# Requirements Checklist — Inventory Core (040)

## Scope

- [x] This checklist applies only to Spec 040 (Inventory Core).

## Constitution Gates

- [x] Inventory-first: inventory stores “last observed” only (no snapshot/backup side effects)
- [x] Read/write separation: no Intune write paths introduced
- [x] Single contract path to Graph: Graph access only via GraphClientInterface + contracts (if used)
- [x] Tenant isolation: all reads/writes tenant-scoped
- [x] Automation is idempotent & observable: run records + locks + stable error codes
- [x] Data minimization & safe logging: no secrets/tokens; DB run records are the source of truth

## Functional Requirements Coverage

- [x] FR-001 Inventory catalog exists (inventory_items)
- [x] FR-002 Stable upsert identity prevents duplicates
- [x] FR-003 Sync runs recorded (inventory_sync_runs)
- [x] FR-004 Tenant isolation enforced
- [x] FR-005 Deterministic selection_hash implemented and tested
- [x] FR-006 Sync does NOT create snapshots/backups (explicitly tested)
- [x] FR-007 Missing is derived (not persisted) relative to latestRun(tenant_id, selection_hash)
- [x] FR-008 meta_jsonb whitelist enforced; unknown keys dropped; never fails sync
- [x] FR-009 Locks/idempotency/observable failures implemented

## Non-Functional Requirements Coverage

- [x] NFR-001 Global + per-tenant concurrency limits (source + defaults + behavior defined)
- [x] NFR-002 Throttling resilience (429/503 backoff+jitter) with stable error codes
- [x] NFR-003 Deterministic behavior is testable (Pest)
- [x] NFR-004 Data minimization enforced (no raw payload storage)
- [x] NFR-005 Safe logging: no secrets/tokens; rely on run records not log parsing

## Tests (Pest)

- [x] Upsert prevents duplicates + updates last_seen fields
- [x] selection_hash determinism (order invariant)
- [x] Missing semantics per latest completed run and selection isolation
- [x] Low-confidence missing when latest run partial/failed/had_errors
- [x] meta whitelist drops unknown keys
- [x] Lock prevents overlapping runs for same tenant+selection
- [x] No snapshot/backup tables are written during sync
- [x] Error reporting uses stable error codes; no secrets/tokens persisted in run error details
