swaitsandClaude Opus 5.5
6c587086a0
The P3 cutover review's open point 1: entries carry projects (classes, B-37), but the QuickBooks Desktop file (B-34) left the CLASS field empty on every line, and neither B-34 nor the README said so, though B-34 rule 6 says nothing changes silently. Intuit's IIF Import Kit (vendored in docs/spec/sources/intuit-iif.md, the kit's SHA-256 unchanged): the `!CLASS` header help says "Only the NAME column is required" and a subclass's NAME is its parents' names first, joined by colons; the kit's "Import First - List Declarations" example declares `!CLASS` rows before any transaction, and its "2004 Deposit (Income)" example names the class line by line in CLASS. So the file now declares every class in a `!CLASS` list after the accounts and before `!TRNS`, and writes each line's class in CLASS (empty where the line has none). Books with no class write no list, byte for byte as before. A line whose class wasn't declared is refused (IifError::UndeclaredClass), never written classless. A class's NAME follows B-34's rules for an account's own name: plain ASCII (rule 3), a colon written '-' (it would start a subclass), trimmed, '?' if nothing is left, cut to 31 characters: Intuit's qbXML Onscreen Reference gives `ClassAdd`'s Name "maxDT" : 31 (and 31 in the Canadian, UK and Australian desktop editions; 100 only in Online), the same as its `AccountAdd` Name (both JSON files vendored by SHA-256); Conductor's QuickBooks Desktop API reference agrees and says the name is case-insensitive. Classes whose NAMEs would match ignoring case get " (id)", round after round, as accounts get " (code)", except that among names that match, those already written differently from the books (made safe, or tagged) yield first, a second " (id)" if need be: a class's own name is kept unless another class's own name is the same ignoring case (classes 1 "Café", 2 "Cafe", 3 "Cafe (1)" are written "Cafe (1) (1)", "Cafe", "Cafe (1)"). Each class is tagged twice at most and ids differ, so none is left alike (a hand-built list is refused). Each class name written differently is an IifChange (IifField::ClassName), said one line each in the warnings and in the package README, whose "written differently" paragraph now names class names' limits; its IIF line says CLASS is each line's project when there are classes. The MCP and viewer notes count "account or class name(s)". API: `iif_classes(ledger)` builds the list; `journal_to_iif` takes it (`&[]` for none). Docs: rules.md B-34 rule 8 with its sources; intuit-iif.md (the `!CLASS` help, the list declarations and deposit examples, Intuit's SDK department page, the qbXML Onscreen Reference's ClassAdd and AccountAdd and Conductor's class reference, each with SHA-256); mcp-interface.md (books.export iif, the package note); the bookspec example iif-quickbooks-journal-file.toml (two projects: one carried and renamed, one only declared; every line derived by hand); testing.md; STATUS (open point 1 done; point 3 waits for the close, the owner said). Tests: ledger-import `iif_writes_each_lines_class_and_declares_the_classes_first`, `iif_class_names_fit_quickbooks_and_every_change_is_listed`, `iif_class_names_written_as_the_books_have_them_are_kept`, `iif_refuses_an_undeclared_or_unfit_class`, property `iif_class_names_never_clash`; ledger-package `the_package_iif_carries_each_lines_project` and the bookspec example. Broken to confirm: CLASS written empty fails the two exact-file tests, the package test and the bookspec example; the " (id)" tag dropped fails the names test and the property; tagging every name that meets (no yielding) fails the kept-names test and the property (its shrunk case, "A-B" beside "A\uFF1AB", kept in the regressions file). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01T3gXMVt7XJPi6ens1or9Dj
wanderbooks
Canonical double-entry bookkeeping, rebuilt from scratch. The engine is verified against oracles, parity is tracked automatically, and the primary interface is AI-first: you talk to an agent, the agent drives the books through MCP. Self-hosted, no rent.
