Alerts that reach someone, and 428 obligations

Until Wednesday 7 October, rework, cost drift and disputes were measured on every protected job every hour. Each result was written to the register and shown on the Alerts tab. None of them was sent to anyone, because nothing created the subscription that turns a result into an alert. The only thing that did was an alert template, and all five starter templates pointed at lapsed compliance. Three diseases could watch a job and never say so.

Every organisation now gets all five, and an organisation cannot switch a disease off. Alert templates are gone, with their gallery and composer. How urgent an alert is comes from the result itself: days to expiry, or dollars at risk.

The email goes to the person the request asks: the holder named for that role on that job under Who signs off. If an organisation has typed a list of addresses for a disease, that list is the whole email audience. A job with nobody named still raises its requests in the app, to the organisation's admins and its champion, and emails nobody. So the fastest way to get the right person emailed is to name them.

Before

Poured before the test. Now it comes out.

With Demiton

Held at the hold point. Poured once.

---

A page for every protected job

A protected job's name on the Project board now opens the job's own page, not its record in Memory. From top to bottom:

• Needs attention. Every open finding on the job, with its amount and currency where the record holds one, and who holds it.
• The next deadline, and whether the job is past its date for completion if nothing extends it.
• The five diseases on this job. Each card says how many obligations it watches, how many need attention, and how many cannot be checked yet. A card opens that disease on that job: its four protection types, the obligations switched on as each with their live results, and who is told.
• The contract, as read. Every term Demiton took from the contract documents: the date for completion, liquidated damages, the notice windows, payment, security, retention, the contract form and the currency.
• Who signs off on this job, and what was caught on it.

When documents disagree, the checks take the strictest reading. A job's documents often say different things. If the letter of acceptance gives 14 days for an extension of time notice and a later variation gives 10, the page shows both, and every check counts 10 until someone confirms which is right. Only a person on that job's sign-off ladder can confirm a term, and once they do, every check uses it. A term no document gave reads Not read, never a guess.

Two changes to how a contract is read came with it:

• The contract sum is stored excluding GST. A letter of acceptance that states its sum inclusive of GST used to be stored as written, so the job counted 10% more against the plan's cover than it should. The reader now subtracts the GST the document states. If it states none, it divides out 10% on an Australian job or 15% on a New Zealand one. If it cannot tell the country, it stores no sum.
• The currency is recorded from the contract, and the job page formats every amount in it. A contract that names no currency shows its sum with "currency not recorded".

The reader also now names a Transport for NSW C41 Minor Works contract as its own form, instead of reading it as GC21 and showing GC21's windows.

Before

Seen at the final account. Too late.

With Demiton

Flagged at $50K. Fixed mid-job.

428 obligations, and five countries

The SWMS duties. 32 obligations from the WHS and OHS Regulations of Queensland, New South Wales, Victoria, South Australia and the ACT, read from each one's text, from Queensland's to New South Wales' 2025 Regulation: make sure a safe work method statement is prepared before high risk construction work starts, give the principal contractor a copy, keep it until the work is done, and review it when the controls change. Missing any of them is an offence. The other three are next.

Four new places, added as a test. Ireland's Construction Contracts Act 2013 and its construction safety regulations. England's CDM 2015, the Construction Act and the Scheme for Construction Contracts. Ontario's Construction Act, its prompt payment and adjudication regime, and OHSA with its construction regulation. South Africa's cidb Act and Construction Regulations 2014.

We added them before anyone asked, to find out how well Demiton's code handles many jurisdictions at once. A product built in one country hides its assumptions about that country until a second one arrives, and it is cheaper to find them with four than to trip over them one customer at a time.

What held. All 144 obligations went into the same public library in the same shape as the Australian ones: the duty, its clause, its window, what missing it costs and which disease it feeds. Ontario needed one new place code. The standards pages and the guides below read them as they read Australia.

What did not, yet. The engine refused to measure in four places, which is why Demiton does not check jobs in these countries yet:

England is also filed under one place code for Great Britain, because the list has no separate code for England, which will matter when Scotland's rules differ. Each row in that table is a piece of work with a clear end, and Ireland goes first.

Which ones Demiton can check went the wrong way. Last week's update said the next step was fewer of the 93 obligations Demiton cannot check. On Australian and New Zealand jobs it is now 149 that can be checked on a project, 10 checked once across the organisation, and 125 that cannot be checked yet. The 32 new ones are all SWMS duties, and no register Demiton reads holds a safe work method statement. The Obligations tab names that reason on each one. The fix is a register for SWMS, or a request that asks the site to upload one.

