feat(receipts): Receipts tab, missing-receipt chaser, Chat cards, nightly QBO bank pull (pipeline v2 phase 2) - #443

Merged

Clarion1631 merged 158 commits into

mainfrom

feat/phase2-queue-memos

Sep 4, 2026

Commits on Sep 2, 2026

fix(qbo): per-request fetch timeout on every QuickBooks call

Clarion1631
and
claude
committed
c597741
test(qbo): cover qbTimedFetch deadline, pass-through, and caller abort

Clarion1631
and
claude
committed
c900334
fix(receipts): fail fast on a QBO timeout instead of burning maxDuration

Clarion1631
and
claude
committed
cc5162f
feat(ops): pipeline health endpoint + 7am morning digest

Clarion1631
and
claude
committed
ff52e06
docs: phase 1 intake-core and phase 4 earned-margin specs

Clarion1631
and
claude
committed
4d24b13
fix(qbo): deadline must govern the response BODY, not just the headers

Clarion1631
and
claude
committed
b11dad3
fix(qbo): restore maxDuration 60; give token refresh its own longer deadline

Clarion1631
and
claude
committed
69867e6
fix(ops): no false-green health — explicit probe status, no 7d auto-pass

Clarion1631
and
claude
committed
59bae35
fix(ops): fail-closed, constant-time Bearer auth for the pipeline routes

Clarion1631
and
claude
committed
03273e9
fix(qbo): latch the abort winner; wrap bytes()/clone(); floor timeout values

Clarion1631
and
claude
committed
0bbdb1c
fix(qbo): stop fallback parsers swallowing timeouts; attach on already-exists

Clarion1631
and
claude
committed
036eafc
fix(ops): probe deadlines, guaranteed digest delivery, creates-only freshness

Clarion1631
and
claude
committed
6496577
fix(qbo,ops): propagate refresh + attachment timeouts; reachable health; real email check

Clarion1631
and
claude
committed
711d04c
fix(qbo): match QB timeouts by name, not instanceof (CI Node 20 caught it)

Clarion1631
and
claude
committed
b1d93a9
fix(qbo): stop the payments cron on a QBO outage; make it visible; retry transient attachments

Clarion1631
and
claude
committed
b6826ff
fix(qbo): abort on any QBO sub-call outage; honest run status; validate upload response

Clarion1631
and
claude
committed
6b51219
fix(qbo): fail-closed payments cron; honest run status; token-save split; transient uploads

Clarion1631
and
claude
committed
363cffb
fix(qbo): no silent probe skips; partial runs visible now; normalize network errors

Clarion1631
and
claude
committed
0dd50b3
refactor(ops): digest cron uses main's postTextToWebhook (one Chat helper)

Clarion1631
and
claude
committed
299e241
fix(qbo): never settle an unread payment; tokens before ok; latest-run status; clamp; real text part

Clarion1631
and
claude
committed
407e1be
fix(qbo): verify empty runs, refuse fabricated paidAt, paginate, alert on lost receipts

Clarion1631
and
claude
committed
43f37ab
fix(qbo): intuit probe fails the check; parse vs transport; end-to-end route budget

Clarion1631
and
claude
committed
6a12e08
fix(qbo): budget from request entry; one audit event per run; a failed count is a failed run

Clarion1631
and
claude
committed
ad57b30
feat(receipts): ReceiptIntake schema (Receipt Pipeline v2, Phase 1)

Clarion1631
and
claude
committed
c377885
feat(receipts): intake endpoint, reader, dedup, booking, and the 5-min worker

Clarion1631
and
claude
committed
b043823
test(receipts): dedup fixtures, prompt pins, booking matrix, and the dry-run proof

Clarion1631
and
claude
committed
f133d66
test(receipts): e2e 401 matrix + idempotent POST; document the as-built contract

Clarion1631
and
claude
committed
80c110a
fix(receipts): busyPasses column, exact host guard, UNIQUE partial-index check

