Operate Lerian Consignado — Dataprev

Operate Lerian Consignado as a tenant-isolated rail, not as a stateless proxy. Commands, background reads, the outbox, and recovery state all participate in the contract.

Command and read surfaces

Use the authenticated HTTP API for client commands and queries. The API separates commands from reads. Each client operation requires an authorization action and runs in the caller’s tenant. Follow the operation’s idempotency requirements. Retries after timeouts are normal and must reuse the same business identity. A mounted operation is not proof that a specific deployment wires its Dataprev adapter. An unavailable rail integration returns 501 Not Implemented for that request instead of disappearing from the API. The capabilities operation reports which operation families your deployment reaches. The Lender command stream remains available for the supported integration commands. It is not a replacement for the complete HTTP surface. See Consignado events.

Scheduled workers

The gateway runs fourteen scheduled loops. They share delayed first execution, stable per-replica staggering, panic isolation, and graceful shutdown. Every loop except the auction fast lane also runs non-overlapping passes with positive jitter.

Worker	Purpose	Default cadence
Reconciliation poller	Reads bookkeeping and repasse data and evaluates expected settlement.	1 hour
Auction discovery poller	Lists open loan requests and publishes each new one.	1 hour
Auction fast lane	Lists the last 60 seconds of open loan requests and publishes each new one. Off by default.	1 second
Portability discovery poller	Lists open inbound portability requests and relays each one with its own expiry.	1 hour
Employment report poller	Reads employment termination data per tenant.	1 hour
Exclusion recovery	Drives admitted exclusions to a terminal state.	30 seconds
Averbação recovery	Converges averbações whose outcome was never established against the rail registry.	1 minute
Rail-command recovery	Converges refinancing, reversal, renegotiation, and portability-exclusion commands whose outcome was never established.	1 minute
Bid reconduction	Resends a bid whose rail answer was lost, under its original proposal number.	15 seconds
Credential cleanup	Expires stale tenant credentials under a lease.	30 seconds
Bid payload cleanup	Removes retained bid payloads after their retention window.	1 minute
Proposal witness	Confirms accepted proposal terms against the durable client bid.	5 seconds
Outstanding-balance clock	Evaluates missed-installment and month-end balance obligations.	24 hours
Outstanding-balance resend	Sends the outstanding-balance reports that a competência turnover held back.	1 minute

Eleven of the fourteen take their cadence from environment configuration and need a restart to change. The auction fast lane, bid payload cleanup, and proposal witness read their cadence through the Systemplane and take effect on the next delay. Averbação recovery and rail-command recovery exist because a rail command can leave its outcome unestablished: the process died mid-call, or the rail never answered. They converge that state against the rail’s own registry instead of losing it. Bid reconduction resends a bid whose rail answer was lost, under its original proposal number, and each resend uses the tenant’s rail budget. The three loops are off by default. Enable the two recovery loops in any deployment that submits averbações or rail commands. Once a month, Dataprev closes for its competência turnover and refuses requests. When a background loop meets that refusal, the loops that poll Dataprev for that tenant pause for 5 minutes, then 15, then 30 for each later refusal. Client requests still reach Dataprev and receive its refusal. The scheduled-jobs report shows paused_until for a paused loop. In multi-tenant mode, the gateway publishes consignado.rail.paused once per turnover and consignado.rail.resumed when Dataprev answers again.

Rail windows

Rail defaults and constraints include:

a 24-hour loan-auction validity window that Dataprev supplies and the gateway does not configure
a 72-hour portability-request lookback
20 calendar days from the origin exclusion to register an inbound portability, when the request names the exclusion date
7 business days to reverse refinancing
a 48-hour auction-discovery window, with a five-minute clock-skew allowance

Treat these as rail constraints, not internal timeouts. Configure only settings exposed by the gateway when the Dataprev contract for the target environment requires a different value. The gateway does not let you change fixed values that Dataprev supplies, including the loan-auction validity window.

Throughput and pacing

Dataprev traffic is paced per tenant. The throughput API sets the tenant’s rate, from 0 to 25 requests per second, and no setting raises that ceiling. A tenant with no stored rate runs at 3 requests per second. A stored value of 0 pauses rail traffic for that tenant.

Reconciliation safety

Bookkeeping and repasse reads are independent. One failing source must not suppress the other. Expected repasses can emit three states:

consignado.repasse.overdue: the expected movement is late
consignado.repasse.resolved: the movement arrived after an overdue alarm
consignado.repasse.unobserved: the gateway cannot currently prove presence or absence

Changing the configured employer-CNPJ scope while expectations remain open can strand those expectations under the old scope. Drain or migrate them in the same maintenance window. The repasse-expectation list counts open expectations by employer scope and marks each scope this deployment no longer reads. Read its freshness state first: an empty list proves nothing unless the state is fresh.

Credentials and artifacts

Rotate the tenant certificate, OAuth secret, requester code, and portal URL through the credentials API. Local certificate-file variables are a development fallback, not a substitute for tenant custody in managed deployments. Registering a worker portal base URL is optional, for the tenant and for each originador. See Discover auctions and submit proposals for the order in which the gateway selects a portal. CCB and rail artifacts use the configured object store. Keep the bucket private and deliver content only through the authenticated artifact operation. The averbação and the CCB attachment accept a signed CCB whose base64 text is up to 8 MiB. A contract correction accepts a corrected resource whose base64 text is up to 8 MiB.

Failure behavior

The rail fails closed on missing tenant identity, malformed command identifiers, and Dataprev endpoints outside the deployment policy: HTTPS in a managed deployment, loopback HTTP only otherwise. A managed deployment also fails closed on missing credentials and on unsupported adapters. Business facts are written through the outbox and delivered at least once. Consumers must deduplicate by CloudEvent source and ID.

​Command and read surfaces

​Scheduled workers

​Rail windows

​Throughput and pacing

​Reconciliation safety

​Credentials and artifacts

​Failure behavior