feat: generate unverified financial report and XBRL proposals - #50
seonghobae wants to merge 82 commits into
Conversation
📝 WalkthroughWalkthrough호출자 제공 재무제표 패키지를 검증하는 Changes재무보고 제안 흐름
Estimated code review effort: 4 (Complex) | ~60 minutes Merge Risk: 🟡 Moderate · up to Report proposals can combine incompatible snapshot claims, weakening provenance reliability. This material integrity defect should be fixed before merge; malformed public inputs also need consistent validation errors. Sequence Diagram(s)sequenceDiagram
participant 호출자
participant build_financial_report_artifact
participant export_xbrl_instance
participant XBRL 인스턴스
호출자->>build_financial_report_artifact: 재무제표 패키지와 보고 컨텍스트 전달
build_financial_report_artifact->>build_financial_report_artifact: 입력 검증 및 비권위 아티팩트 생성
호출자->>export_xbrl_instance: 아티팩트와 taxonomy profile 전달
export_xbrl_instance->>build_financial_report_artifact: 아티팩트 재구성 및 비교
export_xbrl_instance->>XBRL 인스턴스: context, unit, mapped fact 직렬화
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Current-head financial-reporting authority finding on ad12c3234c1c4c8117a8b5212e98d7818258ee25: the new pure builder currently accepts any caller-supplied mapping that satisfies the four arithmetic controls and mints an AIS-shaped urn:cwl:accounting:financial_report:<sha> artifact. Its hash proves only the bytes it received; it does not prove that tenant_reference, legal entity/book/period identity, monetary populations, report currency/date context, or snapshot references came from an AIS-owned PostgreSQL read/receipt. FinancialReportContext is likewise caller-supplied, so an otherwise balanced synthetic package can be relabeled with a different reporting currency/date/entity filing identity and still become a deterministic XBRL instance.
That boundary is weaker than this repository's authority model: accounting truth must remain database-owned and retained provenance must distinguish authoritative/observed/proposed material. A content hash is evidence identity, not origin/authority proof.
RED acceptance before treating this as buyer-authoritative reporting: (1) construct a balanced synthetic statement package for an unrecorded tenant/entity/book/period and prove it cannot produce an artifact that claims authoritative AIS financial-report truth; (2) take a real package and change only caller report currency/current/comparison dates, and prove mismatched context cannot be published as authoritative XBRL; (3) prove a live/non-close-snapshot package is either explicitly unverified/provisional or rejected by the authoritative publication path; (4) prove the positive owner path loads the four statements plus reporting currency/period/snapshot provenance from one repeatable-read AIS boundary and binds those facts into the artifact identity.
Narrow GREEN can preserve a pure deterministic serializer, but it must be truth-status explicit and non-authoritative unless an owner-controlled AIS command/read boundary supplies and verifies the source package/context provenance. Prefer a high-level API that takes tenant/entity/book/period identifiers and obtains the package and database-owned reporting context itself; keep the low-level mapping builder private/internal or label its output unverified. Do not solve this by trusting a caller flag, an arbitrary SHA-shaped source reference, or a taxonomy-profile assertion. XBRL serialization should consume only the resulting provenance-bound artifact when emitting an authoritative accounting report. Keep the existing exact-decimal and no-filing-conformance claims.
seonghobae
left a comment
seonghobae
left a comment
There was a problem hiding this comment.
Current-head revalidation on d27220eee76147d69be2ee071cdb016f36f17186: the one intervening commit only exposes build_financial_report_artifact and export_xbrl_instance from the repository root, so the prior source-authority finding remains valid and is now part of the top-level public API. No source/package provenance control was added by that delta.
Keep the reporting slice Draft until a realistic RED proves that an arbitrary balanced mapping cannot mint buyer-authoritative AIS financial-report/XBRL truth, and until the owner path binds database-owned tenant/entity/book/period/reporting-currency/snapshot provenance (or explicitly classifies the pure serializer output as non-authoritative/unverified). Do not treat content SHA-256, caller dates/currency/entity identifier, or taxonomy-profile metadata as origin/authority proof. Preserve the existing exact-decimal arithmetic and explicit filing/conformance non-claims.
