Audit and Reproduction

By the end you can identify a saved answer by its fingerprints, follow an annex value back to the gazette, replay the answer, and state what replay establishes and what still requires separate review.

1. The question

A year after the decision, an internal audit — or a court — takes up the Vogts’ case. The reviewer asks three things: Which rules and values produced €485? Were they the ones in force on 1 January 2025? Can we get the same answer again today, from the saved bundle, and know that nothing was changed?

2. The saved answer

When a question is asked with --out, the model writes a folder with the question, the program it ran, the case and the result:

law ask <case package> --case Familie2025 --query-json queries/wohngeld-485.json --out runs/familie-2025

runs/familie-2025/
  ask.json       the question and how it was asked
  request.json   the program, the case and the question, as evaluated
  result.json    the answer with its proof graph
  bundle.json    the saved bundle for replay: inputs, snapshot, sources
  index.json     the package index: the canons the case resolved, with their hashes

3. The fingerprints

The manifest of the answer names, among others:

Each value used from an annex carries its own fingerprint too. The node of the formula names the rows it read — WertBMitglieder4#2025-01-01 and its siblings — and for each the hash of the dataset it came from. Each row has a source anchor: the text of Anlagen 1–3 in the second WoGFV. And the canon pins the issue itself: BGBl. 2024 I Nr. 314, taken from recht.bund.de, with the SHA-256 fingerprint of its bytes. So the chain runs from the €485 to the formula node, to the row of Anlage 2, to the annex text, to the gazette issue — each link a hash, not a recollection.

4. Repeat the answer

law eval runs/familie-2025

law eval evaluates the saved answer again — without the source files or a rebuild — and must give the same bytes. On 12 October 2026 the replay of the Vogts’ answer saved in the book’s reproduction kit was byte for byte identical to the saved result.json: both files have the SHA-256 fingerprint e5ce59dd…. The full fingerprints are listed in Appendix D.

The reviewer’s third question is answered: the same program, the same case and the same date give the same answer, and anyone can check that by comparing two fingerprints.

5. Change one thing

Replay the bundle of Familie20241231 instead. The program fingerprint is the same — one program holds both editions — but the case fingerprint differs (another date: sha256:cba33940…), the formula node names the rows #2023-01-01, their anchor is the Wohngeld-Plus-Gesetz, BGBl. I 2022 S. 2160, and the amount is €463. The fingerprints tell the reviewer what differs between two answers before anyone reads a number.

6. What replay does not establish

Replay proves identity, not correctness:

• that the program reproduces its answer — yes;
• that the program reads the Act correctly — no: that is a legal review of the rules, helped by the scenarios of Chapter 5 and the ministry’s examples;
• that the facts were true — no: that is the caseworker’s file;
• that a later version of law gives the same bytes — not shown in this edition: the replay above ran on the version that recorded the answer, law 0.1.12;
• that the pinned texts match the certified originals — only as far as recorded: the canon labels its copies by origin, and a check against the certified gazette is a separate step.

A fingerprint identifies saved bytes; legal interpretation requires a separate review. Keeping the two apart is what makes an audit honest.

7. What this gives the authority

For an internal audit, a court or a Widerspruch — the household’s objection to the decision — the office can hand over one folder: the question, the facts, the program, the answer and the proof. The reviewer can replay it on their own machine and get the same bytes, follow every annex value to the gazette, and focus the legal review on the rules and facts — not on reconstructing what the software did on the day.

Whoever drafts the Bescheid takes from the same answer the amount, the legal date with the edition and annex rows applied, and the facts with their origin — the material for the essential factual and legal grounds a written decision must state (§ 35 Abs. 1 SGB X, Chapter 0). The answer does not write the Bescheid: its wording, and everything the model does not compute, stay with the authority.

8. Where Catala stands on this

Catala 1.3.0 provides computation traces for inspecting intermediate steps (Catala book, ch. 2.4), alongside scenario tests and continuous integration (ch. 3.3). Arxo builds saved query bundles and program, case and result fingerprints into replay; the Catala 1.3.0 book does not describe this built-in query-bundle form. An application can preserve its inputs and outputs. Here the authority can check a specific computation’s identity while leaving legal interpretation open to independent review.

Exercise

1. Two saved answers for the Vogts have the same program fingerprint but different case fingerprints. What can you conclude before reading the amounts?
2. A replay gives a result with a different fingerprint from the saved one. Name two places to look first.
3. A reviewer says: “The replay is identical, so the decision is lawful.” What is missing from that argument?