Skip to content

feat(requests): request list with errors, retries and reprocessing - #43

Merged
Fluory merged 169 commits into
mainfrom
claude/feat-request-list-26
Sep 23, 2026
Merged

Fluory merged 169 commits into
mainfrom
claude/feat-request-list-26

Conversation

@Fluory

@Fluory Fluory commented Sep 23, 2026 •

Copy link
Copy Markdown
Owner

Warum

Fixes #26 · Epic #18 · Basis main (#42 ist gemergt; vorher gestapelt auf claude/feat-review-line-items-25).

Arbeitsstand

  • Ziel: Sachbearbeitung sieht auf einen Blick, welche Anfragen Aufmerksamkeit brauchen, und stößt fehlgeschlagene erneut an.
  • Nicht-Ziele: firmenübergreifende Ops-Dashboards.
  • Erledigt: Listenfilter (Status, mögliches Duplikat) im requests-Modul, Exportzustände im export-Modul, Seite /requests mit Versuchen, letztem Fehler inkl. Stufe, nächstem Versuch (Verarbeitung und Export), Filtern und „Erneut verarbeiten" (Server Action); Zeilenlogik als reine Funktion requestRowView; Tests; Doku; frischer Review eingearbeitet; verify:full grün; CI check grün.
  • Offen: Merge (freigegeben durch den Orchestrator, Reihenfolge des Stapels).
  • Annahmen: keine Paginierung im Pilot (Folge-Issue feat(requests): paginate the request list #48).
  • Nächster kleinster Schritt: Merge nach grünem check gegen main; danach feat(intake,review): duplicate handling in the UI #44.

Was ist passiert (Klartext)

Die Anfragenliste zeigt jetzt je Anfrage die Anzahl der Versuche, den letzten Fehler in verständlichen Worten samt Stufe (Verarbeitung oder Export) und wann der nächste automatische Versuch kommt – auch wenn der Export ans ERP gerade wiederholt wird. Man kann nach Status und nach möglichen Duplikaten filtern. Fehlgeschlagene Anfragen haben einen Knopf „Erneut verarbeiten" – der Statuswechsel, der neue Auftrag und der Protokolleintrag passieren in einem Schritt.

Plan-Pflicht (SYSTEM.md §4)

  • Kein Auslöser – keine Modulgrenze, öffentliche API, Migration, Auth/Rechte, kein Zahlungs-/Daten-/Infrapfad, höchstens zwei Module, keine Architekturvarianten, umkehrbar
  • Auslöser zutreffend – Impact Manifest ausgefüllt (Plan vor Code)

Impact Manifest

Geändert

  • src/features/requests/{repository,index}.ts, src/features/export/{repository,export-job,index}.ts
  • src/app/requests/{page.tsx,actions.ts,row-view.ts,row-view.test.ts}
  • Tests: tests/integration/request-list.test.ts
  • Doku: docs/technical/{architecture,operations}.md, CHANGELOG.md

Nachweis (SYSTEM.md §11)

Doku-Entscheidung (genau eine)

  • Keine langlebige Doku betroffen – Begründung: –
  • Doku betroffen und im selben PR aktualisiert:
    • Produktdoku (P0: README): –
    • Technische Doku: docs/technical/operations.md
    • Architekturkarte: docs/technical/architecture.md
    • ADR: –
    • CHANGELOG [Unreleased] (sichtbares Feature oder Verhalten – im selben PR, nie „später")

Entferntes oder Umbenanntes: nichts entfernt

Dateigrößen und neue Bausteine (SYSTEM.md §7)

Dateien über 500 Zeilen im Diff (Ausnahmen: generierter Code, Lockfiles, Fixtures, Migrationen, Schemas, Ressourcen, Doku, Konfiguration):

  • keine
  • bewusst belassen – Begründung: –
  • im selben PR nach fachlicher Verantwortung geteilt
  • Folge-Issue –

Über 800 Zeilen mit neuer Fachlogik oder über 1000 Zeilen (P1/P2): nicht betroffen

Neue Shared-Komponente, Utility-Datei, Adapter oder fachlicher Service:

  • nein
  • ja – gesucht nach: vorhandener Reprocess-Logik; gefunden: jobs/reprocessRequest – wiederverwendet

Subagent-Einsätze

  • Frischer Review: unabhängiger read-only Subagent (review-pr + Security-Regel).

