CyberGuardPlus
Detection is easy. Closing the loop is the work.
Security operationsPayment operations · Case 01 of 03
What actually happened to the money?
When a ledger, a balance and three provider records disagree, somebody has to reconstruct the truth by hand. TrustLedger is the system that holds each disagreement, what it puts at risk, and the evidence that settles it.
The problem.
A company running money across two or more providers has no single answer to a simple question: what happened to this payment? The internal ledger says one thing, the provider webhook says another, the settlement statement a third. Reconciling them is manual, and the reconstruction is thrown away once the case is closed.
The wedge is deliberately narrow and deliberately read-only. The pilot deployment ingests, reconciles, raises exceptions and preserves evidence. It does not move or route customer money. The repository does contain a tested execution engine with a double-entry ledger and a fraud gate, and it stays, but it sits outside the first sale on purpose.
The path through the system.
One sequence, in order. Each step exists because the next one cannot be trusted without it.
- 01Provider webhookAn event arrives from a bank, a payment service provider, or a settlement file.
- 02Canonical eventIt is normalised into one internal shape, so five providers stop meaning five formats.
- 03Immutable evidenceThe original is preserved before anything derived from it exists.
- 04Ledger comparisonThe canonical event is compared against the authoritative double-entry ledger.
- 05Reconciliation mismatchA disagreement becomes a typed issue with a severity and an amount at risk.
- 06Operator exceptionIt is assigned to a named person with a deadline, not left in a queue.
- 07Resolution audit trailAssignment, reassignment and resolution are all recorded and readable afterwards.
The interface.
What it is built from.
- Core
- Java · Spring Boot · Spring Security OAuth2 resource server
- Data
- PostgreSQL · Flyway · Spring Data JPA
- Events
- Kafka · Redpanda · transactional outbox
- Testing
- Testcontainers, against real PostgreSQL and Redpanda
- Operations
- Micrometer · Prometheus · Actuator
- Console
- Next.js 16 · React 19 · TypeScript
What was measured.
Every figure below is copied from this product’s own tracker, not written for this page.
TrustLedger · evidenceRev 2026-09-08
- Full backend suite, real containers0 failures, 0 errors, 0 skipped, across 118 test classes
- 522 / 522
- Database migrationsUnique migrations, highest V49, validated by script
- 47
- Reconciliation exception operationsAgainst PostgreSQL, including tenant isolation and unassignment history
- 8 / 8
- Statement-to-exception traceabilityIncludes a second tenant receiving 403 on another tenant’s issue
- 9 / 9
- Console production buildTypeScript clean, public-exposure test passing
- 27 routes
What is not proven.
These stay listed until a measurement replaces them. They are part of the evidence, not a caveat attached to it.
- The suite is run locally. It is not run in CI, so nothing enforces it on a push.
- This is local verification, not production. No customer has used it and no customer data has touched it.
- The market gate is INCOMPLETE: 0 conversations and 0 qualified interviews recorded. Under the operating rules that blocks new post-gate infrastructure, and it is why this page exists instead of a longer roadmap.
- One intermittent failure is unexplained. A Flyway SSL connection error failed two contexts in a whole-suite run, then passed 2/2 in isolation and 522/522 on re-run. It is recorded rather than retried away, because a failure that disappears on re-run teaches a team to re-run instead of look.
What I would do next.
- 01Put the suite in CI, so 522 passing is a gate rather than a habit.
- 02Explain the intermittent Flyway failure instead of tolerating it.
- 03Run one incident reconstruction with a real payment operations team. That is the gate, and no amount of further engineering substitutes for it.
The other systems.
Agent Clearing Network
One mandate. One authorised action.
Agent authority and settlement