70 Commits

Include renames

Author	SHA1	Message	Date
swaitsandClaude Opus 5.5	b22a034746	MCP: short connect text, a handbook, tool annotations, safe local imports ... - The 13K-character instructions (clients cut them short) become a connect text of at most 1,400 characters whose first 512 stand alone, plus books.handbook and books://handbook/{section}: the old guidance by section, with no helper commands, home paths, pull requests or file-reading suggestions (tool_text_lint). - Every tool has a title and read-only/destructive hints; no requiresUserInteraction anywhere (owner decision 2026-10-16). - books.import_local_file reads only regular files inside the import roots (the downloads folder by default, or --import-root), never the data dir, books dir, vault or the key's folder, no symlink escapes or hard links, and the file opened must be the file checked. - The store lock is a tokio mutex taken off the runtime threads. - get_info refreshes settings first; a bare books://digest reads. Review fixes (P0 review, 2026-10-16): - Fail closed: a tokio mutex never poisons and spawn_blocking caught the panic, so after a panic mid-mutation the server kept serving a Store behind its journal. A panic (the task, or while holding the store) now stops the shared store; every later request on every session is refused with a plain message; a restart re-verifies the journal. The join error goes through redact_refusal and never carries the panic's text. - books.set_w9 w9_file_path read any path (a link named w9.pdf to the vault key was stored and get_w9 wrote it out): it now goes through the import roots' lockdown, its type judged on the canonical path. - Sealed even inside a root: the key file in force, where a linked one leads, both folders, and the default key folder whatever the settings say. Refusals check the roots first, so outside them every path gets one message (no probing what exists); inside, other books-dir files say to copy them out first. - The open is O_NOFOLLOW | O_NONBLOCK (a pipe swapped in after the check can't hang a thread) and must match the checked file's device and inode. New dependency: libc (unix only), for those two open flags, which std doesn't name. - Default import roots are the downloads folder only (the plan); files with full TINs (get_w9, vendor_1099 include_tins, the CPA package with TINs) are never written into an import root, and the server refuses to import any file it wrote with TINs (by SHA-256). - set_tin and set_w9 overwrite vault records: destructive_hint = true; annotations_complete pins the key tools' hints. The read-only hint is checked in behaviour on every spec_mcp call (journal and data-dir files unchanged). - Text: the connect text names the settings file as the one local file to edit, says every entry balances on real accounts and names its party, says invoice/bill/payment/payroll tools post unchecked, rewords the exemptions, and shows the company name as one plain line; the handbook takes section "all", lists its ids in the schema and says to read contract first; books.settings drops the config.json path and no error names the data dir or the key file. tool_text_lint covers the whole tool JSON and resources and bans git/commit/WL-0001; tool descriptions over 700 characters are pinned to today's eight (P5). - digest: an empty since= is bare; the default date is pinned on every day of a month. Round-2 review fixes (2026-10-16): - TIN files (B-26): the in-memory, per-session set of TIN-file hashes became one registry beside the vault (vault/tin-files.sha256, hashes only), shared by every session and every later server. It holds the W-9 set_w9 reads (recorded as read), get_w9 copies, 1099 worksheets with TINs, CPA packages with TINs and each file in one that holds a TIN; a file is recorded before it is written, and a failure refuses. import_local_file, attach_receipt and file_document (base64 was never checked) refuse a recorded file, and a text file (by type, name, or UTF-8/UTF-16 decoding) holding a full TIN. Not caught: an altered binary copy; the docs say so (P2/P7 remove the path tools). - The text check is narrow (owner/engineer decision, 2026-10-16: bank exports are filed for reconciliation, and has_full_tin's "nine digits however separated" refused their routing numbers, long references and dates run into amounts). Text is refused when it holds (a) a TIN the vault holds for a party, anywhere, as nine digits, 3-2-4 joined by hyphens, spaces or dots, or 2-7 joined by a hyphen or space, compared on the server against the decrypted vault and never returned or logged (a vault that can't be opened leaves (b)); or (b) a stand-alone printed SSN (123-45-6789) or EIN (12-3456789) shape: no digit, and no hyphen or dot followed by a digit, beside it. Full-width digits and Unicode hyphens and spaces read as ASCII. has_full_tin still guards refusals and results (redact_refusal). Known limit, for P7: a refusal under (a) tells the agent a text it chose holds a vault TIN. New dependency: zeroize in ledger-mcp (already in the workspace through ledger-vault, same major version), so the vault's TINs decoded for the scan are wiped from memory on drop as the vault's own are. - Mutation testing of the final P0 diff (docs/testing.md): tests for each law a survivor broke (handbook titles, a dropped default root, a .jpg W-9, the waker, the walk's folder flags against a link and a pipe, the 40-link limit, save paths refused as such, the package marking only its TIN files, a registry that can't be read, text types, the short receipt rule's counts and a 12-character code). Simpler code where only a race could tell: inspect places an existing path by canonicalize itself (no second comparison), read_checked's read limit is its one size check, openat fails on -1 as specified. The 25 MiB upload test removes its 50 MB of books however it ends. - The GUI's stale-rule prompt no longer says to open a pull request: it asks the agent to find the figure from the rule's official authority, confirm it with the human, pass it explicitly, and tell the human so it can be reported upstream (as the handbook says); a lib test pins it and bans files, git, GitHub and pull requests from every attention prompt. - Import roots (local_files.rs INVARIANT 0): XDG_DOWNLOAD_DIR="$HOME/" made $HOME (or /) the root. No root may be /, the home folder or hold it, or hold the books, data dir, vault or a key: a named one stops the server at startup, a default one is dropped; the default falls back to ~/Downloads only if that is a real folder other than $HOME; with no root, an import says so. - The read is a component walk from / with openat(O_NOFOLLOW | O_DIRECTORY) per folder and O_NOFOLLOW | O_NONBLOCK for the file, so a folder swapped for a link after the check fails; no step may land on a protected inode (one renamed into a root); dev/ino and nlink stay. No /proc. Portable to macOS. (libc's openat, two small unsafe blocks.) - One refusal for missing, dangling and outside paths: resolved() follows every link, dangling ones too, so a link's target existing or not no longer changes the answer. - Sealing: the key files (in force, default) and their targets always; their folders only when not $HOME, not a root, not holding a root; and ~/.config/wanderbooks whatever XDG_CONFIG_HOME says. - Agent text (I-12): RuleNotKnown names the authority (IRS, with its address) and says to tell the human, never a repo path, PR or GitHub; the digest's stale_rules drop the repo catalog and path for it; vault, outside-books, STOPPED and local-file refusals name no git, path or flag. tool_text_lint bans docs/, .md, /home, data dir, --data-dir, --import-root, vault.key, .jsonl, sqlite, .gitignore, github, pull request, and also lints every error template (scanned from source), built error texts, and the server's refusal constants. - The receipt rule told (ReceiptPolicy::rule) is the one enforced: the exact threshold in the base currency (no "$", no rounding), required and exempt accounts, reversals exempt; the connect text fits 1,400 characters by dropping reasons, then codes, never the rule. - The connect text follows the parties setting; "offer books.digest" everywhere. shown_name drops Unicode format characters (bidi, zero width). - read_only_tools_change_nothing compares file contents, the database by every row, the vault and the settings file (raw database bytes did not change either; rows are the stable comparison). - import_local_file takes the name and type from the canonical path; the digest's journal repair says when the tail was set aside, not the journal's file name; "version-history messages" back in the TIN rule; openWorldHint false on every tool, pinned in annotations_complete. - Outside the MCP crate, for the same texts: ledger-core's DatedRule gains `authority` (the statute or publication with its address) and RuleNotKnown carries it; ledger-store's "sqlite error" reads "database error"; ledger-config's ReceiptPolicy::rule takes the base currency. New dev-dependency: rusqlite in ledger-mcp (already in the workspace, same version and features as ledger-store), to read the database's rows in read_only_tools_change_nothing. - The filing scan is no TIN oracle (tin_files.rs INVARIANT 4): text holding more than two TIN-shaped numbers (any rendering rule (a) reads) that end in a known TIN's last four (the books' TIN and W-9 facts, via known_tin_last4, before the vault is opened; then the vault's own) is refused with TIN_PROBE, the same words whether or not one is the vault's TIN; only one or two candidates are compared against the vault. Tests: unit text_probing_for_a_tin_is_refused_alike_whether_or_not_it_holds_it, one_or_two_candidates_are_compared_against_the_vault; over HTTP text_probing_for_a_tin_is_refused_alike_by_every_filing_tool. Plan: plan/served.md P0, section 6 "Immediate hole (P0)", 4.1, 4.3, 4.9. Review round 3. S1: a panic stops the server for every session, so no input may reach one. Dates are four-digit years (new ledger_core:: calendar, 0001-01-01..9999-12-31): the MCP's parse_date is strict YYYY-MM-DD, periods are bounded, last_day_of_month returns a refusal (server and store); schedules, assets, recurring entries, periods, documents, disposals and entries refuse dates outside the calendar, and replay refuses such journal dates. Every amount a command takes is at most a line's (draft lines by size, document lines, payouts, payroll, statements, shares, tax basis, proceeds, recurring templates), on replay too, so sums are exact; the 1099 vendor part and the K-1 property share use checked products (TooLargeToCompute); a recurring run makes at most 1,000 drafts. tests/hostile_args.rs drives every tool with schema-derived hostile arguments and every resource with generated URIs, asserting the server never stops; the audit's panics are pinned. S2: a `.