Implementation brief

## Who Uses It
A compliance analyst investigating transaction alerts.

## What You Will Build
Build an agent that assembles transaction histories, entity records, and supplied alert rules into an investigation case. Show linked evidence, unresolved identity questions, and a draft analyst narrative.

## Inputs
- Transaction ledger
- Entity records
- Frozen fictional alert rules

## Workflow
1. Resolve entities using stable identifiers.
2. Build a transaction timeline and relationship graph.
3. Explain which supplied rules produced alerts.
4. Assemble an analyst case with evidence and unresolved questions.

## Interface
A case workspace with a transaction graph, evidence table, analyst notes, and a report export.

## Working Demo
Build an E1-to-E2 case showing total 110, link T1 and T2, and request analyst review without asserting criminal activity.

## Deliverables
- A working local application with the specified review interface.
- Source code, dependency lockfile, and setup commands.
- A recorded end-to-end demo using the supplied starter data.
- Example outputs, action logs, and automated tests.

## Starter Data
These fictional records are a small development fixture, not a production dataset. Implement the mock services described in the brief.

```json
{
  "entities": [
    {
      "id": "E1",
      "name": "Example A"
    },
    {
      "id": "E2",
      "name": "Example B"
    }
  ],
  "transactions": [
    {
      "id": "T1",
      "from": "E1",
      "to": "E2",
      "amount": 60,
      "day": "2026-09-01"
    },
    {
      "id": "T2",
      "from": "E1",
      "to": "E2",
      "amount": 50,
      "day": "2026-09-01"
    }
  ],
  "exercise_rule": {
    "daily_pair_total_review_threshold": 100,
    "implies_illegality": false
  }
}
```

## Constraints
Use fictional entities and rules. Do not file regulatory reports or make real sanctions determinations.
Choose an available model that supports your implementation. Record its identifier and version.

## Evaluation
Review the complete application, not only the starter-case answers.
- The aggregate is 110.
- The case links both transaction records.
- The narrative distinguishes an exercise alert from a finding of wrongdoing.
Add one normal case, one incomplete-input case, and one failure-recovery case.