QUIDZ

refusing the outbound payment that would have gone out twice.

A delivery that arrives twice, out of order, or never must not move money twice. This is the ledger that makes sure of it, and the reconciliation that proves it afterwards.

Tests
146
Python
3.11 to 3.14
Release
v0.1.0
Licence
MIT

The demo, as it really ran

$ uv run quidz demo --scenario adversarial --db /tmp/quidz-demo/quidz.db

QUIDZ demo
  scenario      adversarial
  seed          0
  breaks        amount-mismatch, drop, duplicate, reorder, replay, tamper, unmodelled
  transport     in-process, no socket
  database      /tmp/quidz-demo/quidz.db
  delivery log  /tmp/quidz-demo/quidz.db.jsonl

RECEIPT
  deliveries    17
  accepted      14   duplicate 0   in_progress 1
  rejected      2   (signature 1, replay 1)

DRAIN
  applied 11   noop_duplicate 1   parked 2   dead_lettered 1   retried 2

LEDGER
  PAYMENT                     AUTHORIZED        CAPTURED        REFUNDED  STATUS
  order-YBMEWG9S               45.50 EUR        0.00 EUR        0.00 EUR  capture_failed
  order:MB9WJKNY              196.00 GBP      196.00 GBP      196.00 GBP  refunded
  pi_C29cZ86wXAsjLR2X          33.50 USD       22.11 USD        7.29 USD  partially_refunded
  pi_PCSkRc69KhZqGkJV         128.50 EUR      128.50 EUR        0.00 EUR  captured
  pi_W7bXVRVMG8MCWwSh           5300 JPY           0 JPY           0 JPY  authorized

EXCEPTION REPORT
  generated_at  1787012407
  findings      12  (CRITICAL=1 BREAK=6 WARN=2 INFO=3)
  outbound      BLOCKED
  ingest        open
  blocked_ids   order-CXSHRQTY, order:MB9WJKNY, pi_C29cZ86wXAsjLR2X, pi_W7bXVRVMG8MCWwSh
  rationale     1 critical and 6 break findings, exposure 31022 minor units; outbound blocked for 4 id(s) under scope=payment

  SEVERITY KIND                      PAYMENT                DELTA  DETAIL
  CRITICAL missing_locally           order-CXSHRQTY         12100  order-CXSHRQTY is at the provider and not in the ledger, 346806s old
  BREAK    amount_mismatch           pi_C29cZ86wXAsjLR2X     -1000  pi_C29cZ86wXAsjLR2X net position differs by -1000 USD minor units
  BREAK    amount_mismatch           pi_W7bXVRVMG8MCWwSh     -5300  pi_W7bXVRVMG8MCWwSh net position differs by -5300 JPY minor units
  BREAK    fee_gross_net             pi_W7bXVRVMG8MCWwSh      5122  settlement net 5122 against capture gross 0 on pi_W7bXVRVMG8MCWwSh is 10000 bps, tolerance 500 bps
  BREAK    parked_stale              order-CXSHRQTY             -  a delivery for order-CXSHRQTY has been parked 1206s waiting for its prerequisite, limit 900s
  BREAK    status_mismatch           pi_W7bXVRVMG8MCWwSh         -  pi_W7bXVRVMG8MCWwSh is authorized in the ledger and captured at the provider [remote_ahead]
  BREAK    unsettled_past_sla        order:MB9WJKNY         19600  order:MB9WJKNY captured 19600 GBP, 346806s old and absent from the settlement report
  WARN     unknown_remote_row        EYQCVTMRYEBHXNR9           -  settlement row EYQCVTMRYEBHXNR9 joins to no ledger payment
  WARN     unknown_remote_row        PAYOUT_BATCH_0001          -  settlement row PAYOUT_BATCH_0001 joins to no ledger payment
  INFO     fee_gross_net             pi_C29cZ86wXAsjLR2X       -89  settlement net 2122 against capture gross 2211 on pi_C29cZ86wXAsjLR2X is 403 bps, tolerance 500 bps
  INFO     fee_gross_net             pi_PCSkRc69KhZqGkJV      -397  settlement net 12453 against capture gross 12850 on pi_PCSkRc69KhZqGkJV is 309 bps, tolerance 500 bps
  INFO     in_flight                 order-YBMEWG9S             -  order-YBMEWG9S diverges but is 2934s old, inside the 3600s grace window

COUNTERS
  events_received                         17
  signature_rejected                       1
  replay_rejected                          1
  deduped                                  1
  applied                                 11
  parked                                   2
  dead_lettered                            1
  drift_info                               3
  drift_warn                               2
  drift_break                              6
  drift_critical                           1
  oldest_unresolved_drift_seconds     346806

Output captured on 2026-08-24. It is committed to the repository and a test fails when it stops matching a live run, so this page cannot quietly drift from the code it describes.

Read it

The rest of the toolset