First two of an expected family of dolibarr-* Claude Code skills under .claude/skills/:
dolibarr/ — platform reference skill. DOLAPIKEY auth, the silent voir_tous ACL trap, endpoint catalogue, dol-curl.sh wrapper, .env credentials layout (mode 600, gitignored). Every future workflow skill will depend on this one.
dolibarr-invoice-audit/ — V1 workflow. Three scripts: list-km-invoices.sh, audit-invoice.sh <id> (JSON facts + PDF mandatory-mention checklist), audit-km-thirdparty.sh.
Architecture decision: split now rather than grow a monolith. Future workflows follow dolibarr-<topic>/ and reuse the base skill's .env + dol-curl.sh.
.gitignore hardened with *.credentials, secrets/, *.key, and an explicit .claude/skills/**/.env pattern (defense-in-depth; the root .env rule already matches recursively).
Live findings surfaced by the audit
Captured in examples/ as the V1 baseline:
Invoice 12 (FAC002-CL0001002, 5 100 €, paid 2026-03-12) is missing 4 mandatory mentions on its PDF:
KissMetrics thirdparty (socid=1): address/email OK, but idprof1..6 all empty → EIN missing, plus no phone / no URL.
ai_agent permission setup: the voir_tous flags on Tiers and Factures had to be granted during this work (see dolibarr/README.md step 2). The exact 403 signature is preserved in dolibarr/examples/acl_403_thirdparty.json so we don't fall into the same trap again.
git check-ignore .claude/skills/dolibarr/.env returns the path
## Summary
First two of an expected family of `dolibarr-*` Claude Code skills under `.claude/skills/`:
- **`dolibarr/`** — platform reference skill. DOLAPIKEY auth, the silent `voir_tous` ACL trap, endpoint catalogue, `dol-curl.sh` wrapper, `.env` credentials layout (mode 600, gitignored). Every future workflow skill will depend on this one.
- **`dolibarr-invoice-audit/`** — V1 workflow. Three scripts: `list-km-invoices.sh`, `audit-invoice.sh <id>` (JSON facts + PDF mandatory-mention checklist), `audit-km-thirdparty.sh`.
Architecture decision: split now rather than grow a monolith. Future workflows follow `dolibarr-<topic>/` and reuse the base skill's `.env` + `dol-curl.sh`.
`.gitignore` hardened with `*.credentials`, `secrets/`, `*.key`, and an explicit `.claude/skills/**/.env` pattern (defense-in-depth; the root `.env` rule already matches recursively).
## Live findings surfaced by the audit
Captured in `examples/` as the V1 baseline:
- **Invoice 12 (FAC002-CL0001002, 5 100 €, paid 2026-03-12) is missing 4 mandatory mentions on its PDF:**
- Capital social
- L.441-10 — pénalités BCE+10 / 12,15 %
- 40 € indemnité forfaitaire (Décret 2012-1115)
- L.123-22 / R.123-237
- *Present:* forme juridique (SARL), SIRET `99965745500013`, TVA `FR00999657455`, R.C.S. Évry, NAF-APE 6201Z, **TVA 259-1° CGI** (autoliquidation correctly declared).
- **KissMetrics thirdparty (socid=1):** address/email OK, but `idprof1..6` all empty → **EIN missing**, plus no phone / no URL.
- **`ai_agent` permission setup:** the `voir_tous` flags on Tiers and Factures had to be granted during this work (see `dolibarr/README.md` step 2). The exact 403 signature is preserved in `dolibarr/examples/acl_403_thirdparty.json` so we don't fall into the same trap again.
