/sap-fi-post

name: sap-fi-post
description: |
  Posts FI accounting documents (FB01 G/L, FB60 vendor invoice, FB70 customer
  invoice) from a tab-delimited definition file via BAPI_ACC_DOCUMENT_* RFCs — for
  standalone test data or the settlement tail of O2C/P2P scenarios. A mandatory
  server-side dry-run (BAPI_ACC_DOCUMENT_CHECK) surfaces every posting error
  (account blocked, period closed, unbalanced, substitution) as structured BAPIRET2
  BEFORE anything is committed; then a confirm-gated POST + BAPI_TRANSACTION_COMMIT,
  verified by an authoritative BKPF/BSEG re-read (never trusted from the BAPI RETURN
  alone). The skill auto-generates the CURRENCYAMOUNT / ITEMNO cross-references from
  each item's AMOUNT (positive=debit, negative=credit), defusing the top semantic
  trap. Pure RFC (all FMs remote-enabled on S/4HANA 1909 + ECC 6) — no GUI, no Z
  objects, no transports. Appends a created-document manifest for cleanup tooling.
  Prerequisites: SAP profile via /sap-login (RFC) with FI posting authorization
  (F_BKPF_BUK); SAP NCo 3.1 (32-bit). Postings the BAPI can't express are routed to
  /sap-call-bdc by recommendation, never auto-run.
argument-hint: "post <def-file> | check <def-file> | show <BELNR> <BUKRS> <GJAHR> | template <gl|fb60|fb70> [<out-file>]"

SAP FI Posting Skill

You post FI documents from a definition file — **dry-run first, confirm, post, verify by re-read**. You never trust the BAPI RETURN alone, and you never create a document the CHECK did not first validate.

Task: $ARGUMENTS

---

Shared Resources

| File | Token / call | Purpose | |---|---|---| | `<SAP_DEV_CORE_SHARED_DIR>/rules/safety_policy.md` + `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_safety_gate.ps1` | Rule 0 | Environment guard — Step 5 runs `-Action assert` before the write | | `<SKILL_DIR>/references/sap_fi_post_rfc.ps1` | `-Action check\|post\|show\|preflight -DefFile <f>` | BAPI backend (check/post/verify) | | `<SKILL_DIR>/references/fi_post_def_grammar.md` | read by `template` | Definition-file grammar + 3 template shapes | | `<SAP_DEV_CORE_SHARED_DIR>/scripts/sap_artifact_lib.ps1` | dot-sourced | Manifest + evidence-pack registration | | `/sap-login` | sub-skill | Pinned RFC profile | | `/sap-call-bdc` | sub-skill | Recommended fallback for BAPI-inexpressible postings (never auto-run) |

---

Step 0 — Directories + Logging

Resolve `work_dir` + `{RUN_TEMP}` (canonical one-liner — `sap_connection_lib.ps1` is dot-sourced there — with `Write-Output ('RUN_TEMP=' + (Get-SapRunTemp))` appended). `{RUN_TEMP}` = the per-run scratch dir holding the log state file; mint it once here and reuse (re-minting breaks the `-Action end` state-file lookup). Start logging (`sap_log_helper.ps1`, state `{RUN_TEMP}\sap_fi_post_run.json`). **No GUI session needed** — pure RFC off the pinned profile.

Step 1 — Parse & Dispatch

Modes: `post` / `check` / `show` / `template` (`reverse` → v2, refuse with the roadmap note). `template <gl|fb60|fb70> [<out>]` copies the matching shape from `fi_post_def_grammar.md` into the target file and STOPs (pure local, no SAP).

Step 2 — RFC Profile

Pinned RFC profile required (`/sap-login`). Say explicitly that no GUI session is used.

Step 3 — Preflight (optional, best-effort)

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "<SKILL_DIR>\references\sap_fi_post_rfc.ps1" -Action preflight -DefFile "<def>" -SharedDir "<SAP_DEV_CORE_SHARED_DIR>"

Renders `FIPOST: preflight comp_code=.. exists=YES|NO`, `gl_account/vendor/customer in_bukrs=YES|NO` — turns opaque CHECK errors into "account X not created in BUKRS Y". A failed preflight is a hint, never a blocker.

Step 4 — Dry-run (CHECK) — always, for both `check` and `post`

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "<SKILL_DIR>\references\sap_fi_post_rfc.ps1" -Action check -DefFile "<def>" -SharedDir "<SAP_DEV_CORE_SHARED_DIR>"

The backend does the local validation (balance=0 per currency, unique ITEMNO, required HEADER fields) THEN `BAPI_ACC_DOCUMENT_CHECK` (zero persistence). Read the `BAPIRET:` lines + `FIPOST: check ... verdict=CLEAN|ERRORS` + STATUS.

• `INPUT_INVALID` / `UNBALANCED` → show the offending lines, STOP.
• `check` mode → report the verdict + BAPIRET2 table, log end, STOP (no confirm needed

— CHECK persists nothing).

• `post` mode with `verdict=ERRORS` → STOP (`FIPOST_CHECK_FAILED`), explain the

messages and propose fixes; if the failure is BAPI-inexpressible (one-time account, special G/L), recommend `/sap-call-bdc` with an FB01 recording — **do not auto-run it**.

Step 5 — Confirm Gate (`post` only, mandatory)

**Rule 0 first** (`safety_policy.md`; `post` only — `check`/`show`/`template` skip it): `powershell -NoProfile -ExecutionPolicy Bypass -File "<SAP_DEV_CORE_SHARED_DIR>\scripts\sap_safety_gate.ps1" -Action assert -Skill sap-fi-post` — `SAFETY: ALLOW` (0) proceed; `TYPED_CONFIRM_REQUIRED` (3) -> the operator types the shown `PROD <SID>/<CLIENT>` token, re-run with `-ConfirmationText '<their verbatim answer>'`, proceed only on `ALLOW_CONFIRMED`; `REFUSED class=<C>` (1) / `ERROR` (2) -> **STOP**, end `FAILED` with `-ErrorClass <C>`, relay the remediation lines — never bypass or work around it manually. The typed `POST` escalation and yes/no gate below still apply after ALLOW/ALLOW_CONFIRMED.

State it plainly and get a yes/no:

> I will POST a `<DOC_TYPE>` document in `<SID>/<CLIENT>`, company code `<BUKRS>`, > posting date `<PSTNG_DATE>`, `<n>` line items, total debit `<amount> <CURRENCY>`. > This writes a real FI document. Proceed? (yes/no)

On a **production** client (T000 `CCCATEGORY=P`) escalate to a typed `POST`. Decline → log `SKIPPED`, STOP (zero SAP writes).

Step 6 — POST (verified)

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe -ExecutionPolicy Bypass -File "<SKILL_DIR>\references\sap_fi_post_rfc.ps1" -Action post -DefFile "<def>" -SharedDir "<SAP_DEV_