Changelog

Punchcard product updates

Release notes for Punchcard's audit AI platform, including CoAudit, workpaper automation, PBC request workflows, sampling reports, Excel imports, authentication, and platform reliability.

Page 6

Access Control & Security Fixes

Tightened access controls to ensure the Financial Statement Review page is properly restricted to auditors.

Bug Fixes

  • Financial Statement Review page is now properly restricted to auditors — clients who navigate to a review URL are redirected automatically rather than encountering an incomplete or unauthorized view.

FSR cover sheet, clone file access, and automation reliability

FSR exports now include a clickable tick-mark index cover sheet; cloned engagements restore full file access for all auditors; automation progress is more accurate through network interruptions.

New Features

  • FSR PDF exports now open with a structured cover sheet. The prepended cover sheet provides a full tick-mark index in two sections — §01 lists every flagged exception with its mode, tick-mark identifier, description, and reviewer notes; §02 is a complete index organized by mode (PY → IC → F/CF). Every row is a clickable internal link that jumps directly to the matching page in the financial statements (and to the exact on-page location when a bounding box is available). The cover sheet also includes a masthead (client name, engagement title, reporting period) and a six-entry tick-mark legend, making the exported PDF self-contained for offline review.

Bug Fixes

  • Cloned engagements: reference and library files are now accessible to all recipients. Previously, auditors provisioned via a sandbox clone were denied download and viewer access to reference and library files because file ownership still pointed to the source engagement. Files are now correctly scoped to the destination task, and access is restored immediately for all clone recipients — including non-admin auditors.

  • Engagement board: disabled board pills now show real counts and smarter guidance. When the Requests or Tasks board is turned off in engagement settings, the pill now shows the actual task or request count instead of a hardcoded zero. If hidden tasks exist — for example, after cloning from an ALL-visibility engagement — the tooltip explicitly flags it: "This engagement has client-visible requests but the board is hidden. Enable it in engagement settings." When the count is zero, the original shorter tooltip is shown. Auditors can now tell at a glance whether there are tasks waiting on them vs. whether the board is simply unused.

  • Automation progress cards are more accurate after network interruptions. On reconnect following a pod rotation, stale failure markers in the automation progress card are immediately replaced by the correct live status if the background retry has already succeeded — no more misleading red indicators on automations that actually completed. In the AI chat run card: a "Reconnecting…" pill appears during brief connectivity gaps so in-progress runs look like transient buffering rather than failures; the "Analysis skipped" warning is suppressed while a run is still in flight and only surfaces after the run reaches a terminal state; and Cancel now reliably targets the correct run by its unique ID rather than the short automation ID.

Review Checklist Navigation & FSR Export Improvements

Smarter PDF citation navigation in the review checklist, always-visible Foot/Crossfoot controls, and a redesigned FSR export cover sheet.

Features

  • Auto-navigate to citations on card expand: Expanding a review checklist prompt card now automatically scrolls the PDF to the card's first citation — flagged findings are prioritized, and the lowest page number is selected first when multiple citations exist.
  • Single-citation highlight: Only one citation is highlighted in the PDF at a time. Clicking a different finding row moves the highlight to that citation, making it easier to trace individual findings without visual clutter.
  • Redesigned FSR export cover sheet: The annotated PDF export cover sheet has a new layout and typography (IBM Plex Mono tick marks), clickable rows that link directly to relevant findings, and now includes the Review Summary section.

Improvements

  • Foot/Crossfoot action buttons always visible: Save, Reset, and Apply are now rendered inline at the bottom of the calculator card with an independently scrollable operand list — the action row stays in view regardless of how long your operand list is.

Bug Fixes

  • Workpaper saves target the correct task: Fixed an issue where a queued autosave could be sent to the wrong task when navigating quickly between tasks while the memo panel stayed mounted.
  • PDF navigation for bbox-less citations: Clicking a citation that has a page number but no drawn bounding box now correctly navigates the PDF to that page.
  • Cross-page operands persist on save: Fixed an issue where cross-page Foot/Crossfoot operands were dropped when using the standalone save action.