` or `..` path name is refused as NO_SUCH_FILE up front. S3: NUL-interleaved UTF-16 without a byte-order mark is scanned both ways. S4: resource-read refusals are TIN-redacted. S5: set_w9 records its W-9 only once the call passes every check, just before the vault write. S8: idempotentHint only on verify, run_depreciation, run_schedules, run_recurring, set_party_roles (a repeat leaves journal and vault alone; spec_vault checks every candidate twice); every tool's hints pinned in one table. C1: books.settings lists receipt_required_accounts and receipt_exempt_accounts uncut. C2: the default company name reads "a new company". C3: the parties rule names no-party reasons. C4/C5: the handbook names the settings file only as books.settings' books_toml, and restores "check books.digest and offer it". C6: an import root inside the books, data dir or vault is refused at startup. The lint catches `just` however it ends and where the books are; digest_resource_bare_reads reads the server's month. Review round 4 (2026-10-17): round 3's bounds ran in replay too, so journals main wrote and reopened (an entry dated 0000-06-01 or +10000-01-01, a draft line of 2e15, an asset ending past 9999, a basis or share past the line limit, sub-cent document and payroll lines) no longer opened. Posted is forever: the bounds are the commands' only. - Replay applies main's rule exactly: parse_date takes any date chrono reads; replay_add_line(_fx) has no size bound (add_line/add_line_fx do); replay_register_asset/correct_asset (chrono overflow only), replay_set_asset_tax_basis (check_journaled), replay_set_entry_parties (check_shares_journaled), replay_register_recurring (validate_recurring_journaled), replay_register_schedule (months 1 to 600), replay_create_period (order only), replay_dispose_asset, and no line, date, payment or payroll range checks in replay_invoice/bill, their payments and replay_payroll_run. - Derived figures over such books refuse (TooLargeToCompute, DateOutOfRange), never panic: amortization plans, depreciation into chrono's last month (and the true-up for lives past 9999), intervals, document totals and aging, net pay and payroll plans, money flows and share resolution, the asset register, receipt-policy debits; the MCP tools and the viewer show what can't be computed. - tests/fixtures/old-books: the review's 13 journals, its control and 15 more edges, written by main's Store API with main's figures (expected.json); every one opens in the writer and the viewer to those figures, every derived figure computes or refuses, every MCP tool and GUI page answers; hostile_args restarts the server after each property; each bound has a command/replay test pair. Final review: a schedule's plan refuses a total of 10^26 or more (TooLargeToCompute) instead of letting Decimal round its cents silently, and a null `remaining` in the schedule output is always explained by plan_error. Replay is unaffected: no journaled schedule month can belong to a total that large (the line limit bounds every posted month). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T3gXMVt7XJPi6ens1or9Dj	2026-10-17 09:25:00 -06:00
swaitsandClaude Opus 5.5	aec55b8d12	Store: say "newer wanderbooks", not "corrupt", for books from a newer version ... An unknown event type on a whole, chained line, or a journal.format_set declaring a newer journal format, now raises StoreError::NewerJournal (update wanderbooks) instead of JournalCorrupt. Corruption (bad hash, seq, or JSON) is still corruption. The gate runs in the store, the Snapshot and the GUI, after each line's parse, seq and hash checks, and never skips a line it can't read. Adds the journal.format_set event (format 1 today; nothing writes it yet) and a registry of every event type this version reads, tested against the replay and projection arms. Review fixes (P0 review, 2026-10-16): - A line's own hash is checked only by the next line's prev, and the gate used to refuse a line before reading the next: a flipped bit in a middle line's type (or a format_set edited from 1 to 2) was reported as "newer, the books are not damaged". Now the reader settles every refusal against the next line (format::settle): a next line that doesn't chain makes it corrupt; one that chains makes it newer and verified; with no next line the message says "newer or damaged; update, then run verify", never "not damaged" (NewerJournal.verified). - A newer format number is judged newer before its features are parsed: a newer format may shape them differently. - Snapshot treats a blank complete line as corrupt, as the writer does. - docs/spec/rules.md B-27, which the code cites, now exists. Round-2 review fixes (2026-10-16): - The envelope {seq, ts, type, payload, prev} and its hash (SHA-256 of the canonical JSON) are frozen across formats (rules.md B-27); new fields go in payload. settle reads only the next line's prev, leniently, so a newer format's next line (a float, a string seq, keys of its own) is never called corrupt: no readable prev means unverified newer. - A key beside the envelope's was silently dropped (and the chain then broke as "corrupt"): it is now NewerJournal, hashed over the raw canonical JSON so the next line still checks it; JournalLine::parse refuses such a line. - "the books are not damaged" overclaimed: a verified refusal says line N is intact and this version can't check the lines after it. - The writer read the journal with BufRead::lines (invalid UTF-8 was an I/O error); it now splits bytes on newlines as the Snapshot does, so a non-UTF-8 line is JournalCorrupt in both. - Store::open truncated a torn tail before the gate ran, altering newer books (perhaps mid-append) before refusing them. The gate now runs over the complete lines first; the tail is set aside (and journaled) only when they pass. - Mutation testing (docs/testing.md, P0): the viewer and the writer say the same words about the same damaged line (the newline is no part of it); read_journal_and_format returns every line and the format in force; the journal page tells a format declaration. Plan: plan/served.md P0 and 5.1. Review round 3 (S6, S7). Store::open replays every complete line in memory (the first line's currency, then the ledger) before a cut-off last line is set aside, so a complete line the books can't apply refuses the open with the journal byte for byte as it was and nothing set aside (B-27 SCENARIO 3; test a_bad_complete_line_before_a_torn_tail_leaves_the_journal_as_it_was); catch_up now only projects. The viewer applies the writer's first-line rule (created_currency, shared) instead of guessing USD: any other first line, or a store.created without a sound base_currency, is corrupt to both (test the_first_line_is_store_created_for_the_viewer_and_the_writer). fuzz_store_replay varies the first line (14,696 runs clean). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T3gXMVt7XJPi6ens1or9Dj	2026-10-17 00:32:42 -06:00
swaitsandClaude Opus 5.5	2275948a64	Audit fixes: party money, reconciliations, require policy, K-1 property ... An independent recompute of the real books found no numeric disagreements; review found 15 defects, all fixed with spec-first regression tests: - k1: a prepaid credited straight to capital is property; a member paying a vendor through 2100 is cash. Docs and B-13 match. - parties: a reversal of a reversal counts on its root's side; liability-to-liability payments (member pays the card) count as paid. - viewer: party money uses the server's cash accounts and full calendar year; per-party "What for" scales multi-party entries. - reconciliations: refuse a withdrawn statement before journaling; new books.void_statement; reconciled lines can't be un-cleared; one shared reconcilable-accounts rule for digest and viewer. - CPA package includes receipts linked to entries; a file can't be both filed on and linked to one entry. - parties = "require" covers payroll, tax remittance (agency) and disposal (buyer); no-party marks follow reversal chains and clear when a vendor is tagged. - derived member shares are frozen to exact amounts when posted, so a settings change never re-splits history. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-15 20:16:03 -06:00
