docs(prd): sandbox-vs-prod posture + certified-accounting-grade operations
New compliance.md leaf: French bookkeeping obligations mapped to fleet mechanisms — inaltérabilité (L.123-22) via an append-only production ledger grammar (create/validate/pay/avoir, never mutate a validated document) enforced by a promote-plan compliance linter; FEC (L.47 A LPF) with quarterly export + Test Compta Demat validation (accounting- module binding flagged as unverified gap); piste d'audit fiable (289 VII CGI) framed as a by-product of journals + tx-id reco + monthly packs; retention, numbering, copie fiable; loi anti-fraude scoped out (B2B-only) with BlockedLog as sandbox-first belt-and-braces. New Environments section in agent-architecture: prod = the ledger (grammar-bound), sandbox = disposable iso-prod rehearsal (exempt, never wired to production third parties); side_effect_class -> environment/ credential mapping; POCs write on sandbox only; evals target fresh checkpoints; irreversible-by-design features trial on checkpoints. Woven through hub (goal, requirement, success criteria, leaves table), T03/T05/T15 guardrails, QA (linter suite, pure-append snapshots, FEC cadence, PAF evidence framing), C2, POC-1 exit criteria. Co-Authored-By: Claude Fable 5 <[email protected]>
This commit is contained in:
Claude Fable 5
@@ -33,6 +33,7 @@ A **single operator wearing three hats**, plus the fleet itself:
|
||||
- **Atomic excellence**: each capability is one narrow, contract-bound atom (extract, validate, record, reconcile, report) that does its one job measurably well. Formats are guaranteed by **deterministic validators, not by model goodwill** — the LLM proposes, code disposes.
|
||||
- **The right model for each job** across four tiers — Claude (frontier reasoning), Mistral (EU cloud), local model on the M4 MacBook, SLM on the Raspberry Pi cluster — with graceful degradation when a tier is unavailable. See [model fleet](model-fleet.md).
|
||||
- **Human-gated writes as an invariant**: every ERP mutation is rehearsed on the sandbox and promoted through the existing ADR-0003 gate; approvals and digests flow through Telegram. See [agent architecture](agent-architecture.md).
|
||||
- **Ledger-grade compliance**: production is operated to the discipline expected of certified French accounting software — validated documents are immutable, corrections are new documents (avoirs), the FEC is producible on demand, and the piste d'audit fiable falls out of the architecture. The sandbox stays exempt *because* it is disposable. See [compliance](compliance.md).
|
||||
- **Efficiency**: routine admin costs the human ≤ 15 minutes/day (review + approvals), with hard deadlines never carried in a human head.
|
||||
- **Resilience**: no single point of failure — a cloud outage degrades to local triage + queueing, every write is replayable from manifests, books are restorable (tested backups) and provable (content-hashed snapshots).
|
||||
- **Institutional memory**: what the fleet learns, decides and audits is distilled into the operator's **second brain** (the PARA Obsidian vault, already live and agent-automated) following its existing conventions — knowledge compounds instead of evaporating into chat logs. See [T17](task-inventory.md#t17--knowledge-capture--retrieval-second-brain).
|
||||
@@ -114,6 +115,7 @@ flowchart TB
|
||||
- **[Agent architecture](agent-architecture.md)** — atom contracts, pipeline shape, write safety, security model (least-privilege ephemeral ERP credentials), prompt-injection defenses, runtimes/scheduling, and the human channel.
|
||||
- **[Model fleet](model-fleet.md)** — the four tiers, routing policy, structured-output enforcement, availability model, degraded modes, and cost envelope.
|
||||
- **[Challenges](challenges.md)** — the twelve identified risks and their mitigation strategies (the technical "second temps" of this PRD).
|
||||
- **[Compliance](compliance.md)** — the French bookkeeping obligations (inaltérabilité, FEC, piste d'audit fiable, numbering, retention) mapped to fleet mechanisms; the production ledger grammar and its linter; the sandbox-vs-production operating posture.
