A product built to prove the practice on ourselves

Made the wire contract a build artifact instead of a convention

One OpenAPI 3.0 document is the source of truth for both sides. It generates the Go server interfaces and the TypeScript client, so a renamed field breaks a build, not a customer, and the two tiers cannot quietly disagree about a shape. The client repository re-exports a curated surface, so application code never reaches into generated files directly.

The generator is not treated as infallible. Where its behaviour was wrong for the domain it is wrapped, not patched: a query parameter that arrives present-but-empty was being coerced to a silent false by the generated parser, so the routes are mounted through a wrapper that strips those before they reach it — wrapping both the ordered and unordered route tables, because an unwrapped copy would be a second, silently different mounting.

Projected recurring money instead of storing it

A recurring entry is one row that is simultaneously the first occurrence and the template for every other one. Occurrences are computed per request, with an identity derived deterministically from the series and the date, so the same occurrence is addressable across requests without a table of millions of rows that all say the same thing.

What a series does spawn is overrides: rent went up in August only, or this one payment was skipped. Editing “this and all future” truncates the series and starts a new one, recording its lineage so the split can be reasoned about later. Payment state — paid, when, how much actually left the account — is deliberately never copied from the template onto a projection, because payment belongs to a specific occurrence and not to the pattern.

The recurrence vocabulary is the part users never see and always feel: “the 15th and the last business day”, rolling off a weekend the way payroll does, is a preset, not something to hand-assemble, and a bill due on the 31st lands on a real date in the months that do not have one.

Built a forecast that re-anchors instead of drifting

The signature move — the one the product is named for — is telling the app what the bank actually says. That is not a transaction and not a correction factor: it declares that on this date the balance is this number, the running total restarts from there, and everything before it stops mattering to every day after it.

Each day is computed independently from the most recent anchor instead of accumulated forward, so one bad day cannot poison the rest of the month, and the whole calendar can be read in two modes off the same ledger: planned, and confirmed-only — settled money, re-dated to when it really landed, at the amount that really left.

Getting that right meant treating precision as a correctness concern, not a display one. Anchors written through an older wire model had been narrowed to 32-bit floats, so $391.60 was stored as 391.6000061035156 — and because an anchor is an input, no amount of care on the output side can repair it. A dedicated repair pass identified them by exact float32 representation rather than by magnitude, and the endpoint now refuses a sub-cent balance outright.

Made test-driven development an artifact you can check

Nobody can audit whether a test was written before the code. What can be audited is the evidence it leaves behind, so CI does exactly that: every test a branch adds must fail against the branch it came from. A test that passes against unchanged production code is not a regression test for anything — it either transcribes the implementation it claims to check, or it describes behaviour that already worked.

Both failure modes had already shipped here before the check existed, which is why it exists. A test that fails to compile against the base counts as a pass, because referencing code the branch introduces is precisely what a test for new code looks like. The escape hatch is a deliberately conspicuous marker in the commit message, since a dependency bump has no failing test to show and pretending otherwise only teaches people to write throwaway ones.

The counterpart rule is that a deliberately failing test is welcome in history. That commit is the specification, and it is worth more than a test written afterwards to fit the fix — provided it is named as red in the message, and provided it is green before the pull request opens.

Turned the colour system into something tests can enforce

The interface ships eight colour schemes across five layouts and three entry treatments, in light and dark. That is a large enough matrix that “looks fine” stops being a review technique, so legibility was written down as a contract instead: text must clear 4.5:1 against the surface it is actually drawn on.

The word actually is carrying the weight. A tinted chip is a translucent wash over the cell, and measuring the text against the bare cell overstated contrast by up to 0.9 — six role and mode combinations passed on paper and failed where the text really was. The rule now measures against the composited surface, and a test walks every scheme, mode, treatment and direction, resolving the colours the component would really render. A further rule requires the income and expense colours to separate by brightness as well as hue, so the two directions survive greyscale and the common forms of colour blindness.

That test is the difference between a design system and a mood board: it makes the contract enforceable instead of aspirational, and it fails the build, not a user.

