- Shipped
- August 27, 2026 at 6:29 PM UTC
- Author
- Kamo
- Commit
- c6d7371
BL1 Task 1. A near-verbatim transliteration of the payroll provider enums and PayrollConnection into **************** Enums, one entity and one repository — no stereotypes, so SharedLibBeanSafetyTest stays green and the owning service (InvoicingService) declares every bean. New relative to payroll: WEBHOOK_SECRET_CIPHERTEXT, a per-org rotatable webhook secret in its own column (B2). One platform-wide secret would mean rotating after any single org's leak breaks every other org's payment ingestion at the same instant. PlatformOAuthProviderType has NO QUICKBOOKS, XERO or SQUARE constant — it ends at ADP_WFN(17), its ids are persisted and it is documented append-only. Per the plan's Task 1 Step 3 instruction, all three ship PER_ORG_CREDENTIALS with a null registration rather than growing a shared ordinal enum in this task. That makes the plan's **************** vacuous on its usesPlatformOAuth() branch, so a fifth test states the consequence directly: no type may claim PLATFORM_OAUTH with no registration to point at. TDD evidence. RED (test written, no implementation): [ERROR] **************** cannot find symbol [ERROR] symbol: variable BillingProviderType [ERROR] location: class **************** [ERROR] **************** cannot find symbol [ERROR] symbol: variable BillingAuthKind GREEN: [INFO] Tests run: 5, Failures: 0, Errors: 0, Skipped: 0 -- in **************** MUTATION (KAMO_NATIVE authKind NONE -> PER_ORG_CREDENTIALS) — exactly one test red, which is the point: [ERROR] Tests run: 5, Failures: 1, Errors: 0, Skipped: 0 <<< FAILURE! [ERROR] **************** <<< FAILURE! **************** expected: NONE but was: PER_ORG_CREDENTIALS at **************** Reverted. FULL SUITE: Tests run: 2271, Failures: 0, Errors: 0, Skipped: 0 / BUILD SUCCESS. Run in an isolated `git archive HEAD` copy with its own target/ and its own -Dmaven.repo.local, NOT in the shared checkout: another session was mid-TDD in it **************** with no implementation yet), so `mvn test` there is red for reasons unrelated to this change. ~/.m2 was not written to and mvn install was not run. Not pushed — Task 9 lands the DDL first.