[Feature] Acquire and preserve immutable sanctions source snapshots #10

New Issue

zemion · 2026-07-28T00:58:10+02:00

zemion commented

2026-07-28 00:58:10 +02:00

Outcome

Implement source adapters for the sanctions screening story without putting legal matching semantics in Connectors.

First Slice

Start with a synthetic fixture provider and one explicitly approved authoritative publisher. Fetch and retain raw evidence where policy/licensing permits, verify transport and checksums/signatures where available, normalize acquisition metadata, and publish an immutable snapshot reference to Risk Compliance.

Acceptance Criteria

Snapshot metadata includes publisher, jurisdiction/list type, source ID/version, publication/effective/acquisition timestamps, checksum/signature evidence, parser version, licence/trust notes, and connector run ID.
Refreshes create new immutable snapshots and never rewrite prior evidence.
Conditional fetch, retry/backoff, size limits, content-type checks, and safe XML/CSV parsing are covered.
Unavailable, stale, malformed, and unexpectedly changed sources produce explicit health states.
Synthetic fixtures allow deterministic tests without relying on live external services.
No subject data is sent to source providers during list acquisition.

## Outcome Implement source adapters for the [sanctions screening story](https://git.add-ideas.de/GovOPlaN/govoplan/issues/12) without putting legal matching semantics in Connectors. ## First Slice Start with a synthetic fixture provider and one explicitly approved authoritative publisher. Fetch and retain raw evidence where policy/licensing permits, verify transport and checksums/signatures where available, normalize acquisition metadata, and publish an immutable snapshot reference to Risk Compliance. ## Acceptance Criteria - [ ] Snapshot metadata includes publisher, jurisdiction/list type, source ID/version, publication/effective/acquisition timestamps, checksum/signature evidence, parser version, licence/trust notes, and connector run ID. - [ ] Refreshes create new immutable snapshots and never rewrite prior evidence. - [ ] Conditional fetch, retry/backoff, size limits, content-type checks, and safe XML/CSV parsing are covered. - [ ] Unavailable, stale, malformed, and unexpectedly changed sources produce explicit health states. - [ ] Synthetic fixtures allow deterministic tests without relying on live external services. - [ ] No subject data is sent to source providers during list acquisition.

zemion added the

module/connectors

module/dataflow

module/risk-compliance