238 lines
11 KiB
JSON
238 lines
11 KiB
JSON
{
|
|
"date": "2026-11-10",
|
|
"passed": true,
|
|
"checks": 78,
|
|
"tests": {
|
|
"result.json": {
|
|
"sha256": "ba882fdd91b731f128f77810e737960ca60962864c5bcc8a903858fd580163e3",
|
|
"checks": [
|
|
"existing regression native order readable with mapped identity",
|
|
"actual invoice preview via API transport",
|
|
"preview has no budget consumption or payable",
|
|
"preview rolls all business rows back",
|
|
"successful response is not cached",
|
|
"disabled endpoint refuses even valid credentials",
|
|
"missing or wrong principal/token refused",
|
|
"missing or wrong principal/token refused",
|
|
"missing or wrong principal/token refused",
|
|
"stale context version refused",
|
|
"non-TLS remote request refused",
|
|
"non JSON refused",
|
|
"oversized body refused",
|
|
"malformed JSON refused",
|
|
"client cannot choose tenant",
|
|
"supplier cannot be silently associated",
|
|
"floating point amounts refused",
|
|
"inconsistent total refused by original writer",
|
|
"foreign native line refused",
|
|
"foreign native order refused",
|
|
"malformed idempotency key refused",
|
|
"revoked authentication version refused",
|
|
"unauthorised unit mapping refused",
|
|
"revoked prepare right refused",
|
|
"confirmation creates pending invoice only",
|
|
"lost response recovered by same confirmation",
|
|
"same request recovered through preview after commit",
|
|
"same key different content conflicts",
|
|
"confirmation must use the preview key",
|
|
"tampered preview refused",
|
|
"replay revalidates current authority",
|
|
"second individually prepared document confirmed",
|
|
"changed source invalidates earlier preview",
|
|
"failure between writer and receipt rolls invoice back",
|
|
"same operation recovers after failure",
|
|
"concurrent same-key confirmations return one create and one recovery",
|
|
"concurrent receipts identify one invoice",
|
|
"no new consumption stock obligation payment or ledger effects",
|
|
"previous accepted invoice rows preserved",
|
|
"host rows permissions budget and sequences unchanged",
|
|
"8085 host/native all rows and sequences unchanged",
|
|
"context cleaned after request"
|
|
]
|
|
},
|
|
"security-result.json": {
|
|
"sha256": "60b3e603926d1896ef0a37366e57f05b54f21eb68b61c14865839b09b0016ef4",
|
|
"checks": [
|
|
"existing confirmed invoice recovered without new business write",
|
|
"foreign tenant_id principal rejected",
|
|
"foreign company_id principal rejected",
|
|
"disabled principal rejected even for replay",
|
|
"rotated credential invalidates old bearer",
|
|
"old context header rejected after rotation",
|
|
"old preview rejected with new context header",
|
|
"disabled purchasing module refuses API replay",
|
|
"same key cannot be moved to another authorised order",
|
|
"UUID case does not create a second operation",
|
|
"query cannot inject another context",
|
|
"nested unknown authority field rejected",
|
|
"transport cannot approve or consume invoice",
|
|
"legacy payment route remains unmounted",
|
|
"durable receipt recovered after preview lifetime with current authority",
|
|
