Auction window
Each worker loan request opens a 24-hour auction. The discovery poller scatters only requests it has not seen before, so a request is auctioned once; the win-detection poller then tracks the submitted proposal until it reaches an accepted state.
Reconciliation grain
Reconciliation runs at two grains:
- Escrituração — per contract. Each contract’s installment record is captured once per (competência, employer) snapshot.
- Repasse — per record. Each settlement record has an append-only, immutable identifier and is re-read on every tick across a sliding window of competências.
Credentials and rotation
Credentials rotate per tenant through the control plane. Registering a certificate or OAuth secret upserts or rotates the stored value; the per-tenant Dataprev client is cached and refreshed on rotation, so a rotation takes effect without a redeploy. Secrets are never returned by any read.
Idempotency and redelivery
Every record and settlement is keyed by its immutable subject, so at-least-once redelivery and restarts dedupe to a no-op downstream. Reprocessing the same record never double-counts a settlement.
Rate limiting
A shared outbound limiter caps Dataprev reads at 25 requests per second, split across the auction and reconciliation pollers, so neither can starve the other or exceed the rail’s tolerance.

