How it works

Two clinics were acquired and kept their booking software. Payments arrive from two processors on different settlement clocks. Cancellations live in a spreadsheet a manager maintains by hand. None of these were designed to be added together, and none of them are wrong from where they sit.

Six stages, in order, on a systemd timer. Everything after this section is one of them explained. A hard control failing stops the run before export, so the console keeps the last figures that passed rather than showing new ones that did not.

Staging is written by ingest; everything below it is built by a numbered SQL file that declares the one table it produces, run top to bottom. Nothing is updated in place — each run rebuilds every model from staging, so the warehouse is a pure function of the files that have arrived. There is no accumulated state to drift, and re-running yesterday reproduces yesterday exactly. Each layer may only read the ones above it.

The acquired clinics kept their own patient numbering, so one person is PT-IRV-00123 in the booking export and LUM-IRV-C00123 in Stripe. Those are the same string with a different prefix — a documented fact about the migration, not a similarity that happens to score highly. Nothing here is matched on edit distance: a reference fitting neither shape is left unresolved and surfaced, because a payment attached to the wrong person’s chart is worse than one attached to nobody.

Supplier names are typed by an AP clerk, so they arrive as A Supplier Inc., A Supplier, Inc and a supplier inc. Punctuation and legal suffixes are stripped and the remaining tokens compared as a set — still a rule, still inspectable. The one that fits nothing is on the exception register with its money intact rather than folded into whichever supplier looked closest.

That is the shape of the decision. This is how it actually landed across every payment in the warehouse — each one records why it was classified the way it was, so a figure can be traced back to the evidence that produced it rather than to a rule someone believes ran.

The ladder is ordered by how much the evidence proves. A processor that declares what it sold beats a match on client, date and amount; that beats a match on date and amount alone; and a price that merely falls in a package band is the weakest rung of all. Anything reaching the bottom is contested or quarantined, never assigned to the most likely answer.

A medspa takes money long before it does the work. Someone buys six laser sessions in March and turns up for the last one in October, and the business owes them treatments in the meantime. Right now that is $2,674,656 held on the balance sheet: 2,024 sessions on packages the pipeline could schedule, plus $1,681,510 against packages it could not — a guest-checkout deposit with no customer reference buys something, but nothing in the files says what. Getting this wrong does not produce a small error; it produces a business that thinks it is profitable in March and cannot explain October.

The split is the whole design. A hard control asserts something that cannot be true of correct data — a duplicate primary key, a null in a required column, an identity that does not balance — and its failure stops the run before anything is published. A soft control reports a suspicion: a feed a little late, a contested share a little high. Suspicions are never allowed to stop a run, and never allowed to trigger an automatic repair, because a system that lets a machine act on a hunch will eventually act on the wrong one.

The shape above is the argument. Below it is the evidence: two of these that actually ran, read out of the run record — what the diagnostician was handed, what it chose, and what the gate did about it. Nothing here is illustrative.

The last stage writes a single file, pipeline.json, and the console reads it and draws it. The web tier holds no database connection, makes no network call, reaches no model, and performs no arithmetic that changes a figure — money is divided by a hundred once, when an integer number of cents becomes a string. That is not a style preference. A number computed at render time is a number no check ever saw, and the whole claim of this project is that what is on the screen was verified before the screen existed. A test fails the build on the commit that introduces a fetch, a database import, or a fourth runtime dependency. Two consequences you can see: the export is re-read on every request rather than imported, so the page cannot freeze at the moment it was built; and identities are quoted verbatim from the control that proved them rather than recomputed here, because a page that recalculates the identity it claims to have verified has verified nothing. A run that fails a hard check writes no figures at all — it writes only a health file saying so, which is what the banner at the top of these pages reads when the pipeline is blocked.

Everything above is the pipeline marking its own homework. So a second program reads the same delivered files with the standard library, reaches its own totals, and compares them to what was published. It imports nothing from the pipeline — a test asserts that structurally, by parsing its imports — which means it had to re-derive every format decision independently: that Stripe reports integer cents while everything else is decimal dollars, that a Square gross includes the tip, that refunds are ordinary negative rows, and that seven status words across two booking systems collapse to five outcomes. A verifier reusing the pipeline’s parsers would inherit its bugs and prove only that the code agrees with itself. It exits 0 when every claim holds, 1 naming the claim that does not, and 2 when the landing zone has changed since the export was published — the emitter runs on its own timer, and comparing across that boundary would report a difference that is not an error, which is the most expensive kind of false alarm because it looks like a finding. What it deliberately does not verify is revenue recognition itself: re-deriving that would be a second implementation rather than a check, and it says so in its own output rather than letting you assume otherwise.

Two timers run every fifteen minutes. The first plays the part of the seven source systems: it advances a business clock by six hours and re-exports the current month’s files, the way a great many real export jobs behave. The second runs the pipeline over whatever it finds. One simulated day passes per real hour, so the pipeline is genuinely processing data it has not seen before rather than re-reading a frozen folder and skipping everything — which would be unattended in name only.