Bulk File Actions, AI Math Correction, and Deep Analysis Improvements

Multi-select file management with bulk download, OCR re-run, and grouping transitions; automatic AI math correction in FSR; deep analysis chats auto-open on completion.

File Explorer

  • Multi-file selection across datasources: checkboxes appear on hover; a header checkbox selects every file across all datasource folders at once; Shift+click range-selects including across folder boundaries; folder headers show a live selected/total count (e.g., "3/8")
  • Floating bulk action bar: when 2 or more files are selected, a pill-style bar anchors to the bottom of the file explorer showing the selection count, a clear button, delete, and (for auditors) an Actions dropdown
  • Bulk download: download all selected files as a single zip; files from multiple datasources are organized into labeled subdirectories; a single selected file downloads directly without zipping
  • Bulk re-run OCR: re-run text recognition on all selected files at once from the Actions dropdown
  • Bulk match grouping transitions: move selected files between match groupings — Unmatched, Match Unlocked, Match Locked, or Excluded; each option shows how many of the selected files are eligible
  • Right-click bulk context menu: right-clicking any file in a multi-selection shows the bulk actions menu instead of the single-file menu
  • Datasource folder collapse/expand: each datasource folder can be independently collapsed or expanded; newly uploaded datasources auto-expand; collapsed state survives data refreshes; an upload button appears on folder header hover (auditors only)

Deep Analysis

  • Chat auto-opens after completion: when a deep analysis question finishes, the resulting chat opens automatically in the task chat sidebar — no need to navigate manually; freshly created chats appear without a page refresh
  • Deep Analysis chats in history: Deep Analysis chats in the chat history sidebar display a purple bolt icon to distinguish them from user-started conversations; the "Deep Analysis: " title prefix is stripped so only the question title is shown
  • Faster start: deep analysis no longer waits for embedding or classification pipelines — questions begin processing immediately after OCR completes

Financial Statement Review

  • AI math correction: the FSR pipeline now includes automatic math validation correction — for each detected table, the AI identifies total rows and columns, determines the correct operand set and sign assignments (add vs. subtract), and commits corrections only when the result achieves zero discrepancies; partial improvements are never applied; discovery mode also establishes operand formulas for totals that were detected by OCR but had no formula yet, improving validation coverage after the first AI run without requiring a separate follow-up pass

Workpaper

  • Table row extraction completeness: the AI extraction safety net now catches leading-row omissions in financial statement tables (e.g., combined net assets or partners' capital statements with no parent header row); both leading-row gaps and zero-row returns trigger a correction re-prompt, ensuring all values appear in the workpaper grid
  • Reviewed cells stay highlighted during Run All: accepted (green) and rejected (red) cells no longer flicker white or yellow mid-run when bulk automation is triggered — their visual state is maintained throughout the entire run; as an added safeguard, reviewed cells are now skipped even if the protected flag is absent

Engagement Board

  • Collapsible document search results: document search results are now organized as collapsible groups — task → datasource → file → matching pages; each level is independently collapsible; tasks that matched only on title or description appear at the top labeled "Metadata match" with no document evidence shown; clicking a task header navigates to the task overview; clicking a file result opens it at the matching page

Co-Audit Agent

  • Column scope for run_automation: the AI can now re-run a single attribute column across all rows in a datasource — the right action after updating a column's prompt and wanting every row recomputed without triggering a full workpaper re-run

Clients

  • Filter banner: when active filters hide one or more items from the client list, a banner appears showing the hidden count with a Clear Filters button to reset all active filters at once

Unmatched Row & Lock/Unlock Matches

New unmatched-files summary row in the workpaper grid and a bulk lock/unlock action for confirmed matches.

New Features

  • Unmatched aggregate row: Match-agent datasources now display a pinned Unmatched row at the bottom of the workpaper grid whenever files remain unmatched. Each datasource column shows an amber chip with the unmatched file count — clicking it opens the cell detail panel filtered to those files. Once all files are matched, the chip turns green. Sample datasource columns are visually subdued so the row reads as a single status band rather than live data.

