Plan independent BFF and adapt selected Sendico foundations (#34)

backend/PROVENANCE.md

@@ -0,0 +1,38 @@
+# Sendico reuse provenance
+
+Source repository: `S_I/sendico`; revision `8bb20dcd622dd8eb92d289b6b34411e7eccab083`.
+Inspected 2026-09-12. These are owned forks inside SXCHNGE, not runtime imports.
+Source files below match the committed revision; local dependency edits were not used.
+No generated Sendico SDK, shared database models, deployment configuration or credentials were copied.
+
+## `internal/browser/policy.go`
+
+- Source: [api/edge/shared/auth/browser/browser.go](https://git.sendico.io/S_I/sendico/src/commit/8bb20dcd622dd8eb92d289b6b34411e7eccab083/api/edge/shared/auth/browser/browser.go)
+- Source Git blob: `3af7b54aea277d91e0d8c3eba9ee84c155f4b624`
+- Adaptation: Adapted cookie creation/clearing, origin validation and CSRF checks. Replaced Sendico names/errors/env path resolution with explicit SXCHNGE policy; checks do not depend on a client-controlled transport header. Host-only Secure/HttpOnly cookie, Lax same-site navigation, duplicate-cookie rejection and explicit expiry validation.
+- Tests are SXCHNGE-specific behavioral checks for the adapted boundary.
+
+## `internal/credential/token.go`
+
+- Source: [api/edge/shared/storage/verification/hash.go](https://git.sendico.io/S_I/sendico/src/commit/8bb20dcd622dd8eb92d289b6b34411e7eccab083/api/edge/shared/storage/verification/hash.go)
+- Source Git blob: `36fadcf404bfc77608b28cca1e669a4a62f31774`
+- Adaptation: Adapted generateMagic/tokenHash only: 32-byte crypto/rand, URL-safe encoding, SHA-256 digest. Added constant-time matching. Excluded deterministic token generation, Sendico models and all numeric OTP hashing.
+- Tests are SXCHNGE-specific behavioral checks for the adapted boundary.
+
+## `internal/evidence/key.go`
+
+- Source: [api/edge/shared/storage/s3key/key.go](https://git.sendico.io/S_I/sendico/src/commit/8bb20dcd622dd8eb92d289b6b34411e7eccab083/api/edge/shared/storage/s3key/key.go)
+- Source Git blob: `e3cca16304d2c4cb9f256f510d5a1a30a21e22a6`
+- Adaptation: Adapted relative object-key confinement. Replaced merrors with a local sentinel and rejected encoded sequences, backslashes and embedded control characters. Not a filesystem or customer-authorization utility.
+- Tests are SXCHNGE-specific behavioral checks for the adapted boundary.
+
+## Maintenance
+
+The command, operational HTTP shell, module configuration and tests are new SXCHNGE code.
+There is no automatic synchronization or promise of source compatibility with Sendico.
+For an upstream fix, review the pinned source difference, port only the relevant behavior,
+record a new provenance entry and run backend tests/vet. Provider contract changes belong
+in the future Sendico adapter and its transport fixtures, not application models or widgets.
+
+These primitives do not create sessions, deliver email, validate TOTP or upload documents.
+Use them inside the durable flows described in the [BFF plan](../docs/architecture/bff.md).