swaitsandClaude Opus 5.5	4c74169d18	Shared parties with exact shares, member capital statements, TINs for any party, K-1 worksheet ... Entries may name several parties, each with an exact amount, a percent, or a share derived from the members' capital lines or [[company.members]] shares (entry.parties_set); shares always sum exactly. The 1099 worksheet counts a vendor's share. A member's party page is their partner capital statement, from the same ledger_core::k1 source as the CPA package. books.set_tin stores any party's TIN (members' SSNs for K-1s) in the vault (party.tin_set, last four in the books). The CPA package carries a K-1 member worksheet (k1-members.csv, with a members' total that ties to Schedule L) and the 1099 worksheet with full TINs, saved outside the books only. files_jointly_with notes spouses' two K-1s land on one 1040. Adversarial review fixes: reversed contributions no longer inflate K-1 contributions and distributions; a K-1 row never takes another party's TIN; TIN detection covers dot/slash/dash separators; refusals redact TINs; vendor tagging can't silently replace shared parties; reversals follow re-apportioning. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-15 18:20:18 -06:00
swaitsandClaude Opus 5.5	ae927c3f73	Attachments, statements, reconciliations, TIN vault, counterparty policy ... MCP: books.link_attachment, unlink_attachment, attachments; link_to on attach_receipt and file_document; record_statement, statements; books.reconcile previews and, confirmed against a recorded statement, records the reconciliation; void_reconciliation, reconciliations; import_bank_csv links its source file; digest lists unreconciled accounts. TIN vault: books.set_w9 takes the TIN and the form into the encrypted vault (last four in the books); books.vendor_1099 include_tins and save_csv_to for the CPA's copy; books.get_w9; books.purge_tin. A leak test scans every tool output, the journal, the database, and the blobs. [books] parties = off | suggest | require (default suggest): every preview names the entry's party or suggests likely ones; require refuses to post until it names one or is marked as having none (entry.no_party). Viewer: documents on every subject page; statements and reconciliation history per account; reconciliation pages; reconcile and no-counterparty attention items; party money by period (paid out, received in, net, what for, by month); Needs attention gets its own full-width section. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-15 15:42:37 -06:00
swaitsandClaude Opus 5.5	e265ed4339	Parties, attachment links, statements, reconciliations (store), TIN vault crate ... Parties: one directory for vendors, contractors, customers, employees, members, platforms, agencies, banks, landlords (ledger-core parties.rs). W-9/W-4 facts without the number (last four only; any nine-digit run in a party field is refused, Treas. Reg. 301.6109-4). Vendor and customer records link to parties on replay; core tags every bill, invoice, payment, and reversal with its counterparty. Journal events party.*, entry.party_set; payroll lines name the employee party. MCP: books.add_party, update_party, set_party_roles, set_w9, set_w4, parties, party, set_entry_party; draft_entry party; run_payroll employee; show party. Viewer: Parties directory and party pages, search, journal text, W-9 attention, demo data. One definition of a party's money (ledger_core::parties::activity) for MCP and viewer. 1099 amounts count payments from cash and financing accounts (a member paying for the company counts; a card doesn't; a prepayment counts when made): vendor_1099_report_with, B-19. Store: attachment links to any subject, statements, reconciliations (schema v11), with replay and projection. ledger-vault: encrypted TIN and W-9 records (ChaCha20-Poly1305, key file outside the books). Spec-blind tests for parties (core, store, MCP, viewer) and attachments. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-15 14:43:40 -06:00
swaitsandClaude Opus 5.5	4826a39a88	fix: books with an asset linked to a since-reversed entry failed to open (the projection read-back re-checked the link against today's books); links restore as recorded, Ledger::acquisition_reversed reports ones to relink; regression test ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-15 13:51:17 -06:00
swaitsandClaude Opus 5.5	27e78a0ed5	Assets can be corrected before depreciation: books.correct_asset (cost, salvage, life, in-service date, with a reason), journaled as asset.corrected with the old figures; refused once depreciation is posted ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-15 13:41:15 -06:00
swaitsandClaude Opus 5.5	6e6f9d65b2	Fixed assets carry federal tax basis beside book value; tests sweep stale temp dirs ... - core: TaxBasisRule (cost IRC 1012, carryover IRC 723, personal-use conversion Treas. Reg. 1.168(i)-4(b)), TaxBasis with the contributor's adjusted basis, Asset::tax_basis and ::built_in_gain (IRC 704(c)); the register gains tax rule, contributor basis, tax basis, built-in gain, total tax basis, missing count (rules.md B-25; sources vendored in docs/spec/sources/irs-partnership-basis.md) - store: asset.tax_basis_set journaled, replayed, projected (schema v10) - mcp: books.set_asset_tax_basis; register_asset takes tax_basis_rule and contributor_basis, checked before anything registers (found by the spec-blind suite); list_assets and the register export (json, csv) carry tax basis; instructions say to record it for every asset - import: the register's XLSX and PDF gain the federal tax basis table with citations - viewer: tax basis on the Assets page, the asset page (a Tax basis card), the report, the journal, and Needs attention for assets without one - just: check and the mutation recipes sweep this user's test book dirs older than an hour (killed runs had left 23 GB in RAM-backed /tmp) - docs: the parties, attachments, TIN vault, completeness engine, and updates designs (docs/parties-and-attachments.md) - tests: spec-blind tax basis suites in core, store, MCP; register PDF/XLSX and viewer tests Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-15 13:30:09 -06:00
swaitsandClaude Opus 5.5	49c49aef33	Asset descriptions can change: books.label_asset description, journaled as asset.described (with the old one), replayed, projected, shown in the journal ... Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-15 12:43:28 -06:00
swaitsandClaude Opus 5.5	2e14c702c0	viewer: journal text for asset.acquisition_linked; a test that every event type the store writes has plain-language journal text ... The acquisition link was added after the viewer's asset work and showed its raw event name in recent activity. The new test reads the event types from the store's replay arms, so the next new event without text fails it (checked: it fails without this fix). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-15 12:35:39 -06:00
swaitsandClaude Opus 5.5	ee7e205f5c	Fixed assets, fully featured: tags, serials, acquisition links, label sheets, the fixed asset register, and an Assets section in the viewer; fix a flaky verify ... - core: asset tags (generated PREFIX-0001 or the human's own; unique ignoring case; never reused by another asset) and serial numbers (rules.md B-24); a journaled link from an asset to the entry that acquired it (posted, unreversed, debiting the cost account); fixed_asset_register(as_of), reconciled to the GL (unposted depreciation, unregistered cost) - store: asset.tagged, asset.serial_set, asset.acquisition_linked journaled, replayed, projected (schema v9); differs_from now also compares control roles and tag history - config: [books] asset_tag_prefix, default the company's initials without legal-form words - import: Avery 5160/8160 label sheets with QR codes (geometry vendored from Avery, docs/spec/sources/avery-5160.md); the register as XLSX and PDF - mcp: register_asset tags (and links) automatically; books.label_asset, books.asset_labels; asset tools take a tag; books.show asset / assets page / register report; export fixed_asset_register (json, csv, xlsx, pdf) and in the CPA package - viewer: Assets page (register, reconciliation), asset page (identity, schedule posted vs not, entries, documents), Fixed asset register report, global search by tag/serial/description, journal text, needs-attention items - fix: verify compared snapshot amounts as strings; a zero total summed in hash-map order could print "0" or "0.00", so agreeing books failed verify at random. Now by value (regression test) - tests: spec-blind suites for tags, register, prefix, store, MCP; label and register PDF/XLSX tests; viewer tests Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-15 12:18:00 -06:00
swaitsandClaude Opus 5.5	1771d87e0e	Control roles in the journal (books.assign_role, books.roles); the MCP reloads wanderbooks.toml on change and reports settings problems (books.settings, digest); new writes a full commented wanderbooks.toml ... - core: ControlAccount keys, Ledger::assign_role/check_assign_role/role_account (rules.md B-23): one account per role, of the role's type, balance sheet roles move only when empty; invoices, bills, payroll, remittance, and closes post to the assigned account; an assigned role frees its default code for renumbering - store: role.assigned journaled and replayed (strict account_id) - mcp: settings.rs reloads by content at the start of each request, keeps the last good settings on a broken edit; books.settings with chart problems; digest settings_problems; instructions say when to edit the toml - viewer: journal text for role.assigned - cli: full example wanderbooks.toml, tested to load with every example uncommented - tests: spec_roles.rs (25, spec-blind), store roles.rs (6), MCP reload/problems/roles, settings unit tests Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-15 10:30:16 -06:00
