Operate Lerian Consignado — Dataprev

Operational guidance for Consignado: workers, idempotency, rail windows, throughput, reconciliation, credentials, and failure recovery.

Operate Lerian Consignado as a tenant-isolated rail, not as a stateless proxy. Commands, background reads, the outbox, and recovery state all participate in the contract.

Command and read surfaces

Use the authenticated HTTP API for client commands and queries. The API separates commands from reads and assigns every operation a tenant-scoped authorization action. Follow the operation’s idempotency requirements. Retries after timeouts are normal and must reuse the same business identity.

The OpenAPI contract describes the operations mounted on develop. A mounted operation is not proof that a specific deployment wires its Dataprev adapter. An unavailable rail integration returns 501 Not Implemented for that request instead of disappearing from the API.

The Lender command stream remains available for the supported integration commands. It is not a replacement for the complete HTTP surface. See Consignado events.

Scheduled workers

The gateway runs eleven scheduled loops. They share delayed first execution, stable per-replica staggering, non-overlapping passes, positive jitter, panic isolation, and graceful shutdown.

Worker	Purpose	Default cadence
Reconciliation poller	Reads bookkeeping and repasse data and evaluates expected settlement.	1 hour
Auction discovery poller	Lists open loan requests and starts pre-auction fan-out.	1 hour
Portability discovery poller	Lists open inbound portability requests and relays each one with its own expiry.	1 hour
Employment report poller	Reads employment termination data per tenant.	1 hour
Exclusion recovery	Drives admitted exclusions to a terminal state.	30 seconds
Averbação recovery	Converges averbações whose outcome was never established against the rail registry.	1 minute
Rail-command recovery	Converges refinancing, reversal, renegotiation, and portability-exclusion commands whose outcome was never established.	1 minute
Credential cleanup	Expires stale tenant credentials under a lease.	30 seconds
Bid payload cleanup	Removes retained bid payloads after their retention window.	1 minute
Proposal witness	Confirms accepted proposal terms against the durable client bid.	5 seconds
Outstanding-balance clock	Evaluates missed-installment and month-end balance obligations.	24 hours

Nine of the eleven take their cadence from environment configuration and need a restart to change. Bid payload cleanup and proposal witness are the two runtime-configurable ones: they read their cadence through the Systemplane and take effect on the next delay.

Averbação recovery and rail-command recovery exist because a rail command can leave its outcome unestablished: the process died mid-call, or the rail never answered. They converge that state against the rail’s own registry instead of losing it. Both loops are off by default. Enable them in any deployment that submits averbações or rail commands.

Rail windows

Rail defaults and constraints on develop include:

• a 24-hour loan-auction validity window that Dataprev supplies and the gateway does not configure
• a 72-hour portability-request lookback
• 20 days to complete portability registration
• 7 business days to reverse refinancing
• a one-year auction-discovery lookback, with a five-minute clock-skew allowance

Treat these as rail constraints, not internal timeouts. Configure only settings exposed by the gateway when the Dataprev contract for the target environment requires a different value. The gateway does not let you change fixed values that Dataprev supplies, including the loan-auction validity window.

Throughput and pacing

Dataprev traffic is paced per tenant. The operator config provides the validated ceiling, while the throughput API records the tenant’s effective allocation. A stored value of 0 pauses rail traffic for that tenant. Auction fan-out has a separate budget and can never exceed the hard Dataprev ceiling.

Reconciliation safety

Bookkeeping and repasse reads are independent. One failing source must not suppress the other. Expected repasses can emit three states:

• consignado.repasse.overdue: the expected movement is late
• consignado.repasse.resolved: the movement arrived after an overdue alarm
• consignado.repasse.unobserved: the gateway cannot currently prove presence or absence

Changing the configured employer-CNPJ scope while expectations remain open can strand those expectations under the old scope. Drain or migrate them in the same maintenance window.

Credentials and artifacts

Rotate the tenant certificate, OAuth secret, requester code, and portal URL through the credentials API. Rotation invalidates the cached Dataprev client without a redeploy. Local certificate-file variables are a development fallback, not a substitute for tenant custody in managed deployments.

Registering a worker portal base URL is optional. A tenant that has one gets it injected as the type 0 formalization contact of every bid proposal. A tenant that has none submits bids that carry only the client’s own contacts. Each proposal must then carry at least one contact. A single bid can also override the tenant’s registered portal for that submission alone. That is how one institution that originates through several partners formalizes each bid on the originating partner’s portal.

CCB and rail artifacts use the configured object store. Keep the bucket private and deliver content only through the authenticated artifact operation.

Failure behavior

The rail fails closed on missing tenant identity, missing credentials, Dataprev endpoints outside the deployment policy (HTTPS in managed deployments, loopback HTTP only in local/dev), unsupported managed-mode adapters, and malformed command identifiers. Business facts are written through the outbox and delivered at least once. Consumers must deduplicate by CloudEvent source and ID.