"expired unapplied preview cannot write",
|
|
"lock timeout returns recoverable503 without duplicate",
|
|
"after lock release same operation recovers correct invoice",
|
|
"security and lock continuation added no invoices or audit commands",
|
|
"source configuration remains disabled with no principals"
|
|
]
|
|
},
|
|
"context-result.json": {
|
|
"sha256": "a8260e789c2020fcca9c9bd159e6f73c221fd9dc320fd81ccf2c4b65e377ab57",
|
|
"checks": [
|
|
"authenticated exact order exposes current revision and lines",
|
|
"context response is uncached and excludes unrelated invoice list",
|
|
"context read requires bearer",
|
|
"context read refuses foreign tenant order",
|
|
"context read rejects query authority",
|
|
"context read rejects a request body",
|
|
"context read revalidates view grant",
|
|
"context route also remains disabled",
|
|
"POST durable replay unchanged after adding read-only context route",
|
|
"context checks add no business effects"
|
|
]
|
|
},
|
|
"authority-result.json": {
|
|
"sha256": "789964b5f41a4bc143caad7d69e445890125f0ceb0db49c17092fbd68495b124",
|
|
"checks": [
|
|
"current native operator lock permits authorised recovery",
|
|
"revoked native finance function prevents receipt recovery",
|
|
"native finance fixture restored by transaction rollback",
|
|
"maintenance-only native operator cannot recover invoice receipt",
|
|
"normal recovery resumes without another business command",
|
|
"operator guard checks add no invoice or audit commands"
|
|
]
|
|
}
|
|
},
|
|
"transport": "Laravel HTTP kernel, actual PostgreSQL and independent PHP workers; no TCP server",
|
|
"routes": [
|
|
"POST /api/v1/integration/sgc/invoices",
|
|
"GET /api/v1/integration/sgc/invoices/orders/{order}"
|
|
],
|
|
"result": {
|
|
"new_pending_invoices": 4,
|
|
"concurrent_statuses": [
|
|
200,
|
|
201
|
|
],
|
|
"lock_statuses": [
|
|
503,
|
|
200
|
|
],
|
|
"invoice_audit_atomicity_proved": true,
|
|
"workflow": "original pending invoice writer",
|
|
"auto_financial_validation": false
|
|
},
|
|
"isolation": {
|
|
"existing_regression_book": "da77bb730751",
|
|
"source_fixture": "SQL fixture only; not executed request/award/receipt/stock workflows",
|
|
"protected_8085_hashes": [
|
|
"6168b382599448d71b39691ba4c347db0c8ab8a8d8dc7388283b212239ac9290",
|
|
"58e032c3a30234433adf66cc75478bd729ba0f62592637cf737e2ee23e01773b"
|
|
],
|
|
"protected_8085_code_unchanged": true,
|
|
"prior_receipts_and_movements_sha256": "8fc992e83559200f691b253fd72e22986a972eb58f77b50bdf32d4d18d5f5dd4",
|
|
"prior_consumed_minor": 10000,
|
|
"external_payments": 0,
|
|
"six_protected_records_changed": false,
|
|
"cache_cleared": false,
|
|
"new_database": false,
|
|
"new_role": false,
|
|
"new_server": false,
|
|
"new_demo": false,
|
|
"new_real_grants": false
|
|
},
|
|
"disabled_configuration": {
|
|
"enabled": false,
|
|
"principals": []
|
|
},
|
|
"publication": false,
|
|
"checkpoint": false,
|
|
"business_authority_unchanged": [
|
|
{
|
|
"file": "app/Modules/Purchasing/InvoiceController.php",
|
|
"sha256": "85eb46ca7e65c60bed190e592a134eb48db5762c0a90b8cd4c9d6fbd81198ba4"
|
|
},
|
|
{
|
|
"file": "app/Modules/Purchasing/ReceiptRuntime.php",