swaitsandClaude Opus 5.5	c1f92ed3e8	store journals payroll.taxes_remitted; viewer tests for the numbers mutation found unchecked ... A payroll tax remittance was journaled as a plain entry, so the viewer labeled it "Journal entry" and, at a 0.00 threshold, flagged it as missing a receipt (the server posts it without one, like a payroll run). The store now names it with payroll.taxes_remitted, as it names runs with payroll.run; replay and the projection pass over it, and the viewer's journal page describes it. tests/view_model.rs: the cash history is never empty when cash moved and ends on the last day it did; the prior month runs to the same day; burn averages over only the months the books cover, half away from zero; cash accounts found by name when the settings name none; card accounts; each entry's accounts debits first, once each; only what arrived since the last refresh is fresh; integrity counts files again without rereading them; the invoice's customer, the bill payment's vendor, payroll and remittance origins. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-14 18:03:10 -06:00
swaitsandClaude Opus 5.5	fe9625502f	viewer: proven read-only; its database check no longer creates SQLite files ... tests/read_only.rs: with every file and folder of the books read-only on disk, the viewer loads, follows live, and renders every page (receipts included), and every file keeps its bytes, size, and mtime; on writable books nothing appears beside the database either. Found: with no writer running, the snapshot's read-only open of the WAL database had to create -wal/-shm (a write into the books) and failed on read-only books, showing a false "database unreadable". With no -wal file no writer has it open, so check_disk now reads it immutable. just mutants-gui sweeps only what the viewer must get right: the view model's numbers (books.rs) and their formatting (fmt.rs); 179 mutants. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-14 13:54:40 -06:00
swaitsandClaude Opus 5.5	5b8910a1cd	books.renumber_account: give an account a new code, history kept ... Ledger::renumber_account changes only the code (entries name accounts by id): refuses an unknown account, a blank or used code, and a control code for an account of the wrong type or a placeholder. Journaled as account.renumbered (with the previous code), replayed, projected, shown in the viewer's journal. The MCP tool lists wanderbooks.toml settings that still name the old code. The server instructions now warn that the engine can't tell a same-type account with another purpose at a control code (a hosting expense at payroll's 6100). Tests: core property (only the code changes; trial balance equal), core refusals, the store's command property, MCP end to end with restart. Mutation on the new code: 8 of 8 viable caught. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-14 08:00:58 -06:00
swaitsandClaude Opus 5.5	f1bdac4bca	store: last mutation survivors killed; 98% with four equivalent left ... Final store mutation run: 357 caught + 1 timeout of 365 viable (from 82% this morning). Three of its seven survivors now have tests: - replay refuses a re-chained journal whose schedule posting differs from what it re-derives (check_replayed_entry guards that event); - a disposal refused for an account's type says the type it needed; - a database whose last pages are damaged while its settings still read fails the integrity check and is rebuilt (verified to fail with the check disabled: "database disk image is malformed"). The four left are equivalent: sort_value's two arms, OpenFlags | vs ^, and writing the long form of a sweepless retained-earnings close. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-13 19:59:37 -06:00
swaitsandClaude Opus 5.5	7559b4c808	store: second mutation pass (345/373); trim what rehearsal covers; tests ... Store mutation rerun: 345 caught of 373 viable (92.5%, from 82%). The survivors, triaged: - Removed code the survivors showed could never matter: set_line_class's hand-written checks (its rehearsal refuses first), ensure_on (the engine creates missing control accounts itself), and verify's live-vs-replay halves of the asset, class, and payroll comparisons (the whole-ledger comparison above them already checks that; the SQLite read-back halves stay). - New tests: disposal account types; depreciation periods must be real months; search_entries (filters, newest first, paging, no drafts); the database's invoice amount paid and status; replay refusing a re-chained journal whose closing entry differs from what it re-derives; a projection missing a table. - Equivalent: sort_value's arms (serde_json's maps are already sorted without preserve_order, which nothing enables; the function stays as the guard if anything ever does), OpenFlags | vs ^ (disjoint bits), and writing the long form of a sweepless retained-earnings close (replay reads both). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-13 19:46:00 -06:00
swaitsandClaude Opus 5.5	d67e897f1b	store: a database with the wrong currency is rebuilt, not blamed on the journal ... Store::open refused books whose database recorded a base currency other than the journal's, with JournalCorrupt, though the journal was fine and the database is derived (a mutation-testing survivor: nothing tested the case). Now the currency comes from the journal, and a database that fails its integrity check or disagrees on currency goes through the same path: kept aside for forensics and rebuilt (open SCENARIO 6). Also tests: the viewer tells a database Behind the journal from one Ahead of what it has read; the table check counts missing and unexpected rows; a new journal creates its directory; a stored blob exists and an unknown one doesn't. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-13 19:37:20 -06:00
swaitsandClaude Opus 5.5	0cf8fb842f	store: tests for mutation survivors; drop pre-checks the rehearsal covers ... From the first store mutation run (324 caught of 396 viable): - receive_payment and pay_bill repeated the engine's refusals by hand after rehearsing the engine itself, so those checks could never fire (their mutants survived). Removed: the rehearsal is the check. - New hand-computed tests: a disposal's final catch-up after some depreciation was posted (200 of 300, gain 100); a disposal on the purchase date (allowed) or the day before (refused); a retained earnings close with a sweep replays it; a float inside an array is refused; the viewer's journal and head hash. - The concurrency test's reader stops when the writer thread ends, not only when it says it's done, so a mutant that kills the writer fails the test at once instead of spinning to the five-minute timeout. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-13 19:32:32 -06:00
swaitsandClaude Opus 5.5	4d8d5daf37	store: refusals leave the live books untouched; per-filing names; spec suite ... The refusal property gained the converse law (an accepted command journals something; only batch runs may find nothing to do) and checks the store's class and payroll listings. It found a schedule registered with an out-of-range total whose first month was refused after its entry was begun: the live ledger kept a draft the journal never had. - Core: compound commands (post_schedule_month, reverse_entry, close_period_to, create_invoice, create_bill, receive_payment, pay_bill, run_payroll, remit_payroll_taxes) run inside Ledger::atomically, so a refusal partway leaves the ledger exactly as it was. - Core: a schedule total no line could carry, or finer than a cent, and an asset cost beyond the line range, are refused at registration. Replay keeps older schedules (replay_register_schedule). - Store: add_line, add_line_fx, mark_cleared, set_fx_rate, post_schedule_month and close_period_to changed the live ledger before journaling; they now run on a copy, journal what it produced, then swap it in, so a failed write leaves the live books as journaled. New spec-blind suite tests/spec_store.rs (57 tests written from the store's specs alone). Its two findings, adjudicated: - A file filed twice under different names listed the first name and type for both (the projection kept them per blob). Schema v8 gives each attachment its own; older databases backfill and heal by verify. - Withdrawn attachments stay in the store's listing, marked (the MCP listing hides them): the spec and doc said "omit" and are corrected. Also removes journal::truncate_to_last_good_seq: unused, and it dropped everything after the first bad complete line, which the books now treat as corruption for a person, never repaired automatically. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-13 19:24:34 -06:00
swaitsandClaude Opus 5.5	8a49f0ff0e	store: specs for the write path, open, verify, heal, receipts, viewer ... GOAL/SOURCE/INVARIANTS/SCENARIOS blocks, citing R-11, R-12, R-13a, docs/receipt-store.md, IRS Pub. 583, and Rev. Proc. 98-25: the module spec every command method follows (refuse whole, journal first, gapless chained lines, replay equals live, multi-step commands rehearsed whole, nothing deleted), Store::create, open, verify, verify_and_heal, attach_receipt, link_receipt, unlink_receipt, withdraw_attachment, and Snapshot::refresh. Also moves ensure_control_account's doc comment back onto it (it had been stacked on rehearse). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-13 19:08:33 -06:00
