Inspiration
Procurement reconciliation is manual drudgery: orders live in one system, invoices in spreadsheets, payment status in a supplier portal. Exceptions surface late, and when they do, nobody can say whose number is wrong. I wanted an auditor that doesn't just flag problems, but proves them.
What it does
Ghost Auditor takes order and invoice files (CSV/XLSX), optionally captures a supplier portal through the browser, and runs a deterministic matching engine: quantity checks, price checks, missing-invoice detection, and duplicate-payment detection. Every exception carries an evidence chain — the exact order line, invoice line, and portal value behind it — assembled into a dossier you can export as Markdown. A ghost persona narrates the worst finding in one sentence.
How we built it
FastAPI backend with SQLite run storage, a pandas matching pipeline with money as integer cents (no float arithmetic ever touches an amount), Playwright for portal capture, and a single-page dark frontend. The matching rules are deterministic: no model ever guesses an amount.
How we used Kiro
The project was built spec-first. Requirements, design, and task specs in .kiro/specs guided implementation; steering docs lock in the product rules — deterministic matching first, every exception must cite evidence, synthetic demo data only; hooks automate matching-engine checks on save and evidence verification before commit. The four-agent crew (capture, normalize, match, explain) maps directly to code modules, and the /.kiro directory sits at the repo root, visible to judges.
Challenges we ran into
The sandbox VM couldn't install a Playwright browser (CDN download failure), so portal capture was built with a verified fallback: when no browser is available, the audit proceeds on file data and marks portal evidence as not captured. Keeping money exact also meant banning floats entirely — all amounts are integer cents via Decimal.
What we learned
Deterministic rules beat clever guesses for audit work — an auditor that invents a number is worse than useless. And one core flow, demonstrated end to end, beats a pile of half-working features.
What's next
Live portal capture on a machine with a browser, a hosted demo deployment, and voice narration for the ghost — deliberately kept as stretch, not built.
Log in or sign up for Devpost to join the conversation.