sxchnge/backend/PROVENANCE.md

Sendico reuse provenance

Source repository: S_I/sendico; revision 8bb20dcd622dd8eb92d289b6b34411e7eccab083. Inspected 2026-09-12. These are owned forks inside SXCHNGE, not runtime imports. Source files below match the committed revision; local dependency edits were not used. No generated Sendico SDK, shared database models, deployment configuration or credentials were copied.

internal/browser/policy.go

• Source: api/edge/shared/auth/browser/browser.go
• Source Git blob: 3af7b54aea277d91e0d8c3eba9ee84c155f4b624
• Adaptation: Adapted cookie creation/clearing, origin validation and CSRF checks. Replaced Sendico names/errors/env path resolution with explicit SXCHNGE policy; checks do not depend on a client-controlled transport header. Host-only Secure/HttpOnly cookie, Lax same-site navigation, duplicate-cookie rejection and explicit expiry validation.
• Tests are SXCHNGE-specific behavioral checks for the adapted boundary.

internal/credential/token.go

• Source: api/edge/shared/storage/verification/hash.go
• Source Git blob: 36fadcf404bfc77608b28cca1e669a4a62f31774
• Adaptation: Adapted generateMagic/tokenHash only: 32-byte crypto/rand, URL-safe encoding, SHA-256 digest. Added constant-time matching. Excluded deterministic token generation, Sendico models and all numeric OTP hashing.
• Tests are SXCHNGE-specific behavioral checks for the adapted boundary.

internal/evidence/key.go

• Source: api/edge/shared/storage/s3key/key.go
• Source Git blob: e3cca16304d2c4cb9f256f510d5a1a30a21e22a6
• Adaptation: Adapted relative object-key confinement. Replaced merrors with a local sentinel and rejected encoded sequences, backslashes and embedded control characters. Not a filesystem or customer-authorization utility.
• Tests are SXCHNGE-specific behavioral checks for the adapted boundary.

Maintenance

The command, operational HTTP shell, module configuration and tests are new SXCHNGE code. There is no automatic synchronization or promise of source compatibility with Sendico. For an upstream fix, review the pinned source difference, port only the relevant behavior, record a new provenance entry and run backend tests/vet. Provider contract changes belong in the future Sendico adapter and its transport fixtures, not application models or widgets.

These primitives do not create sessions, deliver email, validate TOTP or upload documents. Use them inside the durable flows described in the BFF plan.