|
||||
- **[POC plan](poc-plan.md)** — feasibility proofs as real implementations, ordered, with exit criteria.
|
||||
- **[QA strategy](qa-strategy.md)** — golden sets, eval harness, autonomy promotion gates, parity checks, and ops QA. Mandatory per PRD convention.
|
||||
|
||||
@@ -133,6 +135,7 @@ flowchart TB
|
||||
- **Bank**: weekly reconciliation with zero unexplained deltas older than 7 days.
|
||||
- **TVA**: every declaration prepared ≥ 5 days before its deadline; dry-run figures match filed figures exactly (€-parity).
|
||||
- **Write safety**: zero prod writes outside the manifest → gate → promote path; 100 % of writes replayable from journals.
|
||||
- **Ledger discipline**: zero mutations of validated documents (snapshot-verified — corrections exist only as avoirs); the FEC exports clean quarterly once the accounting-module binding is verified.
|
||||
- **Resilience**: triage and reminders keep running through a full cloud outage (Pi tier alone); monthly restore drill passes.
|
||||
- **Cost**: cloud inference spend ≤ 30 €/month at current volumes (alert at 20 €).
|
||||
|
||||
@@ -162,6 +165,7 @@ Golden datasets built from real history (mails, invoices, filed declarations), a
|
||||
| [Agent architecture](agent-architecture.md) | Atom contracts, pipeline shape, write safety, security, injection defenses, runtimes, human channel. | 🟡 In design |
|
||||
| [Model fleet](model-fleet.md) | Four tiers, routing policy, structured outputs, availability, degraded modes, cost. | 🟡 In design |
|
||||
| [Challenges](challenges.md) | Twelve risks with mitigation strategies and residual ownership. | 🟡 In design |
|
||||
| [Compliance](compliance.md) | Bookkeeping obligations → mechanisms; ledger grammar + linter; sandbox-vs-prod posture; Dolibarr verifications. | 🟡 In design |
|
||||
| [POC plan](poc-plan.md) | Ordered feasibility proofs with exit criteria and challenge coverage. | 🟡 In design |
|
||||
| [QA strategy](qa-strategy.md) | Golden sets, eval harness, promotion gates, parity checks, ops QA. | 🟡 In design |
|
||||
| [STATUS](STATUS.md) | Foundation ledger (shipped PRs) + phase tracker. | 🟢 Current |
|
||||
|
||||
@@ -91,7 +91,31 @@ flowchart TB
|
||||
- **Gated promote**: `promote-plan` (human-readable review) → `promote-apply --target prod` requiring the prod write key from ENV only (never stored) + an explicit confirm variable.
|
||||
- **Iso-prod checkpoints**: the sandbox is re-seedable from prod at will, so rehearsals run against *today's* real state.
|
||||
|
||||
This PRD adds around it: idempotency keys on every write atom, predicted-delta assertions (rehearse → re-read → compare *before* asking for approval), pre/post snapshots ([T13](task-inventory.md#t13--erp-snapshot--drift-detection)), and approval cards as the human interface to the gate.
|
||||
This PRD adds around it: idempotency keys on every write atom, predicted-delta assertions (rehearse → re-read → compare *before* asking for approval), pre/post snapshots ([T13](task-inventory.md#t13--erp-snapshot--drift-detection)), a **compliance linter** in `promote-plan` (a manifest with any operation outside the [ledger grammar](compliance.md#the-ledger-grammar-production) never reaches the approval card), and approval cards as the human interface to the gate.
|
||||
|
||||
## Environments — sandbox vs production
|
||||
|
||||
The environment split is not an implementation detail — it is both the **safety** device (ADR-0003) and the **compliance** device ([compliance](compliance.md)): the sandbox may host any experiment because its state is disposable; production is held to append-only ledger discipline because it *is* the books.
