sxchnge/backend/PROVENANCE.md

Copied Sendico source

Source repository: S_I/sendico (git.sendico.io). Revision: 8bb20dcd622dd8eb92d289b6b34411e7eccab083.

PROVENANCE.json records each copied file, original path and Git blob, plus whether a Go file changed beyond import namespace and formatting. It contains 416 Go source/test files, 112 public OpenAPI files and one adapted policy seed. Sources were read from the pinned commit, not Sendico's dirty working tree. These are owned SXCHNGE copies, not submodules or automatic synchronization links.

What was retained

• Shared BFF Chi runtime, process/version/logger bootstrap, HTTP middleware, auth transport and response conventions.
• Password/account service, local Mongo account/role/policy repositories, transactions and local organization membership.
• Verification issuance, expiry, attempt limits, consumption and idempotency; refresh-session rotation/revocation and login rate-limit storage.
• Canonical models, merrors, structured logging, health and retained tests.
• The public OpenAPI 4.2.37 entry point and recursive local schema references, copied into contracts/sendico without schema changes (trailing blank lines normalized in three YAML files).

Deliberate adaptations

• Import roots now belong to git.sendico.io/tech/sxchnge/bff. Versions are seeded from committed Sendico manifests and tidied for the selected dependency set.
• Product's composition root selects local account services instead of platform services/provisioning. Its shared HTTP runtime remains the implementation.
• Removed internal discovery and broker configuration, registration, startup and teardown. An instance ID uses the existing UUID dependency without discovery.
• Excluded internal gRPC/protobuf clients/converters and unused model files. Local account-role values remain; private protobuf conversion helpers do not.
• Program identity and the refresh-cookie name use SXCHNGE.
• The policy seed retains the existing upsert helpers and three local organization/account/role definitions, with an SXCHNGE database default. Platform policies, automatic role backfills and pruning are excluded.
• Startup configuration now rejects missing database/middleware/HTTP settings and invalid HTTP timeouts. Runtime-construction failure closes the database. Listen/start failures preserve the cause and produce a nonzero CLI exit.
• Copied Casbin adapter errors and test sentinel errors use canonical merrors instead of errors.New. Removed raw database settings from error logs.
• The recipient-migration-only test was excluded together with its migration: neither that platform feature nor historical Sendico data migration is part of this bootstrap. Tests for every retained runtime/component remain included.

No financial engine, internal service client, gateway, platform organization provisioning, deployment configuration, credential or generated binary was copied. The local account service's organization is an SXCHNGE authorization tenant; it does not create Sendico organizations per customer.

Local additions

internal/profile composes the copied account service. Architecture checks enforce project errors, no private provider imports/transports and self-contained public contract references. Configuration tests cover the executable example and missing settings. Guidelines and the backend-review skill are restored from Sendico with SXCHNGE paths and the public-only integration boundary.

The source includes complete local auth building blocks, not a fully wired SXCHNGE product API. Remaining endpoint, email, local tenant/client provisioning and public Sendico integration work is explicit in the architecture plan.