feat(receipts): ReceiptIntake state machine + intake endpoint + worker (pipeline v2 phase 1) - #440

Open

Clarion1631 wants to merge 104 commits into

mainfrom

feat/phase1-intake-core

Commits on Sep 2, 2026

fix(qbo): per-request fetch timeout on every QuickBooks call

Clarion1631
and
claude
committed
c597741
test(qbo): cover qbTimedFetch deadline, pass-through, and caller abort

Clarion1631
and
claude
committed
c900334
fix(receipts): fail fast on a QBO timeout instead of burning maxDuration

Clarion1631
and
claude
committed
cc5162f
feat(ops): pipeline health endpoint + 7am morning digest

Clarion1631
and
claude
committed
ff52e06
docs: phase 1 intake-core and phase 4 earned-margin specs

Clarion1631
and
claude
committed
4d24b13
fix(qbo): deadline must govern the response BODY, not just the headers

Clarion1631
and
claude
committed
b11dad3
fix(qbo): restore maxDuration 60; give token refresh its own longer deadline

Clarion1631
and
claude
committed
69867e6
fix(ops): no false-green health — explicit probe status, no 7d auto-pass

Clarion1631
and
claude
committed
59bae35
fix(ops): fail-closed, constant-time Bearer auth for the pipeline routes

Clarion1631
and
claude
committed
03273e9
fix(qbo): latch the abort winner; wrap bytes()/clone(); floor timeout values

Clarion1631
and
claude
committed
0bbdb1c
fix(qbo): stop fallback parsers swallowing timeouts; attach on already-exists

Clarion1631
and
claude
committed
036eafc
fix(ops): probe deadlines, guaranteed digest delivery, creates-only freshness

Clarion1631
and
claude
committed
6496577
fix(qbo,ops): propagate refresh + attachment timeouts; reachable health; real email check

Clarion1631
and
claude
committed
711d04c
fix(qbo): match QB timeouts by name, not instanceof (CI Node 20 caught it)

Clarion1631
and
claude
committed
b1d93a9
fix(qbo): stop the payments cron on a QBO outage; make it visible; retry transient attachments

Clarion1631
and
claude
committed
b6826ff
fix(qbo): abort on any QBO sub-call outage; honest run status; validate upload response

Clarion1631
and
claude
committed
6b51219
fix(qbo): fail-closed payments cron; honest run status; token-save split; transient uploads

Clarion1631
and
claude
committed
363cffb
fix(qbo): no silent probe skips; partial runs visible now; normalize network errors

Clarion1631
and
claude
committed
0dd50b3
refactor(ops): digest cron uses main's postTextToWebhook (one Chat helper)

Clarion1631
and
claude
committed
299e241
fix(qbo): never settle an unread payment; tokens before ok; latest-run status; clamp; real text part

Clarion1631
and
claude
committed
407e1be
fix(qbo): verify empty runs, refuse fabricated paidAt, paginate, alert on lost receipts

Clarion1631
and
claude
committed
43f37ab
fix(qbo): intuit probe fails the check; parse vs transport; end-to-end route budget

Clarion1631
and
claude
committed
6a12e08
fix(qbo): budget from request entry; one audit event per run; a failed count is a failed run

Clarion1631
and
claude
committed
ad57b30
feat(receipts): ReceiptIntake schema (Receipt Pipeline v2, Phase 1)

Clarion1631
and
claude
committed
c377885
feat(receipts): intake endpoint, reader, dedup, booking, and the 5-min worker

Clarion1631
and
claude
committed
b043823
test(receipts): dedup fixtures, prompt pins, booking matrix, and the dry-run proof

Clarion1631
and
claude
committed
f133d66
test(receipts): e2e 401 matrix + idempotent POST; document the as-built contract

Clarion1631
and
claude
committed
80c110a
fix(receipts): busyPasses column, exact host guard, UNIQUE partial-index check

Clarion1631
and
claude
committed
599aefa
fix(receipts): 25s read budget, 2 retries at 1s/3s, HEIC sequence brands

Clarion1631
and
claude
committed
1b6b01e
fix(receipts): Expense.amount is GROSS; vendor confirms a dup; refunds reviewed

Clarion1631
and
claude
committed
d26801b
fix(receipts): dry-run rows can no longer starve the queue; 40s soft deadline

Clarion1631
and
claude
committed
e69d0c9
fix(receipts): sha decides a sourceRef replay; provenance is not caller input

Clarion1631
and
claude
committed
f130894
fix(receipts): STAGING state, per-weak-key lock, requeue inside the claim txn

Clarion1631
and
claude
committed
d1d846b
fix(proxy): refuse a Server Action dispatch on the receipt-intake bypasses