|
||||
|
||||
| | **Production** (`erp.arcodange.lab`) | **Sandbox** (`erp-sandbox.arcodange.lab`) |
|
||||
| --- | --- | --- |
|
||||
| Role | the ledger — book of record | rehearsal, POCs, evals, drills |
|
||||
| State | permanent, append-shaped only | disposable; re-seeded **iso-prod** on demand (`arcodange sandbox checkpoint refresh`) |
|
||||
| Credentials | read-only `ai_agent`; prod write key human-held, ENV-only at promote time | write-scoped `ai_agent_sandbox`, host-guarded (structurally cannot reach prod) |
|
||||
| Ledger grammar | **enforced** (linter + locking + snapshot detection) | exempt — but manifests destined for prod are linted *before* rehearsal |
|
||||
| Third parties | real (Qonto/PA, Zoho, Telegram) | **never wired to production externals**: no PA emission, no outbound mail — side channels are stubbed or blackholed |
|
||||
|
||||
Every atom's `side_effect_class` maps to an environment posture:
|
||||
|
||||
| `side_effect_class` | Runs against | Credential |
|
||||
| --- | --- | --- |
|
||||
| `read` | prod (and sandbox for evals) | read-only `ai_agent` |
|
||||
| `draft` | no ERP at all | none |
|
||||
| `write-sandbox` | sandbox only | `ai_agent_sandbox` (host-guarded) |
|
||||
| `write-prod` | prod, **only** through the promote gate | human-held key + explicit confirm |
|
||||
| `outbound` | production channels | allowlisted recipients, human-gated |
|
||||
|
||||
Standing rules: **every POC's write legs run on the sandbox** and enter prod only through the gate with a real approval; ERP-dependent **eval runs target a fresh checkpoint** (iso-prod refresh = a reproducible fixture); restore drills and game-days land on the sandbox by construction ([T14](task-inventory.md#t14--backup--restore-verification), [QA strategy](qa-strategy.md#ops-qa)); anything designed to be irreversible in prod (e.g. Dolibarr's BlockedLog module) is trialed on a checkpoint first, because the sandbox provides exactly the reversibility production denies.
|
||||
|
||||
## Security model
|
||||
|
||||
|
||||
@@ -18,7 +18,7 @@ Each challenge states what breaks, the mitigation strategy, and the **residual**
|
||||
## C2 — ERP write integrity
|
||||
|
||||
**Breaks:** duplicate invoices, phantom payments, corrupted referential state; an agent re-run double-records a batch.
|
||||
**Strategy:** idempotency keys on every write atom (e.g. supplier + `ref_supplier` + TTC); pre-write dedupe lookup against prod; sandbox rehearsal with **predicted-delta assertion** (re-read what was created, compare to the draft *before* requesting approval); manifests as the only write vehicle (replayable, reviewable); pre/post snapshots with content-hash ([T13](task-inventory.md#t13--erp-snapshot--drift-detection)); daily backups with tested restore as the last line ([T14](task-inventory.md#t14--backup--restore-verification)).
|
||||
**Strategy:** idempotency keys on every write atom (e.g. supplier + `ref_supplier` + TTC); pre-write dedupe lookup against prod; sandbox rehearsal with **predicted-delta assertion** (re-read what was created, compare to the draft *before* requesting approval); manifests as the only write vehicle (replayable, reviewable) and **linted against the production ledger grammar** — create/validate/pay/avoir only, never mutation of a validated document ([compliance](compliance.md#the-ledger-grammar-production)); pre/post snapshots with content-hash ([T13](task-inventory.md#t13--erp-snapshot--drift-detection)); daily backups with tested restore as the last line ([T14](task-inventory.md#t14--backup--restore-verification)).
|
||||
**Residual:** logically-valid-but-wrong entries that pass all checks — caught (late) by the monthly coherence audit and the human's review taps.