Ran the date-sensitive suites in three timezones every build

The domain rule is only as good as the evidence that it holds, and a test suite that runs exclusively in the timezone of the machine that wrote it proves very little about a rule whose entire purpose is timezone independence. The date-sensitive suites are re-run under a zone west of UTC with daylight saving, and under the deepest zone without it, alongside the default run.

The harness sets the zone at process spawn instead of through the test runner, because that is what survives date-library caching and models how a browser sees a fixed session zone. It also fails if the matrix silently loses a file to a rename — a guard that exists because a reviewer asked the obvious question about what happens when someone moves one.

Took the service from one instance to several, then proved it

The original design had a hard ceiling: state that lived in process memory, and a database on a volume that attaches to exactly one machine at a time. Getting past it meant a Postgres cutover and moving every shared control — rate limits, entitlement caching, per-user cooldowns — onto Redis behind a deliberately narrow interface, small enough that a fake cannot cheat and the wrapper cannot grow into a general-purpose Redis client.

The interesting decision was the fallback. Every one of those controls degrades to process-local when Redis stops answering, and a store error is never converted into an allow — a limiter that disappears during a blip fails open, which is worse than the in-memory map it replaced. The honest cost is written down alongside it: at the moment Redis goes away, one caller gets a fresh local allowance.

Because a machine behaves identically whether its limits are shared or private, the property needed proving from outside. A validation script pins requests to specific instances through the platform proxy and reads back which machine answered, so “counted on one, enforced on the other” is observed, not assumed — and it ships with a self-test that proves its own judgments offline, with no cloud and no network.

Wrote migrations that are allowed to run more than once

Data migrations are an append-only registry, each keyed by name, each in a transaction that claims its own bookkeeping row so a racing deploy loses cleanly instead of running twice. Standard practice, until one of them had to fight the schema tool.

The ORM re-renders those text date columns on every automigrate, which means the damage is repeatable while a name-keyed repair is one-shot — restore a snapshot, start a machine, and you get corrupted dates with the migration recorded as applied and a green deploy. So migrations can now be marked convergent: a repair, not a transformation, re-run every bootstrap, recording when it last did something. Two of the seven are.

The same care shows up in what they refuse to do. The migration that reduced timestamps to calendar days runs only where the original offset still exists, and refuses outright where it has already been lost, because guessing the wrong day is worse than stopping. Another enumerates the four data shapes it deliberately does not repair, each considered and rejected as unprovable, not overlooked.

Shipped the same application to the browser and to four platforms

The SPA also ships as a native application on macOS, Windows, Linux and iOS through Tauri, and the native shell is 58 lines of Rust — the discipline is keeping it that way, so a platform is a build target, not a fork. Environment selection is done by build mode, with every variant file in one location shared by browser and native builds, and the release pipeline asserts that a production bundle really did bake in the production API before it will publish.

The build tooling exists because the workspace is three packages deep and the failure modes are boring but expensive: a shared library built in the wrong flavour, or a route added without a component bound to it. The second one is now a compile error, via a mapped type over the generated route ids — the kind of guard that costs an afternoon once and never has to be remembered again.

Put the documentation under the same gate as the code

Across the two repositories there are 179 markdown documents, which is exactly enough for an index to quietly become fiction — and it did, once, rotting to 31 of 59 entries. Every document now opens with a status line naming its state, the date it was verified and the commit it was verified against, and where a document lives is what state it is in: finished work moves to an archive directory with a matching filename suffix. A check written in nothing but shell and grep fails the build on a missing header, an index row that disagrees with it, or a link that no longer resolves. It runs before the toolchain is even installed, because it costs a second.

The specification documents are held to a stricter standard still, and say so in their own opening: everything read from the code and not from other documents, claims carrying file and line so they can be re-derived, and explicit markers separating what was verified from what was not. Documentation in this repository has been found stale often enough that it is not treated as evidence about itself.

The same protocol governs the boundary between the API and the front end, which are developed as separate repositories that never write source into each other. Work that crosses the line becomes a hand-off document stating the direction, the decisions already made and why, the verification commands — and what not to change, which is reliably the section that saves the most time.