  • Lock / Unlock Matches: A new Lock Matches button in the unmatched-files panel lets auditors bulk-protect every confirmed match in a datasource with a single click. When all matches are already protected, the button switches to Unlock Matches. The button is hidden while unmatched files remain — a Re-run Match button is shown instead.

Improvements

  • Accounting Policy entries previously labeled Rich Text are now labeled Custom.

Client Upload Inheritance & Co-Audit Agent Pagination

Document groups on client-visible tasks auto-enroll for client uploads; Co-Audit Agent now pages through large datasources.

New

  • Automatic client-upload enrollment: document group datasources added to a task that is already client-visible are now automatically set up for client uploads at creation time — no need to manually toggle "Provided by: Client" afterward.
  • Co-Audit Agent row pagination: the agent can now page through large datasource tables (default 20 rows per call, up to 100 per request with offset support) and filter by specific columns — reducing incomplete or truncated reads on wide or high-row-count tables.

Improvements

  • Unsupported file formats now download automatically: clicking a file in the file explorer that cannot be previewed triggers a browser download instead of failing silently.
  • Clear message for deleted files: if a file has been removed, the viewer now shows "This file is no longer available — it may have been deleted." instead of a generic error.

Fixes

  • Memo auto-saves are more resilient — edge cases that previously caused silent save failures are now handled correctly.
  • Resolving multiple comments at once is faster — previously sent one request per comment, now resolved in a single call.
  • Stale chat sessions are cleaned up correctly when a chat no longer exists in the list.

Template sharing, Roll Forward improvements, and engagement error pages

Share template previews via link, richer Roll Forward fidelity, and clearer access error pages.

New Features

  • Template share links: Copy a universal link to any task template directly from the template preview header. Recipients are taken to their own board with the Add modal already open to that template's focused preview — no searching required.
  • Template deep-link: Boards opened with a ?templateId URL (e.g. from a shared template link) jump straight to that template's focused preview; an error toast appears if the template is unavailable or inaccessible.

Improvements

  • Roll Forward now preserves more: rolling tasks into a new engagement carries over categories, memo fields (Purpose, Source, Scope, Procedures), and datasource column structure. Task status resets to To Do; conclusions are intentionally left blank. Engagement variables are cloned with their workpaper column links intact; re-running roll-forward removes any stale column links that were disconnected in the source since the last run.
  • Add task modal context: when opened from an engagement, the client and engagement are now pre-selected from the current URL even before the page context has fully loaded. Client and engagement dropdowns scroll when the list is long.
  • Task description editing: external changes to a task description (e.g. from AI chat) now apply in-place without reloading the editor — cursor position and focus are preserved mid-keystroke. Saving your own changes no longer briefly echoes back to the same tab.
  • Formula columns on Collective output: formula columns that reference a Collective retrieval column now reduce the multi-value result sensibly — numbers are summed, dates become a min–max range, booleans check that all values are truthy, and text values are deduplicated and joined.
  • Semantic search on Excel and CSV files: files without vector embeddings (Excel, CSV) now automatically fall back to trigram keyword search so they appear in semantic search results even before the embedding pipeline has run.
  • Sandbox reset reliability: resetting a sandbox engagement now performs an atomic swap — the new copy replaces the old one with the same short identifier preserved. If the clone fails, the original is left intact and the reset can be retried. The board auto-refreshes on completion.

Bug Fixes

  • Engagement access errors: navigating to an engagement you cannot access or that no longer exists now shows a descriptive error page instead of an infinite loading spinner. Auditors see guidance to ask an admin to add them; clients are told to contact their auditor. A Go to home button is shown in both cases.
  • Clients page access: non-auditor users are now correctly blocked from /clients routes at the middleware layer and redirected to home, rather than reaching an error state.

Memo Templates, Full-Screen Chat & Workflow Builder Retirement

Task templates now carry memo content, task chat gains a full-screen expand mode, and the workflow builder has been retired.