|
||||
|
||||
## C3 — Prompt injection via inbound content
|
||||
|
||||
@@ -0,0 +1,57 @@
|
||||
[vibe](../../README.md) > [PRD](../README.md) > [AI back-office](README.md) > **Compliance**
|
||||
|
||||
# Ledger compliance — operating to certified-accounting standards
|
||||
|
||||
> **Status:** In design
|
||||
> **Last Updated:** 2026-07-11
|
||||
> **Up:** [AI back-office hub](README.md)
|
||||
> **Related:** [Agent architecture](agent-architecture.md) · [Task inventory](task-inventory.md) · [QA strategy](qa-strategy.md) · [Challenges](challenges.md)
|
||||
|
||||
Arcodange self-hosts Dolibarr, so it is not just a software *user* — it is the software *operator*, and the agent fleet is part of that software. This page maps the French bookkeeping obligations onto fleet mechanisms, and states the operating rule that makes the [sandbox-vs-production split](agent-architecture.md#environments--sandbox-vs-production) a compliance device: **the sandbox is exempt because it is disposable; production is bound because it is the ledger.**
|
||||
|
||||
> [!CAUTION]
|
||||
> This page is engineering's reading of the law, not legal advice. Every mapping below feeds the expert-comptable checkpoint ([QA strategy](qa-strategy.md#fiscal-parity-checks)) before it is relied on.
|
||||
|
||||
## Obligations → fleet mechanisms
|
||||
|
||||
| Obligation | Source | How the fleet satisfies it |
|
||||
| --- | --- | --- |
|
||||
| **Inaltérabilité** — books kept without blanks or alteration; validated entries are immutable | Code de commerce L.123-22, PCG | The [ledger grammar](#the-ledger-grammar-production) below: corrections are *new documents* (avoirs, contre-passations), never edits; enforced by the promote-plan **compliance linter**, detected by snapshots ([T13](task-inventory.md#t13--erp-snapshot--drift-detection)) and, if enabled, Dolibarr's BlockedLog chain. |
|
||||
| **FEC** — the fichier des écritures comptables must be producible in the normed format at any tax audit | LPF art. L.47 A / A.47 A-1 | Quarterly FEC export + validation with the DGFiP *Test Compta Demat* tool, folded into [T15](task-inventory.md#t15--monthly-coherence-audit). **Gap to close first:** the read skills bypass Dolibarr's double-entry accounting module — whether it is enabled and account-mapped (prerequisite for a clean FEC) is unverified. Verification runs on the sandbox ([checklist](#dolibarr-verifications-sandbox-first)). |
|
||||
| **Piste d'audit fiable (PAF)** — documented, permanent controls linking invoice ↔ service ↔ payment | CGI art. 289 VII 1° | The fleet *is* the PAF: run journals, deterministic payment↔bank linkage by `transaction_id`, GED originals hash-addressed, monthly audit packs ([T15](task-inventory.md#t15--monthly-coherence-audit)). The PA lane (e-invoices) carries its own platform guarantees; the PAF remains load-bearing for everything outside it — notably the **KM export invoices**, which stay out of e-invoicing scope. |
|
||||
| **Sequential numbering** of invoices | CGI art. 289 | Dolibarr owns the sequence (numbering masks); the linter rejects any manifest supplying a manual ref where Dolibarr must assign it; [T05](task-inventory.md#t05--client-invoice-issuance) guardrail. |
|
||||
| **Retention** — 10 years commercial, 6 years fiscal | L.123-22 / LPF L.102 B | Daily backups with 10-year tiered retention, restore-tested ([T14](task-inventory.md#t14--backup--restore-verification)); GED attachment presence audited monthly. |
|
||||
| **Copie fiable** for digitized paper originals | LPF A.102 B-2, arrêté 2017-03-22 | Mostly moot: sources are native PDFs/e-invoices. Any paper original is *kept* — the fleet never destroys paper; a copie-fiable process (PDF/A + fingerprint + timestamp) is deferred until paper volume justifies it. |
|
||||
| **Certified cash-register software** (inaltérabilité/sécurisation/conservation/archivage attested NF525 or editor certificate) | CGI art. 286-I-3° bis | **Not applicable today**: it binds *systèmes de caisse* (B2C payment recording); Arcodange is B2B-only. Dolibarr's **BlockedLog** module (chained, hash-linked event register — Dolibarr's answer to this law) is the cheap belt-and-braces anyway: evaluated on the sandbox first because enabling it is designed to be hard to undo. Re-scoped the day any B2C receipt appears. |
|
||||
|
||||
## The ledger grammar (production)
|
||||
|
||||
Production accepts **only append-shaped operations**:
|
||||
|
||||
- `thirdparty` create / complete (non-ledger fields);
|
||||
- `invoice` (customer/supplier) create as draft → **validate** (the locking event);
|
||||
- `payment` record (with `transaction_id`);
|
||||
- `creditnote` (avoir) create — *the* correction primitive for anything already validated;
|
||||
- GED attach (source documents).
