API / SDK
When the system can communicate server-to-server, we use API v1 or the SDK while keeping sensitive fiscal logic outside the legacy application.
VERIFACTU FOR LEGACY SOFTWARE AND POSLocal Agent available
Adapt legacy software without replacing it just because it lacks a modern API.
Kairoseth Fiscal selects the route according to actual capabilities: API, CSV/XLSX, Local Agent, read-only database, watch-folder or SFTP. AEAT logic and certificates remain outside the source system.
AVAILABLE ROUTES
We select the least invasive adapter that can read invoicing facts.
The approach does not depend on a specific ERP brand. Diagnosis checks capabilities while every ingress route uses the same fiscal core.
CSV / XLSX
When it exports files, the import flow supports inspection, mapping, preflight, explicit confirmation and durable batches without requiring internal changes.
Local Agent
For local or network software without a modern integration surface, the agent uses outbound HTTPS, a durable queue, checkpoints and recovery without opening an inbound HTTP listener.
Read-only database
PostgreSQL, MySQL/MariaDB and SQL Server support read-only extraction using one SELECT query, SELECT-only credentials and a server-side MappingProfile.
Watch folder
The agent can monitor CSV/XLSX, identify content revisions by hash, turn rows into durable jobs and move the local file only after the batch finishes.
Read-only SFTP
SFTP ingress uses pinned host keys, non-destructive downloads and durable receipts; it never renames, deletes or uploads files on the customer's server.
LOCAL SAFETY
The agent transports data; it does not inherit fiscal authority.
Read-only, outbound-only, idempotency and fail-closed behavior are part of the design rather than optional recommendations.
Read-only by default
Generic database extraction requires a verified driver, exactly one SELECT statement and production credentials provisioned with SELECT-only permission. Runtime guards are defense in depth, not a substitute for database permissions.
No inbound ports
Local Agent opens no HTTP listener. Communication to Kairoseth/Puente is outbound over HTTPS; insecure HTTP is restricted to explicit localhost development.
Certificate remains server-side
The agent does not accept AEAT certificates, PFX files, passphrases or private keys as valid configuration. That authority remains in the secure fiscal runtime.
Durable idempotency
Each operation keeps an identity derived from sourceId + sourceKey. Restarts, lost responses or redelivery must not create a second fiscal operation.
Issuance disabled by default
Watch-folder, database and other sources fail closed until issueEnabled=true is explicitly enabled after diagnosis and testing.
Controlled recovery and rollback
The local queue uses SQLite, leases and checkpoints. Upgrades verify state and backup before activating new code; code rollback never restores the database automatically.
CURRENT EVIDENCE
Compatibility is communicated using the matrix we actually execute.
Current CI evidence includes the databases and platforms listed below. A version outside this matrix can be evaluated by capability, but is not advertised as tested until equivalent evidence exists.
PostgreSQL 16
MySQL 8.4
MariaDB 11.4
SQL Server 2022
Linux x64
Windows x64
macOS Intel x64
macOS ARM64
FAQ
Legacy software and VeriFactu
Can I adapt old software that has no API?
Yes, when invoicing facts can be obtained through a supported capability. Kairoseth Fiscal provides Local Agent, read-only database sources, watch-folder, SFTP and CSV/XLSX in addition to API/webhooks. Diagnosis selects the least invasive route.
Does Kairoseth Fiscal write into my ERP database?
Not through the generic database adapter. The strategy is read-only and requires SELECT-only credentials. Each extracted row becomes an agent job while fiscal authority stays on the server.
Which databases are tested?
Current CI evidence covers PostgreSQL 16, MySQL 8.4, MariaDB 11.4 and SQL Server 2022. Other versions require capability and evidence review before they are declared supported.
Do I need to open a port on the local PC or server?
No. Local Agent uses outbound-only communication to Kairoseth/Puente and does not host an inbound HTTP listener.
Does the agent store the AEAT certificate?
No. Certificates, private keys and passphrases remain server-side. The agent moves source data, queue and operational state but never becomes the fiscal engine.
Does SFTP modify files on the source server?
No. SFTP ingress is non-destructive: it lists and downloads eligible files, verifies host keys and fingerprints and keeps local receipts; it never renames, deletes or uploads files on the source.
Does installing Local Agent enable AEAT production?
No. Installation, doctor, read-only extraction, mapping and TEST can be completed with issuance disabled. AEAT production keeps a separate technical and regulatory gate with explicit authorization.
PRODUCTION IS SEPARATE
Installing Local Agent does not enable AEAT production.
We can install, run doctor, validate read-only extraction, mapping and TEST with issuance disabled. Fiscal go-live requires its own certificate, configuration, regulatory and explicit-authorization gate.