feat: OSCBR token support, Cosmos out of the active chain, quota-safe OSCBR backfill (dry-run selection), provider env passthrough; 1.3.3 (Hub only)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

deploy/agent-windows/agent.env.template

@@ -19,4 +19,4 @@ FB_PASSWORD=
 FISCAL_MODE=DRY_RUN
 FIREBIRD_WRITES=0
 POLL_INTERVAL_SECONDS=5
-AGENT_VERSION=1.3.2
+AGENT_VERSION=1.3.3

deploy/agent-windows/gti-agent.ps1

@@ -164,7 +164,7 @@ switch ($Command) {
                 "GTI_HUB_URL=$hub", "AGENT_TOKEN=$token", "AGENT_ID=$agentId",
                 "COMPANY_CODE=$code", "COMPANY_CNPJ=$cnpj", "COMPANY_CRT_SOURCE=$crtSource",
                 "FIREBIRD_DATABASE_PATH=$db", "FB_USER=$fbUser", "FB_PASSWORD=$fbPass",
-                'FISCAL_MODE=DRY_RUN', 'FIREBIRD_WRITES=0', 'POLL_INTERVAL_SECONDS=5', 'AGENT_VERSION=1.3.2'
+                'FISCAL_MODE=DRY_RUN', 'FIREBIRD_WRITES=0', 'POLL_INTERVAL_SECONDS=5', 'AGENT_VERSION=1.3.3'
             )
             Set-Content -Path $EnvFile -Value $lines -Encoding UTF8
         }

deploy/agent-windows/pilot-construcao.env.example

@@ -19,4 +19,4 @@ FB_PASSWORD=
 FISCAL_MODE=DRY_RUN
 FIREBIRD_WRITES=0
 POLL_INTERVAL_SECONDS=5
-AGENT_VERSION=1.3.2
+AGENT_VERSION=1.3.3

deploy/agent-windows/profiles/mmmodas.env.example

@@ -19,4 +19,4 @@ FB_PASSWORD=
 FISCAL_MODE=DRY_RUN
 FIREBIRD_WRITES=0
 POLL_INTERVAL_SECONDS=5
-AGENT_VERSION=1.3.2
+AGENT_VERSION=1.3.3

deploy/agent-windows/profiles/rincao.env.example

@@ -19,4 +19,4 @@ FB_PASSWORD=
 FISCAL_MODE=DRY_RUN
 FIREBIRD_WRITES=0
 POLL_INTERVAL_SECONDS=5
-AGENT_VERSION=1.3.2
+AGENT_VERSION=1.3.3

deploy/agent-windows/profiles/uniao.env.example

@@ -19,4 +19,4 @@ FB_PASSWORD=
 FISCAL_MODE=DRY_RUN
 FIREBIRD_WRITES=0
 POLL_INTERVAL_SECONDS=5
-AGENT_VERSION=1.3.2
+AGENT_VERSION=1.3.3

deploy/hub/.env.example

@@ -1,5 +1,5 @@
 # GTI Fiscal Hub — production environment (copy to .env, never commit .env)
-GTI_FISCAL_VERSION=1.3.2
+GTI_FISCAL_VERSION=1.3.3
 
 # REQUIRED. URL-safe secret (used inside a connection URL): openssl rand -hex 24
 POSTGRES_PASSWORD=
@@ -45,3 +45,12 @@ FISCAL_INTERNAL_API_TOKEN=
 BACKUP_DIR=./backups
 # Max whole-database jobs (INITIAL_SYNC / REPROCESS_ALL) running at once across all Agents; others queue as PENDING. <=0 disables.
 HEAVY_JOB_CONCURRENCY_LIMIT=3
+
+# Product-enrichment providers (free plans) - fill on the SERVER only, never commit values
+OSCBR_TOKEN=
+OSCBR_USER=
+OSCBR_PASSWORD=
+KODEBAR_API_KEY=
+COSMOS_ENABLED=0
+OSCBR_BACKFILL_ENABLED=0
+PROVIDER_OPERATIONAL_RESERVE_PERCENT=20

deploy/hub/docker-compose.prod.yml

@@ -36,7 +36,7 @@ services:
     build:
       context: ../..
       dockerfile: central/Dockerfile
-    image: gti-fiscal-hub:${GTI_FISCAL_VERSION:-1.3.2}
+    image: gti-fiscal-hub:${GTI_FISCAL_VERSION:-1.3.3}
     restart: unless-stopped
     depends_on:
       postgres:
@@ -45,6 +45,14 @@ services:
       APP_ENV: production
       POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD is required}
       LOG_LEVEL: ${LOG_LEVEL:-INFO}
+      # Product-enrichment providers (free plans). Secrets live ONLY in deploy/hub/.env on the server (never committed, never in the Agent/installer/panel/logs).
+      OSCBR_TOKEN: ${OSCBR_TOKEN:-}
+      OSCBR_USER: ${OSCBR_USER:-}
+      OSCBR_PASSWORD: ${OSCBR_PASSWORD:-}
+      KODEBAR_API_KEY: ${KODEBAR_API_KEY:-}
+      COSMOS_ENABLED: ${COSMOS_ENABLED:-0}
+      OSCBR_BACKFILL_ENABLED: ${OSCBR_BACKFILL_ENABLED:-0}
+      PROVIDER_OPERATIONAL_RESERVE_PERCENT: ${PROVIDER_OPERATIONAL_RESERVE_PERCENT:-20}
       BASE_URL: ${BASE_URL:?BASE_URL is required (public HTTPS URL of the Hub)}
       AGENT_ONLINE_THRESHOLD_SECONDS: ${AGENT_ONLINE_THRESHOLD_SECONDS:-120}
       # Reverse proxy on another host: uvicorn only honours X-Forwarded-For/-Proto