cadrumo.application.workflow.state_models module

Persisted workflow state contracts and their state-scoped helpers.

This module owns the encrypted WorkflowState envelope and transaction-catalogue selection. Active-profile selection and record resolution live in active_profile, while run stages, deadline observations, step details, and terminal results live in run_models.

class WorkflowState(**data)

Bases: BaseModel

Encrypted operator state for the Cadrumo aeat CLI.

The entire state is persisted as a single encrypted envelope via WorkflowStateRepository. Mutations always return a new copy (model_copy()) to preserve the frozen-model invariant.

Variables:

• auth – Local AEAT access readiness state.

• invoice_reviews – Invoice review annotations keyed by invoice_id.

• ledger_reviews – Ledger transaction review annotations keyed by transaction_id.

• updated_at – UTC timestamp of the last write.

Parameters:

data (Any)

The historical profiles field has retired. Consumers that need to enumerate registered profiles call cadrumo.application.workflow.profile_bucket_scan.list_profile_buckets() or read_profile_bucket() directly; both enumerate only committed current-format capsules through their anchored descriptors and never open an encrypted database. The active profile resolves via the precedence chain (Settings override > plaintext pointer file).

auth: AuthState

invoice_reviews: dict[str, InvoiceReviewRecord]

ledger_reviews: dict[str, LedgerReviewRecord]

bucket_events: tuple[WorkflowEvent, ...]

updated_at: datetime

active_profile_record()

Return the active UserProfileRecord from its secure bucket.

The active selector resolves via the precedence chain in cadrumo.application.workflow.active_profile.active_profile_selection() resolves the canonical selector, then the committed-capsule projection resolves a display label to its immutable bucket UUID before secure storage is addressed.

This is the convenience view for callers that legitimately act only on a present record and treat every absence alike. A caller that REPORTS the absence to an operator must use resolve_active_profile_record() instead: the None here does not distinguish a locked profile from one whose record is genuinely gone, and a projection that guesses between them tells the operator their financial records are missing when they merely need to log in.

Return type:

UserProfileRecord | None

active_profile_bucket_id()

Return the selected profile’s canonical secure bucket UUID.

Core owns active-selector precedence. The committed-capsule projection then maps an operator-facing label to the existing immutable bucket UUID. A selector without a current capsule has no secure bucket and returns None; health diagnostics retain the raw selector separately.

Return type:

str | None