|
Fresh exact-head gate correction / current-producer canary (2026-09-08 KST): PR #50 is still unchanged at I used the supported failed-jobs rerun without source churn on that exact CodeQL run so this immutable AIP head can exercise the current protected central producer rather than a predecessor callback. Run Do not create a leaf no-op commit, synthetic status, provider/status workaround, PAT bypass, or gate weakening to move this canary. The current owner-plane acceptance remains authenticated terminal receipt/publication and consumer settlement on this unchanged head under protected |
|
Current source-owner repair supersedes the stale exact-state section in the PR body. Fresh review found a real RFC 3986/HTTP authority boundary defect in the shared report/XBRL URI value object: the previous TDD lineage on this branch:
Current exact head is therefore Decision rationale: a bespoke authority parser was rejected because it would duplicate standard-library IPv6/user-info/authority semantics and create a larger security surface. The smallest fail-closed boundary is to keep the existing |
|
/opencode Re-review exact head Predecessor |
|
@coderabbitai review Please review current exact head |
🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected_head="8a08cec57959a0f51873d065fd858427126bd432"
actual_head="$(git rev-parse HEAD)"
printf 'HEAD expected=%s actual=%s\n' "$expected_head" "$actual_head"
git status --short
printf '\n== Bounded commit diff ==\n'
git diff --check 57360b6881fa892fd61415b322a96cd0cb7b64ba..HEAD
git diff --stat 57360b6881fa892fd61415b322a96cd0cb7b64ba..HEAD
git diff --find-renames --unified=80 57360b6881fa892fd61415b322a96cd0cb7b64ba..HEAD -- \
src/accounting_information_platform/financial_reporting/primitives.py \
tests/test_xbrl_reporting_validation.py \
docs/doctoring/XBRL_STANDARD_TRACEABILITY.md \
docs/testing/FINANCIAL_REPORTING_TEST_MATRIX.md
printf '\n== Source outline ==\n'
ast-grep outline src/accounting_information_platform/financial_reporting/primitives.py --items all
printf '\n== URI validation and direct tests ==\n'
rg -n -C 12 --glob '*.py' '_absolute_uri\s*\(|hostname|\.port\b|https?://' \
src/accounting_information_platform/financial_reporting tests
printf '\n== Traceability mentions ==\n'
rg -n -C 8 -i 'RFC 9110|authority|host|absolute URI|URI' \
docs/doctoring/XBRL_STANDARD_TRACEABILITY.md \
docs/testing/FINANCIAL_REPORTING_TEST_MATRIX.mdLength of output: 159484 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/accounting-information-platform"
sha="8a08cec57959a0f51873d065fd858427126bd432"
printf '== Commit ==\n'
gh api "repos/$repo/commits/$sha" --jq '{sha:.sha, parents:[.parents[].sha], message:.commit.message}'
printf '\n== Check runs ==\n'
gh api "repos/$repo/commits/$sha/check-runs?per_page=100" \
--jq '.check_runs[] | {name, status, conclusion, details_url, started_at, completed_at}'
printf '\n== Combined status ==\n'
gh api "repos/$repo/commits/$sha/status" \
--jq '{state, statuses:[.statuses[] | {context, state, target_url, created_at}]}'
printf '\n== PR review decision state ==\n'
gh pr view 50 --repo "$repo" --json isDraft,reviewDecision,reviews \
--jq '{isDraft, reviewDecision, reviews:[.reviews[] | {author:.author.login, state, submittedAt, commit:.commit.oid}]}'Length of output: 9831 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/accounting-information-platform"
run_id="34146242854"
job_id="101818827651"
printf '== Accounting Foundation job metadata ==\n'
gh api "repos/$repo/actions/jobs/$job_id" \
--jq '{name,status,conclusion,head_sha,started_at,completed_at,steps:[.steps[] | {name,status,conclusion,number}]}'
printf '\n== Accounting Foundation job log highlights ==\n'
gh run view "$run_id" --repo "$repo" --job "$job_id" --log 2>&1 \
| rg -n -i -C 2 'unittest|financial_reporting_uri_rfc3986|coverage|repository contracts|compile|wheel|pass|fail|error' \
|| true
printf '\n== RED commit ==\n'
git show --format=fuller --find-renames --unified=50 3335edc22b85b4e0772c444ce9f64fd481bc9f1f -- \
tests/test_financial_reporting_uri_rfc3986_red.py
printf '\n== GREEN commit ==\n'
git show --format=fuller --find-renames --unified=50 6e8978e7e0d41fb8ed5e516155d7ad7488a806e6 -- \
src/accounting_information_platform/financial_reporting/primitives.py
printf '\n== Generation-path network imports/calls ==\n'
rg -n -C 2 --glob '*.py' \
'^\s*(import|from)\s+(urllib\.request|requests|http\.client|socket|aiohttp|httpx)\b|\b(urlopen|requests\.(get|post|request)|httpx\.(get|post|request)|socket\.)\s*\(' \
src/accounting_information_platform/financial_reportingLength of output: 218832
The regression test covers both The RFC 9110 traceability entry accurately limits this control to proposal-input validation. The documentation continues to state that proposals are non-authoritative and not filing-ready. Accounting Foundation job Queued or skipped standalone checks remain non-passing. The Draft state and missing independent approval remain appropriate.
