Files

T

arcodangeandClaude Fable 5 a00f5cb065 docs(prd): sandbox-vs-prod posture + certified-accounting-grade operations

New compliance.md leaf: French bookkeeping obligations mapped to fleet
mechanisms — inaltérabilité (L.123-22) via an append-only production
ledger grammar (create/validate/pay/avoir, never mutate a validated
document) enforced by a promote-plan compliance linter; FEC (L.47 A
LPF) with quarterly export + Test Compta Demat validation (accounting-
module binding flagged as unverified gap); piste d'audit fiable (289
VII CGI) framed as a by-product of journals + tx-id reco + monthly
packs; retention, numbering, copie fiable; loi anti-fraude scoped out
(B2B-only) with BlockedLog as sandbox-first belt-and-braces.

New Environments section in agent-architecture: prod = the ledger
(grammar-bound), sandbox = disposable iso-prod rehearsal (exempt, never
wired to production third parties); side_effect_class -> environment/
credential mapping; POCs write on sandbox only; evals target fresh
checkpoints; irreversible-by-design features trial on checkpoints.

Woven through hub (goal, requirement, success criteria, leaves table),
T03/T05/T15 guardrails, QA (linter suite, pure-append snapshots, FEC
cadence, PAF evidence framing), C2, POC-1 exit criteria.

Co-Authored-By: Claude Fable 5 <[email protected]>

2026-07-11 14:48:20 +02:00

6.8 KiB

Raw Blame History

vibe > PRD > AI back-office > Compliance

Ledger compliance — operating to certified-accounting standards

Status: In design Last Updated: 2026-07-11 Up: AI back-office hub Related: Agent architecture · Task inventory · QA strategy · Challenges

Arcodange self-hosts Dolibarr, so it is not just a software user — it is the software operator, and the agent fleet is part of that software. This page maps the French bookkeeping obligations onto fleet mechanisms, and states the operating rule that makes the sandbox-vs-production split a compliance device: the sandbox is exempt because it is disposable; production is bound because it is the ledger.

Caution

This page is engineering's reading of the law, not legal advice. Every mapping below feeds the expert-comptable checkpoint (QA strategy) before it is relied on.

Obligations → fleet mechanisms

Obligation	Source	How the fleet satisfies it
Inaltérabilité — books kept without blanks or alteration; validated entries are immutable	Code de commerce L.123-22, PCG	The ledger grammar below: corrections are new documents (avoirs, contre-passations), never edits; enforced by the promote-plan compliance linter, detected by snapshots (T13) and, if enabled, Dolibarr's BlockedLog chain.
FEC — the fichier des écritures comptables must be producible in the normed format at any tax audit	LPF art. L.47 A / A.47 A-1	Quarterly FEC export + validation with the DGFiP Test Compta Demat tool, folded into T15. Gap to close first: the read skills bypass Dolibarr's double-entry accounting module — whether it is enabled and account-mapped (prerequisite for a clean FEC) is unverified. Verification runs on the sandbox (checklist).
Piste d'audit fiable (PAF) — documented, permanent controls linking invoice ↔ service ↔ payment	CGI art. 289 VII 1°	The fleet is the PAF: run journals, deterministic payment↔bank linkage by `transaction_id`, GED originals hash-addressed, monthly audit packs (T15). The PA lane (e-invoices) carries its own platform guarantees; the PAF remains load-bearing for everything outside it — notably the KM export invoices, which stay out of e-invoicing scope.
Sequential numbering of invoices	CGI art. 289	Dolibarr owns the sequence (numbering masks); the linter rejects any manifest supplying a manual ref where Dolibarr must assign it; T05 guardrail.
Retention — 10 years commercial, 6 years fiscal	L.123-22 / LPF L.102 B	Daily backups with 10-year tiered retention, restore-tested (T14); GED attachment presence audited monthly.
Copie fiable for digitized paper originals	LPF A.102 B-2, arrêté 2017-03-22	Mostly moot: sources are native PDFs/e-invoices. Any paper original is kept — the fleet never destroys paper; a copie-fiable process (PDF/A + fingerprint + timestamp) is deferred until paper volume justifies it.
Certified cash-register software (inaltérabilité/sécurisation/conservation/archivage attested NF525 or editor certificate)	CGI art. 286-I-3° bis	Not applicable today: it binds systèmes de caisse (B2C payment recording); Arcodange is B2B-only. Dolibarr's BlockedLog module (chained, hash-linked event register — Dolibarr's answer to this law) is the cheap belt-and-braces anyway: evaluated on the sandbox first because enabling it is designed to be hard to undo. Re-scoped the day any B2C receipt appears.

The ledger grammar (production)

Production accepts only append-shaped operations:

thirdparty create / complete (non-ledger fields);
invoice (customer/supplier) create as draft → validate (the locking event);
payment record (with transaction_id);
creditnote (avoir) create — the correction primitive for anything already validated;
GED attach (source documents).

Forbidden regardless of who asks: editing or deleting a validated document, renumbering, back-dating a validated entry, detaching a GED original. A correction is always a new document that references the old one.

Enforcement is layered: (1) the compliance linter in promote-plan — a manifest containing an op outside this grammar never reaches the Telegram approval card; (2) Dolibarr's own validation locking (+ BlockedLog if adopted); (3) detection — every promote is bracketed by snapshots (T13), and a diff that is not pure-append is an incident (QA strategy).

The sandbox is deliberately exempt: rehearsals may create, mangle and wipe anything — its state is refreshed iso-prod on demand and never is the books. Exemption stops at the boundary: a manifest is linted against the production grammar before rehearsal, so the sandbox rehearses only what production would accept.

Dolibarr verifications (sandbox first)

Each of these runs on a fresh iso-prod checkpoint before any prod change; results land in STATUS:

Accounting module state — is double-entry accounting (Comptabilité expert) enabled, is the chart of accounts bound, are invoice/payment journals generated? If not, enabling + mapping it becomes a phase-5 chantier (prerequisite for FEC).
FEC export — produce it on the sandbox, validate with Test Compta Demat, file the report.
Validation locking — confirm a validated invoice rejects mutation through both UI and API paths with the write agent's permissions.
BlockedLog trial — enable on a sandbox checkpoint, exercise the invoice/payment flows, verify the chain, then refresh the checkpoint (the reversibility the module denies is exactly what the sandbox provides); decide adoption via a short ADR.
Numbering masks — confirm the customer/supplier sequences are gapless across a validate + avoir cycle.

Questions for the expert-comptable

FEC expectations for the first exercice (mid-January 2026 incorporation, close 2026-12-31) given the accounting-module timeline;
whether adopting BlockedLog pre-emptively has any downside for a B2B-only SAS;
confirmation that the PAF-by-architecture approach (journals + tx-id reconciliation + monthly packs) satisfies art. 289 VII documentation expectations for the export invoices.

6.8 KiB Raw Blame History