Sheetshift

At carriers and managing general agents, the premium a policyholder pays is often computed by a spreadsheet: a rating workbook maintained by pricing analysts. Moving it into a policy system means re-coding it by hand and spot-checking a few quotes. Field audits have found errors in at least 86% of the spreadsheets they examined, and the dangerous errors are rare: in our workbook, a hard-coded tax and a missing credit cap each affect one policy in 10,000, so a 20-quote spot check misses each 99.8% of the time. When charged premiums drift from filed rates, regulators act: in May 2026 Washington fined an insurer $55,000 after it charged incorrect amounts on 585 policies. There is a solution. SheetShift is a governed modernization workflow, run inside IBM Bob 2.0, that turns a rating workbook into an owned, tested Python service and shows, cell by cell, where the two agree and why they differ. Who uses it, and how. A pricing engineer runs one Bob slash command per step. The pricing lead reads Bob's anomaly briefs and decides each one at a terminal. A reviewer opens the certificate and, on the live site, picks any workbook cell to see its code, or re-runs the comparison. Map: every formula goes into a dependency graph; a linter flags structural anomalies. Plan: Bob, in Plan mode, reads the workbook's formulas and the PDF rating manual and writes a service design, flagging every disagreement. Translate: four Bob subagents work in parallel, one per translation unit; every function is tagged with the cells it covers. Check: a harness compares all 43 output columns for 10,000 generated policies (430,000 cells), including 170 boundary cases, against the original workbook recalculated in LibreOffice. Triage: mismatches are grouped by root cell; translation bugs go back to Bob, spreadsheet anomalies to a person, who decides against a cited manual rule in a signed log. Certify: a certificate hashes workbook, service, harness and seed, with cell-to-code traceability. What is new. The AI writes the code, but a harness it cannot edit grades it, and only a person can accept a difference. Custom modes limit Bob's folders, a hook blocks edits to the workbook, grader and decision log, and CI rejects any Bob commit that touches them. The grader is itself tested: of 60 injected bugs it caught 51, and a person labelled the 9 survivors. Result on our synthetic homeowners workbook for a fictional carrier: 430,000 cells compared, 409,539 identical, 20,461 differing only in rows traced to 3 human-signed decisions, 0 unexplained; against the decision-patched workbook, 430,000 of 430,000 match. The three anomalies (a lookup range one row short, mispricing 11 of the workbook's 40 policies; a hard-coded tax; one row missing the credit cap) were seeded by us. Live demo: https://sheetshift-rho.vercel.app. Limits: LibreOffice oracle, not Excel; sampled inputs are evidence, not proof; no macros or volatile functions.