## Out of scope here (V2 candidates)
- `dolibarr-payments-state` — payment cross-reference, deferred-cycle tracking
- `dolibarr-tva-reconciliation` — monthly TVA declaration preparation
- `dolibarr-recurring-templates` — inspect the `Kiss Metrics Invoice` recurring template
## Test plan
- [ ] `./.claude/skills/dolibarr/scripts/dol-curl.sh /users/info | jq -r .login` → `ai_agent`
- [ ] `./.claude/skills/dolibarr-invoice-audit/scripts/list-km-invoices.sh` → 5-row KM invoice table
- [ ] `./.claude/skills/dolibarr-invoice-audit/scripts/audit-invoice.sh 12` → exits 1 with 6 pass / 4 fail (current baseline)
- [ ] `./.claude/skills/dolibarr-invoice-audit/scripts/audit-km-thirdparty.sh` → exits 1 (EIN/phone/url missing)
- [ ] `git check-ignore .claude/skills/dolibarr/.env` returns the path
First two of an expected family of dolibarr-* skills:
- dolibarr/: platform reference — DOLAPIKEY auth, the voir_tous ACL
trap, endpoint catalogue, the dol-curl.sh wrapper, .env credentials
layout (gitignored, mode 600). Every future workflow skill depends
on this one.
- dolibarr-invoice-audit/: first workflow — list KissMetrics invoices,
audit one invoice end-to-end (JSON facts + PDF mandatory-mention
checklist against the French legal corpus), audit the KissMetrics
thirdparty record.
Live captures in examples/ include real audit findings to surface
to the Arcodange × KissMetrics cohort review: PDFs are missing
capital social, L.441-10 penalties, 40 € indemnity, L.123-22 / R.123-237;
KissMetrics thirdparty has no EIN (idprof1..6 all empty);
static/config/company.json holds placeholder values and a wrong
forme juridique (claims SAS, the real Dolibarr is SARL).
.gitignore hardened with *.credentials, secrets/, *.key, and an
explicit .claude/skills/**/.env pattern.
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Summary
First two of an expected family of
dolibarr-*Claude Code skills under.claude/skills/:dolibarr/— platform reference skill. DOLAPIKEY auth, the silentvoir_tousACL trap, endpoint catalogue,dol-curl.shwrapper,.envcredentials layout (mode 600, gitignored). Every future workflow skill will depend on this one.dolibarr-invoice-audit/— V1 workflow. Three scripts:list-km-invoices.sh,audit-invoice.sh <id>(JSON facts + PDF mandatory-mention checklist),audit-km-thirdparty.sh.Architecture decision: split now rather than grow a monolith. Future workflows follow
dolibarr-<topic>/and reuse the base skill's.env+dol-curl.sh..gitignorehardened with*.credentials,secrets/,*.key, and an explicit.claude/skills/**/.envpattern (defense-in-depth; the root.envrule already matches recursively).Live findings surfaced by the audit
Captured in
examples/as the V1 baseline:99965745500013, TVAFR00999657455, R.C.S. Évry, NAF-APE 6201Z, TVA 259-1° CGI (autoliquidation correctly declared).idprof1..6all empty → EIN missing, plus no phone / no URL.ai_agentpermission setup: thevoir_tousflags on Tiers and Factures had to be granted during this work (seedolibarr/README.mdstep 2). The exact 403 signature is preserved indolibarr/examples/acl_403_thirdparty.jsonso we don't fall into the same trap again.Out of scope here (V2 candidates)
dolibarr-payments-state— payment cross-reference, deferred-cycle trackingdolibarr-tva-reconciliation— monthly TVA declaration preparationdolibarr-recurring-templates— inspect theKiss Metrics Invoicerecurring templateTest plan
./.claude/skills/dolibarr/scripts/dol-curl.sh /users/info | jq -r .login→ai_agent./.claude/skills/dolibarr-invoice-audit/scripts/list-km-invoices.sh→ 5-row KM invoice table./.claude/skills/dolibarr-invoice-audit/scripts/audit-invoice.sh 12→ exits 1 with 6 pass / 4 fail (current baseline)./.claude/skills/dolibarr-invoice-audit/scripts/audit-km-thirdparty.sh→ exits 1 (EIN/phone/url missing)git check-ignore .claude/skills/dolibarr/.envreturns the path