What's Built

Every capability below exists because a spec was written for it first, implemented against that spec, and archived once done — the concrete result of the spec-driven approach. Each entry links to its current spec in the repository, the precise, testable statement of what that capability does today.

Capability	What it does
Core ledger	The foundational double-entry ledger: recording transactions without picking debit/credit sides, immutable posted entries (corrections via reversal, never edits), a running register, and an income/expense summary.
Deferred onboarding	A first-time user names their first account and records one real transaction before facing the mandatory recovery-phrase acknowledgment, so they see the app work before the cryptography ritual.
First-week setup wizard	A short, skippable, one-time wizard right after onboarding to name a main bank account and optionally add a credit card and cash account.
Multi-account ledger	Multiple asset and liability accounts, account groups, transfers between accounts, per-account balances and registers, and opening balances.
Account currencies	Each account group has its own currency; net worth is tracked per currency, with no forced conversion.
Home overview	The landing screen: every account (active and archived) with its balance, grouped, an overall net position, a single Add hub for Spent/Received/Moved money/Import, and this month's category totals.
Split transactions	Spread one purchase across multiple categories with a running remainder, instead of squeezing it into one category or splitting it into separate entries.
Recurring templates	Define a repeating bill or paycheck once; a due template shows up on Home and is recorded with a single tap — never posted automatically.
Payees	Autocomplete on the description field that remembers a payee's usual category and account, always overridable, and updates itself from what you actually use.
Monthly category limits	An optional, purely informational month-to-date spending guide per expense category — never blocks recording a transaction.
Credit card household flow	Flag a liability account as a credit card to get "Paid from card"/"Paid from bank" capture shortcuts and a pre-filled "Pay card" transfer — the account itself behaves like any other liability.
Foreign-currency settlement	Cross-currency transfers and foreign-currency transactions, posted at a known rate or provisionally and settled later.
Reference exchange-rate lookup	An optional, off-by-default lookup showing a comparison exchange rate on cross-currency transfers — never used to fill in or validate an amount.
Investment holdings	An investment account as cash plus a lot-tracked instrument inventory: buy (including non-cash acquisitions), sell, dividends, and a labeled market-estimate valuation from background quotes — not a broker, no order routing.
Investment research	Tap a held instrument's name to open a pre-filled research prompt in your favourite consumer AI tool — no API integration, no in-app model call.
Ledger integrity & signing	Verified history for the user's books: each entry is signed and linked to the previous one, the app checks that chain on startup, and entries that no longer verify are shown as unverified instead of being trusted in totals.
Correction (Fix) wizard	A guided flow that corrects a posted transaction by pairing a reversal with a new corrected entry, so the original stays visible and history is never rewritten in place.
Register search	Text search plus optional direction and date-range filters over an account's register, narrowing what's shown without ever changing what's posted.
OFX statement import	Importing bank/credit-card history from OFX/QFX files, with duplicate detection and categorization before posting.
CSV statement import	Importing statement history from CSV files via an explicit, never-inferred column mapping, with reusable saved profiles.
Import category rules	Saved keyword-to-category rules and bulk categorization on the import preview screen, so a category assigned once keeps applying.
Ledger data export	Export a chosen account's transactions for a date range to CSV, with each row's verification status, and never any signing-key material.
Ledger backup & restore	An encrypted, passphrase-protected export/restore of the full local ledger database — distinct from the recovery phrase, which restores identity, not books.
App lock	Optional PIN or device-biometric lock with an idle timeout and app-switcher snapshot hiding, so an unlocked or backgrounded device doesn't expose the ledger at a glance.
Full app localization	The app's interface, input, and error messages in dozens of languages spanning East Asian, European, global-major, and every major Indian language family — with money still formatted by each currency's own convention regardless of chosen language.
Shared UI components	A small set of reusable widgets — destructive-action confirmation, money entry, entity pickers, status banners — used consistently everywhere that shape of UI appears.
User guide	An accurate, end-user guide covering every shipped screen and flow, never describing planned-but-unbuilt functionality.
Contributor guide	The root-level entry point explaining how to propose and submit a contribution.

Why The Integrity Feature Matters

For a normal user, the value is not the phrase "tamper-evident ledger." The value is that financial history becomes harder to rewrite quietly. If an old amount, date, description, or link in the history is changed outside the app, the app can detect that the chain no longer matches and keep that damaged part out of balances.

That helps when restoring a backup, checking whether a local database was damaged, reviewing an old mistake, or exporting records for an accountant. The app still cannot prove that a transaction was truthful when originally entered; it can prove whether the stored history still matches what was signed at the time.

This capability follows the same broad ideas behind accounting audit trails and tamper-aware logs: keep enough chronological evidence to reconstruct what happened, and protect that evidence from silent change. For background, see OpenStax on accounting audit trails, NIST's audit-trail definition, and OWASP's logging guidance.

This list reflects the specs under openspec/specs/ as of when this page was last updated by hand — see the repository for the current, authoritative list.

The privacy policy is the public description of on-device storage and the two optional network lookups, kept in sync with the iOS privacy manifest.