|
|
"sha256": "9b426476b2805094fb317cc753385ef43882fb4964883e880eac287eed89d9e0"
|
|
},
|
|
{
|
|
"file": "packages/payables/src/Payables.php",
|
|
"sha256": "ed853f3eb48ebcf91f51a8fe9ed8e49b0e1bc30cce4852cc9394d51cff28c74d"
|
|
}
|
|
],
|
|
"sources": [
|
|
{
|
|
"file": "bootstrap/app.php",
|
|
"sha256": "42aacf13b19658e80b93c8b2f640133a349e9302f295b5e4c57702e352013382"
|
|
},
|
|
{
|
|
"file": "routes/sgc.php",
|
|
"sha256": "1ca49298535c1edfe1afd494b56274ee1b25842079f4da7557755db471c73348"
|
|
},
|
|
{
|
|
"file": "config/sgc_invoice.php",
|
|
"sha256": "bd5615a9eadd5d98e831db10ce60713d792f9b324282fdd87d52367ad2bf62a4"
|
|
},
|
|
{
|
|
"file": "app/Shared/Context/ModuleNavigation.php",
|
|
"sha256": "88a86523568643b4f285647ab341c435819715e9b7eb963bf8a44b3a4167f6dc"
|
|
},
|
|
{
|
|
"file": "app/Http/Middleware/AuthenticateSgcInvoice.php",
|
|
"sha256": "f99e2e26a8b09c31e1b84618a10ec6e7016a9b02a7f9049b64c5a157cc1d9888"
|
|
},
|
|
{
|
|
"file": "app/Http/Requests/Sgc/StoreInvoiceRequest.php",
|
|
"sha256": "e2a859fe54c412cba9cd70353c98582774034996c382e1da4916abef46497d47"
|
|
},
|
|
{
|
|
"file": "app/Http/Controllers/Api/V1/SgcInvoiceIngressController.php",
|
|
"sha256": "d590601efa6c46d9a34f77c655767758c88326e4d64f0da1b66f3174216ad782"
|
|
},
|
|
{
|
|
"file": "app/Modules/Purchasing/SgcInvoiceIngress.php",
|
|
"sha256": "4acde7b84193b509f09d0cac5c7993b298384651443c0ce58ee9effcefc4d6bf"
|
|
},
|
|
{
|
|
"file": "scripts/sgc-invoice-proof-bootstrap.php",
|
|
"sha256": "0988f2e9f6c2b59e057de893fafe8996070e313354d82056ad4494223f0efea7"
|
|
},
|
|
{
|
|
"file": "scripts/sgc-invoice-proof.php",
|
|
"sha256": "725f985e8429a7456b87d44066e8339b3204255f07dc83bde2806b75158bcf85"
|
|
},
|
|
{
|
|
"file": "scripts/sgc-invoice-security-proof.php",
|
|
"sha256": "71095d6c20fbbe0e5874741a915de6c45c37cae4149c38c027559c090f91b146"
|
|
},
|
|
{
|
|
"file": "scripts/sgc-invoice-context-proof.php",
|
|
"sha256": "44d290770f6e3bd2127b0be96c2e663aef9b67d0d68a4e29d994a76c5f1247ec"
|
|
},
|
|
{
|
|
"file": "scripts/sgc-invoice-authority-proof.php",
|
|
"sha256": "d5b41a4594b79e0b61a40654d831a00e2e4dc9542df94672ac755aa2565b2087"
|
|
},
|
|
{
|
|
"file": "scripts/sgc-invoice-check.mjs",
|
|
"sha256": "7ecc6bc75d228285e3a5917b9d8db78d36ac7b3cbdaa3c9d1a42e305cf080119"
|
|
},
|
|
{
|
|
"file": "scripts/summarize-sgc-invoice.php",
|
|
"sha256": "52f3aa34fce4d7463aa614280500ad4ef4453d43f93d78a86567a0ae2ed4a91a"
|
|
},
|
|
{
|
|
"file": "tests/payloads/invoice_test.json",
|
|
"sha256": "1a584f2540f48be5b0e57df67796aff07fb77511f3d347a606a02a95b43a34a6"
|
|
}
|
|
],
|
|
"report": "docs/SGC_INVOICE_ENDPOINT.md",
|
|
"limitations": [
|
|
"QA adapter only; no real activation/deployment.",
|
|
"Kernel requests are not network/TLS/visual or sustained-load tests.",
|
|
"Initial72 checks reused; last6 exercise the strengthened native-operator recovery guard without repeating writes.",
|
|
"Synthetic bearer tokens, encrypted previews and private logs are excluded from this proof.",
|
|
"Source preparation adds SQL fixtures to the existing regression book; previous proofs and rows are preserved."
|
|
]
|
|
}
|