Skip to content

Platform Integration / Provider Current Surface Validation — 2026-08-08

  • Status: STATIC VALIDATION PASS / ENVIRONMENT AND PROVIDER EVIDENCE NOT RUN
  • Previous platform baseline: qa/master@a5280b7cdc1c78b809ed6f1996ca31491b522146
  • Current review ref: qa@2163051c30380585f07b9541ccd15cbc28d7e7fe
  • Source refresh: PLATFORM_INTEGRATION_PROVIDER_CURRENT_SOURCE_REFRESH_2026-08-08.md
  • Credential authority: PLATFORM_PROVIDER_CREDENTIAL_CURRENT_SOURCE_AUTHORITY_2026-08-08.md
  • Effect matrix: PLATFORM_INTEGRATION_PROVIDER_CURRENT_EFFECT_MATRIX_2026-08-08.md
  • Read-only package: RBR-INTEGRATION-001-READONLY-CURRENT-SURFACE-PREFLIGHT.md
  • Phase implementation: USER HOLD

1. Validation Purpose

This document validates that:

  1. current provider-adapter freshness claims are supported by exact source comparisons;
  2. newly added credential-management behavior is documented without exposing a secret or overstating provider readiness;
  3. current business callers are separated from provider adapters and local business authority;
  4. the effect matrix preserves partial/unknown/callback/file boundaries;
  5. the preflight is read-only, tenant-scoped, bounded and secret-safe;
  6. the documentation does not introduce a generic outbox or replay authority.

It does not validate current provider objects, credentials, callbacks, services, scheduler state, object readability or target-role acceptance.

2. Source Baseline Validation

The current ref is 52 commits ahead of the previous Integration source-authority baseline.

The following core adapter/helper blobs are identical between the two refs:

Owner Blob SHA Result
QuickBooksOnlineClient.php 0bb4d1e13785cef130401c15f3efa5a4389100e5 byte-identical
quickbooks_time_sync_helper.php 8c0a63cc7d038ce8a62ca0c5297101e8c0610aa1 byte-identical
GmailSender.php f2dd8c51fd42eaed848eaad22d198ac52538eda7 byte-identical
TelegramSender.php f450b9bade24bc492da9608c9958eeecedd23f47 byte-identical
file_storage.php ed6e44f93d53bf82f0174a5a8c3ef1acf37beeee byte-identical
AI Voice voice_helper.php 3aab6b3368ee702c9bb326b3188bb76a384004fb byte-identical
GmailAppointmentWatchService.php e36a82ef99ebd2e59a21d4c3157ba4d3d390e809 byte-identical

Result:

CORE PROVIDER ADAPTER SEMANTICS REMAIN CURRENT
CURRENT CALLER AND CREDENTIAL SURFACES REQUIRE ADDENDA

3. New Credential Source Validation

Current source adds tenant-scoped managed credential reveal and replacement.

Validated properties:

  • only provider-definition allowlisted secret keys are accepted;
  • encrypted storage uses SECRET.<CONFIG_KEY> with enc:v1: AES-256-GCM envelope;
  • a compatible legacy direct key can be read server-side and is retired/wiped during managed replacement;
  • reveal/update routes redact request bodies from API diagnostics;
  • reveal adds no-store response headers;
  • list/read metadata masks secret value and exposes safe configured/revision fields;
  • replacement supports EXPECTED_UPDATED_AT optimistic conflict;
  • replacement performs no provider request;
  • reveal returns one plaintext value to the authorized caller only;
  • the Admin page clears a revealed value when another credential is shown and on page exit.

Current gaps correctly retained:

  • no managed removal command located;
  • no dedicated immutable credential-management event located;
  • server enforcement of dedicated-deployment read-only behavior requires evidence;
  • long-lived process cache/rotation observation requires evidence;
  • stored credential validity and provider connectivity are not proven by replacement.

Result: PASS WITH CURRENT GAPS.

4. Current Caller Validation

QBO

The local AR/QBO owner remains the same. QBO Invoice create is still a direct provider request after local claim, and no universal provider search/reconciliation attempt ledger was located.

Result: PASS.

QuickBooks Time

The adapter is unchanged, but current Loader Work Assignment Start/Complete callers commit local Staff Time events and invoke QBT synchronization after commit.

local Staff Time commit
!= external timesheet synchronized

Result: PASS.

Gmail

Current outgoing callers include:

  • BOL;
  • Packing List target/part delivery;
  • Inventory Report XLSX delivery;
  • Booking Inquiry grouped delivery;
  • appointment reply/intake workflow.

The shared sender remains unchanged. Each caller owns different identity, attachment and partial-result semantics.