swaitsandClaude Opus 5.5	2cbb6a263f	store: benchmarks at 10k entries on disk ... benches/store.rs (criterion, in `just bench`): open 249 ms, viewer load 616 ms, full verify 809 ms, post one entry (four synced appends) 62 ms. The books are built on a temp dir and copied under target/ so every sync hits a real disk. Baselines in docs/testing.md; no budget, by decision. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-13 19:06:11 -06:00
swaitsandClaude Opus 5.5	fb3b4ab476	closes: a run of members closes splits cumulatively ... Each close into members' capital rounded on its own, ties to the earlier member, so twelve monthly 50/50 closes of odd-cent income could leave one member several cents ahead of half the year (docs/testing.md #12, found with the members' equity fix). - CloseTo::Members now splits cumulatively over a run (closes back to back with the same members and shares): each close gives a member allocate(run total so far) - allocate(run total before). Periods record their close order and a cumulative close's members and net (Period::close_seq, member_close) so the next close continues the run and replay recomputes it exactly. A close to anything else, or other shares, ends the run. - Journaled "rounding": "cumulative". The per-close rule is kept as CloseTo::MembersPerClose for closes journaled "largest_remainder"; older closes still replay with the last member absorbing it. - Lean: runPart_telescopes (a member's total from a run is their allocation of the run's total) and closePart_total (each close hands out exactly its net), audited to the standard axioms. - Tests: hand-computed three one-cent months (per close A 0.03 / B 0; cumulative A 0.02 / B 0.01), a run ending, a property that each member stays within a cent of their share (fails on the per-close rule), and a store contract that each rule journals and replays as itself. Wanderland's books have no closes yet, so all of theirs use the new rule. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-13 18:58:21 -06:00
swaitsandClaude Opus 5.5	f4381f170c	viewer: no false "database differs" while the books are being written ... New concurrency test: one thread writes entries, drafts and receipts as fast as it can while a Snapshot (the viewer) refreshes in a loop. At every refresh the snapshot's books must balance, never go backward, and never see the writer's database as differing from the journal; at the end it must equal the writer in full. It failed 30 runs in 50: check_disk read the applied position and the tables in separate statements, so a write landing between them made a consistent database look like it "differs", which the viewer shows as a problem in Needs attention. - check_disk reads in one read transaction (one consistent view). - A database that has applied lines the viewer hasn't read yet is now DiskCheck::Ahead ("viewer catching up"), not Behind. - Without the transaction the test fails 14 runs in 20; with it, 50/50. Also: members' equity spec 3b states the exact bound (a member's period income is within two cents of their share, one cent of rounding at each end; the running balance chains exactly), and the spec-blind property checks that bound. docs/testing.md gains the concurrency layer and item 12: each close into members' capital still rounds on its own (pending). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-13 18:51:15 -06:00
swaitsandClaude Opus 5.5	0dcf865ff8	core: no entry posts a fraction of a cent; verify compares whole ledgers ... CI's run of the store refusal property found a payroll run that posted $65.27794: the employer tax was passed in unrounded and nothing refused it, though rules.md B-3 already says a ledger in one money holds no fractions of its smallest unit. Sums of it then differed in scale between journal replay and the SQLite read-back. - Ledger::post_entry refuses any line finer than its currency's ISO 4217 minor unit (FinerThanMinorUnit), whatever made the line: payroll, closes, disposals. add_line refuses it up front. Older journals replay as booked through replay_post_entry. Spec tests for the kernel's ten-place limit now run on the replay path. - The property's body is now run_ops, so failing sequences become named regression tests (regression_payroll_with_a_fraction_of_a_cent). The generator rounds payroll tax to the cent, as callers must. - Ledger derives PartialEq and gains differs_from; Store::verify compares the live ledger with the journal replay in full (drafts, documents, schedules, periods, settings), not just balances, and names the parts that differ. The property checks the ledger its commands built against that replay and against the reopened books. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-13 18:17:13 -06:00
swaitsandClaude Opus 5.5	4af2f6c0bb	store: set aside a torn last journal line on open; server waits for lock ... A crash or power loss mid-append can leave a partial last line. The writer acknowledges an append only after its whole line is synced, so that line was never acknowledged: opening now saves those bytes to journal.jsonl.torn.<time>, truncates to the last newline, and journals journal.tail_repaired (replay and projection ignore it; the GUI shows it; books.digest reports it in journal_repairs). Damage before the last newline is still corruption and still refuses to open. Tested at every byte of the last append. The MCP server now waits up to ten seconds for the writer lock: a restarted server (a client reconnecting) raced the exiting one and died with Locked, which also made mcp_schedules_and_recurring_over_stdio flaky. The test harness now waits for each server to exit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-13 17:58:29 -06:00
swaitsandClaude Opus 5.5	22d1a3d449	store: refusal property reaches every success path; two engine fixes ... The refusal property now starts from real books and adds compound commands with valid arguments (book an entry, register an asset or schedule, raise an invoice or bill, close a month to members), so every command's success path is exercised. Compound commands checkpoint after each step, so the law is checked against the one command refused. STORE_CASES sets the case count (256 by default). It found two bugs: - run_recurring created drafts dated inside a closed period (B-12). generate_recurring now refuses them, atomically; the store leaves them ungenerated and books.run_recurring reports them in skipped_closed_period for a human to decide. Replay uses replay_generate_recurring so older journals still open. The store also journals before mutating the ledger here, as everywhere else. - Disposing an asset for no proceeds (scrapping it) journaled a catch-up depreciation entry and a half-built draft with a 0.00 line, then refused. Zero lines are now left out (Store::disposal_lines, shared with the MCP preview), and the whole disposal is rehearsed on a clone before anything is written. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-13 17:48:20 -06:00
swaitsandClaude Opus 5.5	1212367138	fix(store): a full disk mid-command leaves the books whole ... Max-testing pass on ledger-store, fault injection (rank 1). A full disk is simulated with no code seam: the test re-runs its own binary as a child under bash with the file size capped (ulimit -f, SIGXFSZ ignored), so writes past the cap fail as on a full disk. Two bugs, both of which left the books unopenable: 1. SQLite side: applying one journal line runs several statements (rows, events mirror, last_applied_seq) in autocommit. When the disk filled partway, the rows committed but last_applied_seq didn't, and the next open's catch-up re-applied the line into "UNIQUE constraint failed: entries.id". Each line now applies inside a savepoint: all or nothing. (docs/receipt-store.md promised exactly this heal; it wasn't atomic.) 2. Journal side: an append that failed partway left a partial line, and any later line would land after it, mid-journal. append now cuts the file back to its length before the write on any error. Tests (tests/faults.rs, its own binary because the child re-runs it): a_full_disk_mid_command_leaves_the_books_whole (the database fills first) and a_full_disk_mid_append_leaves_only_whole_journal_lines (the journal writer alone). Both shown to fail without their fix. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-13 17:16:43 -06:00
swaitsandClaude Opus 5.5	725b9beaac	fix(store): a blob id never reaches outside the blob store ... Max-testing pass on ledger-store (security property, rank 2). Blob ids come from the journal, which is untrusted input on disk. BlobStore built paths from any string: an id under four bytes (or with multi-byte characters) panicked on slicing, and exists() would report on any path an id like "../../x" reached. get() never served such bytes (it serves only content whose SHA-256 equals the id), but it read them. Now only a 64-hex-digit id names a blob; anything else is an error from get() and false from exists(), touching nothing. Test a_blob_id_never_reaches_outside_the_blob_store (empty, short, unicode, traversal, absolute, non-hex, 63/65 digits; uppercase hex still works). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-13 17:10:01 -06:00
swaitsandClaude Opus 5.5	8c8ba19471	fix(store): one writer at a time; a second is refused, not allowed to corrupt the books ... Max-testing pass on ledger-store, found during the survey: nothing stopped two processes from opening the same books for writing. Two agent sessions (two MCP servers) on one books dir would each extend the hash chain from the same last line; one write from each broke the journal ("seq gap: expected 3, found 2") and the books would not open. The store now holds an exclusive lock on books-data/wanderbooks.lock (std's File::try_lock, no new dependency) from before it reads the journal until it is dropped; the OS releases it if the process dies. A second writer gets StoreError::Locked saying another process has the books open. The viewer reads through Snapshot and never takes the lock. The lock file is git-ignored in the books scaffold. Regression: a_second_writer_is_refused_while_the_first_has_the_books (refused while open, allowed after close, books whole). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-13 16:05:59 -06:00
