Plan independent BFF and adapt selected Sendico foundations (#34)

docs/implementation.md

@@ -362,3 +362,36 @@ See [the UX and measurement contract](ux/two-factor.md) and
 Delivery: [PR #33](https://git.sendico.io/tech/sxchnge/pulls/33) targets `main`;
 committed and pushed, unmerged. Issue #32 and PR #33 metadata verified: frontend
 label, tech owner and SXCHNGE project. No stacked dependencies.
+
+## Independent BFF plan and Sendico reuse — task #34
+
+Audited `S_I/sendico` at `8bb20dcd622dd8eb92d289b6b34411e7eccab083` without
+modifying its unrelated working-tree dependency edits. The
+[BFF plan](architecture/bff.md) records source-backed reuse choices, independent
+ownership, target structure, proposed Mongo persistence, client/API mapping,
+required provider services and phased acceptance criteria. Source availability
+is distinguished from supported/deployed external APIs.
+
+The main provider gaps are delegated customer provisioning/owner mapping, a
+spendable-balance projection, customer-scoped compliance access/manual review,
+and verified payment/callback replay contracts. Existing quotation/orchestration
+owner constraints and durable limits mutation code can underpin the provider
+facade. Sendico's personal-compliance ownership assumptions and stale limits
+README are called out explicitly. Sendico remains authoritative for financial
+execution, limits and compliance; the BFF does not clone those engines.
+
+Created a separate Go module and operational shell under `backend/`, plus adapted
+browser cookie/CSRF policy, opaque credential generation/digests and evidence-key
+confinement. [Provenance](../backend/PROVENANCE.md) pins source blobs and deviations.
+No Sendico imports, sibling replacements, external Go modules, shared database
+access or live provider calls. The starter exposes health and deliberately 503
+readiness; authentication, persistence and financial product routes remain planned.
+Root/backend README and backend guidelines describe the current scope.
+
+Validation: `make test-backend` (race-enabled tests across four packages),
+`make lint-backend` (gofmt/vet), `go build` and `git diff --check` passed.
+CLI smoke verified health 200, readiness 503, unimplemented session 404 and SIGTERM
+exit 0. Module/dependency inspection confirms standard-library-only dependencies.
+Pinned source paths, source blobs and local documentation links were checked.
+Reviewed all new backend files and the task diff. No Flutter code changed;
+frontend tests and security scans were not run for this backend starter/plan task.