About
LedgerTB is a local-first desktop bookkeeping app built around the trial balance. It takes a client from raw bank transactions to books that tie, then through a close package a reviewer can sign. Everything lives in one encrypted file on your machine, with no server, no account, and no vendor holding your data.
It is for CPAs and bookkeepers keeping several clients’ books who want a ledger they can read, run, and change.
- Real double-entry. If an entry does not balance, it does not post. Templates and schedules generate recurring drafts without duplicates.
- Bank CSV imports with saved per-bank formats, duplicate detection, and undo.
- AI categorization that only suggests. Claude proposes a category; nothing posts until you accept it. Every assistant action is stamped (AI) in the audit trail.
- Book Review. A deterministic integrity sweep for unbalanced entries, unposted imports, broken links, and quiet accounts, plus an AI consistency pass.
- Close Map. Lead sheets, support references, variance explanations, and append-only preparer and reviewer signoff that reopens if anything changes.
- Reports and a close package. Every core statement plus GL and bank rec, exported as PDF and Excel with the client’s own branding.
Status: v1.7.0 shipped on 2026-08-30, the twentieth release in twenty days. The repo is public under MIT. I do not have a confirmed firm running its books here yet, so I call it shipped, not adopted.
Where it fits. LedgerClaw is the hosted firm OS. LedgerTB owns the local-first claim: an encrypted file, no hosted database. Its close package is what LedgerPDF turns into a binder and what Tax Prep Ledger reads as a trial-balance source.
How I built it
LedgerTB started in January 2026 as ProBooks, was rebuilt from July, renamed in August, and went public as v1.0.0 on 2026-08-11. Built and maintained with Claude Code.
- Plain Python, on purpose. Streamlit renders inside a native pywebview window and PyInstaller freezes the whole thing. No ORM, just hand-written SQL and numbered migrations. Money is integer cents everywhere.
- Encryption you cannot skip. SQLCipher with a passphrase-derived key held in the OS credential vault. The release pipeline refuses to ship a build where encryption is unavailable.
- The MCP server is the same binary. Twenty-five tools with three access levels, read, propose, and post, enforced by a SQLite authorizer on every connection rather than by a prompt. No level can grant UPDATE or DELETE.
- Agents on branches. Hardening, security automation, and housekeeping ran on their own agent branches and landed through pull requests, including one fix authored through Codex.
- Packaging was the hard part. The repo’s CLAUDE.md keeps a long “learned the hard way” log on signing, notarization, and Windows smoke tests. That is where twenty releases in twenty days went.