New Features

  • Memo fields in task templates: Templates now capture the task memo — Purpose, Source, Scope, and Procedures — when saved. When you create a task from a template, those fields are pre-filled automatically. The template browser also shows a read-only Memo preview before you select, so you know what setup content will be applied. Conclusion is intentionally excluded (it's per-audit sign-off content, not template material).
  • Full-screen task chat: A new expand button in the task chat sidebar header widens the chat panel to fill the screen, giving more room for longer AI-assisted review sessions. Press ESC or click the collapse button to return to the normal layout.

Improvements

  • Workflow builder retired: The inline workflow builder has been removed from Co-Audit Chat. Workpapers are now created directly via task creation. Existing conversations that used workflow builder tools display an inline notice in place of the old tool cards.

Bug Fixes

  • Comment errors now visible: Comment submissions that failed silently (403 error) now show an error toast so you know the comment didn't go through.
  • Bulk-review cross-datasource cells: Fixed bulk-review and right-click review not correctly picking up cross-datasource and top-level cells.
  • Deep analysis progress indicator: The in-progress spinner now appears correctly when running a single-question deep analysis.
  • Duplicate task preserves Conclusion: Duplicating a task now correctly retains the Conclusion memo field on the copy.

Bulk Review, Deep Analysis, and PDF Export Improvements

Range selection now covers all row types with live counts, deep analysis spinners appear instantly, and PDF-to-Excel exports work in follow-up messages.

Workpaper

  • Bulk accept/reject now covers all row types: Validate, Flag, and Clear operations in the range selection panel now apply to consolidated cells (cross-datasource inline rows) and top-level non-group rows — these were previously silently excluded. The accepted/rejected/pending counts in the range panel also update in real-time as review states change from any surface (right-click menu, live sync), without requiring you to re-select the range.
  • Deep analysis spinner appears immediately: Starting a deep analysis run — whether a single question or a bulk run — now shows the progress spinner right away in the toast notification, instead of briefly displaying an empty circle before the run is registered server-side.
  • Crash fixes in the workpaper editor: Two stability issues were resolved: one that could crash the workpaper when collapsing the chat panel via ESC in certain edge cases, and one triggered by mention transforms in the text editor.

Chat

  • PDF-to-Excel exports work in follow-up messages: You can now ask the AI to export a PDF to Excel in a follow-up message, even after the original attachment has scrolled out of the latest turn. Previously the export tool was only available in the same message where the file was attached, making common workflows like "now export that to Excel" fail unexpectedly.
  • Reorganized task chat sidebar header: Navigation controls (back to board, chat history) and action controls (new chat, expand/collapse, more options) are now split into distinct groups in the task chat header, improving discoverability and reducing visual clutter.

Formulas

  • More reliable collective formula reductions: Formulas that aggregate multiple AI-retrieved values now handle mixed types correctly — numeric comparisons, boolean logic, and currency symbols (including $ prefixes) are preserved across collective reductions in AI retrieval formula paths.

Workpaper Grid Redesign, Match File Pills & Memo Enhancements

Cleaner row display in the workpaper grid, visual file pills on match columns, expanded memo editing, and smarter automation scoping.

Workpaper Grid

  • Simplified row layout: single-child lineage paths now collapse inline — when a parent record has exactly one matched child, that child's values appear directly on the parent row, eliminating redundant rows. Multi-child fan-out continues to show individual child rows.
  • Always-expanded rows: parent rows are no longer collapsible. Child rows appear automatically when there is genuine fan-out (2 or more children in the same datasource), removing the need to manually expand rows to see data.
  • File pills on match columns: MATCH and MATCH_AGENT columns now display matched files as styled pills with a file-type icon and truncated filename. Hover to see the full name. Unmatched records show a red ✗. Contra-evidence count appears as a red badge on the pill corner.

Memo

  • Editable memo fields: Purpose, Source, Scope, Procedures, and Conclusion are now editable directly on the memo page and persist on save.
  • Editable testing attribute descriptions: testing attribute descriptions on the memo page can be edited inline, with hover controls to delete or link entries.
  • Memo included in exports: memo fields now flow through the engagement-level export.

