Ledgers
Which sets of books are connected, when each was last read and how much came back, and what is drafted and waiting for a named person to approve. Nothing here reaches a live system; the bridge is simulated.
Which sets of books are connected, when each was last read and how much came back, and what is drafted and waiting for a named person to approve. Nothing here reaches a live system; the bridge is simulated.
Counted from this application's own tables. Nothing on this screen has been read from a live Tally or Zoho instance.
Counted from this application's own tables. Nothing on this screen has been read from a live Tally or Zoho instance.
Connection health
Read onlyWhat is connected, when it was last read, and how much came back. Two systems, two cursors: Tally advances an AlterID — a monotonic integer stamped on every change — while Zoho advances a timestamp. They are not interchangeable and are not shown as though they were.
What is connected, when it was last read, and how much came back. Two systems, two cursors: Tally advances an AlterID — a monotonic integer stamped on every change — while Zoho advances a timestamp. They are not interchangeable and are not shown as though they were.
No ledger connection is recorded.
Each entity's books need a connection row before anything can be read from them or drafted back.
A cursor is how the bridge avoids re-reading the whole ledger. Losing one means a full re-read; moving one forward without having processed what it skipped means silent data loss, so it is only ever advanced after the batch it covers has been committed here.
A cursor is how the bridge avoids re-reading the whole ledger. Losing one means a full re-read; moving one forward without having processed what it skipped means silent data loss, so it is only ever advanced after the batch it covers has been committed here.
The approval queue
Awaiting approvalNo write to any accounting system happens without a stored, named human approval. Reads may be automatic; writes never are.
No write to any accounting system happens without a stored, named human approval. Reads may be automatic; writes never are.
Nothing is queued to post.
Nothing has been drafted for posting. That is the normal resting state: this application computes and drafts, and a person decides.
This is simulated
Out of scopeNothing on this screen reaches a real accounting system. Live Tally and live Zoho authorisation are out of scope, and every cursor, status and queue entry below is read from this application’s own tables.
Why an agent, and not a connection
The constraint is not a preference. It decides the whole shape of the bridge.
The constraint is not a preference. It decides the whole shape of the bridge.
Tally’s interface is a local XML server. It listens on the machine Tally is installed on and is never exposed to the internet — there is no inbound rule, no port forward and no static IP at the head office.
So nothing here connects to Tally. An agent runs beside it and dials outward: it reads from the local XML server, posts what it finds to this application, and asks whether anything has been approved for writing back. Every exchange is initiated from inside the network. That also means the bridge can never be more current than the last time the agent called, which is what the cursor and the last-read time above are for.
Write safety
Six guaranteesWhat has to be true before this application is allowed to write anything to a set of books it does not own.
What has to be true before this application is allowed to write anything to a set of books it does not own.
| Guarantee | What it means | State |
|---|---|---|
| Idempotency key | Minted when the draft is created, not when it is sent, so a retry after a timeout cannot post the same entry twice. | in the schema |
| Dry-run diff | The approver sees exactly what will change in the target system before approving, not a summary of it. | not built |
| Named approval | A stored approval against a named person. No write is automatic; reads may be. | in the schema |
| Closed-period guard | A closed period blocks drafting, not only posting — so nothing can sit in a queue waiting to violate a close. | in the schema |
| Reversal path | Every posting has a stated way to be reversed. Nothing is deleted; a correction is a new entry. | not built |
| Append-only audit log | The audit log takes inserts and nothing else. What happened cannot be edited afterwards. | in the schema |
The bridge is simulated, so none of these has been exercised against a real system. What is claimed here is the design the write path must satisfy before it is switched on, not a report that it has been.
The bridge is simulated, so none of these has been exercised against a real system. What is claimed here is the design the write path must satisfy before it is switched on, not a report that it has been.