docs(prd): anti-hallucination contract for agent writes

Operator requirement (2026-07-11): mechanical measures against
hallucinated values in agent-performed edits. Four deterministic
layers in agent-architecture: (1) no free-text critical fields —
code copies values from validated extraction/bank-feed payloads,
the model never re-types them; (2) provenance anchors per critical
field {source_sha256, raw_excerpt} re-verified by a deterministic
checker against re-extracted source text (locale-normalized);
(3) cross-system corroboration against FRESH bank pulls + arithmetic
/checksum invariants; (4) read-back closes the loop. A failed check
refuses, never repairs. Woven into hub goal, C1 strategy, and QA
write-path (seeded-wrong-value fixtures must FAIL). Proven live:
the books-regularization pack shipped with a standalone
verify-provenance checker — 36 field-level checks green against
source PDFs + fresh Qonto/Wise feeds before the human gate.

Co-Authored-By: Claude Fable 5 <[email protected]>

vibe/PRD/ai-back-office/README.md

@@ -30,7 +30,7 @@ A **single operator wearing three hats**, plus the fleet itself:
 **Goals**
 
 - **Enumerate every recurring admin/accounting task** with an explicit mode opératoire, guardrails, and a target autonomy level — the [task inventory](task-inventory.md) is the requirement backbone of this PRD.
-- **Atomic excellence**: each capability is one narrow, contract-bound atom (extract, validate, record, reconcile, report) that does its one job measurably well. Formats are guaranteed by **deterministic validators, not by model goodwill** — the LLM proposes, code disposes.
+- **Atomic excellence**: each capability is one narrow, contract-bound atom (extract, validate, record, reconcile, report) that does its one job measurably well. Formats are guaranteed by **deterministic validators, not by model goodwill**, and every written value is **provenance-anchored** — mechanically re-verified in its source document or bank feed before any gate ([anti-hallucination contract](agent-architecture.md#anti-hallucination-contract-for-agent-writes)). The LLM proposes, code disposes.
 - **The right model for each job** across four tiers — Claude (frontier reasoning), Mistral (EU cloud), local model on the M4 MacBook, SLM on the Raspberry Pi cluster — with graceful degradation when a tier is unavailable. See [model fleet](model-fleet.md).
 - **Human-gated writes as an invariant**: every ERP mutation is rehearsed on the sandbox and promoted through the existing ADR-0003 gate; approvals and digests flow through Telegram. See [agent architecture](agent-architecture.md).
 - **Ledger-grade compliance**: production is operated to the discipline expected of certified French accounting software — validated documents are immutable, corrections are new documents (avoirs), the FEC is producible on demand, and the piste d'audit fiable falls out of the architecture. The sandbox stays exempt *because* it is disposable. See [compliance](compliance.md).