|
||||
|
||||
Forbidden regardless of who asks: editing or deleting a validated document, renumbering, back-dating a validated entry, detaching a GED original. A correction is always a new document that references the old one.
|
||||
|
||||
**Enforcement is layered:** (1) the **compliance linter** in `promote-plan` — a manifest containing an op outside this grammar never reaches the Telegram approval card; (2) Dolibarr's own validation locking (+ BlockedLog if adopted); (3) detection — every promote is bracketed by snapshots ([T13](task-inventory.md#t13--erp-snapshot--drift-detection)), and a diff that is not pure-append is an incident ([QA strategy](qa-strategy.md#write-path-qa)).
|
||||
|
||||
The sandbox is deliberately **exempt**: rehearsals may create, mangle and wipe anything — its state is refreshed iso-prod on demand and never *is* the books. Exemption stops at the boundary: a manifest is linted against the production grammar **before** rehearsal, so the sandbox rehearses only what production would accept.
|
||||
|
||||
## Dolibarr verifications (sandbox first)
|
||||
|
||||
Each of these runs on a fresh iso-prod checkpoint before any prod change; results land in [STATUS](STATUS.md):
|
||||
|
||||
1. **Accounting module state** — is double-entry accounting (`Comptabilité expert`) enabled, is the chart of accounts bound, are invoice/payment journals generated? If not, enabling + mapping it becomes a phase-5 chantier (prerequisite for FEC).
|
||||
2. **FEC export** — produce it on the sandbox, validate with *Test Compta Demat*, file the report.
|
||||
3. **Validation locking** — confirm a validated invoice rejects mutation through both UI and API paths with the write agent's permissions.
|
||||
4. **BlockedLog trial** — enable on a sandbox checkpoint, exercise the invoice/payment flows, verify the chain, then **refresh the checkpoint** (the reversibility the module denies is exactly what the sandbox provides); decide adoption via a short ADR.
|
||||
5. **Numbering masks** — confirm the customer/supplier sequences are gapless across a validate + avoir cycle.
|
||||
|
||||
## Questions for the expert-comptable
|
||||
|
||||
- FEC expectations for the first exercice (mid-January 2026 incorporation, close 2026-12-31) given the accounting-module timeline;
|
||||
- whether adopting BlockedLog pre-emptively has any downside for a B2B-only SAS;
|
||||
- confirmation that the PAF-by-architecture approach (journals + tx-id reconciliation + monthly packs) satisfies art. 289 VII documentation expectations for the export invoices.
|
||||
@@ -7,7 +7,7 @@
|
||||
> **Up:** [AI back-office hub](README.md)
|
||||
> **Related:** [Task inventory](task-inventory.md) · [Challenges](challenges.md) · [QA strategy](qa-strategy.md) · [STATUS](STATUS.md)
|
||||
|
||||
POCs are **real implementations against real data** (the live mailbox, the live bank feeds, the iso-prod sandbox) — not demos. Each has a hard exit criterion; a POC that can't meet it produces a documented "no" and a fallback decision, which is also a success. Order follows the [roadmap](README.md#phased-roadmap); effort is S/M/L (rough: S ≈ a day, M ≈ a few days, L ≈ a week-plus of focused sessions).
