The bank, the dealer and the identity provider are fakes. Everything behind
them — the ledger, the price guards, the hold period, the reconciliation — is the
real engine, running against a real Postgres. There is no authentication; this is a
workbench, not a product.
Step 1
Open an account
Identity and sanctions screening run for real. Try an email
containing sanctioned, pepmatch,
thin or fraud to see the gates fire.
What they authorized, stored verbatim
Note what it never says: deposit, wallet, balance. The
authorization is for a purchase — money resting with us would be
stored value.
Step 2
Buy gold
One action, not two. There is no "add money" — the debit exists
only to fund this purchase.