swaitsandClaude Opus 5.5	c539004d1a	test: fuzzing, Miri, benchmarks, CI, and a strategy note; the journal refuses floats ... Max-testing pass, ranks 4-6 and step 9 for ledger-core. Fuzzing (rank 4): fuzz_op_sequence now drives balanced pairs, foreign lines, periods, closes, and amounts from raw decimal bits, and asserts the books stay valid (TB balances, posted entries validate, no draft in a closed period); new fuzz_core_serde (every persisted core type round-trips) and fuzz_store_open (a corrupt journal is an error, never a panic); hangs count (-timeout=10). 54M executions; one crash: - fuzz_journal_line: a number too big for an integer parsed as a float, and its canonical form (which the hash chain covers) re-canonicalized differently. The journal never holds floats (R-2), so the reader now refuses them (JournalLine::parse, used by every journal reader); regression a_journal_line_with_a_float_is_refused. Checked first: the real books' journal has none. Rerun: 13.2M executions, clean. Seeds in fuzz/seeds/ (synthetic, minimal); the grown corpora stay out of git. `just fuzz <target> <seconds>`. Miri (rank 4): the core's unit, bridge, and invariant tests under Miri (our code has no unsafe; rust_decimal and chrono do): no undefined behavior. `just miri`. A pinned nightly (nightly-2026-10-01, with miri) is now in mise.toml. Benchmarks (rank 6): criterion (new dev-dependency: the playbook's Rust benchmark tool; none existed) in benches/books.rs; baselines in docs/testing.md. The store's per-command rehearsal clone costs ~1 ms at 10k entries. No budget yet, so nothing gates on them. `just bench`. CI: .github/workflows/check.yml runs `just check` on every push; scheduled.yml runs proofs, the GnuCash oracle, fuzzing, and mutation weekly. Tools come from mise.toml. docs/testing.md: every layer, its oracle rank, command, runtime, and gate; benchmark baselines; the ASSUMED invariants for Stephen to reject; the gap list with triggers. docs/oracle.md's fuzzing paragraph had claimed persistent corpora that didn't exist; corrected. Also: ledger-import now inherits the workspace lints (nightly cargo warned). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-13 15:09:22 -06:00
swaitsandClaude Opus 5.5	beb1fcf233	test(core): spec-blind suites and a live GnuCash oracle; four fixes they found ... Max-testing pass, steps 2-4. Spec-blind tests (rank 1-2): four agents, each given only the specs and the public interface (doc comments and signatures, every body removed, never src/ or the existing tests), wrote tests/spec_reports.rs (62), spec_ledger.rs (72), spec_arap.rs (42), spec_assets_payroll.rs (50): hand-computed examples per scenario and a proptest law per invariant (conservation, partition, invariance, scaling, reversal cancels, "a refusal leaves the books unchanged" over random invalid commands). They found: 1. A refused payroll run changed the books: an all-zero run passed validation, then failed at post after creating seven payroll accounts and using up an entry id. validate_payroll_lines now refuses a run with no gross pay. 2. A refused add_account used up an account id (empty code, duplicate, unknown parent). The id is now taken only when the account is added. 3. Stale prose: close_period_to and members_equity still described the old last-member rounding. 4. Open (left #[ignore]d pending Stephen): depreciation_schedule's doc says "through the month containing" the date; the code prorates that month by days. GnuCash oracle (rank 3, an oracle never the spec): `just oracle` builds GnuCash 5.10 in a container pinned by base digest and package versions (oracle/gnucash/) and runs tests/oracle_gnucash.rs: 200 seeded random books built through wanderbooks (entries, foreign lines, reversals, monthly closes), every account's balance at month ends and random dates and each month's P&L, compared exactly: 15,800 comparisons. First run: 4,724 differences, all from foreign lines; without them, zero. Adjudicated from principles (rules.md B-3): wanderbooks booked foreign * rate unrounded ($108.34567); a ledger in one money holds no fractions of its smallest unit, and its cash must match a bank. Stephen decided: book in the base currency's minor unit, half away from zero. add_line_fx now rounds; minor units per ISO 4217 list one (2026-09-17, SIX), generated into Currency::minor_units and recorded in docs/spec/sources/iso-4217.md. Replay now takes the journaled base amount (replay_add_line_fx), so lines booked before replay exactly as booked (contract: books_written_under_older_rules_still_open). Now: zero differences, foreign lines included. Tests: 449, from 223. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-13 14:39:06 -06:00
swaitsandClaude Opus 5.5	925c3ba523	fix(core,store): child accounts share their parent's type; periods nest; lines checked when added ... Three spec decisions from Stephen (2026-10-13), each test-first: - A child account has its parent's type (ParentTypeMismatch): a child subdivides its parent. Test: a_child_account_has_its_parents_type. - Periods nest (a month in a quarter in a year) but never partially overlap (PeriodsOverlap; a refusal uses no id). Test: periods_nest_but_never_partially_overlap. - A line's account must exist and take postings when the line is added, not only at post (UnknownAccount / PlaceholderAccount from add_line and add_line_fx); posting still re-checks. Two older tests that pinned the post-time refusal now check both (the post-time check is reached through the unchecked replay path, as old journals can). Compatibility: replay reads history through new Ledger::replay_* commands (add_account, add_line, add_line_fx, create_period) that skip checks added later, so books written before these rules still open. The contract test books_written_under_older_rules_still_open writes such a journal directly and found, on its first run, that the SQLite cross-check rebuild used the checked commands and would have failed verification ("sqlite projection can't be read back"); it now replays too. Documented in docs/spec/README.md; decisions recorded in rules.md (B-1, B-4, B-12). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-13 14:16:51 -06:00
swaitsandClaude Opus 5.5	df38dcccf9	feat(core,mcp,gui): never apply a legal rule past what wanderbooks knows ... Stephen (2026-10-13): when what wanderbooks knows is stale, check the date, research it or ask the owner or CPA, and update the rule for everyone with a pull request (best) or an issue (worst). - ledger_core::rules: a registry of rules set by law that change over time. Each says the years it's known for, its rules.md entry, its vendored official source, and a review date. stale_rules(today) is pure; the engine has no clock. - The 1099 threshold is the first: $600 through 2025, $2,000 in 2026, then indexed for inflation (26 U.S.C. §6041(h)). default_threshold and vendor_1099_report now return Result; for 2027+ they refuse with LedgerError::RuleNotKnown, whose message says what to do: get the figure from the official source or the owner/CPA, pass it explicitly, then open a PR (or issue) at github.com/swaits/wanderbooks. Before, 2027+ silently used $2,000. - MCP: books.vendor_1099 relays that refusal; books.digest gains stale_rules; the server instructions tell the agent the procedure (and how to handle control-account conflicts: explain, never renumber). The CPA package writes a NOT-INCLUDED note instead of a guessed 1099 worksheet. - Viewer: "Needs attention" shows each stale rule with a ready prompt for the agent; the 1099 page explains instead of guessing. Review date for the 1099 rule: 2026-11-01, when the IRS usually publishes next year's inflation adjustments (CONVENTION, marked as such in the registry). Tests: an_unknown_year_threshold_is_never_guessed, dated_rules_go_stale_on_their_review_date (dates passed in, so no clock in the test), MCP stdio: 2027 refused with guidance, explicit threshold accepted, digest carries stale_rules (asserted date-independently). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-13 14:07:22 -06:00
swaitsandClaude Opus 5.5	e2bebce051	fix(core,store): refuse control accounts of the wrong type, with a reason ... Invoices, bills, payments, payroll, and closes post to accounts the engine finds by code (1200, 2000, 4000, 6999, 3999, 6100-2150). If an account with that code existed it was used whatever its type: a 1200 "Customer Deposits" liability would have taken receivables. Now (Stephen, 2026-10-13: never force an imported chart into our numbering) the engine refuses with ControlAccountMismatch, naming the code, the account, its type, the role, and the type needed, so the agent can work it out with the human. A placeholder is refused too. Every command checks all its control accounts before changing anything (Ledger::check_controls, spec + SOURCE in its doc comment), so a refusal never leaves a half-made account behind. One table of control accounts (ledger_core::RECEIVABLES ... PAYROLL) replaces the codes duplicated across the engine and the store. Tests (spec-derived, all assert the books are untouched after the refusal): an_invoice_refuses_a_1200_that_is_not_receivables, an_invoice_refuses_a_placeholder_1200, an_invoice_creates_nothing_when_its_second_account_is_wrong, a_bill_refuses_a_2000_that_is_not_payables, a_close_refuses_a_3999_that_is_not_equity. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-13 12:29:24 -06:00
