feat: audited-decision gate for PIS/COFINS and CFOP_ENTRADA NOT_APPLICABLE/OPERATION_TIME

Missao 2 (fechamento de lacunas fiscais, read-only + UI/engine gated):
- field_contract: pis_cofins_profile now also accepts the literal sentinels
  NOT_APPLICABLE/OPERATION_TIME, resolving to NA only from an audited
  FiscalContextEntry - never inferred from emission statistics. CFOP_ENTRADA
  under an already-decided entry_scope=MIXED_OR_DYNAMIC now resolves to NA
  instead of MANUAL, so it stops blocking product completeness and stops
  re-asking an already-answered question. Regression tests prove: no ADMIN
  decision => unchanged old behavior; decision present => gated bucket, no write.
- context_keys: validate_entry accepts the two sentinels for pis_cofins_profile.
- Contexto Fiscal UI: PIS/COFINS and CFOP_ENTRADA cards show the Bloco 2
  cross-database evidence (5 installations, CRT 1 and 3: emission never reads
  the PIS/COFINS cadastral fields anywhere) and a link to an ADMIN-facing,
  anonymized dossie-for-the-accountant; entry_scope is now a dropdown.
- release/tests: decoupled the Hub's GTI_FISCAL_VERSION from the Agent's own
  version (test_versions_are_coherent_across_hub_and_packages vs the new
  test_agent_version_is_internally_coherent) - a Hub-only release must not
  require touching, rebuilding or republishing the Agent.
- New read-only evidence: docs/runs/GTI_dryrun_universe_summary.json (527
  products, Agent 2's real database), docs/runs/BLOCO2_PIS_COFINS_CROSS_DB_V1.json
  (5 installations), docs/fiscal_completeness_matrix.md, docs/dossie_contador.md
  (internal, real names) + central/static/docs/dossie_contador.md (public,
  anonymized - no CNPJ/razao social/product names), docs/AGENT2_UPGRADE_RUNBOOK_V1.md.
- CLAUDE.md: recorded the permanent fiscal-mission rules (no AI/scraping, no
  Firebird schema changes, deploy only via deploy_hub.ps1, never reenroll,
  no remote access to client Agent hosts, no client data in unauthenticated
  static routes).

No schema/migration change. Zero Firebird writes (new scripts never open a
write connection). Hub only - Agent code untouched.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This commit is contained in:
gti
2026-09-28 09:44:05 -03:00
co-authored by Claude Sonnet 5
parent 1621ea4e0b
commit e935ed61d5
21 changed files with 1066 additions and 35 deletions
+5 -5
View File
@@ -1,14 +1,14 @@
{
"artifact": "RELEASE_MANIFEST",
"GTI_FISCAL_VERSION": "1.3.9",
"generated_at": "2026-09-28T01:15:00+00:00",
"GTI_FISCAL_VERSION": "1.3.10",
"generated_at": "2026-09-28T12:00:00+00:00",
"hub": {
"version": "1.3.9",
"version": "1.3.10",
"api_compat": "1.0",
"engine_version": "0.3.0",
"decision_version": "mission-04c-ipi-ex-split"
},
"agent_version": "1.3.9",
"agent_version": "1.3.8",
"fiscal_engine": {
"ENGINE_VERSION": "0.3.0",
"DECISION_VERSION": "mission-04c-ipi-ex-split",
@@ -89,5 +89,5 @@
"record_count": 11103
}
],
"note": "1.3.9: adds the ADMIN-only Contexto Fiscal section to the Agent detail page (central/app/fiscal_context_ui.py) - confirm/alter/clear the 3 real fiscal decisions field_contract cannot derive alone (icms_treatment/pis_cofins_profile/entry_scope, reduced from an original 5-item list by auditing real production data: icms_rate/credit_rate and rounding were proven NOT_APPLICABLE/ALREADY_DERIVED for this CRT=1 company and dropped). Persists through the existing FiscalContextEntry table, CSRF+RBAC+audit reusing the same mechanism as /agents/{id}/features. No schema change. Hub only - Agent unchanged, no new installer published this release."
"note": "1.3.9: adds the ADMIN-only Contexto Fiscal section to the Agent detail page (central/app/fiscal_context_ui.py) - confirm/alter/clear the 3 real fiscal decisions field_contract cannot derive alone (icms_treatment/pis_cofins_profile/entry_scope, reduced from an original 5-item list by auditing real production data: icms_rate/credit_rate and rounding were proven NOT_APPLICABLE/ALREADY_DERIVED for this CRT=1 company and dropped). Persists through the existing FiscalContextEntry table, CSRF+RBAC+audit reusing the same mechanism as /agents/{id}/features. No schema change. Hub only - Agent unchanged, no new installer published this release. 1.3.10 (Missao 2 - fechamento de lacunas fiscais, read-only + UI/engine gated): PIS/COFINS's pis_cofins_profile context key now also accepts the literal sentinels NOT_APPLICABLE/OPERATION_TIME (central/app/context_keys.py + central/app/field_contract.py), resolving to NA only when explicitly recorded by an audited FiscalContextEntry - never inferred from emission statistics; sem decisao ADMIN, comportamento identico ao anterior (regression tests in central/tests/test_field_contract.py). CFOP_ENTRADA under an already-decided entry_scope=MIXED_OR_DYNAMIC now resolves to NA instead of MANUAL, so it no longer blocks product completeness or re-asks an already-answered question (same file, same gate, existing scope-required-first test unchanged). Contexto Fiscal UI: PIS/COFINS and CFOP_ENTRADA cards show the Bloco 2 cross-database evidence and a link to docs/dossie_contador.md (also published at central/static/docs/dossie_contador.md); entry_scope is now a dropdown of its 3 valid values. New read-only evidence artifacts: docs/runs/GTI_dryrun_universe_summary.json, docs/runs/BLOCO2_PIS_COFINS_CROSS_DB_V1.json, docs/fiscal_completeness_matrix.md, docs/dossie_contador.md, docs/AGENT2_UPGRADE_RUNBOOK_V1.md. No schema/migration change. No Firebird write anywhere (zero writes, confirmed by construction - the new dry-run scripts never open a write connection). Hub only - Agent code untouched; Agent 2 was upgraded 1.3.7->1.3.8 by a human operator on-site (no self-update mechanism exists - confirmed by code audit), no new Agent installer published this release."
}