cadrumo.application.ledger.extraction_draft_store module

Encrypted store for pre-confirm extraction drafts.

An InvoiceDraft is derived financial data: supplier tax id, invoice number, taxable base, per-rate cuota. Persisting one is STORAGE rather than processing, so it routes through the core’s encrypted bucket-scoped repository and never through the inference subpackage, which holds no storage handle by contract.

Its pre-confirm, operator-correctable lifecycle does not change its sensitivity. A leaked draft would disclose exactly what the confirmed invoice would, so it is stored at the same FINANCIAL classification rather than a softer one.

A draft is not an invoice and this store must never become a second writer of one. It holds what a reader proposed, pending the operator’s confirm; the sole sanctioned Invoice writer stays where it is. Keeping the draft here is what lets an operator leave a review half-finished and return to it without the extraction being re-run – which is also why the store is keyed by the evidence reference the draft came from rather than by the draft’s own content: correcting a field must update the review in place, not fork a second one.

class StoredExtractionDraft(**data)

Bases: BaseModel

One pending extraction draft, keyed by the evidence it was read from.

Variables:

• evidence_reference – The evidence or attachment id the draft was read from. The key, so a correction updates the review in place rather than forking a second one for the same document.

• draft – The proposed fields, exactly as the reader produced them.

• extractor – Which reader produced it, so a draft from a superseded extractor is identifiable rather than silently trusted at confirm.

• read_transports –

  Every transport that carried this document’s reading. Separate from extractor because they answer different questions at different granularities. WHICH reader produced a value is a per-field fact, already carried by the draft’s own provenance envelopes, and a document-level claim about it would be exactly the laundering those envelopes exist to prevent. WHETHER any bytes left the host is legitimately document-level: if any field went off-host then the document did, so the fact is monotone over fields and loses nothing by being aggregated here.

  Empty means UNKNOWN, not on-host. A writer that cannot establish where the read ran says nothing rather than claiming the safe answer, and the consent withdrawal survey surfaces the uncertainty instead of resolving it optimistically.

• drafted_at – When the draft was written.

Parameters:

data (Any)

evidence_reference: str

draft: InvoiceDraft

extractor: str

read_transports: tuple[str, ...]

drafted_at: UtcInstant

class ExtractionDraftDocument(**data)

Bases: BaseModel

One bucket’s pending extraction drafts.

Parameters:

data (Any)

bucket_id: BucketId

drafts: tuple[StoredExtractionDraft, ...]

extraction_draft_object_key(document)

Return the canonical natural object key for one draft document.

Return type:

str

Parameters:

document (ExtractionDraftDocument)

class ExtractionDraftRepositoryProtocol(*args, **kwargs)

Bases: Protocol

Persistence operations required by extraction-draft application policy.

load(identifier)

Load the document stored under identifier, when present.

Return type:

ExtractionDraftDocument | None

Parameters:

identifier (str)

save(payload)

Persist one complete extraction-draft document.

Return type:

None

Parameters:

payload (ExtractionDraftDocument)

class ExtractionDraftRepositoryFactory(*args, **kwargs)

Bases: Protocol

Construct a repository port for one bucket and storage configuration.

bind_extraction_draft_repository_factory(factory)

Bind one outward-composed repository factory for the host context.

Return type:

Generator[ExtractionDraftRepositoryFactory]

Parameters:

factory (ExtractionDraftRepositoryFactory)

load_extraction_drafts(bucket_id, settings)

Load a bucket’s pending drafts, or an empty document when none exist.

Return type:

ExtractionDraftDocument

Parameters:

• bucket_id (str)

• settings (Settings)

read_extraction_draft(*, bucket_id, evidence_reference, settings)

Return the pending draft for this evidence reference, or None.

Return type:

StoredExtractionDraft | None

Parameters:

• bucket_id (str)

• evidence_reference (str)

• settings (Settings)

write_extraction_draft(*, bucket_id, evidence_reference, draft, extractor, settings, read_transports=())

Persist a draft through the core’s encrypted repository.

Replaces any pending draft for the same evidence reference. Two drafts for one document are a re-read or a correction, not two proposals, and leaving both would give the confirm boundary two answers with nothing saying which the operator meant.

Return type:

ExtractionDraftDocument

Parameters:

• bucket_id (str)

• evidence_reference (str)

• draft (InvoiceDraft)

• extractor (str)

• settings (Settings)

• read_transports (tuple[str, ...])