Clarion1631
and
claude
committed
1d36272
fix(receipts): strong-before-weak dedup, resumable publish, tagged storage, RLS

Clarion1631
and
claude
committed
ca59fc9
test(receipts): reshape the cross-namespace leak test around the new 400 guard

Clarion1631
and
claude
committed
138b4e9
fix(pkg): de-duplicate test:receipt-intake, dropped by my rebase resolution

Clarion1631
and
claude
committed
ce6a376
fix(receipts): staging never 2xx, lease held through routing, attachment preflight

Clarion1631
and
claude
committed
1126a73
fix(receipts): checks carry no sales tax; persist only the tax booking accepted

Clarion1631
and
claude
committed
7a14a21
fix(receipts): shadow backlog retires as SHADOW_DONE; attachment checked on both paths

Clarion1631
and
claude
committed
fc91992
chore: re-trigger CI for fd0fb4b8 (Actions did not fire on the push)

Clarion1631
and
claude
committed
5d84c17
fix(health): re-apply the intake probes onto Phase 0's pipeline-health

Clarion1631
and
claude
committed
d75de00
fix(receipts): cutover boundary, two-step upload, split secrets, phase re-check

Clarion1631
and
claude
committed
4daa8c2
fix(receipts): void-lock, shared object validation, evidence-based retirement

Clarion1631
and
claude
committed
e3da4a6
fix(receipts): seal verified objects, quarantine unprovable rows, fence the claim

Clarion1631
and
claude
committed
8297b46
fix(receipts,proxy): fail-closed cron gate; machine endpoints refuse action dispatch

Clarion1631
and
claude
committed
d6e709b
fix(receipts): fence every write on the claim, seal after commit, refuse .txt

Clarion1631
and
claude
committed
8b332c7
fix(receipts): authorize late fields, CAS every mutation, make cleanup durable

Clarion1631
and
claude
committed
85d6af5
fix(receipts): release ownership on every transition; fence publish and reject

Clarion1631
and
claude
committed
be9ae4c
fix(receipts): validate the phase against the job at intake, not just at finalize

Clarion1631
and
claude
committed
8c21abd
fix(receipts): initial publication obeys null-or-equal and validates the tuple

Clarion1631
and
claude
committed
6f8ecc3
test(receipts): make the cleanup-test function slices EOL-agnostic

Clarion1631
and
claude
committed
1cb66bb
fix(receipts): fence the publish on the exact observed park, not the state set

Clarion1631
and
claude
committed
7050cbe
test(e2e): bring the intake spec up to the route's contract

Clarion1631
and
claude
committed
93bb785
fix(receipts): authorize the EFFECTIVE project on every session finalize

Clarion1631
and
claude
committed
0c7112d
fix(receipts): fence the reject, trust v1 evidence, re-arm swept uploads

Clarion1631
and
claude
committed
856517b
fix(receipts): fenced sweeper reject, upload leases, own bucket, sourceRef shapes

Clarion1631
and
claude
committed
c2e6408
fix(receipts): tagged presence on the replay path; a secret owns SOURCES not rows

Clarion1631
and
claude
committed
281d14b
fix(receipts): one ceiling, production ref shapes, stable receipt refs, atomic terminal release

Clarion1631
and
claude
committed
8418a67
feat(receipts): version the upload lease so a resumed upload cannot be rejected

Clarion1631
and
claude
committed
390a62e
fix(proxy): allowlist anonymous Server Action dispatch instead of denylisting it

Clarion1631
and
claude
committed
0962751
fix(receipts): inline route shares decideSource; replays verify the object; inline orphans sweep

Clarion1631
and
claude
committed
afda5be
fix(intake): round 16 — SHA identity guard, finalize CAS, attachment naming, tax warning preservation

Clarion1631
and
claude
committed
430e924
fix(receipts): give the e2e storage stub a list(), and stop expectedSha256 bricking recovery

Clarion1631
and
claude
committed
5cf88dc
fix(receipts): round-17 Codex findings — Expense lifecycle, read deadline, receipt links, storage orphans, stuck-upload detection

Clarion1631
and
claude
committed
862c7d7
ci: retrigger Codex gate (runner sandbox errors on prior attempts)

Clarion1631
and
claude
committed
dddeeb4
fix(receipts): round-18 Codex findings — fenced deletes, live-lease reuse, archive secret in deploy docs

Clarion1631
and
claude
committed
870577c

Commits on Sep 3, 2026

fix(receipts): PR #440 Codex gate — dry-run kill switch, /start lease renewal, receipts page role gate

