# Zoho Receipts Pipeline — Acquisition Brief

**Status:** Active
**Last updated:** 2026-06-13
**Audience:** Buyer-side due diligence (CFO, technical TDD, legal). Also: CBB internal use as a one-page narrative for any acquisition conversation.
**Owns:** Synthesis of as-built state, costs, controls, and risks framed for an external reader.
**Does NOT own:** Source-of-truth detail — see linked docs.

---

## 1. One-paragraph summary

Cold Bore Ballistics LLC's accounting is run on Zoho Books US (Standard plan, org ID `927659458`, account created 2026-06-12). Vendor receipts arrive at a single dedicated shared mailbox (`finance@coldboreballisticsllc.com`) and are processed by a fully automated, infrastructure-as-code Azure pipeline running in North Central US at a marginal cost of under $1/month above the existing Zoho subscription. The pipeline preserves every source artifact in OneDrive, renders each receipt to PDF for attachment, filters zero-dollar receipts (free trials, $0 statements) out of Zoho entirely while still preserving the source, attributes every expense to a product line (CBB Corporate vs. ScopeDOPE) at the journal-line level, backs up Zoho data to immutable blob storage with 7-year retention, runs weekly integrity checks, and auto-populates the CBB Asset Register SharePoint list via a strictly-scoped separate service. There are no hand-built resources, no shared credentials, and no human-in-the-loop steps for healthy traffic.

## 2. What a buyer gets

**Accounting system:** Zoho Books, US edition, $20/mo. Standard small-business accounting feature set; bank feeds connected; clean chart of accounts; product-line attribution at the account-name level (doubled-COA pattern). Validated against the live org 2026-06-13.

**Receipts corpus:** Every receipt — manual-entry historical, automated-import current — preserved as both:
- The original artifact (PDF, EML, etc.) plus a rendered canonical PDF, under `OneDrive/CBB_Corporate/03_-_Confidential/Financial_Records/Receipts/_raw/<YYYY>/<MM>/<message-id>/`
- A normalized Markdown summary under `Receipts/CBB/<YYYY>/<MM>/` or `Receipts/ScopeDOPE/<YYYY>/<MM>/`

The canonical PDF is what gets attached to the Zoho expense; the Markdown is the human-readable index in OneDrive.

**Automation pipeline:** Five Azure Container Apps Jobs across two services — the receipts pipeline (ingest with PDF rendering, backup-nightly, backup-weekly, consistency-check) and the separate Asset Register service (event-driven SharePoint writer) — managed via Terraform in `infra/cbb-infra`, with zero hand-built resources.

**Asset Register integration:** Asset-eligible expense line items automatically populate the CBB Asset Register SharePoint list via a strictly-scoped separate service. The receipts pipeline does not write to SharePoint; it emits events to an Azure Storage Queue that the asset service consumes. Two independent managed identities, two independent Key Vaults, two independent permission grants — minimum-scope isolation by design.

**Zero-dollar receipt handling:** Free trials and $0 statement-only receipts are detected at the validation stage and filtered out of Zoho entirely (Zoho rejects $0.00 expenses with `code 5015`). The source artifact is still preserved in `_raw/`, a canonical PDF is still rendered for the audit trail, and a `zero_dollar_receipt` notification fires so the operator can schedule a calendar reminder for the convert date. No synthetic expense records, no fake "Free Trial" bucket accounts.

**Data backup:** Nightly JSON-per-module + weekly full-org exports to Azure Blob Storage in North Central US, lifecycle-tiered Hot → Cool → Cold → Archive, with 7-year retention.

**Documentation:** Complete domain documentation package — Architecture Reference, Operating Runbook, Rebuild Guide, Integration Guide, Recommendations, this Brief, plus the Cost-Impact Analysis required by the cost-approval gate, plus the script references in `cbb-utils/zoho/README.md` and `cbb-utils/asset-register/README.md`.

## 3. Cost transparency

| Line item | Monthly cost | Notes |
|---|---|---|
| Zoho Books Standard | $20.00 | Year-over-year stable. |
| Azure receipts pipeline (4 jobs, storage, KV, queue, logs) | ~$0.32 | Within Container Apps free grant; storage and KV are negligible. PDF rendering folded in. |
| Azure asset-register service (1 job, KV, logs) | ~$0.06 | Separate service, separate identity, separate Key Vault. |
| Mailbox license (`finance@`) | $0.00 | Shared mailbox, unlicensed. |
| PDF rendering library (`weasyprint`) | $0.00 | Open-source, BSD-licensed, runs in the existing container. |
| **Total monthly accounting infrastructure** | **~$20.38** | |

**Worst-case ceiling at 10× projected volume:** ~$24/mo (see Cost-Impact Analysis §9). Hard ceiling for approval: $5/mo new Azure spend.

**Cost separation by product line:** Achieved via doubled chart-of-accounts (`<Account> - CBB` vs. `<Account> - ScopeDOPE`). Filterable P&L per product line is supported natively in Zoho Books Standard. Combined columnar P&L requires either (a) the planned automated combined-export job (Recommendations R-2) or (b) upgrade to Premium tier ($70/mo) for native reporting tags. Both paths are documented and budgeted.

## 4. Controls and identity model

**No shared credentials.** Every Azure resource, managed identity, Zoho Self Client, and Graph permission grant is scoped to a single purpose. Per CLAUDE.md "Credential Sharing — VERBOTEN — MANDATORY" and "Service Identity Ownership — MANDATORY" — these rules are written into the project's authoritative configuration and enforced by the pipeline design.

