Skip to content

Platform Integration / Provider — Current Evidence Package Index — 2026-08-08

  • Status: CURRENT EVIDENCE NAVIGATION / DEFINITIONS DO NOT AUTHORIZE EXECUTION
  • Current source baseline: qa@2163051c30380585f07b9541ccd15cbc28d7e7fe
  • Source refresh: PLATFORM_INTEGRATION_PROVIDER_CURRENT_SOURCE_REFRESH_2026-08-08.md
  • Effect matrix: PLATFORM_INTEGRATION_PROVIDER_CURRENT_EFFECT_MATRIX_2026-08-08.md
  • General preflight: RBR-INTEGRATION-001-READONLY-CURRENT-SURFACE-PREFLIGHT.md
  • Phase implementation: USER HOLD

1. Evidence Rule

package defined
!= package authorized
!= package run
!= provider state proven
!= provider effect approved

Every executed package must state:

  • exact environment, host, source SHA and config reference;
  • exact tenant/profile;
  • actor/subject/role;
  • local business record identity;
  • provider-read or file-read authorization;
  • prohibited effects;
  • before state and observed state;
  • authoritative local/provider/file reread;
  • sensitive-data handling;
  • final classification;
  • accepting owner.

2. Package Portfolio

Package Scope Current state Primary output
RBR-INTEGRATION-001 cross-provider local state, safe config metadata, callbacks, schedulers and handoffs DEFINED / NOT RUN current local integration inventory and provider-read queue
RBR-PROVIDER-CREDENTIAL-001 managed credential reveal/replacement authority, storage, revision and audit boundary DEFINED HERE / NOT RUN role/tenant/storage/revision and no-secret-leak evidence
RBR-QBO-001 QBO Invoice local state, provider object search and unknown-result reconciliation existing family package + current handoff duplicate/absent/linked/manual-review disposition
RBR-QBTIME-001 local Staff Time to QuickBooks Time projection DEFINED HERE / NOT RUN event/mapping/provider conflict and recovery disposition
RBR-GMAIL-001 BOL, Packing List, Inventory Report, Booking Inquiry and appointment mail DEFINED HERE / NOT RUN per-source/target/part local and provider delivery evidence
RBR-TELEGRAM-001 Work Assignment, Loader notifications, suppression, webhook and Break cron DEFINED HERE / NOT RUN sent/suppressed/failed/unknown and duplicate-receipt disposition
RBR-APMT-001 terminal appointment preflight/slot/create DEFINED HERE / NOT RUN local source readiness and provider appointment reconciliation
RBR-AI-VOICE-001 AI Voice local intent, Twilio/Gemini/callback/recording/transcript state existing family + current handoff provider-unknown, callback, cleanup and transcript disposition
RBR-FILE-001 object, metadata, business link, readability and cleanup existing family + current handoff object/link/readability/cleanup classification

3. RBR-INTEGRATION-001 — General Current Surface

Owner:

Required outputs:

provider module/config metadata
credential storage/revision classification
local provider-state distributions
callback/watch state
file metadata/link/cleanup state
scheduler/service/host-local outbox external-read handoff
provider reconciliation queue

No provider request or credential reveal is included.

4. RBR-PROVIDER-CREDENTIAL-001 — Managed Credential Authority

Owner:

Required source evidence

  • allowlisted provider definitions and secret typing;
  • physical super-admin, tenant-admin and selected-tenant rules;
  • reveal/update route registration and body redaction;
  • encryption/decryption helper ownership;
  • optimistic EXPECTED_UPDATED_AT conflict;
  • Admin page show/hide/save/cancel and value clearing;
  • list masking and safe metadata.

Required environment evidence

  • current SECRET.<KEY> and legacy companion counts without values;
  • envelope classification;
  • current revision timestamps;
  • intended and denied role results;
  • selected-tenant isolation;
  • dedicated-deployment direct-route behavior;
  • request/log/browser-storage redaction;
  • no provider request caused by reveal or replacement;
  • cache/long-lived-process observation after approved rotation.

Required negative evidence

unallowlisted key denied
foreign tenant denied
stale expected revision denied
empty replacement denied
secret absent from list and diagnostics
page exit clears revealed value

Open contract

A managed remove command was not located. Do not emulate removal with an empty replacement or direct DB edit.

5. RBR-QBO-001 — QBO Invoice

Required local evidence:

  • READY, SYNCING, SYNCED, ERROR, VOIDED distributions;
  • provider-reference consistency;
  • stale SYNCING candidates;
  • duplicate provider Invoice IDs/Doc Numbers;
  • exact local transaction/source/line readback;
  • no immutable common attempt ledger assumption.

Separately authorized provider read:

  • search by provider ID when present;
  • safe matching identity when local reference is missing;
  • classify provider found/absent/rejected/multiple/unknown.