Automation

  • Unassigned files excluded from Run All: records in match-result datasources with no parent assignment (files the match agent could not link upstream) are excluded from Run All automation passes. These records have no lineage context and previously produced unreliable downstream results.
  • Lineage scoping tightened: downstream MATCH datasources with no parent records in the selected lineage scope are now fully skipped, preventing unintended record recreation during lineage runs.

Cell Detail Panel

  • Inline citation pills: citation references in AI reasoning are now rendered as interactive pills rather than raw tags, including bare [N] tags the model occasionally produces.
  • Match actions: the panel now wraps match cells in an Answer section with Re-run and Unlock actions directly accessible.
  • Inline editing commits on blur: editors in the cell detail panel now save automatically on blur — no explicit save/cancel step required.

Bug Fixes

  • Activity feed client visibility: auditor-only TEXT fields are no longer shown to clients in the activity feed or email notifications.
  • Memo field updates: fixed an issue where memo field updates and their activity log entries were silently failing.
  • Sidebar width: fixed a crash caused by invalid persisted sidebar width values.

Post-run automation summaries in chat, smarter engagement lookup, and match deduplication

Chat now auto-summarizes automation results with ranked fix proposals; engagement search by name/short ID; workpaper match deduplication and source markers.

AI & Chat

  • Post-run automation summary: After triggering a workpaper automation from chat, the AI now automatically follows up with a ranked summary of proposed fix groups — most impactful changes first, with representative before/after examples — and asks for your authorization to apply them. If the run failed, it explains what went wrong. This summary appears immediately after the run and persists on subsequent chat revisits.
  • Engagement search when creating tasks: When asking the AI to create a task from chat, you can now refer to an engagement by name, client, or short ID (e.g. "QA agentive") and the AI will filter to the right match. If nothing matches, you'll get a helpful suggestion rather than an error.

Workpaper

  • Match source markers: Cells in match agent columns now display a small superscript on the passing icon showing how each protected record was sourced — for client-assigned records, for manually protected or matched records, and no suffix for agent-auto-matched records. These markers are preserved when exporting to Excel.
  • Lasso deduplication: Manually lassoing a PDF region for a record that already exists (same file, same parent) now updates and promotes that row in place rather than inserting a duplicate row.
  • Manual match acceptance deduplication: Manually accepting a file or record match in a match-agent datasource now promotes any existing agent-created rows for the same file/parent combination rather than creating duplicates — ensuring your manual acceptance survives the next agent cleanup pass.

Co-Audit Chat: in-chat navigation, task creation, and acceptance criteria tools

The AI assistant can now navigate you around the platform, create tasks from chat, and manage acceptance criteria — without leaving the conversation.

Features

  • Co-Audit Chat — The AI assistant has been renamed from "Copilot" to Co-Audit Agent across the platform, reflecting its deeper integration into the audit workflow.
  • In-chat navigation — Ask the Co-Audit Agent to take you anywhere on the platform and it will present a confirmation card ("Navigate to [page]?") before moving you there. Your chat history carries forward when navigating to pages with a chat area (workpaper, overview, request table, task chat), so you never lose context mid-conversation.
  • Task search and discovery from chat — The Co-Audit Agent can now search for tasks by name, description, or short identifier across all your engagements, and list all engagements you have access to — directly from the chat input.
  • Create tasks from chat — Ask the agent to create a new task and it will do so without leaving the conversation. You can create blank tasks or instantiate from a firm template (pre-configured with datasources, columns, and automations). A "Task created" card appears with Go to task / Stay here options, and your current chat carries forward to the new task.
  • Acceptance criteria tools in workpaper chat — The Co-Audit Agent can now list, create, edit, delete, and run acceptance criteria on a workpaper datasource directly from the task chat. Deletion requires explicit user approval. The agent will not proactively create acceptance criteria — it only acts when you ask.

