Syrve test-only payment write playbook

Safe live payment write on test iiko only. Registered runtime capability is always on, but execution still requires explicit manual approval and all safety checks.

Key concept: method-specific preflight

Generic BackOffice RPC verify (403 forbidden on authorization / getCurrentAuthInfo) is not a total blocker when:

• REST /resto/api/auth succeeds
• Document sync / refresh works
• Method-specific preflight is WriteEligible for setPaymentsForInvoices or setPaymentsForOutgoingDocuments

Safety logic uses required ISyrvePaymentWritePreflightService rather than treating generic connection health as sufficient.

Preconditions

1. Read-only smoke: REST auth OK; sync shows at least one Unpaid / PartiallyPaid test document.
2. Generic RPC verify results are interpreted by method-specific preflight; there is no bypass flag.
3. Operator selects account + cash-flow article on posting (PUT /write-target) or via env defaults.
4. Owner approval for this specific test posting.

Always-on runtime contract

Do not add removed Syrve/iiko enablement, verification-status, or bypass flags. A new posting always starts in ApprovalRequired. Required checks are scoped RBAC, manual approval, idempotency, payable/amount/allocation/anomaly controls, server applicability, credentials, HTTP/RPC and method-specific preflight, and technical limits.

Account / cash-flow (test operator-provided or from references API):

IIKO_TEST_PAYMENT_ACCOUNT_FROM=<guid>
TEST_SYRVE_CASHFLOW_ARTICLE_ID=14c0fe4b-76ec-2681-846e-81d1ec32db08

Flow (no synchronous API write)

1. Read-only smoke until sync + unpaid document confirmed.
2. Bank allocation for tiny unpaid document (confirm → optional approve).
3. POST /api/syrve/postings/queue/{allocationId}
4. PUT /api/syrve/postings/{id}/write-target if account/cash-flow not set from env.
5. GET /api/syrve/postings/{id}/preflight — method-specific eligibility.
6. POST /api/syrve/postings/{id}/dry-run — gates + payload preview, no iiko write.
7. POST /api/syrve/postings/{id}/approve
8. Worker (PaymentPostingWorker) executes live write via IIikoPaymentWriteFacade.
9. GET /api/syrve/postings/{id}/evidence
10. Reconciliation worker / POST /api/syrve/postings/{id}/reconcile
11. Verify in Syrve/iiko BackOffice.
12. File report under docs/docs/integrations/reports/.

API

Method	Path	Notes
GET	/api/syrve/postings/{id}/preflight	Method-specific write eligibility
PUT	/api/syrve/postings/{id}/write-target	Account + cash-flow article
POST	/api/syrve/postings/{id}/dry-run	Gates + preview only
GET	/api/syrve/postings/{id}/attempts	Worker attempt metadata
GET	/api/syrve/postings/{id}/evidence	Sanitized before/preflight/request/after

Blockers

Code	Meaning
read_path_unavailable	REST/read path unhealthy (no server version, auth failed)
write_preflight_required	Preflight not run or incomplete
write_contract_not_verified	Historical/compatibility code; investigate method-specific applicability and transport contract
connection_not_connected_for_write	Connection/transport readiness failed
approval_required	Approve posting
account_required / cash_flow_article_required	Configure write target

Never

• Treat always-on capability as permission to write.
• Add direct “Execute now” from API/UI.
• Mark Reconciled without readback.