MEGAccountant

Local-first accounting with evidence-backed AI review

Comment

Inspiration

Accounting software often asks people to choose between convenience, explainability, and control over sensitive records. We wanted a local workspace where every number can be traced back to evidence, missing facts remain visibly missing, AI can help without becoming the bookkeeper, and a human remains responsible for every consequential accounting decision.

What it does

MEGAccountant opens into one device-local owner’s durable Book without an online account or a hosted MEGAccountant database. The owner can preview and explicitly commit a fictional CSV, or review watch-only wallet evidence from an exact public address or an ENS name.

ENS handling is intentionally narrow: MEGAccountant previews only explicit Ethereum (coin type 60), World Chain (2147484128), and Solana (501) records. It never guesses an address, copies an Ethereum address into another chain, crawls subnames, or requests a seed phrase, private key, signature, or signing authority.

Imported activity retains immutable source evidence and an honest completeness state. If fiat value or classification is missing, posting remains blocked until the owner supplies it. Review shows the provenance and exact proposed journal effect. Optional GPT-5.6 assistance can explain or suggest a classification only after Book-level enablement, explicit financial-context consent, and provider configuration. It remains a proposal and cannot post or change the books.

After human preview and confirmation, Rust validates authorization, optimistic version, idempotency, and equal debits and credits. It appends the balanced journal, exposes the proof in Ledger, and updates the authoritative profit-and-loss report from the same posted records. The local SQLite state survives restart.

How we built it

The accounting and authorization core uses Rust 2024. Axum and Tokio expose a loopback HTTP API, SQLx persists forward-only SQLite migrations, and Serde defines explicit request and response contracts. React, TypeScript, and Vite provide the workbench, while Electron supplies the desktop boundary.

Financial amounts use integer minor units. Source events and audit events are append-only. Posted journals are immutable. Exact retries are idempotent, conflicting key reuse is rejected, and optimistic versions prevent lost updates. Missing prices, values, classifications, and completeness information remain missing instead of being invented to finish a workflow.

OpenAI requests originate only from the local Rust sidecar. The optional Responses API adapter minimizes context, uses structured output with store: false, validates citations and prohibited actions, and returns a proposal rather than accounting authority.

For the Build Week submission, we froze one coherent path: Accounts → Review → Ledger → profit-and-loss Reports, with essential Settings. Broader backend capabilities remain outside active navigation and are not presented as submitted workflows.

Challenges

  • Compressing a broad accounting codebase into one coherent path without weakening accounting or security invariants.
  • Treating Ethereum, World Chain, and Solana ENS records as distinct explicit sources without inferring addresses across chains.
  • Representing partial wallet history and missing value honestly instead of inventing completeness.
  • Keeping model output bounded, cited, consented, and unable to approve or post.
  • Proving that the rendered desktop path reaches the real Rust sidecar and migrated SQLite database, then preserves the same result across restart.
  • Freezing a large integration tree without making deferred routes reachable.

Accomplishments

  • Built a real local evidence-to-journal workflow rather than a static mock or a precomputed result.
  • Preserved immutable source evidence, explicit missing-value blocking, owner classification, balanced posting, Ledger drilldown, and authoritative P&L recalculation through shared Rust services.
  • Exercised a deterministic fictional three-record ENS fixture through the real React, Rust sidecar, and fresh schema-56 SQLite path: three distinct sources, visibly partial history, owner-confirmed value and classification, human approval, balanced lines, a +$42.17 P&L effect, and exact restart verification. This is mock-provider evidence, not a live-provider claim.
  • Inventoried all 2,035 handwritten production bodies reachable through the frozen MVP—1,369 Rust, 468 web, and 198 desktop—and mapped each meaningful branch to named behavior evidence.
  • Passed the Session 3 web, desktop, and Rust gates, including 389 Vitest tests, 26 Node contracts, 135 desktop tests, API 146, application 210, persistence 400, strict Clippy, migration integrity checks, and the workspace build.

What we learned

Local-first is an architectural constraint, not a marketing label: identity, secrets, migrations, restart behavior, and failure recovery all have to work without a hosted MEGAccountant service.

Missing financial data deserves a first-class state. AI safety becomes clearer when deterministic calculations, proposal generation, human approval, and execution are separate phases. We also learned that release evidence is version-specific: a previously tested installer becomes stale as soon as its embedded schema and validation contract no longer match current source.

What’s next

The immediate next step is to freeze the current source in one clean tested commit and qualify a current schema-56/native-validation-v6 macOS Apple-silicon judge artifact through normal installation, first launch, the fictional golden path, shutdown, restart persistence, checksum, manifest, SBOM, and provenance checks.

After Build Week, we plan to qualify configured live watch-only providers, produce separately tested Windows and Linux artifacts, and revisit deferred reconciliation, close, portability, tax, rules, and agent workflows without retroactively expanding the submitted MVP.

Honest boundaries

The demo uses fictional CSV data and deterministic mock wallet/provider evidence. It is not evidence of a live provider or live GPT-5.6 call. MEGAccountant is pre-release software for macOS arm64 and is not production-ready, filing-ready, audited, signed, or notarized. The source is available for non-commercial use under PolyForm Noncommercial 1.0.0; that license is not OSI-approved.

Built With

Share this project:

Updates