Improvements

  • File search is more powerfulsearchFilePages now supports regex patterns, page ranges, case-sensitive mode, and word/line-based context extraction. It also auto-detects total page count to prevent out-of-range searches, skips pages that error rather than treating them as matches, and returns a clean error immediately for inaccessible files.
  • Deep analysis survives page refreshes — Run status (running / completed / error) is now persisted server-side. If you refresh the workpaper while a deep analysis is in progress, the spinner is restored immediately and the run continues uninterrupted.
  • Deep analysis progress card stays in sync on reconnect — If your WebSocket reconnects mid-run, the deep analysis progress card is updated in place rather than being dropped or duplicated.

More reliable PDF-to-Excel conversion and OCR processing

Large PDF files convert to Excel more reliably, and OCR retries no longer leave files in a broken state.

Improvements

  • PDF to Excel on large documents: The extraction pipeline that cleans and fills converted tables now processes pages in batches. Large PDFs that previously failed mid-conversion due to size limits will complete successfully. Pages that are exceptionally large are escalated to a higher-capacity model; pages that still exceed limits are skipped gracefully rather than aborting the entire conversion.

Bug Fixes

  • OCR retry reliability: If an OCR job had to retry after partially completing, subsequent attempts could fail with a conflict error — leaving the file stuck in a failed state. Retries now cleanly replace any partial results, so files recover correctly without manual intervention.

OCR Indexing & Table Extraction Fixes

Improved OCR document content indexing and restored reliable table extraction.

Fixes

  • Table data extraction has been restored to consistent, accurate performance — auditors working with complex tables in uploaded documents will see reliable extraction results again.
  • OCR document indexing has been improved to ensure page content within uploaded files is fully indexed, reducing gaps where content could be missed during AI-assisted review and search.

Multi-turn chat citations, Calculate-First foot/crossfoot, OCR durability, and more

Citation continuity across chat turns, copy controls on AI tables, session-persistent board filters, Calculate-First validation mode, durable OCR processing, and live Excel formula exports.

Copilot Chat

  • Citation continuity across conversation turns: when the AI cites document evidence with numbered references like [1] or [2], those source links are now carried forward into follow-up exchanges — the AI can correctly refer back to previously cited content in multi-turn conversations without losing context
  • Copy and download controls on AI tables: markdown tables in AI responses now include a toolbar to copy or download tabular data directly, eliminating the need for manual selection
  • Built-in product coaching: ask the copilot where to find any platform feature and it will describe what it does and guide you to the right page — the full platform layout is now part of its context in every chat mode

Engagement Board

  • Filters persist across engagement switches: search queries and active filter selections now carry over when switching between engagements in the same browser session; assignee and category filters are automatically reconciled against the new engagement's valid values, with unrecognized values quietly dropped

Review

  • Calculate-First mode for foot/crossfoot validation: draw all operands on the PDF first, then apply the result to a cell — an alternative to the standard flow; footer action buttons (Save, Reset, Apply Valid/Exception) stay pinned and accessible while scrolling the calculator panel
  • Assignment focus mode: when the system cannot automatically link a drawn operand to its row and column in the table, the calculator collapses and a focused card guides you step-by-step to draw the row and column headers in the PDF to complete the link; the calculator re-expands once the link is resolved

Task Overview

  • Task properties update live from AI chat: status, priority, due date, assignee, and category now reflect changes made via AI chat in real time — no page refresh needed
  • Description stays current without refresh: the task description editor automatically remounts when AI chat updates the content externally, so edits appear immediately

Workpaper

  • OCR is resilient to server interruptions: OCR processing now runs as a durable background job — if the server restarts mid-upload, the job is automatically picked up and completed on another node; duplicate OCR requests for the same file within 5 minutes are deduplicated; files no longer get stuck in a failed state due to transient server issues
  • Formula cells export as live Excel formulas: cells whose value starts with = are written as real Excel formulas in all .xlsx exports — values calculate automatically when the file opens; number formatting (currency, date, number) is applied based on the column's data type
  • Testing attribute columns are visually distinct: columns used for testing procedures now display with a blue header background and bold centered label, always appearing as the rightmost columns within their datasource group for quick identification
  • Automation output reliability improved: AI-generated text in match and testing attribute automations is sanitized before saving, preventing rare write failures caused by edge-case characters in LLM outputs