Four commitments,and what they cost us.
Principles are cheap to publish and expensive to keep. Each of these comes with the concrete practice it forces — a principle with no consequence is decoration.
Correctness before surface
In systems that touch money, a polished interface over a ledger that drifts is worse than nothing — it hides the problem until an audit finds it. We build the invariant first and make the interface report it honestly, including when the answer is unwelcome.
The ledger balances on every write, and a total we cannot compute correctly is shown as unavailable rather than as a plausible number.
Prove, don't claim
We would rather show a mechanism doing its job than describe it with adjectives. Demonstration data is labelled as demonstration data, and a figure on a page is one we can point at in the source that produced it.
No invented metrics, no benchmark without its method, and no customer logo we cannot name.
The failure modes are the work
The happy path is the easy fifth of any system. Retries, webhook replays, partial outages, currency edges, and test rows that must never reach production are where the engineering actually lives — and where the cost of getting it wrong is real.
Idempotency on every mutation, isolation enforced at the database, and a test boundary that batch jobs respect.
No leverage traded away
We do not couple a client to a vendor because it is convenient for us, and we avoid dependencies that are hard to leave. If a component should be replaceable, we design the seam and prove it by replacing it.
The payment processor in our own product is a config value, because that is the only way to know the seam is real.
A retry is not a rare event.
Networks drop responses, users press the button twice, and a queue redelivers on its own schedule. The question is never whether the same charge arrives twice — it is what happens when it does.
Send it a few times, then take the key away and send it again. The dedup store on the right is the real one; nothing here is a recording.
Every send carries the same Idempotency-Key, the way a client retry does.
0 requests sent · 0 charges applied
However many times the request arrives, the balance moves once.
If that matches how you want your software built, say hello.
And if it does not, that is useful to know early too.