the spine
every cross-reference every module asserts, in one list — the visible proof that nothing links pairwise and nothing is copied. a link is a fact too, and each one below has exactly one home.
The plan
One program that runs the whole business — books, costs, stock, orders, shipping, and the seams between them — living on your own disk, in plain text you can read without it.
Customer zero is Iron Roots Supply. It is pre-revenue with zero sales ever, and that is not a problem to route around — it is the reason the order below is what it is. There are no hours being lost yet. There is a business being set up correctly before it starts.
Why not just buy one
Because bookkeeping is already automated and that fight is lost. Intuit ships accounting agents, Basis raised $100M for them, Xero has an MCP server with write access. Categorizing bank lines better than the largest transaction corpus on earth is not a plan.
Every one of them stops in the same four places:
| Data boundary | They run books. They do not buy labels, run pours, or notice a component about to stock out before a scheduled batch. The labor is in the seams, and nobody owns the seams. |
| Wrong buyer | Basis, Puzzle, Truewind all sell to accounting firms. Nobody builds for the operator who is also the shipper and the formulator. |
| Custody | Your data lives in their cloud. Writing into QuickBooks is free; reading back out is metered. |
| Price | The weakest leg, and it does not need to carry weight. Checked live Aug 2026: Xero Early is $25 and includes inventory on every plan; QuickBooks Plus went $99 → $140. The earlier figures both understated and overstated. The case rests on the seams and on custody — not on price. |
On 27 Dec 2024 Bench Accounting went dark and locked ~12,000 businesses out of their own books mid-year-end, because a proprietary ledger meant nobody could move their data anywhere else.
The restated thesis: the incumbents automated bookkeeping; nobody automated the business, because the connective tissue lives in an operator's head and nobody will let you own the system that holds it.
The one chain
Everything else in this system is a variation on this. Build it once, completely, then generalize.
- Order arrives through the site — the operator's view starts here, not at the payout
- Paid through PayPal
- Picked from a batch of inventory — a lot, with a known cost
- Shipped through Pirateship, in a batch of labels bought in one pass
- Booked correctly — which is five legs, not two: gross revenue, the PayPal fee, sales tax payable, and COGS relieved at ship because physical relief and cost recognition belong to the same event. PayPal deposits net: book revenue from the deposit and the bank reconciles perfectly against a wrong P&L
- Granted — a Fire·Skull order carries a course entitlement. "Fulfilled" means atoms shipped and grants made, or the chain can mark an order done that never was
- Reconciled, then the month is closed
Build order
Sequenced by what is unrecoverably expensive if it is not captured from day zero — not by what saves time this week. At zero revenue, nothing saves time yet. Money and costs are the only things you cannot go back and reconstruct.
Who writes what
"Exactly one home per fact" is only a slogan until it names names. Every row has exactly one writer; every other copy is a generated, read-only view. /heart is the pail until each function's replacement actually ships — one dated flip at a time, never a big-bang cutover, and never two live writers.
Who is already trusted
The honest version. "Never trust anyone's server" was already untrue as printed — the transport chosen to satisfy it is itself someone's server.
What does not pause
A generated view of the compliance calendar — web/data/calendar.json
is the one home of every deadline, and the
calendar module is where they
are acted on. This table restates nothing; it reads the same file.
What it inherits
The same method the whole workshop was built by: take the single sharpest thing from each, never the whole product. Ideas are inherited; architectures never are — five borrowed modules means five data models that disagree.
| Beancount | A parser that rejects an unbalanced entry — arithmetic as the guardrail, not attention |
| Git | History nobody can quietly rewrite |
| ERPNext | A real bill of materials, with yield loss inside the unit cost |
| QuickBooks | Reconciliation as a ritual you perform, not a report you read |
| Bank feeds | Capture should be automatic. Typing is the bug |
| Pirateship | Do not rebuild what is already cheapest — wrap it |
| /heart | Batch-as-lot, and cost-per-gram as a first-class number |
The rule that settles arguments: exactly one home per fact. Money lives in the ledger and nowhere else. Stock lives in inventory and nowhere else. Anything needing a number asks whoever owns it.
What it will never do
Walled off by law or universal practice. No amount of model quality moves these, and a system that pretends otherwise is lying to you.
- Sign a tax return, or represent you before the IRS
- Audit, review or compile — those are attest work. This performs preparation, and every statement it prints says so on its face
- Give legal judgment — entity choice, contract terms, worker classification
- Approve money leaving the business. Autonomy is earned by widening the batch under one approval, never by removing the approval
- Store a card number or a banking credential. Payment events only
- Draft a health, drug or disease claim. No outbound copy ships without passing a deterministic wordlist lint — Salve·Me never says wound, heal or infection; Bug·Bane never names a disease, which alone would void its 25(b) exemption
And one thing it must declare rather than drift into, because at this size the ledger's method silently becomes the tax method: cash-basis overall, inventory as materials deducted at ship under §471(c); the first return will conform.
Everything else — capture, classify, post, reconcile, allocate, schedule, draft, remind, prepare-for-filing, reorder — is fair game, and it is 90%+ of the hours.
Where it lives
| Ledger | Plain-text double entry, in git, on your disk. Readable in Notepad in ten years with no software at all |
| This page | Static files reading generated JSON — no second server, no API to secure, works with the network down |
| Off-machine | Ciphertext only, keys stay here. An encrypted bundle to a private repo; the key never leaves this PC and is written on paper. Bench is a portability lesson, not a single-copy one — "nothing off this PC" made the retention policy equal one consumer disk's lifespan, and quietly voided "history nobody can rewrite," because git on one disk rewrites fine |
| Ladder | (a) second disk at every close — unavailable, this box has only C: · (b) encrypted bundle to a private repo — running now, restore-verified · (c) restic to object storage, pennies |
🔴 If Matt can't do this himself
The runbook a stranger could follow — refunds, where the books are, what has a deadline. Print it. Whoever needs it is the person who cannot sign in, so the page is a printing tool and the paper is the safety net.
🔴 Open the break-glass page