ConusAI vendor v0.1.0-beta.114

2026-11-14 09:56:45 +00:00
commit 1ce8d23c35
867 changed files with 122104 additions and 0 deletions
@@ -0,0 +1,19 @@
+# Ledger
+
+Status: optional source implementation; local synthetic verification only. Installed Ledger acceptance remains separate.
+
+This module mounts service-owned accounts, exact balances, immutable entries and transactions in a project tab. Data belongs to the **app organization**, not the mounting project. Canonical caller tenancy hooks resolve current app membership; the request-scoped business binding selects the platform organization and opaque app partition. Procedure input cannot select that authority. No module database, migration, balance projection, financial sequence, cookie or persistent browser store exists.
+
+Ledger stays out of `businessModulesOn`. `kit module:on ledger` requests read scopes only. Approval of account administration (`ledger.accounts:write`) and financial effects (`ledger.transactions:write`) is separate. Viewer reads, editor financial writes, and admin account configuration/reversal permissions are distinct. UI permissions reflect the caller; server permissions and readiness remain authoritative. Native and Convex remain refused until their shared service readiness/binding contracts support them; inclusion does not provision or enable a service.
+
+The generated `@conusai-sdk/ledger` client handles exact raw JSON i64 tokens. Amounts and revisions cross the app boundary as canonical decimal strings and the SDK adapter encodes them as exact BigInt-backed integer tokens. Pure previews also use BigInt. Enter positive **minor units**, without decimal points. No currency precision, conversion, tax, personal chart of accounts or default financial numbering is invented.
+
+Accounts support create, detail, configuration and archive; archive preserves history. Transactions support balanced multi-line pending holds or posted recording, hold post/void and posted reversal. The service owns locks, currency validation, bounds, funds and state transitions. Posted rows cannot be edited or deleted; reversal creates a new compensating transaction. List cursors are user-driven reads, never local financial storage.
+
+All financial instructions are reviewed in a confirmation dialog. A component retains the request key for an identical retry and rotates it when the submitted payload changes. Keys do not survive navigation/reload; after an uncertain response, inspect service history before intentionally starting another operation. The server avoids mutable account/state pre-reads ahead of the service's replay check. Revision/idempotency conflicts expose a redacted reload instruction; remote detail is discarded.
+
+The page shows the actual projection verifier result. The server core fails closed on drift or verifier failure before record/post/reverse; the UI also fences those actions. Void remains available for pending-hold recovery. A drift appearing after an earlier commit can refuse an otherwise identical replay until recovery; retain its original key. The verifier preflight is not an atomic substitute for service enforcement. Projection repair and coherent restores belong to operators; this module never repairs balances.
+
+Operational labels, descriptions and references must contain no personal identifiers. See [Ledger data policy](../../../../docs/reference/compliance/lifecycle-ledger.md). Do not use real financial or customer data as fixtures.
+
+Verification and unexecuted acceptance are recorded in the [S12 brief](../../../../docs/plans/cloud-lifecycle/briefs/s12.md). Source SDK workspace links and synthetic HTTP/browser fixtures do not establish packed-template, gateway, PostgreSQL persistence, concurrency, restore or live acceptance.