Risiken / offene Punkte

  • Keine Paginierung (Pilotmengen) – Folge-Issue feat(requests): paginate the request list #48.
  • Direkt nach einem Reprocess aus ERROR(export) zeigt die Zeile kurz den letzten Export-Fehler, bis der neue Versuch läuft – bewusst belassen (zutreffende letzte Ursache).

🤖 Generated with Claude Code

https://claude.ai/code/session_01DJ5vaKvTYiMvdngT4d3xo1

…ion access control

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DJ5vaKvTYiMvdngT4d3xo1
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DJ5vaKvTYiMvdngT4d3xo1
…LS with integration proofs

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DJ5vaKvTYiMvdngT4d3xo1
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DJ5vaKvTYiMvdngT4d3xo1
…boss queues

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DJ5vaKvTYiMvdngT4d3xo1
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DJ5vaKvTYiMvdngT4d3xo1
…nd download routes

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DJ5vaKvTYiMvdngT4d3xo1
…-only audit, composite FK

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DJ5vaKvTYiMvdngT4d3xo1
- sign-up requires the invitation id (link) plus the invited e-mail – no takeover by address alone
- one company per user (unique index), deterministic membership lookup, actor from membership
- organization plugin accepts only admin/clerk roles
- configurable client-IP source for the auth rate limit; local secret refused in production
- invite page: zod input, 404 for clerks, shows the invitation link; signup needs the link
- tests: wrong/missing invitation id, foreign set-active/list-members, last admin, roles
- docs: operations (rate limit/proxy, recovery), data model, exceptions register (admin plugin)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DJ5vaKvTYiMvdngT4d3xo1
…e rejection

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DJ5vaKvTYiMvdngT4d3xo1
… docs for #5

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DJ5vaKvTYiMvdngT4d3xo1
…secret

The image sets NODE_ENV=production, so the previous check blocked the local compose stack.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DJ5vaKvTYiMvdngT4d3xo1
…re script

Python 3.13 package requestflow_ai (src layout), docling/fastapi/google-genai
pinned, CPU-only torch via the PyTorch CPU index, dev tools ruff/pyright/pytest.
The synthetic PDF fixture is generated by scripts/make_fixtures.py (reportlab).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DJ5vaKvTYiMvdngT4d3xo1
Test-first per ADR-0001 D8: quote normalisation (whitespace, case, NFKC,
hyphenation), German number and date formats, and the verifier rules that
turn unsupported model claims into unverified. Also adds the segment and
model-output types the tests build on; the verifier does not exist yet.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DJ5vaKvTYiMvdngT4d3xo1
normalize_text folds NFKC, soft hyphens, line-break hyphenation, typographic
dashes/quotes, whitespace and case. values parses German/ISO numbers and
DD.MM.YYYY, D.M.YY and ISO dates. verify_field only keeps or downgrades the
model's status: a quote not in the cited segment, an unknown segment, a value
inconsistent with the quote, found without evidence or value, and missing
with a value all become unverified with a reason.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DJ5vaKvTYiMvdngT4d3xo1
…ction (red)

EML: body lines with 1-based line locators, From/Subject header segments,
RFC 2047 and quoted-printable decoding, HTML-only bodies, header newline
collapse, no attachment payloads. PDF: textline segments with page + top-left
bbox via docling-parse (model-free); the layout-pipeline test only runs with
AI_TEST_DOCLING_MODELS=1. Detection by magic bytes; .msg rejected for now.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DJ5vaKvTYiMvdngT4d3xo1
EML via the standard library email package (policy=default): From/Subject
header segments and one segment per non-empty body line, HTML-only bodies
reduced to text lines. docling's EMAIL backend was checked but emits
paragraphs without provenance, so it cannot give line locators.

