Personal Finance Module

Reusable PersonalOS pocket family-office orchestration for wealth positions, cash flow, budgets, ownership, encrypted document references, obligations, aggregate overview projections, and correction/export/deletion rights. Portfolio, scenario, and account-aggregation services compose those contracts through exact consent, authenticated-encryption, host-vault, state, and audit ports. Scenario changes require a verified subject decision and account sync denies expired, reauthentication-required, stale-revision, or stale-cursor work before provider or persistence effects. Account commits compare and advance the same connection revision atomically; partial pages require a continuation cursor or an explicit terminal-incomplete result.

Production hosts should compose the module through the server-only PersonalOS bundle finance runtime. That composition owns two-phase authority, encrypted subject-state hydration, immutable event and receipt creation, idempotency, and the single atomic snapshot/event/receipt/outbox transaction; the module remains provider-neutral and effect-port only.

The module is non-advisory and fail-closed. Hosts must supply durable authenticated-encryption storage, audit evidence, export artifact storage, provider transports, credential custody, backup/restore, and deletion propagation. Formal financial, privacy, and regional qualification is deferred until evidence exists; no qualification is inferred from these seams.