|
||||
POCs are **real implementations against real data** (the live mailbox, the live bank feeds, the iso-prod sandbox) — not demos. Each has a hard exit criterion; a POC that can't meet it produces a documented "no" and a fallback decision, which is also a success. Environment rule for every POC: **write legs run on the sandbox** and reach prod only through the promote gate with a real approval; anything irreversible-by-design is trialed on a disposable checkpoint first ([environments](agent-architecture.md#environments--sandbox-vs-production)). Order follows the [roadmap](README.md#phased-roadmap); effort is S/M/L (rough: S ≈ a day, M ≈ a few days, L ≈ a week-plus of focused sessions).
|
||||
|
||||
## POC-1 — Supplier invoice end-to-end
|
||||
|
||||
@@ -15,7 +15,7 @@ POCs are **real implementations against real data** (the live mailbox, the live
|
||||
|
||||
**Proves:** the full A2 loop — the pipeline shape, dual extraction, validators, sandbox rehearsal, Telegram approval, gated promote, GED attach. Covers [T01](task-inventory.md#t01--mailbox-triage--routing)→[T04](task-inventory.md#t04--thirdparty-creation--completeness).
|
||||
**Build:** mail → dual extraction (M4 + Mistral) → validators → manifest → sandbox → approval card → promote → attach + verify, journaled end-to-end. Triage may start as a cron script (Pi model comes in POC-2).
|
||||
**Exit criteria:** 10 consecutive *real* supplier invoices recorded in prod with **zero human field-corrections** (approvals only); critical-field accuracy ≥ 98 % over the full golden set (overall field accuracy reported alongside); all injection fixtures quarantined; every run replayable from its journal.
|
||||
**Exit criteria:** 10 consecutive *real* supplier invoices recorded in prod with **zero human field-corrections** (approvals only); critical-field accuracy ≥ 98 % over the full golden set (overall field accuracy reported alongside); all injection fixtures quarantined; every run replayable from its journal; post-run snapshot history is **pure-append** (no validated document mutated) and the compliance linter's forbidden-manifest suite passes ([compliance](compliance.md#the-ledger-grammar-production)).
|
||||
**Fallback if failed:** stay at A1 (agent drafts, human enters in UI) and iterate extraction only.
|
||||
|
||||
## POC-2 — Pi sentinel
|
||||
|
||||
@@ -17,7 +17,7 @@ The fleet's product is *trustworthy books*, so QA is not a phase — it is the o
|
||||
|
||||
## Eval harness
|
||||
|
||||
- **Per-atom regression:** any change to an atom (prompt, model, version bump in the registry) re-runs its golden set; scores are committed alongside the change (a PR that degrades an atom's score is visible as such).
|
||||
- **Per-atom regression:** any change to an atom (prompt, model, version bump in the registry) re-runs its golden set; scores are committed alongside the change (a PR that degrades an atom's score is visible as such). ERP-dependent eval runs target a **fresh sandbox checkpoint** — the iso-prod refresh is a reproducible fixture ([environments](agent-architecture.md#environments--sandbox-vs-production)).
|
||||
- **Injection suite:** every atom that reads untrusted content runs the adversarial fixtures; a single leak (instruction obeyed, field fabricated under influence) is a blocking failure regardless of the accuracy score.
|
||||
- **Disagreement telemetry:** dual-extraction disagreement rates and escalation rates are recorded per run — a drift upward is an early-warning signal *before* accuracy visibly drops.