|
|
/opencode Re-review exact head Predecessor |
|
@coderabbitai review Please review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected_head="82a69abd6b89e489da8a5a8bf01657ef18dbd069"
predecessor="8a08cec57959a0f51873d065fd858427126bd432"
printf '== Exact head ==\n'
printf 'expected=%s\nactual=%s\n' "$expected_head" "$(git rev-parse HEAD)"
git status --short
git diff --check "$predecessor..HEAD"
git diff --stat "$predecessor..HEAD"
printf '\n== Candidate files ==\n'
fd -a 'primitives.py|test_financial_reporting_uri_rfc3986_red.py|XBRL_STANDARD_TRACEABILITY.md|FINANCIAL_REPORTING_TEST_MATRIX.md' . \
| sort
printf '\n== Source structure ==\n'
ast-grep outline src/accounting_information_platform/financial_reporting/primitives.py --items all
printf '\n== Bounded source, test, and documentation delta ==\n'
git diff --find-renames --unified=100 "$predecessor..HEAD" -- \
src/accounting_information_platform/financial_reporting/primitives.py \
tests \
docs/doctoring/XBRL_STANDARD_TRACEABILITY.md \
docs/testing/FINANCIAL_REPORTING_TEST_MATRIX.md
printf '\n== RED and GREEN commits ==\n'
git show --format=fuller --find-renames --unified=100 \
ea46ebae4c80a778e1a2327888a737b38a125012 \
54e23f2fb0b49d57b1d2b4e108da680785a6f710 -- \
src/accounting_information_platform/financial_reporting/primitives.py tests
printf '\n== URI implementation and direct test evidence ==\n'
rg -n -C 20 --glob '*.py' \
'def _absolute_uri\b|parsed_uri\.(hostname|port|netloc|scheme)|urn:|RFC 8141|absolute URI' \
src/accounting_information_platform/financial_reporting tests
printf '\n== Generation-path network access search ==\n'
rg -n -C 2 --glob '*.py' \
'^\s*(import|from)\s+(urllib\.request|requests|http\.client|socket|aiohttp|httpx)\b|\b(urlopen|requests\.(get|post|request)|httpx\.(get|post|request)|socket\.)\s*\(' \
src/accounting_information_platform/financial_reporting || true
printf '\n== Traceability evidence ==\n'
rg -n -C 10 -i 'RFC 8141|URN|RFC 3986|RFC 9110|derefer|resolv|trust|authority' \
docs/doctoring/XBRL_STANDARD_TRACEABILITY.md \
docs/testing/FINANCIAL_REPORTING_TEST_MATRIX.mdLength of output: 202546 🏁 Script executed: #!/bin/bash
set -euo pipefail
repo="ContextualWisdomLab/accounting-information-platform"
sha="82a69abd6b89e489da8a5a8bf01657ef18dbd069"
printf '== Commit identity ==\n'
gh api "repos/$repo/commits/$sha" \
--jq '{sha:.sha,parents:[.parents[].sha],message:.commit.message}'
printf '\n== Exact-head check runs ==\n'
gh api "repos/$repo/commits/$sha/check-runs?per_page=100" \
--jq '.check_runs[] | {name,status,conclusion,details_url,started_at,completed_at}'
printf '\n== Exact-head combined status ==\n'
gh api "repos/$repo/commits/$sha/status" \
--jq '{state,statuses:[.statuses[] | {context,state,target_url,created_at}]}'
printf '\n== PR state and reviews ==\n'
gh pr view 50 --repo "$repo" --json headRefOid,isDraft,reviewDecision,reviews \
--jq '{headRefOid,isDraft,reviewDecision,reviews:[.reviews[] | {author:.author.login,state,commit:.commit.oid,submittedAt}]}'Length of output: 8244 🏁 Script executed: #!/bin/bash
set -euo pipefail
predecessor="8a08cec57959a0f51873d065fd858427126bd432"
head="82a69abd6b89e489da8a5a8bf01657ef18dbd069"
printf '== Head and changed paths ==\n'
git rev-parse HEAD
