feat(audit): books.audit, the attestation tools and the CPA gate (P8)

The whole re-audit through the tools: books.audit previews its checks, then
with the preview's digest runs them, files the workpaper and journals the
run; the same books, day and scope return the run that exists.
books.attest_receipt, books.review_entry and books.attest_period record a
named client's claim with its self-reported method; books.attestations
weighs each against policy.attestation_bar as it stands. Under
policy.cpa_package_requires_audit = refuse, books that declared audits
cannot export the CPA package without a counted audit for the handoff at the
current head unless a reason is given, which is journaled as a decision
(D-9). Needs attention asks for the month-end attestation, the annual audit
and the audit before the handoff. Rules B-45, the handbook section, the
interface, parity, receipt-store and testing records, and the As-built
block. Merge needs no go-ahead: the live books refuse the new writes until
the owner gives it.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HS8WZziDnyxunC23MUxrLp

spec/ledger.md

@@ -132,10 +132,11 @@ how the books are kept.
 
 ### BS-ledger-13: Audits and attestations (B-45)
 
-- **Status:** reserved
+- **Status:** CONVENTION
-- **Statement:** Reserved: allocated in the wanderbooks plan (8.0.3), not yet stated in `docs/spec/rules.md`.
+- **Statement:** An audit of the books through a day MUST give the same findings for the same books and programme; a claim that someone checked MUST rest on the books as they were when the audit ran, MUST NOT count when what it read disagrees with the books, and its method is the claimant's own word.
 - **Sources:**
-  - none yet
+  - external: Revenue Procedure 98-25, section 5.01, machine-sensible records with an audit trail
-- **Symbolic form:** none yet.
+  - vendored `sources/irs-records.md`: "In addition, you must keep supporting documents"
-- **Examples:** none yet
+- **Symbolic form:** `findings(books, through) = f(books, through, programme)`; `counted(a, bar) = meets(method(a), bar) and not disagrees(a)`.
-- **Applicability:** none yet.
+- **Examples:** none yet. The example schema has no audit event or query; an audit example waits on a schema extension.
+- **Applicability:** engines that are audited.

spec/rules-index.md

@@ -6,8 +6,8 @@ what its statement rests on and the examples that demonstrate it.
 
 A rule whose only source is a human choice carries rules.md's **CHOICE**, bookspec's status of the same name:
 the specification names the options, an engine declares its pick
-(`claims.choices`, `bookspec_checker::Claims`). Rules B-39, B-40, B-43
+(`claims.choices`, `bookspec_checker::Claims`). Rules B-39, B-40 and B-43
-and B-45 are allocated in `plan/served.md` 8.0.3 and not yet stated: their
+are allocated in `plan/served.md` 8.0.3 and not yet stated: their
 identifier and area are fixed here so a later unit fills them in
 without moving anyone else's number.
 
@@ -57,4 +57,4 @@ without moving anyone else's number.
 | B-42 | `BS-arap-6` | arap | CONVENTION | A settlement is exact, one party, and names its lines; the gross discount and the gross fee | — |
 | B-43 | `BS-entry-5` | entry | — | Drafts and evidence (allocated, not yet stated) | — |
 | B-44 | `BS-ledger-12` | ledger | CONVENTION | Evidence is read from the bytes, never trusted over them; identical files are kept once | — |
-| B-45 | `BS-ledger-13` | ledger | — | Audits and attestations (allocated, not yet stated) | — |
+| B-45 | `BS-ledger-13` | ledger | CONVENTION | An audit is deterministic over the books; an attestation is a claim by a named client | — |