Private books for shielded Zcash — Mac-native, local-first. Import a viewing key, classify income / change / expense, and share a scoped proof pack with your accountant. Cannot spend ZEC.
Download notarized v0.1.0 · 100% Transparent Code under PolyForm Shield (not casual “open source”)
CipherPay gets you paid privately. ZBooks runs team treasury. SaneBooks is the Mac CPA layer: change ≠ income, and an expiring .sanebooks pack — not a permanent UFVK.
Shielded Zcash already has viewing keys (ZIP 316). Merchants can take ZEC privately. What is missing is an accountant layer: classify change so it is not counted as income and hand a CPA a scoped artifact — not a permanent UFVK and not an unreviewed wallet dump. Fiat marks remain user/import supplied; SaneBooks does not currently claim a live price-source integration.
Community signal: Is anyone actually using viewing keys for business accounting? (Jun 2026).
| Step | What happens |
|---|---|
| 1 | Import a UFVK (uview…) for bookkeeper mode (or UIVK for receivables-only, with a permanent degraded-mode banner) |
| 2 | Sync compact history via lightwalletd (ZcashLightClientKit 2.7.0-rc.4; demo via SANEBOOKS_FORCE_MOCK=1) |
| 3 | Tag rows: Income / Expense / Change / Fee — change is excluded from income totals |
| 4 | Build an encrypted, Reader-expiring .sanebooks pack or intentionally export non-expiring plaintext CSV/PDF |
| 5 | Accountant opens Reader mode — read-only rows, no vault key, no chain sync |
The Appearance settings include persisted Standard, Large, and Extra Large text sizes. This is app-managed because Apple documents that SwiftUI Dynamic Type does not change text size on macOS; the large layouts scroll instead of compressing or hiding primary controls.
- Not a wallet — no seeds, no spending keys, no send UI
- Not CipherPay — CipherPay is merchant checkout / IVK payment detect; SaneBooks starts after money arrives
- Not ZBooks — ZBooks is team/DAO treasury + SIWZ + approved ZIP 321 payouts (web). SaneBooks is solo owner → CPA on a local Mac with expiring proof packs
- Not tax software — we export accountant-ready rows; the CPA owns filing
- Not “temporary UFVK access” — viewing keys are irrevocable; share packs, not raw keys
- Reject seed phrases and spending-key strings at import
- Prefer bookkeeper mode on UFVK; UIVK never claims complete books
- Proof packs carry fingerprint + classified rows only — never embed UFVK/UIVK
- Pack footer names lightwalletd endpoint + tip height + “assumes honest LWD”
- No iCloud / CloudKit for vault data; the imported key uses ThisDeviceOnly Keychain storage. Live sync also creates sensitive, owner-only Zcash SDK account data in backup-excluded Application Support storage.
- CSV/PDF are plainly labeled non-expiring plaintext; only
.sanebooksis encrypted and Reader-expiring - Pack format v2 uses PBKDF2-HMAC-SHA256 (600,000 iterations), ChaCha20-Poly1305, authenticated canonical headers, and encrypted private metadata
NU6.3 / Ironwood activated on mainnet at height 3,428,143 (ZIP 258). New shielded receives land in Ironwood, not Orchard.
SaneBooks links ZcashLightClientKit 2.7.0-rc.4 (Ironwood receive/sync; tracking issue #1806 closed). Live path imports a UFVK as view-only and syncs against a configurable lightwalletd (default zec.rocks:443). Demo/offline still uses MockSyncFacade when SANEBOOKS_FORCE_MOCK=1 or the fixture demo key is used.
UIVK/receivables mode cannot import via the public SDK yet — that path stays degraded/honest.
- Build and run (below)
- Import Viewing Key → Use Demo Key → Continue
- Wait for mock sync to catch up
- Open a row → classify → New Proof Pack → export
.sanebooks/ CSV - Reader → unlock pack with passphrase
Requirements: macOS 14+, Xcode 16+.
Use the project wrapper so the Mini, nonzero-test gate, framework repair, receipts, and process cleanup are all applied:
cd ~/SaneApps/apps/SaneBooks
xcodegen generate
./scripts/SaneMaster.rb verify --timeout 1800
./scripts/SaneMaster.rb verify --ui --timeout 1800
./scripts/SaneMaster.rb launchDirect SwiftPM commands are focused diagnostics only, not release or E2E proof. Debug runs without the sandbox; the Release configuration enables App Sandbox, outbound networking, and user-selected files.
Public distribution is the notarized GitHub Release v0.1.0. Mini verify --ui was green before that ship (122 tests including UI journeys). Sparkle auto-update and a marketing site remain off in this lane.
Historical Mini captures live under:
outputs/visual-audit-sanebooks/
They are useful references, not proof of the current source. Current clean app-only, minimum-size user-journey captures live under outputs/e2e/2026-08-04/final-green/cropped/; build/test receipts live under outputs/verify/ and are qualified in the current session handoff.
| Doc | Purpose |
|---|---|
| docs/GRANT_PROPOSAL.md | Draft Coinholder-Directed Retroactive Grant application |
| docs/COMPETITIVE_POSITIONING.md | vs CipherPay, Zodl, ZGo, Koinly, ZBooks |
| docs/WALLET_VIEWING_KEY_GUIDE.md | How to export a UFVK from common wallets |
| docs/LIVE_PROBE_FUNDING.md | How to fund the live probe UA for a real ledger row |
| SECURITY.md / PRIVACY.md | Threat model and data boundaries |
| AGENTS.md | Agent / contributor project facts |
PolyForm Shield 1.0.0 — source-available “Transparent Code,” not OSI open source. Contact: hi@saneapps.com