**Mailbox access scoping.** The receipts pipeline's managed identity holds Microsoft Graph `Mail.ReadWrite` at the application level, but is restricted to **only** the `finance@coldboreballisticsllc.com` mailbox via an Exchange Online `ApplicationAccessPolicy`. The grant has been tested for both Granted (target mailbox) and Denied (any other mailbox) responses.

**SharePoint access scoping.** The asset-register service's managed identity holds Graph `Sites.Selected` (which grants nothing on its own) plus a per-site write permission scoped to the CBB Asset Register SharePoint site only. Tested for write success on the target site and 403 on any other site. The receipts pipeline holds zero SharePoint permissions.

**Key Vault access.** Zoho credentials (refresh token, client ID/secret, organization ID) live exclusively in `kv-cbb-receipts-prod` under Azure RBAC. SharePoint site/list IDs live exclusively in `kv-cbb-asset-register-prod`. Neither service's managed identity can read the other's vault. Rotation is a separate, human-owner operation.

**Storage access.** Backup blobs are written by the receipts pipeline's managed identities (`Storage Blob Data Contributor` scoped to specific containers, not the storage account). Read access for any downstream consumer requires a separate RBAC role assignment documented in the Architecture Reference. The asset event queue is producer-only for the receipts pipeline (`Storage Queue Data Message Sender`) and consumer-only for the asset service (`Storage Queue Data Message Processor`).

**No human runtime path.** The pipeline runs end-to-end without human credentials. Operator activity (rotation, troubleshooting) is the only human path, attributed to the named owner.

## 5. Operational maturity

**Cadence:** Ingest hourly; nightly backup; weekly full backup (Sunday); weekly consistency check (Tuesday — chosen to avoid Monday holidays). Asset Register writes are event-driven within seconds of receipt ingestion.

**Documentation completeness:** Per CLAUDE.md "Operational Domain Documentation Structure — MANDATORY" requirement of five document types plus optional Recommendations and Integration Guide, all seven are present, plus an eighth Cost-Impact Analysis required by the cost-approval gate, plus two script-reference READMEs in `cbb-utils/` (one per service). No critical knowledge lives only in one person's head.

**Disaster recovery:** A from-scratch rebuild is documented step-by-step in the Rebuild Guide and exercised at each significant change. The rebuild time-to-recovery target is under 4 hours of operator time.

**Backup verifiability:** The Operating Runbook includes a quarterly restore-test procedure §8. Backup data is in Azure Blob Storage LRS with Storage soft-delete and versioning available (configurable per `cbb-infra` Terraform module).

**Audit trail:** Every pipeline action is logged to `log-cbb-receipts-prod` Log Analytics workspace. Every receipt has its raw source preserved in OneDrive at `_raw/<YYYY>/<MM>/<msg-id>/` plus a rendered canonical PDF. Every Zoho expense has the canonical PDF attached. Every Asset Register row has a stable DedupKey traceable to the source receipt. Reconstruction of any decision from journal entry back to source email is possible. **Zero-dollar receipts still leave a full audit trail in `_raw/` and `canonical.pdf` even though no Zoho expense is created.**

## 6. Known constraints and risks

These are surfaced openly per the acquisition-lens principle that omissions cost more than disclosures.

| Item | Status | Mitigation |
|---|---|---|
| Side-by-side combined P&L not native on Zoho Standard | Documented limitation (R-1) | Filterable per-line P&L works natively; combined export job planned (R-2); Premium upgrade path documented |
| Historical receipt records the founder's personal PayPal Gmail as a funding source for one GitHub charge | Resolved (R-12) | GitHub PayPal source migrated to CBB-owned account on `finance@`; historical receipt left in place as documented legacy fact |
| Workstation-as-SOT for some adjacent CBB systems (not this pipeline) | Disclosed in CLAUDE.md "mac001 — Standing SOT for Everything CBB" section as acquisition-flagged stopgap | This pipeline is fully Azure-native and not workstation-dependent |
| 27 historical receipts (pre-pipeline) lack canonical PDFs alongside their Markdown summaries | Documented (R-17) | Backfill PDFs from `finance@` via Graph as part of the backlog import; defer until pipeline + Graph permission exist |
| Some vendors (Anthropic confirmed) send receipts to "the account-holder email" regardless of any billing-email setting | Resolved (R-11) | Vendor audit completed; account-holder emails migrated to `finance@` |
| Zoho Books Standard caps API at 2,000 calls/day | Within projected volume | Monitored by consistency-check job; throttle alert path documented in Operating Runbook §6 |
| Zoho rejects $0.00 expenses (`code 5015`) | Empirically verified 2026-06-13; design handles it | Zero-dollar receipts filtered at ingestion; not posted to Zoho; tracking mechanism for free trials is R-15 (open) |
| Zoho rejects Markdown/text receipt attachments (`code 40`) | Empirically verified 2026-06-13; design handles it | Canonical receipt is always PDF (R-16); Markdown is the OneDrive index, not the Zoho attachment |
| Single-owner administrative dependency | Documented | Documentation package designed to allow a buyer's team to operate without the founder; managed identities + Azure RBAC mean access can be re-assigned without re-provisioning |
| Asset Register service is append-only in v1.0 (no UPDATE / DELETE) | Documented (R-13) | Manual correction via SharePoint UI is documented; update support deferred to v1.2+ |
| Free-trial tracking mechanism not yet decided | Open (R-15) | Stopgap: zero-dollar receipt notification with operator-driven manual disposition; decision deferred until volume justifies a permanent mechanism |

No items above are blocking for acquisition. All are written down rather than hidden.

## 7. What's in vs. out of sc