Bootstrap copied BFF and local accounts with public Sendico contracts (#34)

backend/PROVENANCE.md

@@ -1,38 +1,64 @@
-# Sendico reuse provenance
+# Copied Sendico source
 
-Source repository: `S_I/sendico`; revision `8bb20dcd622dd8eb92d289b6b34411e7eccab083`.
-Inspected 2026-09-12. These are owned forks inside SXCHNGE, not runtime imports.
-Source files below match the committed revision; local dependency edits were not used.
-No generated Sendico SDK, shared database models, deployment configuration or credentials were copied.
+Source repository: `S_I/sendico` (`git.sendico.io`). Revision:
+`8bb20dcd622dd8eb92d289b6b34411e7eccab083`.
 
-## `internal/browser/policy.go`
+[PROVENANCE.json](PROVENANCE.json) records each copied file, original path and
+Git blob, plus whether a Go file changed beyond import namespace and formatting.
+It contains 416 Go source/test files, 112 public OpenAPI files and one adapted policy seed. Sources were
+read from the pinned commit, not Sendico's dirty working tree. These are owned
+SXCHNGE copies, not submodules or automatic synchronization links.
 
-- Source: [api/edge/shared/auth/browser/browser.go](https://git.sendico.io/S_I/sendico/src/commit/8bb20dcd622dd8eb92d289b6b34411e7eccab083/api/edge/shared/auth/browser/browser.go)
-- Source Git blob: `3af7b54aea277d91e0d8c3eba9ee84c155f4b624`
-- Adaptation: Adapted cookie creation/clearing, origin validation and CSRF checks. Replaced Sendico names/errors/env path resolution with explicit SXCHNGE policy; checks do not depend on a client-controlled transport header. Host-only Secure/HttpOnly cookie, Lax same-site navigation, duplicate-cookie rejection and explicit expiry validation.
-- Tests are SXCHNGE-specific behavioral checks for the adapted boundary.
+## What was retained
 
-## `internal/credential/token.go`
+- Shared BFF Chi runtime, process/version/logger bootstrap, HTTP middleware,
+  auth transport and response conventions.
+- Password/account service, local Mongo account/role/policy repositories,
+  transactions and local organization membership.
+- Verification issuance, expiry, attempt limits, consumption and idempotency;
+  refresh-session rotation/revocation and login rate-limit storage.
+- Canonical models, `merrors`, structured logging, health and retained tests.
+- The public OpenAPI 4.2.37 entry point and recursive local schema references,
+  copied into `contracts/sendico` without schema changes (trailing blank lines
+  normalized in three YAML files).
 
-- Source: [api/edge/shared/storage/verification/hash.go](https://git.sendico.io/S_I/sendico/src/commit/8bb20dcd622dd8eb92d289b6b34411e7eccab083/api/edge/shared/storage/verification/hash.go)
-- Source Git blob: `36fadcf404bfc77608b28cca1e669a4a62f31774`
-- Adaptation: Adapted generateMagic/tokenHash only: 32-byte crypto/rand, URL-safe encoding, SHA-256 digest. Added constant-time matching. Excluded deterministic token generation, Sendico models and all numeric OTP hashing.
-- Tests are SXCHNGE-specific behavioral checks for the adapted boundary.
+## Deliberate adaptations
 
-## `internal/evidence/key.go`
+- Import roots now belong to `git.sendico.io/tech/sxchnge/bff`. Versions are seeded
+  from committed Sendico manifests and tidied for the selected dependency set.
+- Product's composition root selects local account services instead of platform
+  services/provisioning. Its shared HTTP runtime remains the implementation.
+- Removed internal discovery and broker configuration, registration, startup and
+  teardown. An instance ID uses the existing UUID dependency without discovery.
+- Excluded internal gRPC/protobuf clients/converters and unused model files.
+  Local account-role values remain; private protobuf conversion helpers do not.
+- Program identity and the refresh-cookie name use SXCHNGE.
+- The policy seed retains the existing upsert helpers and three local
+  organization/account/role definitions, with an SXCHNGE database default.
+  Platform policies, automatic role backfills and pruning are excluded.
+- Startup configuration now rejects missing database/middleware/HTTP settings
+  and invalid HTTP timeouts. Runtime-construction failure closes the database.
+  Listen/start failures preserve the cause and produce a nonzero CLI exit.
+- Copied Casbin adapter errors and test sentinel errors use canonical `merrors`
+  instead of `errors.New`. Removed raw database settings from error logs.
+- The recipient-migration-only test was excluded together with its migration:
+  neither that platform feature nor historical Sendico data migration is part of
+  this bootstrap. Tests for every retained runtime/component remain included.
 
-- Source: [api/edge/shared/storage/s3key/key.go](https://git.sendico.io/S_I/sendico/src/commit/8bb20dcd622dd8eb92d289b6b34411e7eccab083/api/edge/shared/storage/s3key/key.go)
-- Source Git blob: `e3cca16304d2c4cb9f256f510d5a1a30a21e22a6`
-- Adaptation: Adapted relative object-key confinement. Replaced merrors with a local sentinel and rejected encoded sequences, backslashes and embedded control characters. Not a filesystem or customer-authorization utility.
-- Tests are SXCHNGE-specific behavioral checks for the adapted boundary.
+No financial engine, internal service client, gateway, platform organization
+provisioning, deployment configuration, credential or generated binary was copied.
+The local account service's organization is an SXCHNGE authorization tenant;
+it does not create Sendico organizations per customer.
 
-## Maintenance
+## Local additions
 
-The command, operational HTTP shell, module configuration and tests are new SXCHNGE code.
-There is no automatic synchronization or promise of source compatibility with Sendico.
-For an upstream fix, review the pinned source difference, port only the relevant behavior,
-record a new provenance entry and run backend tests/vet. Provider contract changes belong
-in the future Sendico adapter and its transport fixtures, not application models or widgets.
+`internal/profile` composes the copied account service. Architecture checks enforce
+project errors, no private provider imports/transports and self-contained public
+contract references. Configuration tests cover the executable example and missing
+settings. Guidelines and the backend-review skill are restored from Sendico with
+SXCHNGE paths and the public-only integration boundary.
 
-These primitives do not create sessions, deliver email, validate TOTP or upload documents.
-Use them inside the durable flows described in the [BFF plan](../docs/architecture/bff.md).
+The source includes complete local auth building blocks, not a fully wired
+SXCHNGE product API. Remaining endpoint, email, local tenant/client provisioning
+and public Sendico integration work is explicit in the
+[architecture plan](../docs/architecture/bff.md).