PDF via docling: the default textlines pipeline reads docling-parse text
lines (page + top-left bbox, no ML models, no network); the opt-in layout
pipeline uses DocumentConverter (OCR and tables off) and the heron layout
model. docling is imported lazily.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DJ5vaKvTYiMvdngT4d3xo1
…ex model client (red)

The model client is exercised through the real google-genai SDK with an
httpx MockTransport replaying recorded generateContent bodies: eu multi-region
URL, bearer auth, structured-output config, token usage, fail-closed init
(no project, no credentials, dev flag without key), no silent switch to API
key mode, and schema-invalid output. Adds the env-based Settings.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DJ5vaKvTYiMvdngT4d3xo1
…lient

Prompt extract_header_v1.md (system instruction) plus render_document, which
puts segment-id-prefixed lines between <document> delimiters and neutralises
delimiter-like tags inside the document. GeminiModelClient calls Vertex via
google-genai with response_schema = ModelExtraction, JSON mime type,
temperature 0 and no tools; schema-invalid output raises ModelOutputError.
build_model_client needs VERTEX_PROJECT and credentials, loads ADC eagerly,
refuses API-key mode for Vertex, and allows the Gemini API only with
AI_ALLOW_GEMINI_API_DEV=true plus GEMINI_API_KEY.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DJ5vaKvTYiMvdngT4d3xo1
Pipeline: PDF and EML end to end with recorded model responses, a model date
contradicting its own quote, the prompt-injection mail (the recorded model
obeys and invents a quote -> unverified), and the no-text PDF that skips the
model. API: bearer auth (401 + WWW-Authenticate), response shape, request id
handling, 400/413/415/422/429/502 mapping without echoing input, JSON logs
with IDs only. Contract: the committed OpenAPI file equals the app's schema.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DJ5vaKvTYiMvdngT4d3xo1
…e/feat-review-line-items-25

# Conflicts:
#	AGENTS.md
#	CHANGELOG.md
… range), DOCX part, Outlook attachments unwrapped
…line metric present, injected value also fails as uncertain, --live aborts before any case without a client; scanned-case gap documented (#24 review)
…' into claude/feat-request-list-26

# Conflicts:
#	CHANGELOG.md
#	docs/technical/architecture.md
…keep the value in their accessible name, stale item corrections not mapped onto a newer run (#25 review)
…ever read attachments beyond the cap

olefile only logs 'stream too large' by default, and python-oxmsg reads every
stream at load time, so a 2 KiB .msg declaring a gigabyte stream on a looped
FAT chain was read sector by sector. check_ole_container opens the directory
with DEFECT_INCORRECT and rejects any stream, the mini stream, or the sum of
streams declaring more bytes than the container has. Used by detect and
load_message.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DJ5vaKvTYiMvdngT4d3xo1
…X block

A 60 MB document.xml of empty paragraphs (8.8 MB zipped) passed the 64 MiB/100:1
checks and cost 37 s / 1.3 GB for 0 segments. open_package now rejects any
entry declaring more than MAX_PART_BYTES (16 MiB) from the zip index, and the
DOCX walker counts every paragraph and table cell against MAX_BLOCKS (100,000),
not only emitted segments.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DJ5vaKvTYiMvdngT4d3xo1
…rest with a warning

