platform/order + platform/event gain the sale.paid and refund.issued wire
contracts (per-rate VatBuckets, PSP provider, timestamps) that drive the
ledger's SHOP-/REFUND- vouchers (go-cart-actor 2b819bd). docs/status.md
records the shop-sales + PSP settlement stack (tickets 17 + 18); the
wayfinder ledger tracker gains the two closed tickets and their Decisions
entries. Bumps go-cart-actor + backoffice (PSP float stat).
🤖 Generated with Codebuff
Co-Authored-By: Codebuff <noreply@codebuff.com>
The backoffice commerce build now merges the ledger service's full MCP
tool surface (/ledger-mcp) into /mcp via MountLedgerMCP — a JSON-RPC
bridge that forwards tools/call to the ledger service (single-writer
AOF preserved), gated by the shared MCP_API_KEY. Compose backoffice now
sets LEDGER_URL=http://ledger:8080.
Submodule bumps:
- backoffice: ledger MCP bridge + device approve-page sign-in gating
- slask-finder: safe returnTo after OIDC login + dep tidy
- go-cart-actor / go-image-gen / go-redirector / slask-tracking: dep updates
Infra: k8s order CHROME_CDP_URL pinned to the headless-shell ClusterIP
(DNS-rebinding guard) + shared invoice-issuer-config ConfigMap for the
invoice PDF seller block; platform go.mod refreshed (otel direct, x/sys).
docs/status.md notes the ledger tools on /mcp.
Generated with Codebuff 🤖
Co-Authored-By: Codebuff <noreply@codebuff.com>
The approve UI needs to show what a user code asks for and how long it
is valid; GrantInfo returns (scopes, secondsLeft, ok) without consuming
the grant (consumption stays one-shot in Token).
platform/auth gains the LocalJWT (HS256 mint/verify, AUTH_TOKEN_SECRET,
disabled when unset), the RFC 8628 DeviceFlow (start/approve/poll with
requested-scope gating) and KeyStore.ReloadIfChanged (mtime-based, so a
freshly minted key works across processes without a restart). One shared
store at /commerce/apikeys.json (AUTH_APIKEYS_FILE) now backs the
backoffice admin gate, the CMS API and every MCP endpoint; AUTH_TOKEN_SECRET
lets the companion app's device flow mint bearer tokens the same surfaces
accept. Submodule bumps: backoffice (AuthGate + device endpoints + mcp
scope), go-cart-actor (mcpauth sources), go-graph-cms-v2 (shared store +
token chain).
Also lands the still-pending receipt-ocr sidecar (previous pass): the
PP-OCR ONNX inference service + download-ocr-models.sh + k8s
deployment/initContainer, wired into compose and the ledger RECEIPT_OCR_URL,
with the extractor pairing fix riding the go-cart-actor bump.
Deploy: AUTH_APIKEYS_FILE/AUTH_TOKEN_SECRET/AUTH_DEVICE_BASE_URL on
backoffice + cart/profile/order/ledger in compose and k8s, /device ingress
route, stack-secrets AUTH_TOKEN_SECRET optional ref, docs updated.
Generated with Codebuff 🤖
Co-Authored-By: Codebuff <noreply@codebuff.com>
Restore the per-batch visibility lost in the cart migration: applyDelta now logs
'delta applied epoch=N (+U/-D, overlay=X)', and the snapshot swap line includes
'snapshot' so it's findable. Deltas were applying silently, which read as 'nothing
happened' on a bulk catalog update (only the debounced snapshot swap was logged).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Generic SnapshotWriter[T]/SnapshotReader[T] over a value-agnostic raw layer;
SnapshotHolder[T] now RWMutex-guards munmap vs in-flight Get (race-free swap,
TestSnapshotHolder_SwapRace) — the drain grace is now just close-batching.
- ProjectionStore[T]: snapshot begin|chunk|end assembly → atomic swap, epoch-gated
delta overlay, tombstones, atomic epoch sidecar (ordered before the swap),
cold-start reopen, mandatory ProjectionTransform[T]. Future-epoch deltas are
dropped by contract (recover via next snapshot), not buffered.
- Shared bus-framing constants so producer + consumer agree.
- Bump slask-finder / go-cart-actor / backoffice pointers; refresh status.md +
catalog-projection.md to the finished state.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
mats
