annual third-party pen test. Reports available under NDA.

Public bug bounty via HackerOne. Continuously test our security posture.

Self-serve templates for procurement officers + their counsel. Speeds contracting.

12-page document explaining architecture, controls, certifications. PDF + landing page.

Live uptime + incident history. Subscribe to incident notifications.

Self-serve download of: SOC 2 report, insurance certs, security questionnaire pre-fills (SIG/CAIQ), penetration test summaries.

Data subject access requests, right to deletion, data residency controls.