QUIDZ
refusing the outbound payment that would have gone out twice.
A delivery that arrives twice, out of order, or never must not move money twice. This is the ledger that makes sure of it, and the reconciliation that proves it afterwards.
- Tests
- 183
- Python
- 3.11 to 3.14
- Release
- v0.1.0
The demo, as it really ran
$ uv run quidz demo --scenario adversarial --db /tmp/quidz-demo/quidz.db
QUIDZ demo scenario adversarial seed 0 breaks amount-mismatch, drop, duplicate, reorder, replay, tamper, unmodelled transport in-process, no socket database /tmp/quidz-demo/quidz.db delivery log /tmp/quidz-demo/quidz.db.jsonl RECEIPT deliveries 17 accepted 14 duplicate 0 in_progress 1 rejected 2 (signature 1, replay 1) DRAIN applied 11 noop_duplicate 1 parked 2 dead_lettered 1 retried 2 LEDGER PAYMENT AUTHORIZED CAPTURED REFUNDED STATUS order-YBMEWG9S 45.50 EUR 0.00 EUR 0.00 EUR capture_failed order:MB9WJKNY 196.00 GBP 196.00 GBP 196.00 GBP refunded pi_C29cZ86wXAsjLR2X 33.50 USD 22.11 USD 7.29 USD partially_refunded pi_PCSkRc69KhZqGkJV 128.50 EUR 128.50 EUR 0.00 EUR captured pi_W7bXVRVMG8MCWwSh 5300 JPY 0 JPY 0 JPY authorized EXCEPTION REPORT generated_at 1787012407 findings 12 (CRITICAL=1 BREAK=6 WARN=2 INFO=3) outbound BLOCKED ingest open blocked_ids order-CXSHRQTY, order:MB9WJKNY, pi_C29cZ86wXAsjLR2X, pi_W7bXVRVMG8MCWwSh rationale 1 critical and 6 break findings, exposure 19600 GBP, 10422 JPY, 1000 USD; outbound blocked for 4 id(s) under scope=payment SEVERITY KIND PAYMENT DELTA DETAIL CRITICAL missing_locally order-CXSHRQTY 12100 order-CXSHRQTY is at the provider and not in the ledger, 346806s old BREAK amount_mismatch pi_C29cZ86wXAsjLR2X -1000 pi_C29cZ86wXAsjLR2X net position differs by -1000 USD minor units BREAK amount_mismatch pi_W7bXVRVMG8MCWwSh -5300 pi_W7bXVRVMG8MCWwSh net position differs by -5300 JPY minor units BREAK fee_gross_net pi_W7bXVRVMG8MCWwSh 5122 settlement net 5122 against capture gross 0 on pi_W7bXVRVMG8MCWwSh is 10000 bps, tolerance 500 bps BREAK parked_stale order-CXSHRQTY - a delivery for order-CXSHRQTY has been parked 1206s waiting for its prerequisite, limit 900s BREAK status_mismatch pi_W7bXVRVMG8MCWwSh - pi_W7bXVRVMG8MCWwSh is authorized in the ledger and captured at the provider [remote_ahead] BREAK unsettled_past_sla order:MB9WJKNY 19600 order:MB9WJKNY captured 19600 GBP, 346806s old and absent from the settlement report
The remaining 19 lines of the same run
WARN unknown_remote_row EYQCVTMRYEBHXNR9 - settlement row EYQCVTMRYEBHXNR9 joins to no ledger payment WARN unknown_remote_row PAYOUT_BATCH_0001 - settlement row PAYOUT_BATCH_0001 joins to no ledger payment INFO fee_gross_net pi_C29cZ86wXAsjLR2X -89 settlement net 2122 against capture gross 2211 on pi_C29cZ86wXAsjLR2X is 403 bps, tolerance 500 bps INFO fee_gross_net pi_PCSkRc69KhZqGkJV -397 settlement net 12453 against capture gross 12850 on pi_PCSkRc69KhZqGkJV is 309 bps, tolerance 500 bps INFO in_flight order-YBMEWG9S - order-YBMEWG9S diverges but is 2934s old, inside the 3600s grace window COUNTERS events_received 17 signature_rejected 1 replay_rejected 1 deduped 1 applied 11 parked 2 dead_lettered 1 drift_info 3 drift_warn 2 drift_break 6 drift_critical 1 oldest_unresolved_drift_seconds 346806
Output captured on 2026-08-31. It is committed to the repository and a test fails when it stops matching a live run, so this page cannot quietly drift from the code it describes.
Read it
- Source on GitHub the README carries the argument in full
- The whole toolset what these sixteen repositories argue together, and why there are sixteen
- Release v0.1.0 changelog and tag
The rest of the toolset
- QUACKZ deflating a backtest that only looks good because it was picked out of two hundred
- QUOTEZ market data an agent can read and cannot act on
- QUELLZ measuring what prompt-injection containment costs in utility as well as in attack rate
- QUESTZ stopping a scraper before it writes a CSV from a page that changed shape
- QUIZZ answering what a statistic said at the time, and refusing when it cannot
- QUARANTINEZ treating an outcome the venue never confirmed as terminal rather than as a retry
- QUENCHZ deciding in the open what a tool server gets free while it is still somebody's subprocess
- QUILTZ proving infrastructure code wrong without a cloud account, and saying what that cannot show
- QUAYZ telling a crash loop from an OOMKill, and naming the failure that no single field finds
- QUARRYZ keeping every version a statistical office published, and failing the build when it quietly issues another
- QUASHZ refusing a row whose outcome had not been decided yet when the decision would have been made
- QUALMZ a fixed number of looks at the holdout, where re-running the same configuration does not buy another
- QUEUEZ ordering a feed by its sequence, because on a real recorded session the clock goes backwards
- QUANDARYZ counting the distinct screens a component can settle into when its responses arrive out of order
- QUIETZ watching whether the data arrived rather than whether the server answered