|
||||
|
||||
@@ -34,8 +34,10 @@ Per atom, mechanical, recorded in the registry ([ladder](README.md#the-autonomy-
|
||||
|
||||
## Write-path QA
|
||||
|
||||
- **Compliance linter:** `promote-plan` rejects any manifest operation outside the production [ledger grammar](compliance.md#the-ledger-grammar-production) (mutating a validated document, supplying a manual ref where Dolibarr owns the sequence, detaching a GED original); the linter carries its own test suite of forbidden manifests.
|
||||
- **Predicted-delta assertion:** every rehearsed manifest re-reads what the sandbox created and diffs it against the draft *before* the approval card goes out; a mismatch is a bug, never a "close enough".
|
||||
- **Post-write verification:** after promote, the prod object is re-read and compared again; the pre/post snapshot pair ([T13](task-inventory.md#t13--erp-snapshot--drift-detection)) must show *exactly* the journaled writes and nothing else.
|
||||
- **Post-write verification:** after promote, the prod object is re-read and compared again; the pre/post snapshot pair ([T13](task-inventory.md#t13--erp-snapshot--drift-detection)) must show *exactly* the journaled writes and nothing else — and the diff must be **pure-append** (a mutation of a validated document is an incident, not a diff).
|
||||
- **Ledger & FEC checks:** quarterly FEC export validated with the DGFiP *Test Compta Demat* tool (once the accounting-module binding is verified — [compliance](compliance.md#dolibarr-verifications-sandbox-first)); numbering gaplessness across validate + avoir cycles; BlockedLog chain verification if adopted. All rehearsed on a sandbox checkpoint before running against prod.
|
||||
- **Idempotency tests:** every write atom's test suite replays its own manifest twice and asserts a no-op second pass.
|
||||
|
||||
## Fiscal parity checks
|
||||
@@ -53,4 +55,4 @@ Per atom, mechanical, recorded in the registry ([ladder](README.md#the-autonomy-
|
||||
|
||||
## Evidence trail
|
||||
|
||||
Every month yields an audit pack: the coherence audit ([T15](task-inventory.md#t15--monthly-coherence-audit)), the month's run journals, snapshot content-hashes, approval-card decisions, and fiscal sheets — archived in git + GED. The pack is written for a third party (expert-comptable, auditor, or a future operator): it must let them reconstruct *what the fleet did and why* without access to this PRD or any chat history. A distilled summary of each pack also lands in the second brain ([T17](task-inventory.md#t17--knowledge-capture--retrieval-second-brain)), so institutional memory outlives both chat logs and this repo.
|
||||
Every month yields an audit pack: the coherence audit ([T15](task-inventory.md#t15--monthly-coherence-audit)), the month's run journals, snapshot content-hashes, approval-card decisions, and fiscal sheets — archived in git + GED. This pack is deliberately shaped as the documented-control set of the **piste d'audit fiable** (CGI art. 289 VII — [compliance](compliance.md#obligations--fleet-mechanisms)): the invoice ↔ service ↔ payment linkage is evidenced continuously, not reconstructed under audit. The pack is written for a third party (expert-comptable, auditor, or a future operator): it must let them reconstruct *what the fleet did and why* without access to this PRD or any chat history. A distilled summary of each pack also lands in the second brain ([T17](task-inventory.md#t17--knowledge-capture--retrieval-second-brain)), so institutional memory outlives both chat logs and this repo.
|
||||
|
||||
@@ -81,7 +81,7 @@ Backlog (not yet specified): [see bottom](#backlog--deferred).
|
||||
6. [HUMAN+AGENT] Gated promote to prod (`arcodange promote apply --target prod`, env-confirmed, prod key never stored) — per [ADR 0003](../../ADR/0003-sandbox-state-lifecycle.md).
|
||||
7. [AGENT] Attach the source PDF to the prod supplier invoice in the GED (*gestion électronique de documents* — Dolibarr's attached-files store), verify by re-read + snapshot delta; journal the run.
|
||||
- **Outputs:** recorded + documented supplier invoice in prod; journal entry; GED attachment.
