41 lines
3.4 KiB
Markdown
41 lines
3.4 KiB
Markdown
# Inbound XRechnung validation
|
|
|
|
This module validates an inbound XML invoice through a locally installed, exact KoSIT validator profile. It does not choose the active standard release, download validation artifacts at runtime, approve a payable, or book an invoice.
|
|
|
|
## Pinned profile
|
|
|
|
An administrator records the XRechnung version, validator version, configuration release, absolute Java and JAR paths, JAR SHA-256, configuration root and complete deterministic tree SHA-256, scenario file, and expected minimum validation-step count. Every run rechecks the executable and both artifact digests. Symbolic links and files outside the configuration root are rejected.
|
|
|
|
## Deployment-owned profile allow-list
|
|
|
|
`KoSITProfileRegistry` allows a deployment to approve several exact profiles
|
|
without GovOPlaN choosing a standard version. Each approval binds the verified
|
|
artifact digest, approving actor, decision reference, receive-time window, and
|
|
the state `approved`, `suspended`, or `retired`. A deployment may configure one
|
|
explicit default, or require the invoking workflow to select a profile every
|
|
time. A default is never inferred.
|
|
|
|
Selection uses the invoice receive time, which permits an administrator to
|
|
model an overlap or transition window. Suspended, retired, unknown, expired,
|
|
not-yet-valid, or subsequently modified profiles fail closed. Artifact digests
|
|
are rechecked on selection and again during validation.
|
|
|
|
Administrierende können damit mehrere konkrete Profile zeitlich begrenzt
|
|
freigeben, ohne dass GovOPlaN eine XRechnungs-Version vorgibt. Übergangsfristen
|
|
und ein Standardprofil sind ausdrücklich konfigurierte Entscheidungen. Ohne
|
|
Standard muss jeder aufrufende Prozess ein freigegebenes Profil benennen.
|
|
|
|
The configuration tree must be installed through deployment governance. A newer published release never becomes active automatically. Updating any artifact creates a different profile digest and requires regression evidence with accepted, rejected, malformed, and deliberately broken technical fixtures.
|
|
|
|
## Fail-closed validation
|
|
|
|
Inbound XML is size-bounded and parsed with external entities and DTD processing disabled before Java runs. KoSIT runs without a shell, with an absolute executable, fixed argument vector, bounded time, bounded captured output, and an isolated result directory.
|
|
|
|
GovOPlaN does not trust the report alone. A technically complete result requires a zero process status, no technical error marker in runner output, a bounded well-formed VARL report, a matched scenario, at least the configured number of complete validation steps, and exactly one assessment. Formal validity and the accept/reject recommendation are retained separately because warnings can make them differ. This compensates for the known risk that a partial report can look valid after a transformation failure.
|
|
|
|
Semantic invalidity is different from technical failure. A complete reject report is `invalid`; a timeout, crash, partial report, or inconsistent assessment is `unknown`. Neither result may be handed off as valid.
|
|
|
|
## Governed handoff
|
|
|
|
Only a technically complete, formally `valid`, and explicitly accepted result creates a handoff. The handoff binds tenant, source reference, invoice SHA-256, VARL report SHA-256, profile ID and profile SHA-256, and validation time. Procurement or Payments owns the later payable workflow; Files owns retained invoice bytes; Records may file an exact revision. Revalidation is mandatory after invoice or profile changes.
|