> Canonical: https://antifailure.dev/solutions/fintech > Billing and ledger-safe production twins, with no live money movement. # Billing, ledgers, and side effects that must never hit live processors. The firewall simulates Stripe. Safe State masks account identifiers. The oracle compares ledger writes. Duplicate events are incidents. They belong in a report, not in production. - 0 1 twin.app.internal POST /checkout origin 0.4ms - 0 2 af-proxy:8443 egress rule inspect 1.1ms - 0 3 stripe.pack.local 412b POST /v1/charges mock ledger - 0 4 api.stripe.com live processor deny refused The charge is written to a clone-local ledger. api.stripe.com never resolves. ## Charging a card from a twin is an existential failure. - → The mode is set per host . block, allow, capture, mock, sandbox or synth, written against the host in antifailure.yaml. - → Nothing leaves without a rule . Egress defaults to block, so a processor nobody configured is refused on its first run rather than passed through. - → The ledger records the decision . Each attempt is stored with the mode that decided it, so the reason a request never left is readable afterwards. A host with no rule is blocked on first contact. ## Containment is the product surface. - → Ledger comparison . The oracle compares writes, events, and third-party effects against baseline. - → Irreversible writes . Candidate billing events that old code cannot reconcile show up before ship. - → Mid-market first . Technically sophisticated billing teams. Not a regulated-enterprise procurement motion. ### Twin ledger - chg_184 $49.00 POST /v1/charges - chg_185 $49.00 retry checkout - inv_044 $0.00 refund path ### Live processors - api.stripe.com - api.sendgrid.com - hooks.slack.com - api.prod.internal TTL contained. Processors never resolved. Blocked. Nothing leaves the customer boundary. ## Not a warning. A failed containment model. - → There is no warning level for this . A twin that reaches a live processor has not failed a check. Its containment did not hold. - → The customer finds out . A real card, a real inbox and a real partner endpoint are the three places a contained run becomes somebody else's incident. - → So the default refuses . A host with no rule against it is blocked, which is the only default that stays safe as the integration list grows. Attempted-effect ledger LNS 04 ### Twin run 08f2 must never · fail closed - 01 STRIPE POST /v1/charges $49.00 MOCK - 02 SENDGRID render invoice.paid.html CAPTURE - 03 SLACK webhook preview stored CAPTURE - 04 HOSTNAME api.prod.internal DENY 3 contained · 1 denied · 0 charged - Side-Effect Firewall How egress is denied and simulated. Read - Isolated Twin Where the contained run lives. Read - All solutions Teams and jobs. Read ## Know what happens before you deploy. Create a disposable production twin for every risky change. Catch migration failures before they reach customers.