Result: PASS.

Telegram

Current callers include Work Assignment create, manual Loader dispatch, selected completion/next-queue notifications, webhook handling and Break cron. Suppressed delivery remains distinct from sent delivery.

Result: PASS.

APMT

Current Container Tracking source owns preflight, slot lookup and appointment create. No local universal appointment-attempt ledger was established by the reviewed route.

Result: PASS.

AI Voice / Twilio / Gemini

The existing provider-specific intent, callback, recording-cleanup and transcript-outbox model remains current. It is not evidence for a generic queue.

Result: PASS.

File

File object, metadata, link, readability and cleanup remain independent checkpoints.

Result: PASS.

5. Effect-Matrix Layer Validation

The effect matrix keeps these layers independent:

business caller
local authority
provider/file effect
attempt/result evidence
callback/receipt
unknown-result recovery

Representative examples:

Work Assignment Telegram

Assignment row commit
-> Telegram attempt
-> local marker/result

message failure
!= assignment failure

QBT

Staff Time event commit
-> QBT adapter
-> provider result/manual review

provider conflict
!= local Staff Time reversal

Gmail Packing List

target x part
= independent delivery checkpoint

Credential replacement

encrypted local replacement
!= provider authentication test

Voice transcript outbox

host-local provider-specific staged file
!= universal multi-provider queue

Result: PASS.

6. Generic Outbox Policy Validation

The current documentation does not add or approve:

one generic outbox table
one generic payload replay handler
one generic retry counter
one worker-owned business completion state

It preserves the current policy:

Generic cross-provider outbox/replay authority:
NOT APPROVED

Provider-specific durable intent/attempt/receipt:
ONLY WHEN SEPARATELY JUSTIFIED

Result: PASS.

7. Preflight Construction Validation

7.1 SQL inventory

The preflight contains 40 read-only SQL templates.

Allowed statement forms:

SELECT
SHOW
information_schema read

No template contains a write, lock, mutating procedure, credential reveal or provider request.

Result: PASS.

7.2 Schema-first behavior

The package begins with DB identity, table, column and index inspection. Family queries are conditional on confirmed installed columns.

Result: PASS.

7.3 Tenant scope

Provider config, business rows, callbacks, file metadata and local state require a verified <CLIENT_ID>. Time-based evidence uses bounded <SINCE_UTC> and <UNTIL_UTC> placeholders.

Result: PASS.

7.4 Secret safety

The config queries return:

  • logical key name;
  • storage-key class;
  • value-presence boolean;
  • envelope classification;
  • module/revision metadata.

They do not return decrypted values, ciphertext, OAuth tokens, API keys or signed URLs.

Result: PASS.

7.5 Provider and file boundary

Provider-side search, callback replay, credential reveal and object readability are separate authorization handoffs. The broad preflight cannot perform them.

Result: PASS.

7.6 Bounded output

Broad inventories use aggregate results or bounded row IDs. Full mail bodies, transcript bodies, file paths and recipient directories are excluded.

Result: PASS.

8. Overclaim Review

The package does not claim:

  • current credentials are valid;
  • any provider is reachable;
  • current callbacks are complete;
  • any message was delivered;
  • a QBO ERROR means provider absence;
  • a Telegram suppressed result means sent;
  • a file metadata row means readable object;
  • the credential reveal/update role policy is accepted;
  • the current DB contains expected tables or rows;
  • a generic worker/outbox is needed or approved;
  • M3 or M4 readiness.

Result: PASS.

9. Static Findings

Finding Result
Core provider adapters unchanged confirmed
Credential reveal/update source added confirmed
Managed credential removal source not located
Work Assignment Telegram caller confirmed
Loader Staff Time → QBT after-commit caller confirmed
Inventory Report Gmail caller confirmed
Booking Inquiry Gmail caller confirmed
APMT preflight/slots/create caller confirmed
Gmail watch provider-specific durable workflow confirmed
AI Voice provider-specific intent/callback/outbox confirmed
Generic cross-provider outbox approval absent
Current environment/provider evidence not run

10. Validation Disposition

Source refresh:
PASS

Credential source authority:
PASS WITH OPEN GAPS

Current effect matrix:
PASS

Read-only preflight:
PASS STATIC VALIDATION

Current DB/provider/service/file evidence:
NOT RUN

M3:
NO

M4:
NO

Phase progress:
NONE

---

Source: docs/reconstruction/PLATFORM_INTEGRATION_PROVIDER_CURRENT_SURFACE_VALIDATION_2026-08-08.md — ctc repository · This page is an English translation of the source document. Identifiers, file paths and code symbols are unchanged.