semillero-special-hotel/.agents/plugins/remuneration-plugin/skills/reconciliation-auditing/SKILL.md

name	description
reconciliation-auditing	Checks row-level security boundaries, audits logs immutability, and reconciles PMS sales totals. Use this when running security tests, validating database queries, or auditing log security.

Reconciliation & Auditing

Defines guidelines for validating row-level security (RLS), verifying system audit log immutability, and running compliance tests on calculations.

Core Rationale

Financial systems must maintain zero-trust boundaries. Unauthorized data access or alteration of audit logs ruins regulatory compliance and system trustworthiness.

Execution Rules

1. Row-Level Security (RLS) Boundary Verification

• User-Context Checks: Test database access filters by emulating collaborator queries. Validate that users can only fetch records belonging to their assigned hotel site (e.g., leaders in Cartagena cannot view Bogota records).
• Test Assertion: Execute automated queries using the collaborator's database role or session context and assert that 0 records are returned for other sites.

2. Audit Log Immutability

• Append-Only Logs: Ensure that all logs written to the system are strictly append-only.
• Verification Rule: Attempt to update or delete a log entry in a testing context. Assert that the operation is rejected (either by database triggers, Prisma hooks, or PostgreSQL permissions).

3. Bilingual JSON formatting Checks

• Validation: Inspect the aiAuditNotes and flaggedReason fields in calculation outputs.
• Assertion:
  • The content MUST be a valid JSON object.
  • The object MUST contain both en and es keys.
  • The keys must have non-empty string values.
  • Example Assertion: expect(settlement.aiAuditNotes).toHaveProperty('en'); expect(settlement.aiAuditNotes).toHaveProperty('es');
• UI Rendering: Verify that the Next.js UI component renders the correct translation matching the active context locale.