2 Commits

Include renames

Author	SHA1	Message	Date
swaitsandClaude Opus 5.5	0340f316ee	fix(core): due-today is Current; odd cents split by largest remainder ... Max-testing pass, step 2: two spec decisions Stephen confirmed (2026-10-13), each test-first. Aging (arap::aging_bucket): a document due today was "1-30 days past due"; it is Current, since past due starts the day after (QuickBooks' convention). Spec in the doc comment. Boundary examples at every edge (due today, 1, 30, 31, 60, 61, 90, 91 days) fail on the old code. A property: the balance lands in exactly one bucket, and time only ages it. Member splits (periods::allocate): the last member absorbed every odd cent, so the same partner always got or lost it. Now largest remainder: each share rounded toward zero to the cent, leftover cents to the largest remainders, ties to the earlier member, a loss the negation of the gain. The core is a new kernel function, kernel::apportion, allocation-free so Kani proves it (n <= 3): apportion_is_exact (it succeeds exactly when the shortfall is under a unit per part; then the parts sum to the whole, each gains 0 or 1 unit, one may take the sub-unit fraction) and apportion_is_fair (never a unit to a part while a larger remainder goes without). Kani found an off-by-one in the first version: a shortfall of n units plus a fraction was accepted. Native regression apportion_refuses_a_shortfall_of_a_unit_per_part_or_more. Properties at Decimal (2,000 cases, up to 5 members): conservation, within a cent of each exact share, fairness, sign symmetry; they fail on the old rule. Bridge: apportion agrees on i64 and Decimal. Contract: closes journaled before this change replay exactly. New member closes journal "rounding": "largest_remainder"; journal lines without it replay as CloseTo::MembersLastAbsorbs, the old rule (periods::allocate_last_absorbs, pinned by closes_journaled_under_the_old_rule_replay_with_it). The members' equity statement isn't journaled and uses the new rule. Open gap: Lean proof of apportion's sum law for any n (needs a permutation lemma on the ranking); Kani covers n <= 3, properties n <= 5. The Lean closing theorems already hold for any split summing to the net. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-13 12:10:55 -06:00
swaitsandClaude Opus 5.5	3609bf065e	feat(core): prove the accounting laws (Kani + Lean); fix three engine gaps ... The money arithmetic every invariant rests on now lives in one kernel, ledger-core/src/kernel.rs: signing a line, totals, net, per-account movements, reversal, normal balances, trial-balance columns, closing lines, and the rounding plug for member splits. It is generic over a checked `Amount` trait. The engine runs it on Decimal (validate, movements, reverse_entry, account_balance, close_period_to, allocate, trial_balance): there is one copy of the arithmetic, and it is the one under proof. Three layers, docs/verification.md maps every law to its proofs: - Kani (src/proofs.rs): 17 harnesses prove the kernel at i64 for every input up to 4 lines over 3 accounts. An entry is accepted exactly when it is two or more positive, in-range lines whose debits equal credits; accepted entries net to zero; grouping by account loses nothing; a reversal mirrors and cancels its original; trial-balance columns balance iff the books net to zero; closing lines zero their accounts and a close balances however the net is split; the plug makes parts sum to the whole. No panics, no overflow. kani::cover! shows the proofs are not vacuous. - Lean 4 (verify/lean): 24 headline theorems for books of any size. The ledger is a state machine (add account, draft, post, reverse, open, close), and in every reachable state the books net to zero, the trial balance balances (as of any date), and the accounting equation holds. Posting only appends ("posted is forever"), closed periods are frozen, a close zeroes revenue and expenses and credits exactly the net income, and period statements add up. Audit.lean shows standard axioms only, no sorry. - Bridge (tests/kernel_bridge.rs): the Decimal and i64 kernels agree. What the proofs found (each one missed by every test, fuzzer, and mutant): - The engine accepted negative line amounts; only MCP refused them. Now NegativeAmountLine: direction is the side's job. - Summing lines near Decimal::MAX panicked. Lines are now capped at one quadrillion and ten decimal places (AmountOutOfRange), which keeps every realistic sum exact, and the kernel's sums are checked. - FX conversion (foreign_amount * fx_rate) could panic the same way; it is now a checked multiply. - Kani itself: 0.68 mis-models symbolic-length copy_from_slice (model-checking/kani#4904) and reported a reversal that doesn't net to zero. The counterexample, replayed natively, passes, and a 15-line standalone crate reproduces the bug. Harnesses avoid bulk copies, and a should_panic canary will flag the upstream fix. `just prove` runs it all (Kani memory- and time-capped, fails on an unsatisfiable cover or a non-standard Lean axiom). AGENTS.md now makes formal coverage part of every core change. Also, docs: GnuCash is *an* oracle, never *the* oracle (Stephen). The spec is accounting principles, proved. Golden files are recomputed from principles. External implementations (GnuCash, the old Sheet, QBO/Xero) are cross-checks whose disagreements get adjudicated, never obeyed. docs/oracle.md gains "Who is right"; AGENTS, README, architecture, roadmap, parity, and STATUS are reworded to match. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GWVo7x3UHw5kwCUaWxiejX	2026-10-13 11:12:13 -06:00