Recovery rule:

provider found + local reference missing
-> link/reconcile existing invoice
-> do not create again

6. RBR-QBTIME-001 — QuickBooks Time

Required local evidence:

  • Staff Time event identity and source;
  • mapped provider user availability;
  • current local open Clock/Break/Job state;
  • Loader Work Assignment event linkage;
  • config presence/revision metadata;
  • provider-specific JSONL/log correlation where authorized.

Separately authorized provider read:

  • active timesheet for the exact provider user;
  • matching local event timing and context;
  • conflict with unrelated external timesheet;
  • token/realm connectivity without logging credential content.

Recovery classification:

LOCAL_EVENT_COMMITTED_PROVIDER_MATCHED
LOCAL_EVENT_COMMITTED_PROVIDER_MISSING
PROVIDER_CONFLICT_MANUAL_REVIEW
PROVIDER_ACCEPTED_LOCAL_LOG_MISSING
UNKNOWN

Never reverse local Staff Time solely because provider synchronization failed.

7. RBR-GMAIL-001 — Gmail Outgoing And Intake

Subfamilies:

BOL
Packing List target/part
Inventory Report
Booking Inquiry company group
Appointment Watch/Intake
Appointment Reply

Required local evidence:

  • source record and recipient configuration;
  • exact subject/reference identity;
  • expected attachment set and object readability classification;
  • current request partial-result rows where available;
  • watch cursor/message/request-item state;
  • reply Message/Thread IDs where available;
  • absence/presence of a durable outgoing attempt ledger.

Separately authorized provider read:

  • Sent-message search in a narrow time window;
  • exact recipient/subject/reference and attachment-name matching;
  • Thread/Message ID readback;
  • no resend.

Packing List must be classified per target and part.

8. RBR-TELEGRAM-001 — Telegram

Subfamilies:

Work Assignment notification
manual Loader dispatch
completion/next-queue notification
suppressed delivery
webhook callback
Break-expiry cron

Required evidence:

  • delivery-enable config and safe metadata;
  • caller-owned business row/marker;
  • exact recipient identity without broad chat export;
  • sender response classification;
  • LAST_SENT_TIME or caller result meaning;
  • webhook duplicate identity and domain-state reread;
  • cron item-by-item result and overlap behavior;
  • absence/presence of durable Update-ID or Attempt ledger.

Required classification:

SENT
SUPPRESSED
FAILED_DEFINITE
UNKNOWN
DUPLICATE_CALLBACK
MANUAL_NOTIFICATION_REQUIRED

Assignment or business-row recreation is never the notification retry mechanism.

9. RBR-APMT-001 — Terminal Appointment

Required local evidence:

  • exact Equipment Load and Container;
  • Pickup/Return Booking context;
  • Delivery status/type/freight context;
  • newer Equipment Load conflicts;
  • selected appointment source/type/date/slot;
  • current provider config presence/revision metadata;
  • any local provider appointment reference columns or ledger.

Separately authorized provider read:

  • existing appointment search for the exact container/source/time window;
  • provider ID/status if found;
  • multiple-match manual review.

Recovery rule:

create timeout
-> provider search/read
-> create again only after provider absence is established

10. RBR-AI-VOICE-001 — AI Voice / Twilio / Gemini

Required evidence:

  • local case/call/request-key identity;
  • provider SID presence;
  • current status/session state;
  • PROVIDER_UNKNOWN candidates;
  • callback order and request identity;
  • recording state/deletion retry;
  • transcript segment continuity;
  • gateway service/source/config identity;
  • filesystem outbox backlog/age without reading transcript bodies;
  • signed tool-call correlation.

Provider reads and callback replay are separately authorized.

11. RBR-FILE-001 — File/Object

Required local evidence:

  • T_FILE metadata and business link;
  • duplicate or orphan links;
  • storage adapter class;
  • object locator presence without publishing sensitive path;
  • soft-delete and cleanup marker;
  • shared physical-locator candidates.

Separately authorized object read:

  • object exists;
  • size/checksum/content type where available;
  • authorized user can read expected object;
  • no broad bucket/container listing.

Classification:

OBJECT_AND_LINK_VALID
OBJECT_ONLY
METADATA_ONLY
LINK_CONFLICT
OBJECT_UNREADABLE
CLEANUP_PENDING
UNKNOWN

12. Current Package State

Static source refresh:
COMPLETE

General read-only package:
DEFINED

Provider-specific package definitions:
CURRENT

Current DB/provider/service/file evidence:
NOT RUN

Credential reveal/update evidence:
NOT RUN

M3:
NO

M4:
NO

---

Source: docs/reconstruction/PLATFORM_INTEGRATION_CURRENT_EVIDENCE_PACKAGE_INDEX_2026-08-08.md — ctc repository · This page is an English translation of the source document. Identifiers, file paths and code symbols are unchanged.