# Specification — Echo Inventory Pulse

**Spec ID:** SPEC-EIP-001  
**Status:** ACCEPTED  
**Definition of done:** machine-checkable

## Users & constraints

- **Primary user:** warehouse ops dashboard (server-to-server).
- **Latency budget:** p95 GET < 120 ms on a warm instance.
- **Stack:** Python 3.12, FastAPI, SQLite (demo), no external network at runtime.
- **Auth:** bearer token for write paths; public health endpoint unauthenticated.
- **Out of scope:** multi-tenant RBAC, billing, warehouse hardware drivers.

## Functional requirements

1. `GET /health` returns process liveness and schema version.
2. `GET /inventory/{sku}` returns on-hand, reserved, available, and last cycle-count timestamp.
3. `POST /inventory/{sku}/adjust` applies a signed delta with idempotency key; rejects negative available.
4. OpenAPI 3.1 document shipped with the package.
5. Acceptance suite must pass in CI with zero skips.

## Non-functional requirements

- Typed models end-to-end; no untyped `dict` at API boundary.
- Structured JSON logs; no secrets in log lines.
- Security gate: no high/critical findings; dependency audit clean for known CVEs in lockfile.

## Acceptance criteria (machine-checkable)

- [ ] 12/12 acceptance tests green
- [ ] OpenAPI validates against served routes
- [ ] Security gate severity max = medium (info/low only preferred)
- [ ] Build receipt signature verifies with published sample key