Two Hands
How it works

The model reads, the paper decides

Every part of Two Hands, in order, each linked to where it runs.

  1. Photo
  2. Mask
  3. Gemma on AMD
  4. Gate
  5. Accepted
  6. Person
  7. Receipt

  1. Locate and mask

    The page is straightened onto its layout and the names-and-signatures column is blacked out before anything is stored or sent to a model.

    See a masked sheet

  2. Read on AMD

    One request to Gemma-4-31B-IT on AMD returns every field twice, from the digit boxes and from the words, plus each row's printed label.

    See a read sheet

  3. The gate

    Code, not the model, decides: row labels in place, words = digits, the 17 vote rows sum to TOTAL, and the sheet's sections agree.

    See every check on that sheet

  4. A second reader, optional

    In two-reader mode Qwen3.8-27B, also on AMD, must agree field by field; it can only withhold acceptance, never override.

    See the measured tiers

  5. Accepted or routed

    Every check passes: accepted, nothing to key. Any check fails: the form goes to a person with the failing field named.

    See one of each, end to end

  6. A person settles it

    On the review desk a person types the value from the crop of the photo, and the identities re-check at once.

    See a routed form

  7. A receipt for every disputed field

    Each field is a Merkle leaf with its crop's hash; the report's root is anchored in Bitcoin with OpenTimestamps, so anyone can verify one field alone.

    Verify a receipt

  8. Audit at scale

    An auditor uploads keyed data and scans; disputes come back strongest evidence first, with crops, a CSV and a printable report.

    Open the sample audit

  9. Cases on Evolus

    Each strong finding opens a case: the Intake clerk on Gemma drafts it, and a script, not the model, scores the evidence.

    See the Evolus runs

  10. Web app, API, CLI, MCP

    The same core behind the web app, a JSON API, a command-line tool and an MCP server.

    See the API

  11. Any form that adds up

    A form type is one schema file: fields, mask, tiles and identities. The check is the form's own arithmetic, so it isn't tied to elections. Proven on two form types: Mexico's tally sheets and UK rainfall ledgers (1850-1960), no retraining. Next: tally sheets in at least 7 more countries that publish their images, and the monthly health-facility reports behind DHIS2, used in 70+ countries.

    Also fits: pharmacy and stock registers, timesheets.

    See any form