Skip to main content
Operate Lerian Consignado as a tenant-isolated rail, not as a stateless proxy. Commands, background reads, the outbox, and recovery state all participate in the contract.

​
Command and read surfaces

Use the authenticated HTTP API for client commands and queries. The API separates commands from reads and assigns every operation a tenant-scoped authorization action. Follow the operation’s idempotency requirements: retries after timeouts are expected and must reuse the same business identity. The OpenAPI contract describes the operations mounted on develop. A mounted operation is not proof that its Dataprev adapter is wired in a specific deployment. An unavailable rail integration returns 501 Not Implemented for that request instead of disappearing from the API. The Lender command stream remains available for the supported integration commands. It is not a replacement for the complete HTTP surface. See Consignado events.

​
Scheduled workers

The gateway runs eight scheduled loops. They share delayed first execution, stable per-replica staggering, non-overlapping passes, positive jitter, panic isolation, and graceful shutdown. Reconciliation, auction discovery, employment reporting, exclusion recovery, credential cleanup, and the outstanding-balance clock take their cadence from environment configuration. Bid payload cleanup and proposal witness are runtime-configurable through the Systemplane and take effect on the next delay.

​
Rail windows

Rail defaults and constraints on develop include:
  • a 24-hour loan-auction validity window supplied by Dataprev; the gateway does not configure it
  • a 72-hour portability-request lookback
  • 20 days to complete portability registration
  • 7 business days to reverse refinancing
  • a one-year auction-discovery lookback, with a five-minute clock-skew allowance
Treat these as rail constraints, not internal timeouts. Configure only settings exposed by the gateway when the Dataprev contract for the target environment requires a different value. Fixed values supplied by Dataprev, including the loan-auction validity window, cannot be changed in the gateway.

​
Throughput and pacing

Dataprev traffic is paced per tenant. The operator config provides the validated ceiling, while the throughput API records the tenant’s effective allocation. A stored value of 0 pauses rail traffic for that tenant. Auction fan-out has a separate budget and can never exceed the hard Dataprev ceiling.

​
Reconciliation safety

Bookkeeping and repasse reads are independent. One failing source must not suppress the other. Expected repasses can emit three states:
  • consignado.repasse.overdue: the expected movement is late
  • consignado.repasse.resolved: the movement arrived after an overdue alarm
  • consignado.repasse.unobserved: the gateway cannot currently prove presence or absence
Changing the configured employer-CNPJ scope while expectations remain open can strand those expectations under the old scope. Drain or migrate them in the same maintenance window.

​
Credentials and artifacts

Rotate the tenant certificate, OAuth secret, requester code, and portal URL through the credentials API. Rotation invalidates the cached Dataprev client without a redeploy. Local certificate-file variables are a development fallback, not a substitute for tenant custody in managed deployments. CCB and rail artifacts use the configured object store. Keep the bucket private and deliver content only through the authenticated artifact operation.

​
Failure behavior

The rail fails closed on missing tenant identity, missing credentials, Dataprev endpoints outside the deployment policy (HTTPS in managed deployments; loopback HTTP only in local/dev), unsupported managed-mode adapters, and malformed command identifiers. Business facts are written through the outbox and delivered at least once. Consumers must deduplicate by CloudEvent source and ID.