Your ERP, your databases, your SaaS — behind one governed query layer.

Both bridges answered. I compared 1,284 JobBoss job records against the matching NetSuite sales orders for the last 90 days, keyed on custbody_jobno.

23 records do not agree. They fall into three groups:

The three worst by value:

• JOB-40912 — JobBoss 240 ea, NetSuite 200 ea — $18,400 unbilled
• JOB-41077 — closed 2026-08-04, never reached NetSuite — $11,950
• JOB-40688 — unit price $84.00 against $79.50 — $4,050

Nothing was written to either system — this was a read. Total exposure across the 23 is $61,318.

Done. jobboss-netsuite-reconcile is saved, tested and scheduled. On each run it:

1. Pulls open and closed jobs from JobBoss for a rolling 7-day window
2. Pulls the matching NetSuite sales orders in one pushdown query — the filter runs inside NetSuite, not over the whole table in memory
3. Matches on custbody_jobno, then compares quantity, price and status
4. Writes every exception to the recon_exceptions workspace table under a stable hash, so a repeat offender does not create a second row
5. Auto-corrects only the safe class — quantity drift inside the 2% tolerance in the pipeline config. Everything else is flagged and left alone.

Dry run over the last 90 days: 23 exceptions found, 6 auto-corrected, 17 held for review, 4.1s.

It runs nightly at 02:00 America/New_York under a dedicated execution role that can read JobBoss and write only the two NetSuite fields it needs. Every save is a commit in your tenant's git history, so you can diff it or roll it back.

recon-alerts is live. The bot token went into Key Vault as telegram-bot-token — it is resolved server-side at run time, and it is never returned through the API or written to a log.

It fires on three conditions rather than on every run:

• The reconcile pipeline fails or times out
• Exceptions held for review pass 10 in one night
• Any single exception is worth more than $5,000

Test message delivered to Operations just now:

Nexus · nightly reconcile finished 02:00
17 exceptions held for review (limit 10)
Largest: JOB-40912 · $18,400 · quantity
Oldest unresolved: 6 days
→ Review in the reconciliation dashboard

Quiet hours are on: anything raised between 22:00 and 06:00 is queued and delivered at 06:00, unless it is an outright failure.

Built and published. It reads the same recon_exceptions table the pipeline writes, so there is no second copy of the truth to drift.

• Live counts — held, auto-corrected, failed, and the dollar value at risk
• The exception queue, with approve, reject and post-to-NetSuite on each row
• Run history, and the full log of any night that failed
• Sign-in is your Entra ID, and a person sees only the exceptions their role can act on

Approving an exception there calls the same governed write path the pipeline uses. It is audited under the approver's identity, not the pipeline's.

netsuite_post_journal_entry is registered and live on your MCP server. It takes a subsidiary, a period, a memo and balanced lines, checks that debits equal credits before it touches NetSuite, and returns the created internal id.

Access is a new role, Accounting — JE Post, holding exactly one permission: mcp_tool:invoke scoped to that single tool. It grants nothing else — no query access, no other tool, no admin.

I checked that rather than assuming it — the table is what uql_effective_permissions returned for each identity.

Every invocation is audited with the caller's identity, the arguments and the NetSuite response, and the tool refuses any entry that does not balance to zero.

Published. It is a form, not a console — she never sees UQL, the MCP tool, or NetSuite's field names.

• Lines validate as she types, and Post stays disabled until debits equal credits
• Accounts and subsidiaries load live from NetSuite, so she cannot pick one that no longer exists
• Posting calls the same MCP tool through the same single permission — the website did not get its own back door
• Her last entries are listed with the NetSuite internal id, so she can confirm without opening NetSuite

Anyone without Accounting — JE Post who opens that URL is refused at sign-in. There is no hidden button to find.

Pulled from all three connected systems — QuickBooks Online for the ledger, SQL Server for the operational pipeline, Stripe for recurring revenue — as of 31 July 2026, unaudited.

Three things an investor will ask about, so they are in the report rather than buried in a footnote:

• Cash fell while revenue rose — $1.1M of that is inventory build against the Q4 order book, not burn
• The margin gain is mix, not price: the service line grew three times faster than hardware
• Two customers are 21% of revenue; the concentration table is on page 4

Every figure traces to its source — each number carries the query that produced it, the system it came from, and the timestamp it was read.

Scheduled. On the first business day after each quarter closes it rebuilds from live data, renders to PDF, and emails the board list with the quarter in the subject.

• It will not send on stale data — a QuickBooks sync older than 24 hours holds the run and notifies you instead of shipping a wrong number
• Each edition is committed to your tenant's git history, so Q3's report stays exactly as the board saw it even after the underlying data moves
• The board list gets the PDF; nobody outside the finance role can open the live report

Next run: 1 October 2026, 07:00. The dry run rendered in 6.2s.