kami
da647e87d0
The trust boundary is zenmoney, not maven — they already hold his bank sessions. So the poller reads /v8/diff/ and writes totals as facts(kind=env, source=poll:zenmoney); core reads those back when he asks and never sees the token. internal/zenmoney sums transactions per currency over a window, skipping tombstoned rows and transfers between his own accounts, and refuses to encode a summary built from zero transactions. That refusal is the whole design: a failed or empty read writes nothing and leaves the last good total alone, because a zero recited as fact is worse than silence. No currency conversion either — a figure he can check against his bank beats one he cannot. Off unless configured, and the token is read from a FILE rather than a flag so it never lands in `ps`, in docker-compose.yml, or in shell history. Nothing about the money is search input, no tick rule reads the keys, and the log lines name keys, never figures. The live-credential half is BLOCKED: there is no zenmoney account or token here, so everything is verified against a recorded diff fixture.
51 lines
1.0 KiB
Plaintext
51 lines
1.0 KiB
Plaintext
# Built binaries (root only)
|
|
/mavend
|
|
/mavenclient
|
|
/mavsttd
|
|
/mavttsd
|
|
/mavweb
|
|
/mavpoll
|
|
/mavcaldav
|
|
/mavwaked
|
|
|
|
# Certs (private keys, don't commit)
|
|
certs/
|
|
|
|
# Dependencies (fetch/build, not vendored).
|
|
# Both forms on purpose: 'deps/' misses a symlink named deps, and agents working
|
|
# in a git worktree symlink these in from the main checkout.
|
|
deps/
|
|
deps
|
|
|
|
# ML models (large, downloaded separately) — specific dirs, not blanket,
|
|
# because models/seeds/*.txt are small, tracked files the classifier needs.
|
|
/models/embedder/
|
|
/models/stt/
|
|
/models/tts/
|
|
/models/llm/
|
|
# Symlink forms, same reason as deps above.
|
|
/models/embedder
|
|
/models/llm
|
|
|
|
# Runtime data
|
|
*.db
|
|
|
|
# Deploy secret (the at-rest db key) — never commit
|
|
deploy/db_key.env
|
|
# Deploy secret (telegram bot token + chat id) — never commit
|
|
deploy/telegram.env
|
|
# zenmoney API token, read by mavpoll (never in argv, never committed)
|
|
deploy/zenmoney.token
|
|
|
|
# Temp files
|
|
/tmp/
|
|
|
|
# opencode config (per-project, not for sharing)
|
|
opencode.json
|
|
|
|
# Test coverage output
|
|
coverage.out
|
|
|
|
# Agent worktrees and local agent state
|
|
.claude/
|