Clarion1631
and
claude
committed
e466ed5
fix(receipt-intake): PR #440 round-1 gate — 5 Codex findings

Clarion1631
and
claude
committed
f307454
fix(receipt-intake): PR #440 round-2 gate — 5 Codex findings

Clarion1631
and
claude
committed
ff510a7
fix(receipt-intake): finalize refuses a non-object JSON body

Clarion1631
and
claude
committed
47ebd90
ci: retrigger Codex gate (runner posted no verdict on 47ebd90b)

Clarion1631
and
claude
committed
64a7d29
Merge remote-tracking branch 'origin/main' into feat/phase1-intake-core

Clarion1631
and
claude
committed
a2998e8
fix(receipt-intake): PR #440 a2998e8a gate — 4 adversarial findings

Clarion1631
and
claude
committed
6ff89b2
Merge origin/main into feat/phase1-intake-core

Clarion1631
and
claude
committed
e631dcd
test(receipt-intake): wiring checks for the lease and the payment cursors

Clarion1631
and
claude
committed
482d05a
fix(receipt-intake): PR #440 round-33 gate — 5 adversarial findings

Clarion1631
and
claude
committed
e75b857
fix(receipt-intake): PR #440 round-34 gate — 3 adversarial findings

Clarion1631
and
claude
committed
52190f8
fix(receipt-intake): PR #440 round-34 gate — 4 adversarial findings

Clarion1631
and
claude
committed
631c990
fix(receipt-intake): PR #440 round-35 gate — 3 adversarial findings

Clarion1631
and
claude
committed
d654670
Merge origin/main (#448 deposit-sweep) into feat/phase1-intake-core

Clarion1631
and
claude
committed
59675ef
chore(qbo): restore CRLF line endings on src/lib/quickbooks.ts to match main

Clarion1631
and
claude
committed
39a8b3b
fix(receipt-intake): PR #440 round-36 gate — 3 adversarial findings

Clarion1631
and
claude
committed
1c01ad0
fix(receipt-intake): PR #440 round-12 gate — 3 adversarial findings

Clarion1631
and
claude
committed
4540c84
fix(receipt-intake): PR #440 round-13 gate — 3 adversarial findings

Clarion1631
and
claude
committed
92f2df5
fix(receipt-intake): PR #440 round-14 gate — lease fence, structurally

Clarion1631
and
claude
committed
f1b6c61
fix(receipt-intake): PR #440 round-15 gate — 3 adversarial findings

Clarion1631
and
claude
committed
267a96f
fix(e2e): remove a block my lease-threading script duplicated

Clarion1631
and
claude
committed
252908e
fix(receipt-intake): PR #440 round-16 gate — 3 adversarial findings

Clarion1631
and
claude
committed
fb95e69
fix(receipt-intake): PR #440 round-17 gate — 3 adversarial findings

Clarion1631
and
claude
committed
14fdd8d
fix(tests): measure the connection-hold proof on the test's own client

Clarion1631
and
claude
committed
a292a78
fix(receipt-intake): PR #440 round-18 gate - 4 adversarial findings

Clarion1631
and
claude
committed
f58661d
fix(tests): route the default-repair probe at the probe table, by argument

Clarion1631
and
claude
committed
593e91c
fix(tests): prove non-serialization by OVERLAP, not by counting connections

Clarion1631
and
claude
committed
e220520
fix(receipt-intake): PR #440 round-19 gate - lease issuance, /start contract, target guard

Clarion1631
and
claude
committed
98f2d86
fix(receipt-intake): PR #440 round-20 gate - lease identity, durable tax warning, apply-script e2e

Clarion1631
and
claude
committed
f2f76c3
fix(receipt-intake): the two CI failures on f2f76c30

Clarion1631
and
claude
committed
045ceb6
wip: round-21 gate (pre-merge checkpoint)
Clarion1631
committed
423cf0b
Merge remote-tracking branch 'origin/main' into feat/phase1-intake-core
Clarion1631
committed
cff45ff
fix(receipt-intake): PR #440 round-21 gate - object-claim write skew, deadlines, pooler host

Clarion1631
and
claude
committed
1d3278a
fix(receipt-intake): record ReceiptObjectClaim's RLS in the blind-spot snapshot

Clarion1631
and
claude
committed
8cc25cf
fix(tests): the CREATE-only control counts tables, and the list grew

Clarion1631
and
claude
committed
dc723b9
Merge remote-tracking branch 'origin/main' into feat/phase1-intake-core
Clarion1631
committed
ee8ad15
fix(receipt-intake): PR #440 round-22 P0 - a delete may not outlive its claim

Clarion1631
and
claude
committed
763d40d