A document-to-form autofill tool for the people who re-key statements all day. It never guesses. It never submits. It never leaves the machine.
Agents read values off a statement and type them into a browser form, all day. People make typos. And a typo in an account number doesn't stop at the form — it travels.
Fourteen values to move into the stop-&-reissue form. By hand.
Keyboard slip. The form accepts it — the format looks fine.
The wrong number has been copied into places the agent has never seen.
Hours of unwinding, calls, corrections. All from one keystroke.
This is the real flow, re-enacted: a synthetic Statement of Distribution on the left, the destination form on the right. Values only move when Trove can prove them.
The refusal is the feature. A blank field with a reason is safe; a confidently wrong account number is the thing that starts the ripple. Trove abstains out loud.
The stage above is how it thinks. Below is the thing itself: the Windows app, one Ctrl + Shift + V, filling three different forms it was never taught. Every value verified by read-back — and the full SSN held for you, never auto-filled.
A value is offered only when Trove can defend it — exact source text, or a checksum-grade validator vouching for a scan. Doubt renders as a blank field and a stated reason.
Trove fills; the human checks and sends. Review before anything is written, every write verified by readback, and no code path that touches a submit button. Ever.
No cloud, no account, no telemetry, no AI model at all. Extraction, matching, learning and filling happen on the agent's PC. Grep the source for HttpClient: zero hits.
A CUSIP carries its own check digit — misread one character and the math breaks. Almost. At odd positions, the checksum is blind to a 5↔S swap: the doubled digit-sums differ by exactly ten. And 5↔S is one of the most common OCR confusions there is.
A misread security number could pass validation and reach a form. So Trove adopted a rule instead of a patch: if a plausible misread also yields a valid CUSIP, the check digit proves nothing — refuse it. The test suite pins it with real published CUSIPs.
One gesture — copy — carries three payloads. Each tier declares how much it can be trusted, and the validators hold every value to the same bar before it may touch a form. Forms are read through Windows UI Automation: no browser extension, and hostile legacy pages with zero labels resolve by geometry.
Select-all, copy. The text is exact — no recognition step, nothing to misread. Most of an agent's day lives here.
Copy the file in Explorer. Born-digital PDFs carry their text precisely; a PDF without a text layer is refused to the scan tier.
On-device Windows OCR. Only checksum-vouched fields auto-fill — a valid unambiguous CUSIP, amounts that reconcile to the cent. Everything else is an amber best-guess the agent confirms.
Every number below is reproducible from the repository — a synthetic corpus with per-field ground truth, an echo server that records what a form actually posted, and a deliberately corrupted document slice that the refusal machinery must catch.
Reproduce it: dotnet run --project tools/Score · dotnet run --project tools/Smoke -- "…" stmt-0002 --submit
Development questions answered from the repository itself — every answer carries the file and line that make it true. Press a question.
Prefer it flat?