git diff --name-status "$predecessor..$head"
git diff --check "$predecessor..$head"
printf '\n== primitives.py: imports and _absolute_uri ==\n'
nl -ba src/accounting_information_platform/financial_reporting/primitives.py | sed -n '1,180p'
printf '\n== URI test file outline ==\n'
ast-grep outline tests/test_financial_reporting_uri_rfc3986_red.py --items all
printf '\n== URI test file ==\n'
nl -ba tests/test_financial_reporting_uri_rfc3986_red.py | sed -n '1,260p'
printf '\n== Exact bounded implementation/test diff ==\n'
git diff --unified=60 "$predecessor..$head" -- \
src/accounting_information_platform/financial_reporting/primitives.py \
tests/test_financial_reporting_uri_rfc3986_red.py
printf '\n== RED commit test delta ==\n'
git show --format=fuller --unified=60 ea46ebae4c80a778e1a2327888a737b38a125012 -- \
tests/test_financial_reporting_uri_rfc3986_red.py
printf '\n== GREEN commit production delta ==\n'
git show --format=fuller --unified=60 54e23f2fb0b49d57b1d2b4e108da680785a6f710 -- \
src/accounting_information_platform/financial_reporting/primitives.py
printf '\n== Exact documentation diff ==\n'
git diff --unified=30 "$predecessor..$head" -- \
docs/doctoring/XBRL_STANDARD_TRACEABILITY.md \
docs/testing/FINANCIAL_REPORTING_TEST_MATRIX.mdLength of output: 2160 🤖 web_search executed:
Length of output: 20537 🏁 Script executed: #!/bin/bash
set -euo pipefail
predecessor="8a08cec57959a0f51873d065fd858427126bd432"
head="82a69abd6b89e489da8a5a8bf01657ef18dbd069"
printf '== primitives.py ==\n'
sed -n '1,180p' src/accounting_information_platform/financial_reporting/primitives.py
printf '\n== URI regression tests ==\n'
sed -n '1,280p' tests/test_financial_reporting_uri_rfc3986_red.py
printf '\n== Bounded primitive and test diff ==\n'
git diff --unified=80 "$predecessor..$head" -- \
src/accounting_information_platform/financial_reporting/primitives.py \
tests/test_financial_reporting_uri_rfc3986_red.py
printf '\n== RED commit ==\n'
git show --format=fuller --unified=80 ea46ebae4c80a778e1a2327888a737b38a125012 -- \
tests/test_financial_reporting_uri_rfc3986_red.py
printf '\n== GREEN commit ==\n'
git show --format=fuller --unified=80 54e23f2fb0b49d57b1d2b4e108da680785a6f710 -- \
src/accounting_information_platform/financial_reporting/primitives.py
printf '\n== Documentation delta ==\n'
git diff --unified=40 "$predecessor..$head" -- \
docs/doctoring/XBRL_STANDARD_TRACEABILITY.md \
docs/testing/FINANCIAL_REPORTING_TEST_MATRIX.mdLength of output: 56065
The regression test rejects all reported malformed forms. It retains The traceability and test-matrix updates accurately state the limited validation scope. They do not claim URN resolution, namespace registration, dereferencing, taxonomy trust, AIS origin, or filing authority. The The inspected GitHub state shows exact-head security, SAST, and dependency-diff jobs as successful. You are interacting with an AI system. |
|
/opencode Re-review exact head Predecessor |
|
@coderabbitai review Please review exact current head |
|
Tip For best results, initiate chat on the files or code changes. 🧩 Analysis chain🏁 Script executed: #!/bin/bash
set -euo pipefail
expected_head="e4bc1b417866737e09d7b08a35f6b007953d5bad"
predecessor="82a69abd6b89e489da8a5a8bf01657ef18dbd069"