|
||||
- **Guardrails:** idempotency key = (supplier, `ref_supplier`, TTC) — a replay can never double-record; the sandbox host-guard structurally refuses prod; validation of the *recorded* state, not just the request.
|
||||
- **Guardrails:** idempotency key = (supplier, `ref_supplier`, TTC) — a replay can never double-record; the sandbox host-guard structurally refuses prod; validation of the *recorded* state, not just the request; once validated, the document is immutable — corrections are avoirs, per the [ledger grammar](compliance.md#the-ledger-grammar-production).
|
||||
- **Today:** all write machinery exists and is proven (`dolibarr-sandbox-write`, promote plan/apply, business-key lookup); it is driven by hand from Claude Code sessions.
|
||||
- **Target:** **A2**, Claude tier assembling/verifying, human approving via Telegram.
|
||||
|
||||
@@ -108,7 +108,7 @@ Backlog (not yet specified): [see bottom](#backlog--deferred).
|
||||
3. [AGENT] Run the mandatory-mention audit on the produced PDF (`dolibarr-invoice-audit`: SIRET, RCS, TVA intracom, L.441-10 penalties, 40 € indemnity, etc.).
|
||||
4. [HUMAN] Approves the send; [AGENT] emails the invoice to the client contact (allowlisted recipient) and records the expected due date per the contracted payment cycle.
|
||||
5. From 2027-09: [AGENT] submits the e-reporting data for this international transaction via the PA (leaning Qonto — [challenges C12](challenges.md#c12--e-invoicing-reform-unknowns)).
|
||||
- **Guardrails:** outbound email is always human-gated; the invoice number sequence is owned by Dolibarr (never fabricated); a failed mention-audit blocks the send.
|
||||
- **Guardrails:** outbound email is always human-gated; the invoice number sequence is owned by Dolibarr (never fabricated); a failed mention-audit blocks the send; a validated invoice is immutable — corrections go through an avoir + re-issue ([ledger grammar](compliance.md#the-ledger-grammar-production)).
|
||||
- **Today:** template inspection + invoice audit are A3-eligible (read, on demand); issuance is manual in the UI.
|
||||
- **Target:** **A2**; Claude tier.
|
||||
|
||||
@@ -215,8 +215,8 @@ Backlog (not yet specified): [see bottom](#backlog--deferred).
|
||||
|
||||
### T15 — Monthly coherence audit
|
||||
|
||||
- **Trigger:** 1st of month (after T07 has converged).
|
||||
- **Mode opératoire:** [AGENT] compose the read skills into one audit pack: every invoice's payment state vs bank evidence, TVA bases vs invoice lines, thirdparty completeness, template health, credit-note consistency, GED attachment presence; attach the month's snapshot hash; archive the pack (git + GED) and distill a summary note into the second brain ([T17](#t17--knowledge-capture--retrieval-second-brain)); digest the exceptions only.
|
||||
- **Trigger:** 1st of month (after T07 has converged); extended scope every quarter.
|
||||
- **Mode opératoire:** [AGENT] compose the read skills into one audit pack: every invoice's payment state vs bank evidence, TVA bases vs invoice lines, thirdparty completeness, template health, credit-note consistency, GED attachment presence; attach the month's snapshot hash; archive the pack (git + GED) and distill a summary note into the second brain ([T17](#t17--knowledge-capture--retrieval-second-brain)); digest the exceptions only. **Quarterly, additionally:** export the FEC and validate it (*Test Compta Demat*), and verify ledger discipline — snapshot history shows pure appends, no validated document mutated, numbering gapless (BlockedLog chain check if adopted) — per [compliance](compliance.md#dolibarr-verifications-sandbox-first).
|
||||
- **Guardrails:** read-only; exceptions route to the owning task's queue rather than being fixed inline.
|
||||
- **Today:** each check exists as a skill; composition is manual (the ad-hoc "cohort review" audit sessions run in Claude Code today). **Target: A3**; Claude tier.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user