docs backend evidence ev support EE 17

EE-17 — Licensed operator read adapter and access handoff

Status: LOCAL_DONE Validation: PASS Integration: INTEGRATION_PENDING

Parent: 4ca4b3a3 (maintained dev, EE-16 commit, PR #147 head). Date: 2026-10-22. Depends EE-01/09/14, accepted. Rules EV-07/09/11/15/23/24; journey EV-04/08/12. Risk: external access/security/freshness (fail closed, no invented feed, no secret surface).

Before behavior: no signup, contact, payment, credential or private API exists, so optional-operator reads stay ACCESS_PENDING (EE-01 register, optional_operators). The port contract must still be executable — config pinning, access resolution and the full fault taxonomy run in tests — without inventing a feed or claiming live proof. Recovery: keep the adapter OFF; dated community reads stay functional.

Delivered

• backend/internal/modules/charging/adapters/licensed/licensed.go (new, stdlib only, no net import: nothing dials anyone): Config pins provider/protocol (OCPI_2_2_1|DOCUMENTED_API), read-only modules (STATUS/TARIFFS; COMMANDS/session/billing refused), https base URL (no userinfo/fragment), credential env name (never a value), scope and dated grant expiry. Client.Resolve() answers AUTHORIZED only with a present credential and a current grant, else ACCESS_PENDING (no-credential / grant-expired). Reads refuse unknown locations, propagate cancellation, map every provider fault to a typed ProviderError (wrong-scope, replay-refused, stale-timestamp, provider-outage, quota-exceeded, revoked, invalid-state) and never upgrade UNKNOWN to AVAILABLE. Tariffs are shape-checked and stamped LICENSED_OPERATOR (pricing stays with the EE-11 engine). The default client has no transport: even authorized reads refuse with route-unpinned until a reviewed binding is attached.
• licensed_test.go: config allowlist table (11 refusals), pending without credential (plus default-client refusal), expiry/route gates, full fault taxonomy against a scripted in-memory transport (replay detection executes on reused nonces, stale clock, wrong scope, revocation, bogus kinds/states), tariff shape/provenance, cancel propagation and credential hygiene (secret value never enters the request; only its presence is signalled).
• No jobs/HTTP wiring, no discovery allowlist change, no migration, no OpenAPI change, no credential/contact/payment added anywhere.

Actual checks

From this worktree (2026-10-22, parent 4ca4b3a3):

• RED: with licensed.go removed, the contract tests fail to compile (undefined: Response); restored → GREEN. A COMMANDS module, http/userinfo URLs and lowercase env names were verified refused.
• go test -race -count=1 ./internal/modules/charging/... → PASS (licensed, http, jobs, prepared, domain; read has no tests, as before).
• go vet ./..., GOTOOLCHAIN=go1.27.1 staticcheck (charging), gofmt -l clean, git diff --check clean, bash scripts/scan-secrets.sh clean. No OpenAPI edit → vacuum N/A; no SQL edit → sqlc N/A.
• No network dials in tests (in-memory transport only); no PII/secrets/ GPS/photos in Git/logs/fixtures.

Limits

• No authorized access exists: every licensed read in this build ends in ACCESS_PENDING (optional_operators unchanged). No live sample, no provider fault observation beyond the scripted taxonomy, no endpoint pinned beyond the config shape.
• A real binding still needs, in a separately authorized review: pinned partner plus protocol version/modules, credential issuance/rotation/ expiry handling, bounded HTTPS mechanics and observed provider behavior. This port is shaped to receive exactly that.
• No device, no production, no deploy and no release acceptance is claimed.

Next: EE-18 (Android typed public snapshot + Room import) once authorized; it consumes EE-09/14 reads, never this pending port.