A self-hosted bridge that syncs bank transactions from Enable Banking (PSD2 / Open Banking) into Actual Budget or Firefly III. Built for anyone who wants automated bank-to-budget synchronisation without handing credentials to a third party. The consent is read-only by construction: it cannot initiate a payment even if asked to.

• Two budget backends behind one interface, selected by a single environment variable — a shared harness runs every scenario where the two could disagree against both of them, so a difference in behaviour surfaces in the test suite rather than in someone's budget
• Pending-to-cleared lifecycle with pre-authorisation matching: a hotel authorised as “Hotel Berlin” at 120.00 and booked as “VISA Hotel Berlin” at 138.50 is one purchase, not two
• Matching is record linkage, not a rule set — the part of this project I got wrong first. The same meal appears authorised as “Da Luigi Roma” and booked as “Visa Da Luigi”, the bank having prefixed a card scheme and cut the tail to fit its field. A similarity score cannot tell that apart from a different branch of the same chain: measured, “Shell Tankstelle”/“VISA Shell” and “Da Luigi Roma”/“Visa Da Luigi Milano” both score 0.667 under Sørensen–Dice, and no weighting against Jaro–Winkler separates them. Truncation removes a word; a different branch contradicts one. So the published model does the work instead — Fellegi–Sunter (1969), the same one behind Splink and national statistics offices: each field yields a discrete comparison level worth log₂(m/u) bits of evidence, and the sum becomes a probability
• The batch is decided together rather than pair by pair — a one-to-one assignment over the whole run, which is Jaro’s (1989) reading of linkage as an assignment problem, solved with the Hungarian method. Weighed one at a time, two bookings can both claim the same authorisation and the tie falls to whichever the loop reached first, so the same statement in a different order produced a different budget. Under the constraint that stops being possible, and two payments nothing can tell apart are matched up instead of both landing in front of a person
• Two thresholds rather than one, which is where the model has always kept its clerical review zone. Anything landing between them is held back for a person to decide rather than guessed at — written to no budget, deferring that account's opening balance (which is written once and never revised), and visible on the dashboard, in /health and in its own metrics. Candidates are recomputed when the page is drawn and the probability shown is rechecked when the answer comes back, so a decision made against a stale page is refused rather than applied
• The parameters are argued for rather than asserted. A generated table in the repository moves every one of them by a factor of three and counts which decisions change as a result — it is the reason the shipped values are the ones they are, and a change to it fails the build until somebody has read the diff. Cases get settled three ways: a review answered, a pair the bank’s own reference confirms, and — if switched on — one confirmation per sync about a decision the matcher made alone, picked for how much its answer would say about the parameters. That third one exists because the automatic band is where the expensive mistakes are and the only place nothing would otherwise ever contradict the matcher. Where enough have accumulated, the parameters can be refit from them: a Dirichlet posterior over the levels, Platt scaling for the scale. Only half the model needs anybody’s answer, though. Those probabilities describe pairs that are one payment; the other half describes pairs that are not, and at most one candidate in a window can be a transaction’s counterpart — so every other one it was weighed against is a draw from exactly that population, and counting them needs no labels at all. That is what makes a refit reachable on an installation nobody is answering questions on. Nothing fitted takes effect on its own, though. It has to pass a gate — six documented behaviours still decided the same way, a Brier score better on evidence the fit never saw, and a person pressing the button — and before that it runs in shadow beside the real decision, so what it would have changed is a number rather than a hope
• Opening balances and drift detection: the balance that predates the first import is written once and only ever compared thereafter, distinguishing booked from available balance types, and never silently corrected
• Integration tests against a real Firefly III instance, brought up and destroyed per merge request — deliberately in a timezone west of UTC, which is what exposed a date bug the hand-written test fixture had been agreeing with all along
• Full OpenTelemetry instrumentation — metrics, traces and logs — with Pyroscope continuous profiling and structured logs carrying trace context. Including the things that are otherwise invisible: the distribution of match probabilities, without which the two thresholds are numbers an operator has to guess at, and every database operation by statement kind and table
• Embedded dark-mode web UI with sidebar navigation: a review page for the transactions the matcher would not decide on its own, a matching page showing the parameters in force beside the ones your own answers would support, health endpoint, manual sync trigger, sync history, failure email notifications, session expiry warnings, and a Docker Hub update checker
• Single static binary in a non-root Docker image — no runtime dependencies beyond SQLite
• CycloneDX SBOM embedded in every container image with BuildKit attestations on Docker Hub

AGPL-3.0. Available on GitHub and Docker Hub.