3.4 KiB
Inbound XRechnung validation
This module validates an inbound XML invoice through a locally installed, exact KoSIT validator profile. It does not choose the active standard release, download validation artifacts at runtime, approve a payable, or book an invoice.
Pinned profile
An administrator records the XRechnung version, validator version, configuration release, absolute Java and JAR paths, JAR SHA-256, configuration root and complete deterministic tree SHA-256, scenario file, and expected minimum validation-step count. Every run rechecks the executable and both artifact digests. Symbolic links and files outside the configuration root are rejected.
Deployment-owned profile allow-list
KoSITProfileRegistry allows a deployment to approve several exact profiles
without GovOPlaN choosing a standard version. Each approval binds the verified
artifact digest, approving actor, decision reference, receive-time window, and
the state approved, suspended, or retired. A deployment may configure one
explicit default, or require the invoking workflow to select a profile every
time. A default is never inferred.
Selection uses the invoice receive time, which permits an administrator to model an overlap or transition window. Suspended, retired, unknown, expired, not-yet-valid, or subsequently modified profiles fail closed. Artifact digests are rechecked on selection and again during validation.
Administrierende können damit mehrere konkrete Profile zeitlich begrenzt freigeben, ohne dass GovOPlaN eine XRechnungs-Version vorgibt. Übergangsfristen und ein Standardprofil sind ausdrücklich konfigurierte Entscheidungen. Ohne Standard muss jeder aufrufende Prozess ein freigegebenes Profil benennen.
The configuration tree must be installed through deployment governance. A newer published release never becomes active automatically. Updating any artifact creates a different profile digest and requires regression evidence with accepted, rejected, malformed, and deliberately broken technical fixtures.
Fail-closed validation
Inbound XML is size-bounded and parsed with external entities and DTD processing disabled before Java runs. KoSIT runs without a shell, with an absolute executable, fixed argument vector, bounded time, bounded captured output, and an isolated result directory.
GovOPlaN does not trust the report alone. A technically complete result requires a zero process status, no technical error marker in runner output, a bounded well-formed VARL report, a matched scenario, at least the configured number of complete validation steps, and exactly one assessment. Formal validity and the accept/reject recommendation are retained separately because warnings can make them differ. This compensates for the known risk that a partial report can look valid after a transformation failure.
Semantic invalidity is different from technical failure. A complete reject report is invalid; a timeout, crash, partial report, or inconsistent assessment is unknown. Neither result may be handed off as valid.
Governed handoff
Only a technically complete, formally valid, and explicitly accepted result creates a handoff. The handoff binds tenant, source reference, invoice SHA-256, VARL report SHA-256, profile ID and profile SHA-256, and validation time. Procurement or Payments owns the later payable workflow; Files owns retained invoice bytes; Records may file an exact revision. Revalidation is mandatory after invoice or profile changes.