repo="ContextualWisdomLab/accounting-information-platform"
printf '== Exact head and bounded change ==\n'
printf 'expected=%s\nactual=%s\n' "$expected_head" "$(git rev-parse HEAD)"
git status --short
git diff --check "$predecessor..HEAD"
git diff --name-status "$predecessor..HEAD"
git diff --unified=100 "$predecessor..HEAD" -- \
src/accounting_information_platform/financial_reporting/primitives.py \
tests \
docs/doctoring/XBRL_STANDARD_TRACEABILITY.md \
docs/testing/FINANCIAL_REPORTING_TEST_MATRIX.md
printf '\n== URI primitive structure and implementation ==\n'
ast-grep outline src/accounting_information_platform/financial_reporting/primitives.py --items all
nl -ba src/accounting_information_platform/financial_reporting/primitives.py | sed -n '1,220p'
printf '\n== RED and GREEN commit evidence ==\n'
git show --format=fuller --unified=100 daf89cf1b37d7e9830145a1acd6a99e0b5e72105 -- tests
git show --format=fuller --unified=100 b996252fa5c400edbda2b67774f01df8c2c70c05 -- \
src/accounting_information_platform/financial_reporting/primitives.py
printf '\n== URI tests and all URI call sites ==\n'
rg -n -C 16 --glob '*.py' \
'def _absolute_uri\b|_absolute_uri\(|username|hostname|\.port\b|urn:|userinfo|backslash|percent|absolute URI' \
src/accounting_information_platform/financial_reporting tests
printf '\n== Public exports and proposal-status controls ==\n'
rg -n -C 5 --glob '*.py' \
'authoritative_report|truth_status_code|source_authority_code|publication_readiness_code|filing_readiness_code|xbrl_validation_status_code|build_financial_report_artifact|export_xbrl_instance' \
src/accounting_information_platform
printf '\n== Generation-path network imports and calls ==\n'
rg -n -C 2 --glob '*.py' \
'^\s*(import|from)\s+(urllib\.request|requests|http\.client|socket|aiohttp|httpx)\b|\b(urlopen|requests\.(get|post|request)|httpx\.(get|post|request)|socket\.)\s*\(' \
src/accounting_information_platform/financial_reporting || true
printf '\n== Traceability and matrix delta ==\n'
rg -n -C 10 -i \
'RFC 9110|RFC 3986|RFC 8141|userinfo|credential|resolver|derefer|taxonomy trust|non-authoritative|filing-ready' \
docs/doctoring/XBRL_STANDARD_TRACEABILITY.md \
docs/testing/FINANCIAL_REPORTING_TEST_MATRIX.md
printf '\n== Exact-head GitHub state ==\n'
gh api "repos/$repo/commits/$expected_head/check-runs?per_page=100" \
--jq '.check_runs[] | {name,status,conclusion,started_at,completed_at,details_url}'
gh api "repos/$repo/commits/$expected_head/status" \
--jq '{state, statuses:[.statuses[] | {context,state,created_at,target_url}]}'
gh pr view 50 --repo "$repo" --json headRefOid,isDraft,reviewDecision,reviews \
--jq '{headRefOid,isDraft,reviewDecision,reviews:[.reviews[] | {author:.author.login,state,commit:.commit.oid,submittedAt}]}'Length of output: 47505 🏁 Script executed: #!/bin/bash
set -euo pipefail
expected_head="e4bc1b417866737e09d7b08a35f6b007953d5bad"
predecessor="82a69abd6b89e489da8a5a8bf01657ef18dbd069"
repo="ContextualWisdomLab/accounting-information-platform"
printf '== Working tree and commit ancestry ==\n'
git status --short
git show -s --format='HEAD=%H%nparents=%P%nsubject=%s' HEAD
git merge-base --is-ancestor "$predecessor" "$expected_head"
printf 'predecessor_is_ancestor=%s\n' "$?"
