A Ledger Behind the Cards

Zone 01

Clients
& Edge

📱

User app

installable web app
static build, native-ready shell

🗄️

Admin app

server-rendered, own session layer
internal surface only

🚪

Gateway

token check · request id
rate limits · one error shape

two front ends, two session models -
each matched to its own constraint

signed
request

Zone 02

Identity
& Instruments

🔑

Auth

hardened password hashing
rotating refresh · revocable sessions

👤

Account

profile shell
receive identifiers

💳

Cards

card numbers · tiers · limits
freeze · replace · close

own card

shared card

a shared card is its own instrument
on the owner's funding account

a card number is not an account number -
they are issued and used separately

operation
intent

Zone 03

Decisions
Before Money

⚖️

Risk

velocity · circular transfers
reputation · device signals

allow

hold

block

attempts are counted, not only successes

🧮

Economy

currencies · cashback programmes
quests · deposit and credit rules

📚

Versioned config

every rule change keeps a version
history says which one applied

whatever decides cannot move value -
it returns a decision, nothing else

approved
operation

hold · reversal
reason

Zone 04

Double-Entry
Ledger

🧾

Journal & postings

postings of one entry sum to zero

pending

posted

reversed

posted rows are never rewritten -
a correction is a new opposite entry

🗂️

One bucket per card

same currency, different card → different balance
no pooled user wallet

🔀

Explicit conversion

one currency per account and posting
quote · rate version · expiry · both sides

🔒

Holds · idempotency

holds move value, never hide it
durable keys, replay returns the first result

🧷

Reconciliation

balanced entries · projections match
no negative balance without credit

balances are projections -
rebuildable from postings alone

event in the
same commit

Zone 05

Fanout
& Ecosystem

📤

Outbox

state and event written together
at-least-once · versioned · dead letters

🔔

Notifications

in-app · push · email
realtime fanout after durable write

🧩

Ecosystem products

purchases · production income · market
own idempotency namespace per product

products learn an operation's status,
never a balance or a history

Points are not money

Cashback and event points live in their own append-only journal, and reach a card only through a confirmed redemption quote.

Settlement window

Points stay pending until the reversal window of the purchase behind them has closed, so a refund can never drive a balance negative.

Closed loop

The currencies are fictional by design: no withdrawal, no external transfer, no outside acceptance - and product copy has to say so.

Privacy & audit

Credentials are masked everywhere and absent from events and logs; history is hidden or archived, never deleted; access is audited.

Scaling ladder

Stateless services, config from the environment, health and readiness from day one - so one node grows into a cluster without touching code.