Clarion1631
and
claude
committed
599aefa
fix(receipts): 25s read budget, 2 retries at 1s/3s, HEIC sequence brands

Clarion1631
and
claude
committed
1b6b01e
fix(receipts): Expense.amount is GROSS; vendor confirms a dup; refunds reviewed

Clarion1631
and
claude
committed
d26801b
fix(receipts): dry-run rows can no longer starve the queue; 40s soft deadline

Clarion1631
and
claude
committed
e69d0c9
fix(receipts): sha decides a sourceRef replay; provenance is not caller input

Clarion1631
and
claude
committed
f130894
fix(receipts): STAGING state, per-weak-key lock, requeue inside the claim txn

Clarion1631
and
claude
committed
d1d846b
fix(proxy): refuse a Server Action dispatch on the receipt-intake bypasses

Clarion1631
and
claude
committed
1d36272
fix(receipts): strong-before-weak dedup, resumable publish, tagged storage, RLS

Clarion1631
and
claude
committed
ca59fc9
test(receipts): reshape the cross-namespace leak test around the new 400 guard

Clarion1631
and
claude
committed
138b4e9
fix(pkg): de-duplicate test:receipt-intake, dropped by my rebase resolution

Clarion1631
and
claude
committed
ce6a376
fix(receipts): staging never 2xx, lease held through routing, attachment preflight

Clarion1631
and
claude
committed
1126a73
fix(receipts): checks carry no sales tax; persist only the tax booking accepted

Clarion1631
and
claude
committed
7a14a21
fix(receipts): shadow backlog retires as SHADOW_DONE; attachment checked on both paths

Clarion1631
and
claude
committed
fc91992
chore: re-trigger CI for fd0fb4b8 (Actions did not fire on the push)

Clarion1631
and
claude
committed
5d84c17
fix(health): re-apply the intake probes onto Phase 0's pipeline-health

Clarion1631
and
claude
committed
d75de00
fix(receipts): cutover boundary, two-step upload, split secrets, phase re-check

Clarion1631
and
claude
committed
4daa8c2
fix(receipts): void-lock, shared object validation, evidence-based retirement

Clarion1631
and
claude
committed
e3da4a6
fix(receipts): seal verified objects, quarantine unprovable rows, fence the claim

Clarion1631
and
claude
committed
8297b46
fix(receipts,proxy): fail-closed cron gate; machine endpoints refuse action dispatch

Clarion1631
and
claude
committed
d6e709b
fix(receipts): fence every write on the claim, seal after commit, refuse .txt

Clarion1631
and
claude
committed
8b332c7
fix(receipts): authorize late fields, CAS every mutation, make cleanup durable

Clarion1631
and
claude
committed
85d6af5
fix(receipts): release ownership on every transition; fence publish and reject

Clarion1631
and
claude
committed
be9ae4c
fix(receipts): validate the phase against the job at intake, not just at finalize

Clarion1631
and
claude
committed
8c21abd
fix(receipts): initial publication obeys null-or-equal and validates the tuple

Clarion1631
and
claude
committed
6f8ecc3
test(receipts): make the cleanup-test function slices EOL-agnostic

Clarion1631
and
claude
committed
1cb66bb
fix(receipts): fence the publish on the exact observed park, not the state set

Clarion1631
and
claude
committed
7050cbe
test(e2e): bring the intake spec up to the route's contract

Clarion1631
and
claude
committed
93bb785
fix(receipts): authorize the EFFECTIVE project on every session finalize

Clarion1631
and
claude
committed
0c7112d
fix(receipts): fence the reject, trust v1 evidence, re-arm swept uploads

Clarion1631
and
claude
committed
856517b
fix(receipts): fenced sweeper reject, upload leases, own bucket, sourceRef shapes

Clarion1631
and
claude
committed
c2e6408
fix(receipts): tagged presence on the replay path; a secret owns SOURCES not rows

Clarion1631
and
claude
committed
281d14b
fix(receipts): one ceiling, production ref shapes, stable receipt refs, atomic terminal release

