v1.10.0

Puntovivo v1.10.0 — honest answers, delivered receipts, and recovery you can rehearse

Why this release matters

v1.10.0 is about trust in the things a store cannot afford to guess about:
where your data came from when you migrated in, whether a customer actually got
their receipt, whether an answer from the assistant is something you should act
on, whether an alert reached anyone, and whether your backup would really come
back.

Each of those already existed in some form. This release makes them state their
limits out loud. An import tells you what it recognized and what it refused. A
receipt handoff hands you the message instead of pretending it was sent. The
assistant can be set to show only verified results instead of a confident
narrative. An alert that failed to reach an external receiver still shows up
inside the product. And encrypted recovery is now rehearsed automatically on
Linux, macOS, and Windows rather than trusted from memory.

This is a stronger internal-beta candidate. It is not a claim of Colombian
fiscal certification, qualified hardware, or a staffed monitoring service.

What changed

Bringing your catalog in without guessing

• Added source-aware import profiles for the tested Loyverse, Alegra, Siigo,
  and World Office export layouts, so a file from those systems maps to the
  right columns instead of relying on a generic best guess.
• Kept a generic fallback that fails closed: when the layout is not recognized,
  the import reports what it could not map rather than silently inventing a
  mapping.

Receipts a customer actually receives

• Added a WhatsApp receipt handoff that renders the message text and an
  optional local image, then hands it to the operator to send.
• Deliberately did not add background sending. Puntovivo does not claim a
  receipt was delivered when a person still has to press send.

An assistant that separates results from narrative

• Added an administrator-controlled choice between guided explanations and
  verified results only.
• Both modes show the SQL, the row counts, the tables consulted, and the
  available charts. Results-only suppresses the generated narrative.
• The product states plainly that valid SQL does not guarantee a correct
  business conclusion. That judgement stays with the person reading it.

Alerts that cannot fail silently

• Added a tenant-scoped lifecycle for sync, fiscal, device, and payment
  incidents, with manager and administrator acknowledgement.
• Added delivery to an explicitly provisioned signed HTTPS receiver, with
  bounded retries, dead-letter recovery, immutable attempt evidence, and
  retention enforcement.
• A failed or missing external delivery never hides the incident inside the
  product. The in-app record is the source of truth.

Business events for the tools you already use

• Added optional tenant-scoped outbound webhooks for a small versioned set of
  business events, with fixed HTTPS destinations, encrypted one-time signing
  secrets, HMAC signatures, stable idempotency keys, bounded retry and
  dead-letter recovery, and per-destination evidence.
• This is a narrow, contract-tested integration path. It is not a general
  public REST API and not a catalog of certified third-party connectors.

Recovery that is rehearsed, not assumed

• Added an automated packaged encrypted-recovery rehearsal that runs against
  the built desktop application on Linux, macOS, and Windows.
• The rehearsal checks restore integrity, tenant isolation, rejection of a
  wrong key and a corrupted bundle, an unchanged source database, and a
  successful boot of the restored copy.
• This closes the cross-platform recovery gap that v1.9.0 listed as still open.

Knowing what the AI actually costs

• Extended the monthly spend guard to semantic catalog embedding calls, which
  were previously outside it. This closes the second gap v1.9.0 left open.
• Every embedding attempt now records its tenant context and reports its cost
  state explicitly: estimated, locally zero, unknown, or not incurred.
• Your provider's own limits remain the authoritative cap. Puntovivo cannot
  reserve or certify a third-party bill in advance.

Security housekeeping

• Raised the security floors for several transitive dependencies so the
  workspace audit is clean again. No dependency crossed a major version
  boundary and no application behavior changed.

Before you use it

• Puntovivo still does not sign or transmit production documents through a
  DIAN-authorized Technology Provider. Provider credentials, certificates,
  contingency behavior, conformance testing, and certification are all still
  required. The Mexico and Chile document packs remain draft-only.
• Software paths exist for receipt printing, cash-drawer commands, scanner
  input, and manual payment-terminal recording. Representative physical devices
  still need qualification in a store-like lab.
• The operational alert channel is a software delivery path, not a staffed
  monitoring service and not a response-time guarantee. Before relying on it,
  provision your own receiver, verify signature validation on that side, and
  assign who is on the receiving end.
• The recovery rehearsal proves the mechanism works, using a retained
  262,865-row baseline. Treat that as a baseline, not a service target. Real
  recovery-time and recovery-point expectations should come from a
  representative pilot rather than from one CI runner measurement.
• Day close still reports commissions and waste as unavailable rather than
  inventing zero values. Attendance classifications are evidence for payroll,
  not payroll-final money.
• There is no managed cloud and no staffed 24/7 support. The product is
  local-first, open source, and still requires an observed private pilot before
  any production-readiness claim.

Downloads

Open the v1.10.0 GitHub release
and choose the signed Windows x64 installer, notarized macOS Apple Silicon
archive, Linux x64 AppImage, or web bundle. Update-feed files are consumed by
the desktop updater and are not manual installers.

For engineers and auditors, the generated
v1.9.0...v1.10.0 comparison
keeps the complete commit-level history.