docs backend evidence ev support EE 08

EE-08 — Verified ingestion jobs and conservative reconciliation

Status: LOCAL_DONE Validation: PASS Integration: INTEGRATION_PENDING

Parent: 32688324 (maintained dev, PR #147 head; plus fix 2a0f39e7). Date: 2026-10-22. Depends EE-07, accepted. Rules EV-05–09/23; journeys EV-03/09/12. Risk: jobs/identity/SSRF (critical: allowlisted discovery only, workspace cleanup, dead budgets, no auto-actions).

Before behavior: verified imports run prepare→bridge→store with workspace isolation, cleanup-before-completion, idempotent replay (same manifest returns the existing batch, corrections create new ones) and dead budgets; discovery checks allowlisted indexes for new revisions without downloading; merge/split review flags added, missing and changed places without auto-linking. Imports and schedules default off with explicit config gates; failures retain the last accepted public state. Recovery: imports/schedules off, retain last state.

Delivered

• backend/internal/modules/charging/adapters/jobs/import.go: Runner (bounded workspace, trusted binaries, injected store, cleanup verification, dead budget) and ReviewMergeSplit (pure added/missing/changed flags, never auto-link/close/bind).
• backend/internal/modules/charging/adapters/jobs/discovery.go: Discover over allowlisted origins only (github/openchargemap, gov.br/inmetro paths; https, TLS 1.2+, no redirects/credentials, 1 MB cap, 30 s budget); anything else refuses before dial (no SSRF surface).
• backend/internal/modules/charging/adapters/jobs/handlers.go: queue ImportHandler/DiscoveryHandler (kinds, versions, bounded payloads, no auto-actions).
• backend/internal/platform/config/config.go: ANPFUEL_CHARGING_IMPORTS_ENABLED (default off).
• infra/docker/Dockerfile: build/copy prepare_charging and prepare_vehicle as 65532 (nonroot preserved).
• .github/workflows/backend.yml: build both binaries and export ANPFUEL_TEST_CHARGING_PREPARER_PATH and ANPFUEL_TEST_VEHICLE_PREPARER_PATH.
• jobs_test.go: invalid payloads, missing preparer, dead budget, idempotent replay, non-allowlisted origins, merge/split flags and handler kinds.
• Prerequisite store fix (same open PR): replay by manifest hash returns existing batch (FindChargingBatchByManifest), preserving immutable history.

Actual checks

From this worktree (2026-10-22, parent 2a0f39e7):

• go test -count=1 ./internal/modules/charging/adapters/jobs/ → PASS, 7 tests (payloads, cleanup, budgets, replay, SSRF refusal, review flags, kinds).
• go test -count=1 -tags=integration ./internal/modules/charging/... (loopback PostGIS + real preparer outputs) → PASS: bridge, storage and jobs green.
• go vet + GOTOOLCHAIN=go1.27.1 staticcheck on charging/config → PASS.
• Dockerfile: binary build/copy/chmod lines added with --chown=65532 and USER 65532 preserved (inspected, no daemon build here); backend.yml binaries/paths added.
• git diff --check PASS; bash scripts/scan-secrets.sh PASS.
• No DB migration, HTTP, Android or network activation beyond the allowlisted discovery check; no PII/secrets in Git/logs/fixtures.

Limits

• Jobs are implemented and unit-tested; queue/dispatcher registration and schedules stay off until import enablement (explicitly default-off). Manual Runner execution and tests prove the mechanics; production queue wiring is a future unit.
• Discovery reports index reachability only; it never downloads snapshots, keys or bulk data (fetching needs separate review).
• Merge/split flags are advisory; no auto-link, auto-close or auto-bind occurs. Corrections create new batches; replays return existing ones.
• OSM adapter explicitly out of scope (separate suffixed task after rights/need admission; no commercial candidates implemented).
• No device, no production, no deploy and no release acceptance is claimed.

Next: EE-09 (publication and read contracts) needs its own authorization; it consumes these tested jobs.