Free guides, and a deadline calculator

demiton.io now has six guides, each read from the obligation library so every clause cited is the one Demiton checks against. They are linked from every page's footer under Guides:

• Security of Payment Act: what the Act is, payment claims, payment schedules, adjudication, retention, supporting statements, missed deadlines, and every state side by side.
• WHS Act and SWMS: when to notify the regulator of an incident, safe work method statements, high risk work licences, how long to keep records, and every state's Act side by side.
• Ireland, England, Ontario and South Africa: payment and site safety law for each.

The security of payment deadline calculator counts each Act's windows in business days, skipping that state's public holidays and its own Christmas exclusion. A payment claim served on Monday 14 December 2026:

The calculator's counting is the product's own, and agreed with it on all 53,136 cases we tried. It refuses dates it cannot settle: South Australia's Act also excludes declared shutdown days, which Demiton does not track, and Western Australia's dates across the Christmas edges.

The research behind the five diseases is published as one report: the 2026 record at research.demiton.io, each figure with its source, sample, grade and what it does not measure.

Fixes that matter

• A cleanup job could delete uploaded files. A weekly job removed workflow files older than 30 days that no workflow step referenced. It looked across the whole upload store, and uploaded contracts, intake files and protection evidence are never referenced by a workflow step, so an upload older than 30 days could be deleted. Since 9 October it looks only at workflow files and refuses to run without that boundary. If a file you uploaded before September is missing, tell us and we will check it against the record.
• Declined Assignar leave was pushed to payroll as taken. Assignar marks every leave request approved, declined and pending ones included, and the sync trusted that mark. It now reads approval from the request's status alone.
• A qualification expiry year before 2000 reads as unreadable, not as expired for centuries. A ticket typed as 0027 now asks for a date instead of raising an alarm.
• A site diary that answers its delays question now opens the delay's notice window. Diaries that asked "DELAYS?" as a question were being missed.
• A cost budget with no cost lines is read as a price-side budget, not as a budget of zero that every cost code overruns.
• Asking Demiton through Claude now returns the records, not only their citations, to every host that reads the structured answer, Claude Code included.

Security

A sign-up on 8 October named its organisation after a script tag. Nothing ran it: names are escaped everywhere they are shown. We used it to look again, and closed these:

• Account takeover routes. Your profile can no longer be used to change your email, password or active status, a sign-in consent screen can no longer grant scopes the app does not hold, and an organisation cannot take the platform's own name.
• Mail limits. Sign-in links are rate limited per network address and per recipient, and invites and test emails per organisation and per recipient.
• Connectors cannot point inside our network. A connector address on a private or loopback host is refused for every caller.
• A deactivated account sees one screen, "Your account has been disabled", on the web and in the app, from every route that refuses it.
• Tender descriptions are cleaned by an allowlist, not a pattern a crafted image tag could pass.
• app.demiton.io sends security headers and a content security policy, reporting for a week before it blocks. Both sites publish a security.txt.

Also this week

• On the phone. In the Android release sent to Google Play on 7 October, the Requests tab is now the Inbox, with alerts and weekly digests beside requests. Long-press the app icon for your top request, Send proof, Needs me and Ask Demiton. The camera for evidence works.
• The iPhone app is coming soon. Apple has approved Demiton's developer account. The first iPhone build is uploaded to Apple ahead of review. Last update said it was waiting on that enrolment; it is through.
• See the demo before you onboard. Anyone signing up can skip to the Bridgeworks demo organisation and get a job of their own there with a demo AS 4000 contract. Demo visitors no longer see each other's names. You can also type a contract's terms in instead of uploading it, and a connected project list now opens the contract step on its own.
• Book a 20 minute call from any page; it opens the booking calendar.

What's next

The iPhone app through Apple's review and into the App Store. Microsoft 365 Copilot's listing, which is in Microsoft's validation. A register for SWMS, so the 125 starts coming down.

We are also looking for people to open Demiton in Sydney and Melbourne. If that is you, tell us.

And still the one this series is waiting to report: a protection that fires on a live job, catches something real, and is signed off with cash recovered. Now that every disease reaches the person who answers for it, that is closer. When it happens, it goes here with the date.

If your state, contract form or country has an obligation the 428 do not, check /standards, then tell us.