P.00 Product
One workspace for the part of remediation that nobody's system of record covers.
The NFR Database holds the plan and eMASS holds the POA&M. Tracepoint is where the evidence behind a closure is assembled, attested, and packaged before it goes there.
P.01 In and out
Fifteen doors in. Eleven artifacts out. One workspace between them.
P.02 What comes in
The formats organizations actually have, read with their structure intact.
The first screen asks what you received and offers three doors: Bring in files, Practice with a small example, or Practice with the full example. Nothing is created from any of them until a person confirms the preview.
CSV, Excel workbooks read directly with the worksheet name, Word documents containing a findings table, the ODCFO CAP tracker, and the eMASS POA&M export, which both round-trip. More than fifty fields are recognised, among them identifier, title, condition, criteria, cause, effect, auditor recommendation, management response, corrective action, component, fiscal years, classification, status, issuing auditor, report number, and issued date.
.nessus from ACAS, STIG checklists in .ckl and .cklb, and XCCDF results in .xml including an ARF wrapper. A rescan sorts into four buckets: new, unchanged, reappeared, absent. Absent proposes a closure and never performs one.
GCSS-Army property books, count files, DD Form 577 appointment registers, DA Form 2062 hand receipts, demand history, purchase logs, the auditor's sample selection, component listings, and shortage annexes, each through its own door, for the quarterly floor-to-book sample under AR 710-4. Property is an evidence layer inside the same product rather than a counting application.
Every file is read by its byte signature before its name: a workbook named .csv is read as a workbook, and Office binaries, PDFs, archives, and other non-text files are refused with the reason. A bad row is refused, never the whole file, and every refused row is listed with a CSV download and recorded on the trail.
A financial population file, such as an FBWT transaction listing in xlsx or csv, comes in with a support walk and leaves as a population-support package. A PBC request list becomes requests with a response walk and leaves as a PBC response package.
The complete workspace in open, documented JSON. The product's own Full Export Package re-imports and restores a workspace, checked against its TraceSeal manifest. Named checkpoints in the browser's own storage, and a blocking checkpoint before every one of the twelve irreversible actions.
P.03 What happens to it
Four mechanisms, each one leaving a row on the trail.
Deterministic control linking
A rule-based linker proposes the control a finding implicates from reference packs derived from the FMR, FISCAM, and A-123 material. It is a lexicon rather than a model. It proposes, a named person confirms, and the confirmation is the record. The same file produces the same proposals every time.
A role-guarded corrective action lifecycle
Root cause, plan, milestones, evidence, review, closure, sustainment, reject, reopen. Six roles, each with a defined set of permitted actions. An action a role is not permitted to take is refused with the reason stated. A sustainment cycle whose reviewer is its own preparer is rejected outright.
Challenges, sustainment tests, risk acceptances, repeat findings
A closed finding has to stay closed. Sustainment cycles test that the fix held. Risk acceptances carry an expiry and lapse visibly. Repeat findings are counted, because a reduction in repeats is the measure the Department is being taught to ask for.
Balances tied to their support
A five-rung ladder from source records to the reported total. A difference that is not explained is displayed as unexplained. Nothing is ever forced to zero to make a screen look finished, and the Explain it button opens the form that records a reconciling item under your name and writes it to the trail.
P.04 What goes out
Every export is a file on the user's machine.
There is no transmission. Exports are checked against the government's own formats before they are allowed to save.
| Export | Format | What it is for |
|---|---|---|
| Full Export Package | ZIP | Records, embedded evidence bytes, reports, the activity history with import provenance, the TraceSeal manifest, every interoperability file, the schema, and the stated limitations. The same workspace produces the same package on the same day on a device in the same time zone. |
| Reviewer Package | Single HTML file | An inert, self-contained artifact a reviewer opens with nothing installed and no account |
| OSCAL POA&M | JSON | The NIST open standard, validated against the schema before it saves |
| eMASS POA&M | CSV, 21 columns | The eMASS RMF POA&M import template, in template order with exact header text; columns that must not be derived are left empty and disclosed |
| ODCFO corrective action plan | CSV | Corrective action reporting layout |
| Closure Package | HTML, per corrective action | The evidence behind one closure, in one file |
| Submission print package | HTML | The human-readable submission, with its limitations on its face |
| Outcome Ledger | File | Every outcome the workspace recorded, in order |
| Business case | File | The case for the deployment, with published comparables |
| Canonical workspace | JSON | The complete workspace in open, documented form |
A staleness indicator shows when a package no longer matches the workspace it came from. It discloses and never blocks. Changes since last export are listed by record.
P.05 The trail
The trail underneath all of it.
Every guarded action appends a row with the person, the role, the statement they made, and the time on their clock. Rows are never edited. Evidence is hashed with SHA-256 the moment it arrives. The TraceSeal manifest fixes the records, the trail in order, and the evidence digests under one root digest, and prints the canonicalization rules so anyone can recompute it.
The words are exact on purpose. The product says attested rather than signed, and append-only rather than immutable. The seal is a fixed point rather than an authentication: it shows whether bytes changed, and it cannot show who wrote them or when. Making it evidence of authorship means signing the manifest with the agency's own PKI, outside this application, and the manifest says so on its face.
P.06 What sets it apart
It discloses, and it never decides.
Five behaviours that hold across every screen and every package.
When a file cannot be read, a count cannot be recorded, or a difference is unexplained, the product says exactly why and where the item belongs. Nothing is blocked silently and nothing is quietly adjusted.
A balance is reconciled step by step toward the reported amount, and the record states what tied, what did not, and what remains unexplained, with the evidence for each step.
The ODCFO CAP tracker, the eMASS POA&M, scanner files in .nessus, .ckl, .cklb, and .xml, GCSS-Army property books, DD Form 577 appointment registers, and DA Form 2062 hand receipts import as they arrive. An ODCFO tracker exported and re-imported reports zero differences, and a scan re-imported reconciles as unchanged.
AR 710-4's bars on who may count, who may sample, and consecutive-period inventories are enforced when the workspace knows the people involved, and disclosed on the trail when it does not. Sensitive lines past their inventory cadence, monthly for weapons under 16-24b and quarterly for other sensitive items under 16-23a, are raised as observations, and the cadence can be set in the property policy.
The same workspace produces the same package on the same day on a device in the same time zone, and the Deliver page says so on its face. 2,213 automated checks run before every commit, and the date handling is exercised in four time zones.
P.07 Requirements
What a workstation needs.
A current browser
That is the entire requirement, on Windows, macOS, or Linux. No installer, no runtime, no service, no database, and no administrator rights. It does not run on a machine with no browser.
A place for the workspace file
With the organization's normal backup and access controls. Evidence bytes travel inside the workspace file, so the file is the record.
Your own software approval
Tracepoint runs under your organization's own software approval. It is client-side files with no server, no listening port, and no external connection, which makes the assessment small, and the published integrity manifest makes it precise.
P.08 Next step
Every behaviour on this page can be exercised in the demo.
Load the worked example, take a finding through to closure, and read the package it produces.