printf '\n== Exact primitive and URI regression test ==\n'
sed -n '70,180p' src/accounting_information_platform/financial_reporting/primitives.py
sed -n '1,180p' tests/test_financial_reporting_uri_rfc3986_red.py
printf '\n== RED and GREEN deltas ==\n'
git show --format=fuller --unified=80 daf89cf1b37d7e9830145a1acd6a99e0b5e72105 -- tests
git show --format=fuller --unified=80 b996252fa5c400edbda2b67774f01df8c2c70c05 -- \
src/accounting_information_platform/financial_reporting/primitives.py
printf '\n== URI consumer call sites ==\n'
rg -n -C 8 --glob '*.py' '\b_absolute_uri\s*\(' src/accounting_information_platform tests
printf '\n== Proposal classification and tamper/replay controls ==\n'
rg -n -C 6 --glob '*.py' \
'authoritative_report|truth_status_code|source_authority_code|publication_readiness_code|filing_readiness_code|xbrl_validation_status_code|source_package_hash|report_artifact_hash|reproduc' \
src/accounting_information_platform/financial_reporting tests
printf '\n== Generation-path network access search ==\n'
rg -n -C 2 --glob '*.py' \
'^\s*(import|from)\s+(urllib\.request|requests|http\.client|socket|aiohttp|httpx)\b|\b(urlopen|requests\.(get|post|request)|httpx\.(get|post|request)|socket\.)\s*\(' \
src/accounting_information_platform/financial_reporting || true
printf '\n== Current documentation claims ==\n'
rg -n -C 8 -i \
'RFC 9110|userinfo|credential|RFC 3986|RFC 8141|resolver|derefer|taxonomy trust|non-authoritative|filing-ready' \
docs/doctoring/XBRL_STANDARD_TRACEABILITY.md \
docs/testing/FINANCIAL_REPORTING_TEST_MATRIX.md
printf '\n== Exact-head GitHub checks and review state ==\n'
gh api "repos/$repo/commits/$expected_head/check-runs?per_page=100" \
--jq '.check_runs[] | {name,status,conclusion,started_at,completed_at,details_url}'
gh api "repos/$repo/commits/$expected_head/status" \
--jq '{state,statuses:[.statuses[] | {context,state,created_at,target_url}]}'
gh pr view 50 --repo "$repo" --json headRefOid,isDraft,reviewDecision,reviews \
--jq '{headRefOid,isDraft,reviewDecision,reviews:[.reviews[] | {author:.author.login,state,commit:.commit.oid,submittedAt}]}'Length of output: 100857
The repair retains the existing standard-library parsing path. It does not change percent-escape, backslash, host, port, IPv6, or RFC 8141 URN validation. The URI consumers remain limited to The exact-Decimal The reviewed Exact-head Security and dependency-diff checks are successful. Accounting foundation is in progress. SAST and CodeQL-related checks are queued. These checks are non-passing until they reach terminal success. The Draft state and You are interacting with an AI system. |
|
2026-09-09 central-owner correction for exact Fresh independent consumer canary No historical AIP rerun, leaf PAT/status workaround, synthetic success, no-op push, actor/sender weakening, or predecessor verdict transfer is accepted. #50 stays Draft and non-authoritative; this correction changes neither XBRL/report truth nor the Issue #51 successor boundary. |
1 participant
Problem
The ledger already produces a repeatable-read package containing the income statement, statement of financial position, changes in equity, and cash flow. Buyers also need profit-or-loss headlines, structured report explanations, and XBRL export without allowing a renderer, validator, taxonomy adapter, URI identifier, or model to become another accounting authority.
Implemented bounded delta
Decimalcurrent and comparative profit-or-loss summary;XbrlTaxonomyProfileandXbrlConceptMappingvalue objects;numeric(38, 6)overflow/rounding, malformed URI percent escapes/raw backslashes, non-numeric HTTP(S) authority ports, hostless HTTP(S) authorities, HTTP(S) userinfo, and malformed structural URN assigned names;Authority boundary
The pure builder is deliberately non-authoritative. Its outputs remain:
XBRL proposal output remains:
A content digest or syntactically valid URI proves neither AIS origin nor taxonomy trust. Only a successor owner command may issue authoritative report identity after loading the four statements, reporting currency, fiscal dates, journal/close-snapshot population, close/live state, and knowledge cutoff from AIS-owned PostgreSQL in one controlled snapshot, retaining provenance, running independent validation, obtaining maker-checker approval, and publishing append-only receipts. Issue #51 owns that buyer-visible round trip.