swaitsandClaude Opus 5.5	0340f316ee	fix(core): due-today is Current; odd cents split by largest remainder ... Max-testing pass, step 2: two spec decisions Stephen confirmed (2026-10-13), each test-first. Aging (arap::aging_bucket): a document due today was "1-30 days past due"; it is Current, since past due starts the day after (QuickBooks' convention). Spec in the doc comment. Boundary examples at every edge (due today, 1, 30, 31, 60, 61, 90, 91 days) fail on the old code. A property: the balance lands in exactly one bucket, and time only ages it. Member splits (periods::allocate): the last member absorbed every odd cent, so the same partner always got or lost it. Now largest remainder: each share rounded toward zero to the cent, leftover cents to the largest remainders, ties to the earlier member, a loss the negation of the gain. The core is a new kernel function, kernel::apportion, allocation-free so Kani proves it (n <= 3): apportion_is_exact (it succeeds exactly when the shortfall is under a unit per part; then the parts sum to the whole, each gains 0 or 1 unit, one may take the sub-unit fraction) and apportion_is_fair (never a unit to a part while a larger remainder goes without). Kani found an off-by-one in the first version: a shortfall of n units plus a fraction was accepted. Native regression apportion_refuses_a_shortfall_of_a_unit_per_part_or_more. Properties at Decimal (2,000 cases, up to 5 members): conservation, within a cent of each exact share, fairness, sign symmetry; they fail on the old rule. Bridge: apportion agrees on i64 and Decimal. Contract: closes journaled before this change replay exactly. New member closes journal "rounding": "largest_remainder"; journal lines without it replay as CloseTo::MembersLastAbsorbs, the old rule (periods::allocate_last_absorbs, pinned by closes_journaled_under_the_old_rule_replay_with_it). The members' equity statement isn't journaled and uses the new rule. Open gap: Lean proof of apportion's sum law for any n (needs a permutation lemma on the ranking); Kani covers n <= 3, properties n <= 5. The Lean closing theorems already hold for any split summing to the net. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-13 12:10:55 -06:00
swaitsandClaude Opus 5.5	a09c1fb218	fix(store,core): a refused command never reaches the journal; reversal rules ... Max-testing pass, step 2 (rank 1 regressions + a rank 2 law). Two ways to make the books unopenable, both found by test, both fixed: 1. Reversing into a closed period: the store journaled `entry.reversed`, then the engine refused it at post. Replay could never apply that line, so Store::open failed ("period 1 is closed"). Regression: reversal_into_a_closed_period_is_refused_before_journaling. 2. An oversized invoice (or any command whose hand-written store pre-checks lagged the engine, here the new line range) journaled, then failed in the engine. Found by the new property refused_commands_never_reach_the_journal within 4s. The fix is structural, not another hand-written check: every journal-first store command now rehearses on a scratch clone of the ledger (`Store::rehearse`), so whatever the engine refuses is refused before the journal, now and after any future engine change. The create_entry rehearsal uses the checked constructor: no draft is ever dated in a closed period (the Lean invariant Inv.draftsOpen, which the store had bypassed). The property (1,000 random command sequences, heavy on refusals) asserts, after every command: a refusal leaves the journal byte-identical; every posted entry validates; the trial balance balances; no draft sits in a closed period; and the books reopen and verify at the end. Shown to have teeth: removing the create_entry rehearsal makes it fail and shrink to open-period, close, draft. Engine (spec confirmed by Stephen, 2026-10-13), Ledger::check_reversal, a pure pre-check that reverse_entry and the store share: - an entry is reversed at most once (EntryAlreadyReversed); reversing the reversal re-instates it; - a closing entry is never reversed (ClosingEntryIrreversible); - a refused reversal leaves no trace (it used to leave a draft and burn an id). Specs go in doc comments as a ```text GOAL/INVARIANTS/SCENARIOS block. New dev dependency: proptest for ledger-store (already the workspace's property library). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-13 11:40:50 -06:00
swaitsandClaude Opus 5.5	024c9896f2	fix(store): verify no longer chokes on a draft before a posted entry ... The SQLite cross-check rebuilt entries by id and assumed no gaps, but drafts aren't projected until posted: a draft #8 before a posted #9 made the server refuse to start. Gaps are now held with empty drafts (which no report counts), and a projection that can't be read back counts as drift to heal, not a reason to refuse to start. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MtYEaR6M6Ybdhm6X98BWNu	2026-10-12 19:09:08 -06:00
swaitsandClaude Opus 5.5	475d08b28e	feat: books.show — the agent puts things on the viewer's screen ... books.show asks the viewer to open an entry, an account register, a report (dates, month/quarter/year columns, prior-period or prior-year comparison), a document, a search, or a page. The request lives outside the books (runtime dir, keyed by data dir, written atomically); the viewer watches it beside the journal and applies books before navigating. 66 tools. Site: the dashboard is the hero again; 'Here's what using it looks like' shows the session beside the viewer, ending in books.show; the cash page replaces the repeated overview lower down. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MtYEaR6M6Ybdhm6X98BWNu	2026-10-12 19:03:19 -06:00
swaitsandClaude Opus 5.5	9694d2a89a	feat: end-to-end integrity checks with self-healing; website; installer and Windows fixes ... Store::verify compares the whole SQLite projection, every table row for row, against a fresh projection of the journal; verify_and_heal rebuilds a drifted database (keeping the old file) at every server start and via the new books.verify tool, which also re-hashes every blob. The GUI checks the server's database read-only and every stored file, and shows the result. rebuild() also drops stale WAL/SHM files. site/: the wanderbooks website (just site, just publish). install.sh: OS detection (Windows points to WSL2), C compiler and git checks, WANDERBOOKS_REPO. Windows: no directory fsync off Unix; .exe-aware lookup. Repo justfile: check, build, install, demo, site. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MtYEaR6M6Ybdhm6X98BWNu	2026-10-12 17:05:05 -07:00
swaitsandClaude Opus 5.5	105fd52694	feat: ledger-gui — a read-only, live desktop view of the books ... egui/wgpu app for owners and their accountant: Overview, Cash, Profit, Transactions (with rendered receipts and journal history), Reports (statements with interval columns, comparisons, drill-down), Accounts, Documents, Company, Journal; Ctrl+K palette; back/forward; light/dark. Follows the journal live (~30 ms from write to screen). --demo opens a deterministic demo company, also used for screenshot tests. Engine: ledger-store Snapshot (read-only, incremental, tolerant of a half-written tail); ledger-core analysis (intervals, balance series, P&L by interval, cash flows); ledger-config extracted from ledger-mcp with the full company profile and cash_accounts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MtYEaR6M6Ybdhm6X98BWNu	2026-10-12 16:20:14 -07:00
swaitsandClaude Opus 5.5	b48addd0e0	feat: 1099 tracking — vendor forms, payment tags, year-end worksheet ... Vendors carry form_1099 (NEC/MISC) and tin_on_file (never the TIN). Entries carry the vendor they paid; bills, bill payments, and reversals are tagged automatically. books.vendor_1099 counts cash paid per vendor per calendar year (card payments excluded) against $600 through 2025 and $2,000 from 2026, or an override, and flags missing W-9s. Four new tools (64), two journal events, schema v7. Docs: finished R-FUTURE work is no longer listed as future. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MtYEaR6M6Ybdhm6X98BWNu	2026-10-11 21:18:32 -07:00
swaitsandClaude Opus 5.5	ddb67a2ca2	feat: prepaid/deferred amortization schedules and recurring entries ... Amortization schedules spread a prepaid expense or deferred revenue over the months it covers, to the cent, posting on month ends; runs preview first, are idempotent, honor closed periods, and are exempt from the receipt policy like depreciation. Recurring entries generate drafts only, never posts. Six new tools (59 total); four new journal events, replayed and checked. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MtYEaR6M6Ybdhm6X98BWNu	2026-10-11 21:09:43 -07:00
