Skip to content

feat(compliance): add the deterministic sandbox kyc provider - #284

Merged
tiana-code merged 1 commit into
mainfrom
feat/E-04-sandbox-kyc-provider
Jun 19, 2026
Merged

feat(compliance): add the deterministic sandbox kyc provider#284
tiana-code merged 1 commit into
mainfrom
feat/E-04-sandbox-kyc-provider

Conversation

@tiana-code

Copy link
Copy Markdown
Owner

E-04 / E-06 #239 - an in-tree sandbox impl of the KycProvider port (unblocked now that port #263 exists). Mirrors the merged SandboxBankProvider (#212).

What

  • infrastructure/kyc/SandboxKycProvider - @Component @ConditionalOnProperty(prefix="fincore.compliance.kyc.sandbox", name=[enabled], havingValue=true, matchIfMissing=false), off by default. Deterministic, marker-based on the opaque subjectReference: reject -> Rejected, pending -> Pending, insufficient -> InsufficientData, otherwise Approved. The same reference always yields the same result; the provider reference is an opaque token (sbx-kyc-<hash>), not the input echoed back.
  • Unit test: each variant + determinism. No properties object (marker consts), so no config wiring change.

Bean-conflict avoidance (the key CI risk - designed out)

Off-by-default + the existing @SpringBootTest ITs (KycApiContextIT/AmlConsumerIT/ComplianceLifecycleIT) do NOT set the flag -> SandboxKycProvider stays inactive there -> their test-fake KycProvider remains the single bean -> no NoUniqueBeanDefinitionException. The ITs are untouched.

Gate chain

  • critic: GO (bean-conflict reasoning verified airtight; 1 LOW deferred to the future chart slice).
  • security-auditor (opus): PASS - §5.3 clean (generic markers, no real provider/logic/PII), off-by-default safe, deterministic+documented, 4/4 ACs.
  • code-reviewer: APPROVED; 1 LOW applied - the provider reference no longer echoes the raw subject value (opaque deterministic token), satisfying the result-field invariant.
  • evaluator: PASS (0.91).
    All local gates green (unit test; infrastructure/kyc so the domain jacoco gate is unaffected).

Closes #239

Provide an in-tree sandbox implementation of the KycProvider port for
local and test use. It is off by default and only activates when
fincore.compliance.kyc.sandbox.enabled is true, mirroring the sandbox
bank provider. The outcome is a pure function of documented
case-insensitive markers in the opaque subject reference (reject,
pending, insufficient, otherwise approved), so the same reference always
yields the same result. It encodes no real provider logic and the
returned provider reference is an opaque token, not the input echoed
back.

Closes #239
@tiana-code tiana-code added this to the v0.3.0 milestone Jun 19, 2026
@tiana-code
tiana-code merged commit d50449a into main Jun 19, 2026
8 checks passed
@tiana-code
tiana-code deleted the feat/E-04-sandbox-kyc-provider branch June 19, 2026 13:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

F-06.2 SandboxKycProvider

1 participant