Current exact state — 2026-09-09
e4bc1b417866737e09d7b08a35f6b007953d5bad;develop@239008c4edc7d305c97704c5102b593c6622b36f;34148534940is terminal GREEN on this exact head. Accounting job101825730784passed behavior/repository tests, complete production branch coverage, explicit denominator enforcement, repository contracts, compile/import, reproducible wheel and package evidence. Retained exact-head coverage is 5,521/5,521 production statements and 2,006/2,006 branches. Same-run exact dependency diff, security, and SAST evidence are GREEN;10028619234digest:sha256:70f044a2e63d55aa8586ccb13a4dca01a5421c3a0812d828f3d2ad9c87fbd097; wheel SHA-256:944b5ff32866345f42adec194a93fe44d36b46c14809862c6af46641202f3b86; SBOM SHA-256:e1b04986dd84a42f84fccfff4d51becb54cbd675b36b4143829793acbc380b1e; source-provenance SHA-256:4226b02659b15dbebb913c118f7876fc76989c3dddd96b328dc0177caf087aad, bound to sourcee4bc1b4...and.github/workflows/ci.yml;34148535028and SAST34148534930are terminal GREEN on exacte4bc1b4...;34148534976remains historical non-passing evidence. Its receiver/coordinator state predates later central workflow generations and is retained diagnostically only; rerunning that historical definition does not prove the current protected producer;.github/main@7fd571dbcdbae6acf29d8f4ee704d7ba6297e4dbafter ordinary integration of #2028;.github#2040@6706c231ab06a3c91c43fdb5b989cfcd79fff593, Ready/mergeable on protectedmain@7fd571.... Required CodeQL run34251822255is terminal FAILURE, so exacte4bc1b4...still lacks authenticated current-generation CodeQL admission;Orgmetra#65@b7f2b730b8b231aa28e485c655fd8cdf18007d46, required run34289116329, demonstrates a stronger central ordering defect: Actions receiver102271601195terminal-failed at 23:14:02Z and Python receiver102271601217at 23:14:03Z, while authoritative dispatch102273249299did not start until 23:17:33Z and completed SUCCESS at 23:17:39Z. Receiver enforcement can therefore fail before same-run producer/dispatch evidence can settle;e4bc1b4...and reported no findings for the userinfo repair, prior URI guards, and bounded URI consumers. This is review evidence, not a qualifying formalAPPROVEDdecision. No qualifying independent current-headAPPROVEDreview is present.Repair lineage
The URI boundary has been repaired by small TDD increments without adding URL dereferencing, taxonomy loading, network authority, or accounting authority.
00ac8baa79cdaa33fdf319e37d5aaad325fb8570proved a non-numeric HTTP(S) port was accepted. Scope correctionfc3889bc2f3c76f09a1b4e58a2db860f9994de0removed an over-broad numeric-port-range claim; GREENc38e0f21fafa8880ab7856a3a712d714a771450cforces stdlibparsed_uri.portsyntax validation and maps parser failure to the stable accounting validation error.3335edc22b85b4e0772c444ce9f64fd481bc9f1fprovedhttps://:443/...andhttps://reporting-user@/...can have non-emptynetlocbut no origin host. GREEN6e8978e7e0d41fb8ed5e516155d7ad7488a806e6evaluates stdlibhostnameplusportand rejects an empty HTTP(S) host. Documentation descendants add RFC 9110 traceability/acceptance.ea46ebae4c80a778e1a2327888a737b38a125012proved authority-form or incomplete URNs could be admitted. GREEN54e23f2fb0b49d57b1d2b4e108da680785a6f710rejects a URN authority, requires a bounded alphanumeric/hyphen NID and non-empty NSS.82a69abd...completed the RFC 8141 acceptance and reached hosted Foundation GREEN before the next review finding.https://reporting-user@example.com/...andhttps://reporting-user:secret@example.com/...retained URIuserinfobecause only host and port were validated. REDdaf89cf1b37d7e9830145a1acd6a99e0b5e72105requires both forms to fail. Minimal production repairb996252fa5c400edbda2b67774f01df8c2c70c05continues usingurlparse, evaluatesparsed_uri.username, and rejects any HTTP(S) userinfo while retaining existing host/port/percent/URN behavior. This follows RFC 9110 §4.2.4 for untrusted HTTP(S) references and the RFC 3986 userinfo security guidance; it does not create a resolver, dereference a URL, or establish network/taxonomy trust.859dc40dec0ad8aa9b3571cb7f39b2c109c9e569and currente4bc1b417866737e09d7b08a35f6b007953d5badbind that userinfo control intodocs/doctoring/XBRL_STANDARD_TRACEABILITY.mdanddocs/testing/FINANCIAL_REPORTING_TEST_MATRIX.md. Currente4bc1b4...has reacquired exact-head Accounting Foundation GREEN, standalone Security/SAST GREEN, and CodeRabbit no-findings evidence; central CodeQL and qualifying approval remain outstanding.A bespoke HTTP authority, credential parser, or URN resolver remains rejected because it would duplicate standard parsing and enlarge the security/trust surface. URI validation here is a proposal-input integrity boundary only. Secrets and authenticated transport identity belong to a purpose-limited adapter/secret store and must not become immutable report/profile identifiers.
