rdmsm4x - feature - Concur export packs - codex - FEAT2026092619 - RDExpense - 202609271405

2026-09-27 14:05:24 EDT; started 2026-09-27 13:51:30 EDT. Scope: rdmsm4x only.

Offline Concur export packs implemented, verified, merged and pushed.

RDExpense Concur export pack — FEAT-20260926-19

Status: done

Started: 2026-09-27 13:51:30 EDT. Completed: 2026-09-27 14:05:24 EDT. Host: rdmsm4x. Identity: codex/expenses-codex-0927. Delegated by expenses@rdmsm4x/expenses0926; parent EPIC-20260926-06.

Summary

Implemented DEC-20260926-11 Option B as rdexpense concur-pack. It reads local inventory.csv with a report-group and/or inclusive date-range selector, loads the RDExpenseProfile expense mapping, and emits CSV + XLSX, a matching source receipt for every row, merged receipt PDF and README with totals/category/policy summary. Only R001–R003 generated. Every per-expense file is below 5,000,000 bytes and its SHA-256 matches inventory. Claim amounts exactly match inventory and report_groups. Nothing submitted, emailed or uploaded to Concur. No credential, vault, xattr, rename/config-seam or app-shell work. No receipt bytes or live profile committed.

Commits

f7ac3f901260e257850fc81d3d6f1e2d4d96e22f — feat(export): add offline Concur packs (FEAT-20260926-19).
Started from 24f8594b33c776d24b322b0f97b49e2de2f34bc1 on current main.
Branch feat/rdexpense-concur-export-20260927 pushed non-force to fleet and backup.
Canonical main fast-forwarded to the same SHA; both remote main and feature refs read back at that SHA using git ls-remote. Both working trees clean.
PR https://github.com/richhdoty/RDReceipt/pull/2 confirmed MERGED.
FEAT-20260926-19 read back as resolved; lease released by resolution. Ticket closeout committed in issues repo as 602613b and pushed to fleet and backup.
Worktree retained clean at /Users/richh/dev/_worktrees/rdexpense-concur-20260927 with local build/test evidence. No source or recovery copies deleted.

Files: ConcurPackGenerator.swift, ConcurPackGeneratorTests.swift, CLI main.swift, docs/CONCUR-EXPORT.md and SESSION-STATE.md. All staged by explicit paths. Existing Agent trailer hook remained enabled (it intentionally truncates session to 8 chars).

Tests

nice -n 10 swift build --package-path Packages/RDExpenseKit --jobs 4: exit 0.
Final swift test: 583 discovered; 582 passed; 0 failed; 1 excluded. 574 Swift Testing (Vault 61, UI 107, Parser 54, OCR 55, E2E 248, Core 49), plus 8 XCTest. Nine new Concur tests passed. Existing testKeychainManagerGetOrCreate deliberately excluded for this unattended run.
Exact full-suite invocation: temp HOME and CFFIXED_USER_HOME, then nice -n 10 swift test --package-path Packages/RDExpenseKit --jobs 4 --skip testKeychainManagerGetOrCreate.
Fixture covers every row's matching PDF and byte identity, typed XLSX values, merged page count, mapping/override, strict >75/>90 thresholds, configured rules, CSV escaping and malformed input, date selection, changed/missing/oversized receipts, invalid claims, cap, duplicates and refusal to overwrite.
CLI invalid-option positive control exited 2. Existing ZeroNetworkTrap tests pass.
Independent verify_packs.py with cached/offline openpyxl+pypdf: all 48 rows, claim/receipt amounts, flags, source hashes and workbook cells match inventory. ZIP CRCs valid; typed dates/amounts; frozen headers/filter range; no formulas.
All merged PDFs rendered with Poppler: 149/149 pages, exit 0, stderr empty. Page counts: R001 12, R002 72, R003 65.
Xcode schemes not touched; xcodebuild not run. This is a package/CLI change.
git diff --check: exit 0. Scoped changed-source/docs secret-pattern scan found zero matches; this is a heuristic and does not claim a credential-store scan.

Evidence: build.log, targeted-tests.log, swift-test-final.log, discovered-tests.txt, pack-verification.json, pack-audit.log, pack-audit.stderr, pdf-reader-warnings.json, pdf-render-check/result.json in this handoff. The initial targeted test run had 8; the ninth was added before both full-suite runs.

Pack paths and totals

Each folder contains keying-sheet.csv, keying-sheet.xlsx, receipts/, receipts-merged.pdf and README.md.

/Users/richh/dev/finance/expenses/reports/R001/
/Users/richh/dev/finance/expenses/reports/R002/
/Users/richh/dev/finance/expenses/reports/R003/

Group	Items	Claim total USD	Category breakdown USD
R001	6	$860.00	phone/internet: $860.00
R002	19	$2942.62	phone/internet: $1920.00; meals: $807.95; ground transport/parking/tolls: $214.67
R003	23	$2937.66	ground transport/parking/tolls: $786.85; phone/internet: $1187.22; meals: $941.81; other: $21.78

Combined: 48 expenses, USD 6,740.28, consisting of 42 PDF receipts and 6 JPEGs. Largest individual receipt: 908,921 bytes. No receipt conversion/compression needed. First generation preserved at /Users/richh/dev/finance/expenses/reports/archive/concur-initial-20260927-140029/ before regenerating sheets with column widths, filtering and frozen headers.

Notes

Export construction is complete; these files support owner review and manual keying, not automatic bulk import or a representation that every expense is eligible.

48 rows lack a business purpose; 8 meals lack attendees/company. Fields are blank and flagged rather than invented.
9 ground transport/parking/tolls rows lack an exact profile mapping. The broad transportation key maps to Airfare, so that unsafe alias is deliberately not used. Set the correct type when keying, or add the exact inventory category key to an approved profile and regenerate to a new output folder.
42 rows older than 90 days; 40 receipts over 75 dollars. Threshold flags are calendar-day/literal flags; separate columns reflect configured profile rules.
Inventory warnings preserved: 30 phone/internet claims require wholly work-related use; 6 meals lack detected itemization; 1 source is confirmation-only over $75. A matching attachment does not satisfy these missing facts.
R003 merged review PDF is 5,839,035 bytes, above 5 MB. Attach individual receipts. Per-expense upload files all satisfy the limit.
pypdf emitted 42 warnings about zero-offset unused PDF objects in PDFKit's optional merged PDFs (2/38/2). Source/upload PDFs emitted zero warnings. Both PDF readers read all pages and Poppler rendered every merged page without error. Do not treat merged review documents as the required per-expense attachments.
Privacy: output folders 0700; output files 0600. Source files unchanged and only synthetic PDF data in tests. Offline validation used cached packages, no download.
Preflight returned the existing stale HIGH-mail backlog; explicit task delegation governed this run. No unrelated mail acknowledged and no bus messages sent.
Apple Notes is pending, per files-only headless scope. Durable changelog copies are in the standard local Claude and Codex changelog directories; no Notes action or interactive permission prompt attempted. Claude was not invoked.
No genuine design fork or money/deletion/communications gate arose. Retry on agy is unnecessary. Step 4 remains untouched for its owning agent.

Reproduce / rollback

See canonical docs/CONCUR-EXPORT.md for CLI syntax. Re-run verify_packs.py with uv run --offline --with openpyxl --with pypdf python for read-only pack verification. To regenerate, archive the existing pack first or use a fresh output directory; the CLI intentionally refuses overwrites. To roll back code, revert the feature commit on a new branch and run the package suite. Keep receipt/source archives.