swaitsandClaude Opus 5.5	dbdc8e671f	feat: entity-aware owner equity — chart templates, draws, distributions, dividends ... Every business has owners, and how owners put money in and take it out depends on what the business is. wanderbooks now knows the four common US shapes: - books.chart_template {entity_type, owners}: a starter chart for a sole proprietorship (owner's capital and draws), partnership or multi-member LLC (capital and distributions per partner, guaranteed payments), S corporation (stock, APIC, shareholder distributions, officer compensation, retained earnings) or C corporation (dividends, income tax expense), plus common income and expense accounts with tax categories, and the wanderbooks.toml settings that go with it (tax form, members with equal-share placeholders that sum to exactly 100, close target). A proposal for the agent to review with the human. - Closing: CloseTo is now RetainedEarnings { sweep }, Account { into, sweep } (a sole proprietor's capital) or Members([MemberClose { capital, share, distributions }]). Sweeps zero owner-pay equity accounts into their target at close: draws into owner's capital, dividends or distributions into retained earnings, each partner's distributions into their own capital. Validation (equity, distinct, shares sum to 1) runs in the pre-close preview, before anything is journaled. The journal records the target; journals with no target or the old "retained_earnings" string still replay. - Members' equity: a partner's distributions account is part of their capital; its activity reports as distributions. - Config: members' distribution_account; [books] close_into and close_sweep for single-owner businesses (rejected alongside members). The cash flow names members on their distribution accounts too. Tests: a sole proprietor (net 2,000 and 500 of draws into capital: 6,500, the cash); a corporation (dividends 300 into retained earnings: 600); a partnership with distribution accounts (Bob 100 + 25 - 20 = 105, swept at close, February begins there); bad sweep accounts; templates round-trip through the chart parser, unique codes, equity per entity, every tax category valid for the entity's return; stdio: template -> settings -> import -> postings -> close with the exact closing lines. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MtYEaR6M6Ybdhm6X98BWNu	2026-10-11 21:01:31 -07:00
swaitsandClaude Opus 5.5	f858fb4cfe	feat: tax categories and the tax summary report ... wanderbooks is a general MCP-first accounting application: every business needs its accounts mapped to where they land on its income tax return, and its CPA needs book-to-tax differences surfaced, not hidden. - ledger_core::tax: a catalog of stable categories (gross_receipts, commissions_fees, meals, guaranteed_payments, officer_compensation, nondeductible, ...) with kind (income, cost of goods, deduction), the returns each appears on (Schedule C, 1065, 1120-S, 1120), a default deductible percent (meals 50, nondeductible 0), and guidance. Keys, not line numbers: form lines move from year to year. - Accounts carry tax_category and an optional deductible_percent override, validated against the account type (and the return, at the MCP layer), journaled as account.tax_set, replayed, projected (schema v6). - tax_summary(start, end, form): the P&L grouped by category, book and deductible amounts (half away from zero to the cent), contra income (refunds) reducing receipts, and every account still uncategorized. - MCP: books.tax_categories (filtered to the configured return), books.set_tax_category, a tax_summary report in every format and in the CPA package, chart output with categories, and a fifth tax_category column in chart CSV imports, validated before anything is created. [company] tax_form, or derived from tax_classification. Scope stays book basis: no tax depreciation, basis, or filing. Tests: a hand-computed quarter (50% meals 333.33 -> 166.67, penalties at 0%, refunds as negative receipts, guaranteed payments, one uncategorized account; book net 5,276.67 vs tax 5,483.33); overrides; category/account /return validation; form parsing and derivation; CSV parsing; stdio: filtered catalog, mapping, refusal, summary, all-or-nothing import. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MtYEaR6M6Ybdhm6X98BWNu	2026-10-11 20:53:56 -07:00
swaitsandClaude Opus 5.5	8164abb2b8	fix: period close sweeps only through the period end; partnerships close into members' capital ... The close zeroed every revenue and expense account's all-time movement, so closing a period after later entries were posted swept those too: close January in March and February's and March's income landed in January's closing entry. The preview had the same bug and never showed where the net went. Now: - close_period_to(id, to) zeroes balances as of the period end; entries dated later stay open for their own period. Periods must close in order (LedgerError::CloseOutOfOrder): a later close has already swept the earlier period. - CloseTo::Members: for a partnership (multi-member LLC) the net goes to each member's capital account by share, to the cent, the last member absorbing rounding, which is what K-1 capital accounts track. CloseTo::RetainedEarnings (3999) stays the default; close_period is shorthand for it. books.close_period picks Members when wanderbooks.toml lists members. - The journal records the close target; replay re-derives the closing entry and now compares every line with the journal, not just the id, so a change to closing math can never silently rewrite history. - The tool's preview is the real close run on a clone of the ledger (Ledger now derives Clone), so preview and post can't disagree. - Members' equity: closing entries into a capital account are income, not contributions. Balance sheet for a partnership: capital accounts (with allocated earnings), then only unallocated earnings — "Undistributed earnings, prior years" if any, and this year's unclosed net income (loss). periods::allocate is shared by the close and the statement. Tests: January closed after February is posted sweeps exactly Dr 4000 2,500 / Cr 6100 800 / Cr 3999 1,700 (mutation-checked: the old code gives 3,500/120/800/2,580); out-of-order close refused; a partnership close splits 666.67 into 333.34/333.33 with no 3999, and the members' equity statement reads correctly before and after; store replay of a members close (reopen, rebuild, verify); partnership and corporate balance sheet layouts; stdio close preview equals the posted lines. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MtYEaR6M6Ybdhm6X98BWNu	2026-10-11 20:39:17 -07:00
swaitsandClaude Opus 5.5	b5af21bb0e	feat: real dates and per-account detail in every statement export ... Every statement export rendered life-of-ledger totals under whatever date range or as-of label was asked for, and the P&L and balance sheet XLSX were totals-only. Now: - books.profit_and_loss / books.balance_sheet and the csv, json, xlsx, pdf exports and CPA package all use core's profit_and_loss_for_period and balance_sheet_as_of, with a line per account. The tools keep their totals and add revenue/expense/asset/liability/equity account lines. An omitted start is the first posted entry, never "0001-01-01". - ledger-import::report lays a statement out once (section, line, subtotal, total) for every renderer, with one exact amount formatter: thousands separators, negatives in parentheses, no floats. XLSX keeps numeric cells with an accounting number format, named sheets, company header, totals with borders; the trial balance gains its totals row. - ledger-mcp reads wanderbooks.toml (next to --data-dir, or --books-toml): company name for headers, fiscal_year_start for the CPA package's fiscal year to date (end derived; Feb 29 rejected), and [books] receipt_threshold, which the server had been ignoring. config.json's receipt_policy still wins when set. New dependency: toml 1.x (already in the lockfile via another crate). - Store::journal_seq(); every report notes the journal seq it reflects. Tests: company.rs unit tests (fiscal years incl. a July start, scaffold parsing, bad settings); report.rs formatting tests; an MCP stdio test with --books-toml (threshold 5.00 enforced, February-only P&L with account lines, start defaults to the first entry, as-of balance sheet). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MtYEaR6M6Ybdhm6X98BWNu	2026-10-11 19:11:36 -07:00
swaitsandClaude Opus 5.5	e59e8001c6	feat: receipt unlink and attachment withdrawal ... Posted entries stay immutable (R-3), but their evidence can now change the same way the ledger does: by appending events, never by editing or deleting. New R-13a. - books.unlink_receipt {attachment_id, reason} journals receipt.unlinked and leaves the receipt filed, unlinked. The receipt policy holds: an entry that requires a receipt can't lose its last one (structured receipt_required error), so a replacement is attach-new, then unlink-old. Drafts and reversals are exempt, as at posting. - books.withdraw_attachment {attachment_id, reason} journals attachment.withdrawn for an unlinked receipt or a filed document: hidden from list_receipts (unless include_withdrawn), never linkable again. The blob stays in the store, hash-verified and readable. - link_receipt now refuses an already-linked or withdrawn attachment. Before, re-linking silently moved a receipt off a posted entry, bypassing the policy; evidence now leaves an entry only through a recorded unlink. dispose_asset checks its receipt ids before posting instead of after. - Schema v5 adds attachments.withdrawn_at/withdrawn_reason; existing stores migrate on open and replay rebuilds the projection. Tests: store test (errors, reopen, rebuild, verify, journal history) and an MCP stdio test (policy refusal, replace flow, withdraw, listings, under-threshold unlink). Dry-run and live use on the Wanderland Labs books: 8 migrated .eml attachments swapped for their PDF renders, trial balance unchanged. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MtYEaR6M6Ybdhm6X98BWNu	2026-10-11 18:40:51 -07:00
swaits	fe50b38616	Payroll accounting, class tracking, CPA handoff package (48 MCP tools)	2026-10-11 15:32:09 +00:00