Sealed Books

Demo

About

Sealed Books is an institutional-grade double-entry accounting ledger that cryptographically guarantees financial period-close finality. In traditional ERPs like QuickBooks or NetSuite, accounting records sit in mutable SQL databases where database administrators or compromised credentials can quietly alter historical journal entries after financial statements are signed. Sealed Books eliminates this counterparty risk through mathematical zero-trust proofs. Key Capabilities: - Strict Double-Entry Engine: All transactions validate Debits == Credits in integer minor units (cents) to avoid floating-point errors. - Deterministic Binary Merkle Tree: Every balanced entry is canonicalized and hashed using SHA-256 into a cryptographic ledger root. - Four-Eyes Multi-Sig Quorum: Period close enforces statutory separation of duties (2-of-2 multi-sig). Both the Financial Controller and an Independent Auditor must review and sign off. - Frictionless Identity via Privy Enclaves: Users log in with standard passwordless email OTP. Sealed Books dynamically provisions Ethereum server wallets in Privy hardware enclaves governed by enterprise signing policies. No seed phrases, browser extensions, or gas tokens. - Hedera Consensus Service Anchoring: The dual-signed seal is published directly to Hedera Testnet topic 0.0.10462941, securing an immutable, globally ordered consensus timestamp. - Instant Forensic Tamper Detection: Anyone—an auditor, bank, or tax authority—can independently verify local database records against the public Hedera Mirror Node over standard HTTP. If a single entry is modified, deleted, or backdated, the verification engine instantly detects the tamper and pinpoints the exact record ID and discrepancy. - Autonomous AI Audits via Bazantic: Features an x402 micropayment gateway and Model Context Protocol (MCP) server so AI agents (Claude, Cursor, autonomous bots) can audit company books on demand with just an accounting period ID.

How it's made

Sealed Books is engineered as a high-performance, memory-safe monorepo across Rust, TypeScript, and native desktop runtimes: Architecture & Tech Stack: - Core Cryptography & Accounting (crates/core): Written in Rust with zero external dependencies for pure determinism. Implements balanced journal arithmetic, canonical JSON leaf sorting, deterministic binary SHA-256 Merkle trees, and trial balance calculations. - Backend Server (apps/server): Built with Axum, Tokio, and LibSQL / SQLite. Features a custom REST API supporting both local embedded SQLite files and remote Turso clusters. - Web & Native Desktop Clients (apps/web, apps/desktop): Built with React 19, TypeScript, Tailwind CSS v4, and Shadcn UI. The desktop client compiles into a lightweight native binary using Tauri v2. Partner Technologies & Integrations: - Privy B2B Policy Server Wallets: Dynamically provisions isolated Ethereum server wallets via Privy's REST API during user registration and team invitations. Signing operations use secp256k1 via Privy's secure enclaves, enforced by organizational policy ID uqwuyziko7po5b6xtfbqug4z. The server enforces separation of duties (approver_1 != approver_2) so controllers cannot co-sign their own books. - Hedera Consensus Service (HCS): Dual-signed compact binary seal payloads are broadcast directly to Hedera Testnet Topic 0.0.10462941 via the Hedera Rust SDK. Verification is completely decentralized: the server queries the public Hedera Mirror Node (https://testnet.mirrornode.hedera.com) over HTTP without needing custom nodes or API keys. - Bazantic MCP Gateway: Deployed an x402 micropayment gateway (https://sealed-books.bazgateway.com) exposing an MCP server. Published the "Sealed Books Accounting Period Audit" recipe enabling AI agents to verify books and inspect cryptographic proofs autonomously. Testing & Verification: The codebase includes 72 automated unit, integration, and live enclave tests covering canonical serialization, Merkle tree construction, secp256k1 signature recovery, and real Hedera consensus verification.