Bootstrap copied BFF and local accounts with public Sendico contracts (#34)

docs/implementation.md

@@ -363,40 +363,44 @@ Delivery: [PR #33](https://git.sendico.io/tech/sxchnge/pulls/33) targets `main`;
 committed and pushed, unmerged. Issue #32 and PR #33 metadata verified: frontend
 label, tech owner and SXCHNGE project. No stacked dependencies.
 
-## Independent BFF plan and Sendico reuse — task #34
+## Copied BFF foundation and public Sendico contracts — task #34
 
-Audited `S_I/sendico` at `8bb20dcd622dd8eb92d289b6b34411e7eccab083` without
-modifying its unrelated working-tree dependency edits. The
-[BFF plan](architecture/bff.md) records source-backed reuse choices, independent
-ownership, target structure, proposed Mongo persistence, client/API mapping,
-required provider services and phased acceptance criteria. Source availability
-is distinguished from supported/deployed external APIs.
+Bootstrapped SXCHNGE from Sendico revision
+`8bb20dcd622dd8eb92d289b6b34411e7eccab083`: shared HTTP runtime, authentication
+and session stack, verification and refresh storage, account service, Mongo
+repositories, authorization, canonical models/errors and structured logging.
+The original handwritten shell and replacement helpers were removed. File-level
+[provenance](../backend/PROVENANCE.json) records 416 copied Go files and 112 public
+OpenAPI files. The source checkout and its unrelated dependency edits were untouched.
 
-The main provider gaps are delegated customer provisioning/owner mapping, a
-spendable-balance projection, customer-scoped compliance access/manual review,
-and verified payment/callback replay contracts. Existing quotation/orchestration
-owner constraints and durable limits mutation code can underpin the provider
-facade. Sendico's personal-compliance ownership assumptions and stale limits
-README are called out explicitly. Sendico remains authoritative for financial
-execution, limits and compliance; the BFF does not clone those engines.
+The corrected [architecture](architecture/bff.md) reflects the product boundary:
+SXCHNGE owns customers/authentication; SXCHNGE itself is one Sendico organization;
+all Sendico access uses the public HTTP API. Internal gRPC, discovery, messaging,
+platform service factories and organization provisioning were excluded. Public
+OpenAPI is isolated from local models and tested for self-contained references.
+No live provider call, organization, customer or payment was created.
 
-Created a separate Go module and operational shell under `backend/`, plus adapted
-browser cookie/CSRF policy, opaque credential generation/digests and evidence-key
-confinement. [Provenance](../backend/PROVENANCE.md) pins source blobs and deviations.
-No Sendico imports, sibling replacements, external Go modules, shared database
-access or live provider calls. The starter exposes health and deliberately 503
-readiness; authentication, persistence and financial product routes remain planned.
-Root/backend README and backend guidelines describe the current scope.
+Restored full backend guidelines and the backend-review skill, correcting scoped
+paths. Copied error constructors follow `merrors`; local adaptations also validate
+startup settings, preserve listen failures/nonzero exit, close Mongo after failed
+runtime creation and avoid logging database settings. Architecture checks enforce
+the project error model and public-only provider boundary.
 
-Validation: `make test-backend` (race-enabled tests across four packages),
-`make lint-backend` (gofmt/vet), `go build` and `git diff --check` passed.
-CLI smoke verified health 200, readiness 503, unimplemented session 404 and SIGTERM
-exit 0. Module/dependency inspection confirms standard-library-only dependencies.
-Pinned source paths, source blobs and local documentation links were checked.
-Reviewed all new backend files and the task diff. No Flutter code changed;
-frontend tests and security scans were not run for this backend starter/plan task.
+The copied runtime installs local authentication transport and initializes the
+account service. Signup/profile endpoints, verification delivery/completion,
+initial local tenant/client provisioning, Flutter HTTP adapters and live Sendico
+calls remain future wiring. Public external-customer compliance/ownership gaps
+are documented; internal APIs are not an allowed workaround.
 
-Delivery: [PR #35](https://git.sendico.io/tech/sxchnge/pulls/35), `bff-34` into
-`main`, committed/pushed and unmerged. Issue #34 and PR metadata verified: backend
-label, tech owner, SXCHNGE project. Larger authentication/provider work remains
-separate from this completed audit and starter scope.
+Validation: `make test` (race-enabled backend suite with real MongoDB containers,
+plus all frontend package/app tests), `make lint-backend` (architecture, gofmt,
+vet), `go build` and `git diff --check` passed. Local smoke used a disposable
+SXCHNGE Mongo replica set: health 200, invalid login 400, SIGTERM exit 0 and missing
+configuration exit 1. Earlier extraction failures were fixed: unused import,
+wrong example-config test path, an out-of-scope recipient migration test
+copied without its uncopied migration, and missing built-in policy records on
+fresh startup. The copied policy seed was run twice and retained three records. No security scan was requested or run.
+
+Delivery: [PR #35](https://git.sendico.io/tech/sxchnge/pulls/35), branch `bff-34`
+into `main`; task #34 retains backend label, tech owner and SXCHNGE project.
+This entry supersedes the earlier new-shell/delegated-provisioning proposal.