Standards / profile state
The IFRS Foundation confirms that IFRS Accounting Taxonomy 2025 remains the current taxonomy for 2026 reporting until the next annual taxonomy is issued in Q1 2027. 2026 Proposed Update 1 and Proposed Update 2 remain proposal/consultation artifacts, not released filing authority. #50 does not embed or redistribute the IFRS taxonomy and makes no IFRS conformance claim. Issue #51 owns immutable released-profile/package-digest, independent validation, publication, filing and receipt evidence.
RFC 3986 remains the generic URI-syntax basis for percent encoding, authority grammar and userinfo security guidance. RFC 9110 supplies the HTTP(S)-specific non-empty origin-host and no-userinfo rule for untrusted HTTP(S) identifiers. RFC 8141 supplies the bounded assigned-name structure used for the current URN guard. The implementation intentionally makes no complete RFC 8141 conformance or resolver claim.
Explicit non-claims
This PR does not claim authoritative AIS database origin from the pure builder, IFRS Accounting Taxonomy or DART conformance, XBRL Certified Software status, XBRL 2.1 schema/linkbase validation, Calculations 1.1 or Formula validation, Inline XBRL generation, filing readiness or regulator acceptance, statutory statement/disclosure completeness, approval, publication, audit, or assurance.
Documentation and successor work
Current PR-owned documents include
docs/adr/0067-financial-report-artifact-xbrl-boundary.md,docs/FINANCIAL_REPORTING.md, the XBRL design/plan,docs/doctoring/XBRL_STANDARD_TRACEABILITY.md, anddocs/testing/FINANCIAL_REPORTING_TEST_MATRIX.md, with PRD/TRD/Architecture/Data Model updates. PR #37 remains the single writer fordocs/product-technical-gap-baseline.md, sharedCHANGELOG.md, and canonical cross-product standards rebuild; the HTTP(S)-userinfo invariant has been handed to #37 rather than editing those broad surfaces concurrently.Issue #51 owns the missing authoritative report round trip: PostgreSQL report-run/source registry, forced tenant isolation, object-storage lifecycle, immutable released IFRS/DART profiles, independent XBRL/Calculations/Formula/jurisdiction validation, accessible HTML/PDF/XLSX/Inline XBRL renderers, localized explanation, maker-checker approval, publication, regulator/customer receipts, supersession, withdrawal, recovery, and release evidence. The same successor lane has been ratcheted so profile/filing/report identifiers cannot retain URI userinfo or credentials.
Review admission / merge boundary
Keep Draft until unchanged exact
e4bc1b417866737e09d7b08a35f6b007953d5badobtains authenticated terminal current-generation CodeQL evidence plus all other applicable protected/model/review/security evidence and a qualifying independent approval. Predecessor, queued, pending, stale, synthetic merge-ref, dynamic-code-quality-only, Foundation-internal-only, or model-only evidence cannot substitute for an applicable required gate. Do not merge, auto-merge, self-approve, bypass, force-push, destructively rebase, tag, version or release while any exact-head repository/security/package/review gate is non-passing. The pure proposal boundary must remain non-authoritative, and a later authoritative reporting command must derive source/report context from AIS-owned persistence rather than caller labels.