Clarion1631
and
claude
committed
8418a67
feat(receipts): version the upload lease so a resumed upload cannot be rejected

Clarion1631
and
claude
committed
390a62e
fix(proxy): allowlist anonymous Server Action dispatch instead of denylisting it

Clarion1631
and
claude
committed
0962751
feat(bank-register): nightly server-side QBO register pull (Phase 2 prereq)

Clarion1631
and
claude
committed
6c79516
feat(receipts): MISSING_RECEIPT matcher + nightly request sweep

Clarion1631
and
claude
committed
154fd3f
feat(automation): Receipts tab — the receipt queue on /automation

Clarion1631
and
claude
committed
8cdcc4c
feat(receipts): per-owner Chat digest + the Beverly bridge endpoints

Clarion1631
and
claude
committed
977ea2a
docs(automation): guide covers the Receipts tab and the missing-receipt chase

Clarion1631
and
claude
committed
23e19f4
refactor(receipts): drop the unused intake predicate; cover the loader's pure helpers

Clarion1631
and
claude
committed
ba175ad
fix(tests): strip stray NUL bytes from the idempotency fixture's map keys

Clarion1631
and
claude
committed
2201b19
fix(receipts): real count for the missing-receipt badge; docs match the as-built webhook

Clarion1631
and
claude
committed
562c755
fix(proxy): a bypassed machine endpoint may not dispatch a Server Action

Clarion1631
and
claude
committed
adce1f3
feat(schema): BankLine.sourceOfRecord + the ReceiptRequestCard outbox

Clarion1631
and
claude
committed
cbc486a
feat(bank-ledger): mint canonical lines from QBO, adopt them when the statement lands

Clarion1631
and
claude
committed
c5710df
fix(receipts): resolutions stick, evidence is one-to-one, old issues can close

Clarion1631
and
claude
committed
068ac67
fix(receipts): durable card outbox + starvation-proof selection

Clarion1631
and
claude
committed
0fe4d63
fix(receipts): fence manual writes against the worker; close the retry list

Clarion1631
and
claude
committed
317add0
docs: record the schema change and the two new flags

Clarion1631
and
claude
committed
d3285d9
fix(proxy,schema): action guard covers every machine bypass; round-2 columns

Clarion1631
and
claude
committed
9a3f7c6
fix(bank-ledger): cardinality-aware minting, deterministic N:N adoption, identity lock

Clarion1631
and
claude
committed
11656c7
fix(receipts): token-fenced post claim; outbox is the threads source of truth

Clarion1631
and
claude
committed
9a7dccd
fix(receipts): resolution race, one evidence unit per receipt, booked-after-void

Clarion1631
and
claude
committed
20ea3f1
fix(ci): register BankLine_sourceOfRecord_check as a Prisma blind spot

Clarion1631
and
claude
committed
01121b7
fix(receipts): the four round-3 P0s, plus findings 5 and 11

Clarion1631
and
claude
committed
924aa56
fix(receipts): round-4 items — exceptions queue, run lease, owner attribution

Clarion1631
and
claude
committed
ce5bbac
fix(receipts): round-5 gate — one identity, one owner, real leases

Clarion1631
and
claude
committed
e0d0c7d
fix(receipts): round-6 gate — recovery, error accounting, ownership, budgets

Clarion1631
and
claude
committed
61b5104
fix(receipts): round-7 gate — real matching, real boundaries, real states

Clarion1631
and
claude
committed
c9730b4
fix(receipts): round-8 items 1, 4, 5, 6, 7 (2/3/8 are Phase 1's)

Clarion1631
and
claude
committed
9bbd3df
fix(receipts): round-10 items 2-6 (1 and 7 are Phase 1's)

Clarion1631
and
claude
committed
dea4132
fix(receipts): round-11 gate — components before paging, split date bounds, run phase, scan boundary, memo artifacts

Clarion1631
and
claude
committed
d5df6fd
fix(receipts): reconcile the booking fence with Phase 1's claim token