More pages without text than the OCR cap used to fail the whole PDF (422).
Now the first ones are OCR'd (consecutive pages in one conversion), the rest
stay empty and the response carries the additive warning ocr_pages_skipped.
parse_pdf_document returns page count and OCR counts; parse_pdf stays a wrapper.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DJ5vaKvTYiMvdngT4d3xo1
Per-file caps multiplied across the attachments of a .msg. ParseBudget
(parsing/budget.py) is created once per uploaded document and shared by all
nested attachments: 100 attachments, 128 MiB unzipped OOXML, 100 PDF pages
(at least AI_MAX_PDF_PAGES), MAX_OCR_PAGES OCR pages. An attachment that would
overdraw it is reported with the additive error code budget_exceeded; the rest
of the message is still returned. BudgetExceededError subclasses
DocumentTooLongError, so a top-level document still maps to 422.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DJ5vaKvTYiMvdngT4d3xo1
…EADME limits for the security fixes

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DJ5vaKvTYiMvdngT4d3xo1
…ng requests show a cause, export attempts for export errors), export retries record the next attempt, reprocess buttons named per request (#26 review)
…ges_skipped

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DJ5vaKvTYiMvdngT4d3xo1

Fluory commented Sep 23, 2026

Copy link
Copy Markdown
Owner Author

Frischer Review (unabhängiger Subagent, read-only aus Git-Refs, review-pr + Security-Regel)

Ergebnis: 0 Blocker · 3 should-fix · 4 nits. Bestätigt: Firma nur aus der Session, Reprocess-Autorisierung + Atomarität (Statuswechsel, Job, Audit in einer Transaktion), kein N+1, Query-Parameter gegen Allow-Lists, Filter mit Labels, Status als Text.

# Schwere Befund Auflösung
1 should-fix „Nächster Versuch" nie für Export-Wiederholungen (nur Verarbeitung schrieb nextRetryAt) runExportJob schreibt nach fail() den nächsten Termin aus pg-boss (recordExportRetry, nur solange APPROVED); Integrationstest „shows an export that is retrying…"
2 should-fix Veralteter Export-Fehler/Versuche nach Reprocess; ERROR(export) zeigte Verarbeitungsversuche Zeilenlogik als reine Funktion requestRowView: Ursache nur für fehlernde/wiederholende Anfragen, Export-Versuche bei Export-Fehlern. Bewusst belassen: direkt nach einem Reprocess aus ERROR(export) zeigt die APPROVED-Zeile den letzten Export-Fehler, bis der neue Versuch läuft (Sekunden) – das ist die zutreffende letzte Ursache
3 should-fix Anzeige-Logik ungetestet Unit-Tests für requestRowView (4) + Integrationsfall APPROVED mit laufender Export-Wiederholung
4 nit „keine Stacktraces"-Check prüfte nur selbst gesetzte Texte entfernt (Texte kommen aus describeFailure/describeExportFailure, dort getestet)
5 nit gleichlautende „Erneut verarbeiten"-Knöpfe aria-label mit Betreff
6 nit Stufe doppelt angezeigt Stufe einmal: im Status bei ERROR, als Präfix bei Wiederholungen
7 nit keine Paginierung für den Pilot ok – Folgeaufgabe

Generated by Claude Code

olefile follows the declared FAT sector count along the DIFAT chain in its
constructor (quadratic array copy per sector); a forged count on a looped
DIFAT chain hung it before the stream-size walk could run. The header's FAT,
DIFAT, mini FAT and directory sector counts must now fit the file size.
Also: stale docstring, README package list.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01DJ5vaKvTYiMvdngT4d3xo1
…ored per document and shown in the review; contract types regenerated (#23 review)
…e/feat-review-line-items-25

# Conflicts:
#	src/app/requests/[id]/page.tsx
#	src/features/review/review.ts
#	tests/integration/review.test.ts
@Fluory
Fluory marked this pull request as ready for review September 23, 2026 09:08
@Fluory
Fluory changed the base branch from claude/feat-review-line-items-25 to main September 23, 2026 10:00
@Fluory
Fluory merged commit 8c55775 into main Sep 23, 2026
8 of 10 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

feat(requests): request list with errors, retries and reprocessing

2 participants