What it is
ledger-core— the semantics engine. Exact decimal money, five account types, balanced journal entries, immutable posted log with reversing entries, trial balance, P&L, balance sheet, the statement of cash flows (direct method, with the reconciliation and noncash schedules), fixed-asset register with straight-line depreciation.ledger-store— durable storage. The source of truth is an append-only, hash-chained JSONL journal; SQLite is a disposable projection rebuilt from it; receipts live in a content-addressed blob store. Drafts are durable, corrupt projections self-heal.ledger-mcp— the AI-first interface. 64 MCP tools over stdio or Streamable HTTP: draft → preview → post workflow, server-side receipt policy (>$25), anti-splitting detection, asset management, digest for human review, plus read-only resources for dashboards.ledger-import— QuickBooks interop. Import bank/credit-card CSVs and chart-of-accounts CSVs; export IIF journal entries (for QuickBooks Desktop) and XLSX reports.ledger-config— the company settings in a books dir'swanderbooks.toml.ledger-gui— the viewer: a read-only, live window on the books for owners and their accountant (egui). Answers first (cash, runway, profit, what needs attention), then every number drills down to its lines, its entry, the rendered receipt, and the journal history. Follows the journal live: a change the agent makes appears in milliseconds.--demoopens a realistic demo company.
Verification
This is the storytold way applied to accounting: agents verify against oracles, never ship what they haven't demonstrated.
- 190+ workspace tests: invariant tests encoding accounting law, golden-file report snapshots, property tests (proptest), end-to-end MCP stdio tests.
- Formal proofs of the accounting laws (
just prove,docs/verification.md). Kani model-checks the engine's arithmetic kernel exhaustively within bounds. Lean 4 proves that, after any sequence of commands, the trial balance balances, the accounting equation holds, posted entries are forever, closed periods stay frozen, and a close moves exactly the net income to equity. The first pass found three engine bugs that every test, fuzzer, and mutant had missed: negative amounts accepted, and two crashes on oversized amounts. It also caught a soundness bug in the model checker itself. - Mutation testing via cargo-mutants; fuzzing via cargo-fuzz (11.5M+ executions, zero crashes).
- GnuCash is a behavioral cross-check, never the authority and never a code source (clean room, MIT OR Apache-2.0). Accounting principles, proved, are the spec. Where any other program disagrees, we work out from principles who is right.
Status
Parity is 12 of 12 against the spreadsheet workflow it replaces
(docs/capability-parity.md). The parallel-run plan
(docs/parallel-run.md) is written; the Google Sheet stays the system of
record until a clean month and explicit cutover approval.
See plan/STATUS.md for where things stand and
plan/roadmap.md for where it's going.
Quickstart
cargo test # whole suite
cargo run -p ledger-mcp -- --data-dir /tmp/books # MCP server over stdio
cargo run -p ledger-gui -- --demo # the viewer, on a demo company
New books, one command (installs Rust and wanderbooks if needed, makes the
books' private folder, starts books called acme and lets Claude Code reach
them; nothing needs sudo):
curl -fsSL https://wanderbooks.ai/install.sh | sh -s -- acme
Already installed, three commands: wanderbooks setup, wanderbooks books create acme, wanderbooks connect claude --book acme (or connect codex).
Then talk to the agent; wanderbooks gui acme shows the books, and its
Books menu backs them up, restores, starts new books and closes them.
Developing
Every tool the recipes use (Rust, just, Kani, Lean, cargo-mutants,
cargo-fuzz, Node for deploys) is pinned in mise.toml:
mise install
just # lists the recipes: check, build, prove, demo, ...
Layout
crates/ledger-core/ # engine: money, accounts, journal, ledger, reports
crates/ledger-store/ # journal + SQLite projection + blob store
crates/ledger-mcp/ # MCP server: 119 tools, resources, handbook, receipt policy
crates/ledger-import/ # QBO CSV import, IIF/XLSX export
crates/ledger-config/ # wanderbooks.toml company settings
crates/ledger-cli/ # `wanderbooks`: the one executable (every mode)
crates/ledger-host/ # the host, the agents' bridge, the owner's commands
crates/ledger-package/ # The CPA package and the 1099 worksheet (server and viewer)
crates/ledger-gui/ # the viewer: read-only, live (egui)
docs/ # requirements, architecture, oracle, parity, glossary
plan/ # STATUS.md, roadmap.md
AGENTS.md # operating manual for agents working here
License
MIT OR Apache-2.0. See LICENSE-MIT and LICENSE-APACHE.