Skip to main content

OSS Inventory

Documentation Map​

OSS Inventory

jhf-wire publishes machine-readable OSS inventory truth in:

  • maintenance/oss-inventory.json
  • maintenance/oss-version-truth.json
  • maintenance/oss-drift-contract.json
  • maintenance/upgrade-paths.json
  • maintenance/fabric-oss-upgrade-consumer-contract.json (consumer binding to Fabric-owned canonical upgrade truth)

Scope​

The inventory covers upgrade-relevant OSS surfaces that are directly declared in this repository:

  • runtime/test container images from compose
  • ERiC service base image and pinned Python dependencies
  • CI action references, runner image selector, and pinned CI Python packages
  • local source-build runtime surface for eric-service

Repo-Owned Provider Interfaces (Custom Adapters)​

Besides third-party OSS components, jhf-wire maintains repo-owned adapter surfaces toward external providers. These are custom integration interfaces (not third-party OSS packages) and are tracked here for upgrade/drift readiness context.

Implemented provider interfaces:

  • finAPI
    • primary surfaces: scripts/probe_finapi_live.sh, n8n-workflows/jhf-spindle-bank-sync.workflow.json
    • runtime/config anchors: FINAPI_* variables in infra/docker/.env.example
  • Storecove (XRechnung dispatch)
    • primary surface: n8n-workflows/jhf-spindle-xrechnung-dispatch.workflow.json
    • runtime/config anchors: STORECOVE_BASE_URL, STORECOVE_API_KEY
  • ELSTER / ERiC (tax submit lane)
    • primary surfaces: n8n-workflows/jhf-spindle-elster-submit.workflow.json, infra/eric-service/main.py, scripts/check_elster_artifact_readiness.py
    • runtime/config anchors: ELSTER_*, ERIC_*

Planned / currently non-active in this repo:

  • Paddle
    • no active runtime workflow or repo-owned adapter contract is currently enabled in jhf-wire
    • if introduced, it must be added to docs/MODULE_FEATURES.md and the machine-readable inventory/verify path contracts

Ownership Model​

  • repo_owned: versions pinned and verified inside this repository.
  • external_owner: version stream exists but is owned outside this repository.
  • shared_stack_owner: shared stack component with coordinated ownership.

This repository does not claim owner-truth for external runtime materialization outside its own contracts.

Verification​

Run:

python scripts/check_oss_inventory_versions.py --strict
python scripts/check_oss_maintenance_contracts.py --strict
python scripts/check_fabric_oss_upgrade_consumption.py --strict
python scripts/check_docs_inventory.py --strict
python -m pytest -q tests/test_oss_inventory_versions.py

Both checks are fail-closed and return non-zero on drift.

Issue #83 Closure Verify Path​

For JaddaHelpifyr/jhf-wire#83, closure evidence must include:

  • local verifier output for inventory/version/maintenance/docs contracts
  • CI status reference for the commit that carries the #83 closure updates
  • issue comment evidence that links repo checks and classification outcome (fixed / blocked_external)

Notes​

  • :latest is forbidden for repo-owned surfaces.
  • external owner surfaces remain explicit and must not be silently treated as repo-owned.
  • inventory and version truth must stay ID-aligned.

License: AGPLv3
Project website: https://helpifyr.com