CapVeri

The decision

CapVeri’s reconciliation engine was ported from Python to TypeScript, and the Python became a differential oracle: kept in the repository, under continuous test, deliberately never deployed, and checked against every change to the shipped TypeScript engine. Twenty-one property-based Hypothesis suites generated inputs across the money math and asserted that the two engines agreed on a tenant’s bill to the penny.

The written mandate governing the practice set a strict standard for what agreement could prove: “Matching the Python oracle is NOT automatically correct, AND diverging from it is NOT automatically a bug.” Every disagreement between the two engines was checked against lease language and accounting practice before it counted as a bug, with the ruling recorded at the call site.

That scrutiny is what makes the next fact matter. Five places were found where the TypeScript engine deliberately disagreed with the Python reference, each adjudicated and recorded. The sixth is the one the discipline was built to catch: a Stripe subscription-status mapper defaulted unrecognized statuses to "active" access in both engines, so the two engines agreed and the reconciliation was still wrong. A bug two independent implementations get wrong the same way is exactly the class differential testing is supposed to be blind to, and it surfaced anyway.

A separate hardening pass through the same money-parsing code found a second bug from the same family: a Unicode minus sign (U+2212), used in place of an ASCII hyphen in some source figures, was dropped by the amount parser instead of read as a negative sign, turning a credit into a charge. The fix widened the parser’s negative-sign handling to cover the Unicode minus alongside a bare - and parenthesis notation.

The same idea outlived the product. CAMAudit v2 is a second engine for the same problem, started afterwards in a new repository from an empty tree rather than forked from this one, for the reason the Python oracle existed here: two independent implementations that agree are evidence a single implementation cannot produce on its own.

Architecture

Four independently deployed Cloudflare Workers ran in front of a single Supabase Postgres database, with no origin server and no containers anywhere in the request path. capveri-app served a React 19 SPA and reverse-proxied /api/* to capveri-api, a Hono Worker holding 43 route modules, a queue producer and consumer, and two Durable Objects.

capveri-marketing was a separate Next.js site built with OpenNext, 275 MDX pages deep. Reconciliation and lease extraction ran as jobs on five typed Cloudflare Queues, two of them backed by dead-letter queues, rather than inside a request/response cycle.