WorkpaperOS Audit: Governed Evidence Sync

Governed OneDrive/Google Drive evidence sync for audit teams, with a strict Engagement Files boundary and Codex MCP tools for finding, organizing, and linking support safely.

Comment

Inspiration

Audit teams work across WorkpaperOS, OneDrive, Google Drive, email, and local working folders. The challenge is to synchronize the right evidence without accidentally sweeping private working files into the audit record, losing folder context, or overwriting changes.

WorkpaperOS Audit already had an engagement workspace and an early cloud-sync foundation. During OpenAI Build Week, we meaningfully extended it into a governed, production-ready evidence workflow.

What we built

WorkpaperOS Audit now provides a controlled Engagement Files synchronization boundary for OneDrive and Google Drive.

Only the configured Engagement Files folder and its descendants synchronize. The surrounding engagement folder remains a flexible working area and is never automatically adopted or moved.

The system supports:

  • Recursive folder and file synchronization
  • Stable-identity rename and move reconciliation
  • Trash, restore, and permanent-delete workflows
  • Exact-content checkpoints
  • Conflict protection that avoids silently overwriting either side
  • Preserved PBC request folders and evidence relationships
  • Codex MCP tools for finding, organizing, mapping, and linking synchronized audit evidence
  • OAuth reconnect handling for the Codex MCP connection

How we built it

The primary implementation was built in Codex using GPT-5.6 during the Build Week submission period. The main Codex task was the “Drive Sync” session.

Codex helped analyze the existing synchronization model, implement the provider-neutral lifecycle engine, add Google Drive and OneDrive behavior, create regression tests, review edge cases, and prepare the production deployment. GPT-5.6 was used for the architecture, implementation, debugging, and verification decisions.

The final implementation passed focused cloud-sync and MCP tests, type checking, linting, and a production build. It is deployed at https://audit.workpaperos.com.

Impact

Auditors can keep ordinary working files in the engagement folder while deliberately moving or copying finished evidence into the governed synchronization boundary. This reduces duplicate uploads, protects working files, preserves evidence organization, and gives Codex a reliable, scoped way to work with audit support.

What makes it different

This is not just generic file synchronization. The workflow is designed around audit evidence boundaries, PBC requests, folder provenance, conflict safety, and MCP actions that are constrained to the same governed subtree as the human workflow.

Built With

Share this project:

Updates