Clarion1631
and
claude
committed
dddfacf
fix(receipts): strong-key rule on manual parks, complete-vs-ok, deadlines through reconcile/mint, card re-verify

Clarion1631
and
claude
committed
9ec3380
fix(receipts): re-reconcile the booking fence after the be9ae4c6 rebase

Clarion1631
and
claude
committed
e6a0cfa
feat(receipts): bridge secret, row-version CAS, one 60-day window, overflowExact, uncertain-card surface

Clarion1631
and
claude
committed
50bfc09
fix(receipts): artifact-backed evidence, name-based payee identity, resolvable orphans, verified card delivery

Clarion1631
and
claude
committed
ebece37
fix(receipts): orphan predicate in the WHERE, marker-verified purchases, descriptor refresh reaches the line, closure walk, locked mark-duplicate

Clarion1631
and
claude
committed
33d5b54
fix(receipts): parks hand the row back, open pass walks to closure, delivered cards leave a trace, bankPull is probed

Clarion1631
and
claude
committed
c0d0479
fix(receipts): edge components walk, plans verify their component, cards wait for the chase, delivery+history are atomic

Clarion1631
and
claude
committed
5f60848
fix(receipts): lock the descriptor refresh, fingerprint every planner input, truncated mints, verified memo artifacts, our-space threads

Clarion1631
and
claude
committed
6e6b6f7
fix(receipts): inline route shares decideSource; replays verify the object; inline orphans sweep

Clarion1631
and
claude
committed
afda5be
fix(receipts): apply each component in one locked transaction; make the Drive credential a stated prerequisite

Clarion1631
and
claude
committed
6e30986
fix(intake): round 16 — SHA identity guard, finalize CAS, attachment naming, tax warning preservation

Clarion1631
and
claude
committed
430e924
fix(receipt-queue): round 20 — snapshot reload, evidence fence, cursor halt, card retry, constraint convergence, health probe, owner CAS

Clarion1631
and
claude
committed
1cca9e0
fix(receipts): give the e2e storage stub a list(), and stop expectedSha256 bricking recovery

Clarion1631
and
claude
committed
5cf88dc
fix(receipt-queue): round 21 review fixes — fingerprint, atomic txn, undecided completion, TZ, artifact link, constraint quoting

Clarion1631
and
claude
committed
bc002d9
fix(receipts): round-17 Codex findings — Expense lifecycle, read deadline, receipt links, storage orphans, stuck-upload detection

Clarion1631
and
claude
committed
862c7d7
fix(receipt-requests): checkpoint never advances past contention; fingerprint covers evidence identity

Clarion1631
and
claude
committed
03d5ba7
fix(receipt-requests): widen BankLine re-read to the join window, not the evidence fence

Clarion1631
and
claude
committed
4824760
ci: retrigger Codex gate (runner sandbox errors on prior attempts)

Clarion1631
and
claude
committed
dddeeb4
fix(cron): delete malformed claimed receipt-request-card rows instead of skipping

Clarion1631
and
claude
committed
c3b1cf9
fix(receipts): round-18 Codex findings — fenced deletes, live-lease reuse, archive secret in deploy docs

Clarion1631
and
claude
committed
870577c

Commits on Sep 3, 2026

Commits on Sep 4, 2026

Merge remote-tracking branch 'origin/main' into feat/phase2-queue-memos

Clarion1631
and
claude
committed
ae626e7
Merge remote-tracking branch 'origin/main' into feat/phase2-queue-memos

Clarion1631
and
claude
committed
52fee47
fix(apply): resolve --expect-host instead of comparing a name to an address

Clarion1631
and
claude
committed
cc9fb26
fix(apply): resolving --expect-host alone still refused production

Clarion1631
and
claude
committed
5ca2e19
Merge remote-tracking branch 'origin/main' into feat/phase2-queue-memos
Clarion1631
committed
fea2030
ci: the Phase 1 apply driver must park the migration built on top of it
Clarion1631
committed
bae3528