What's Built

Every capability below exists because a spec was written for it first, implemented against that spec, and archived once done — the concrete result of the spec-driven approach. Each entry links to its current spec in the repository, the precise, testable statement of what that capability does today.

Capability	What it does
Core ledger	The foundational double-entry ledger: recording transactions without picking debit/credit sides, immutable posted entries (corrections via reversal, never edits), a running register, and an income/expense summary.
Onboarding language selection	First launch starts with a language picker showing every supported language in its own script, with the device language pre-highlighted.
Books Copy & Continuation	First launch offers New setup or Restore from a copy. The signing key never leaves the device. A passphrase-protected Books Copy moves books between phones; Continuation continues books under a new this-device key when the private key is missing.
First-week setup wizard	A short, skippable, one-time wizard right after onboarding to name a main bank account and optionally add a credit card and cash account.
Multi-account ledger	Multiple asset and liability accounts, account groups, transfers between accounts, per-account balances and registers, and opening balances.
Account currencies	Each account group has its own currency; net worth is tracked per currency, with no forced conversion.
Home overview	The landing screen: every account (active and archived) with its balance, grouped, an overall net position, a single Add hub for Spent/Received/Moved money/Import, and this month's category totals.
Split transactions	Spread one purchase across multiple categories with a running remainder, instead of squeezing it into one category or splitting it into separate entries.
Recurring templates	Define a repeating bill or paycheck once; a due template shows up on Home and is recorded with a single tap — never posted automatically.
Payees	Autocomplete on the description field that remembers a payee's usual category and account, always overridable, and updates itself from what you actually use.
Monthly category limits	An optional, purely informational month-to-date spending guide per expense category — never blocks recording a transaction.
Credit card household flow	Flag a liability account as a credit card to get "Paid from card"/"Paid from bank" capture shortcuts and a pre-filled "Pay card" transfer — the account itself behaves like any other liability.
Foreign-currency settlement	Cross-currency transfers and foreign-currency transactions, posted at a known rate or provisionally and settled later.
Reference exchange-rate lookup	An optional, off-by-default lookup showing a comparison exchange rate on cross-currency transfers — never used to fill in or validate an amount.
Investment holdings	An investment account as cash plus a lot-tracked instrument inventory: buy (including non-cash acquisitions), sell, dividends, and a labeled market-estimate valuation from background quotes — not a broker, no order routing.
Investment research	Tap a held instrument's name to open a pre-filled research prompt in your favourite consumer AI tool — no API integration, no in-app model call.
Instrument identifier assist	When adding an instrument: an identifier look-up prompt, offline ISIN validation, a currency-mismatch warning, a default-exchange setting, and a confirm-the-listing step so market quotes match the account's currency.
Ledger integrity & signing	Verified history for the user's books: each entry is signed and linked to the previous one, the app checks that chain on startup, and entries that no longer verify are shown as unverified instead of being trusted in totals.
Correction (Fix) wizard	A guided flow that corrects a posted transaction by pairing a reversal with a new corrected entry, so the original stays visible and history is never rewritten in place.
Register search	Text search plus optional direction and date-range filters over an account's register, narrowing what's shown without ever changing what's posted.
OFX statement import	Importing bank/credit-card history from OFX/QFX files, with duplicate detection and categorization before posting.
CSV statement import	Importing statement history from CSV files via an explicit, never-inferred column mapping, with reusable saved profiles.
Import category rules	Saved keyword-to-category rules and bulk categorization on the import preview screen, so a category assigned once keeps applying.
Ledger data export	Export a chosen account's transactions for a date range to CSV, with each row's verification status, and never any signing-key material.
Books Copy save & restore	An encrypted, passphrase-protected copy of the books (never the private key). Restoring replaces rather than merges; device settings stay on the phone.
App lock	Optional PIN or device-biometric lock with an idle timeout and app-switcher snapshot hiding, so an unlocked or backgrounded device doesn't expose the ledger at a glance.
Full app localization	The app's interface, input, and error messages in dozens of languages spanning East Asian, European, global-major, and every major Indian language family — with money still formatted by each currency's own convention regardless of chosen language.
Linux desktop	Linux is a real, CI-validated target alongside iOS, Android, and macOS — it builds, launches, onboards, and keeps its signing key in the desktop's secure storage.
Privacy policy	A plain-language privacy policy, linked from in-app Settings and the store listings, describing exactly what stays on the device and each network lookup.
Shared UI components	A small set of reusable widgets — destructive-action confirmation, money entry, entity pickers, status banners — used consistently everywhere that shape of UI appears.
User guide	An accurate, end-user guide covering every shipped screen and flow, never describing planned-but-unbuilt functionality.
Contributor guide	The root-level entry point explaining how to propose and submit a contribution.
Acceptance test suite	37 end-to-end tests that drive a real, launched build of the app — real database, real OS keychain — run weekly on Linux in every supported language, and again on every release candidate alongside a macOS baseline.

Why The Integrity Feature Matters

For a normal user, the value is not the phrase "tamper-evident ledger." The value is that financial history becomes harder to rewrite quietly. If an old amount, date, description, or link in the history is changed outside the app, the app can detect that the chain no longer matches and keep that damaged part out of balances.

That helps when restoring a backup, checking whether a local database was damaged, reviewing an old mistake, or exporting records for an accountant. The app still cannot prove that a transaction was truthful when originally entered; it can prove whether the stored history still matches what was signed at the time.

This capability follows the same broad ideas behind accounting audit trails and tamper-aware logs: keep enough chronological evidence to reconstruct what happened, and protect that evidence from silent change. For background, see OpenStax on accounting audit trails, NIST's audit-trail definition, and OWASP's logging guidance.

This list reflects the specs under openspec/specs/ as of when this page was last updated by hand — see the repository for the current, authoritative list.

The privacy policy is the public description of on-device storage and the app's network lookups, kept in sync with the iOS privacy manifest.