Release Access v0.1.20 configuration package context

src/govoplan_access/__init__.py

@@ -1,3 +1,3 @@
 """GovOPlaN access platform module."""
 
-__version__ = "0.1.19"
+__version__ = "0.1.20"

src/govoplan_access/backend/api/v1/admin_schemas.py

@@ -850,6 +850,7 @@ class ConfigurationPackageApplyResponse(BaseModel):
     diagnostics: list[dict[str, Any]] = Field(default_factory=list)
     created_refs: dict[str, str] = Field(default_factory=dict)
     updated_refs: dict[str, str] = Field(default_factory=dict)
+    rollback: dict[str, Any] | None = None
 
 
 class ConfigurationPackageExportRequest(BaseModel):
@@ -865,6 +866,7 @@ class ConfigurationPackageExportResponse(BaseModel):
     fragments: list[dict[str, Any]] = Field(default_factory=list)
     data_requirements: list[dict[str, Any]] = Field(default_factory=list)
     diagnostics: list[dict[str, Any]] = Field(default_factory=list)
+    provenance: dict[str, Any] | None = None
 
 
 class SystemSettingsItem(BaseModel):

src/govoplan_access/backend/api/v1/routes.py

@@ -1036,6 +1036,7 @@ def configuration_package_apply_endpoint(
         diagnostics=[item.to_dict() for item in result.diagnostics],
         created_refs=dict(result.created_refs),
         updated_refs=dict(result.updated_refs),
+        rollback=result.rollback.to_dict() if result.rollback is not None else None,
     )
 
 
@@ -1056,6 +1057,7 @@ def configuration_package_export_endpoint(
         fragments=[item.to_dict() for item in result.fragments],
         data_requirements=[item.to_dict() for item in result.data_requirements],
         diagnostics=[item.to_dict() for item in result.diagnostics],
+        provenance=result.provenance.to_dict() if result.provenance is not None else None,
     )
 
 

src/govoplan_access/backend/manifest.py

@@ -378,6 +378,63 @@ ACCESS_DOCUMENTATION: tuple[DocumentationTopic, ...] = (
             "help_contexts": ["access.resource-explanation.subject"],
         },
     ),
+    DocumentationTopic(
+        id="access.workflow.configuration-packages",
+        title="Preflight and apply configuration packages",
+        summary="Access exposes the governed admin API that resolves module providers, verifies operator authority, and records package apply evidence.",
+        body=(
+            "A configuration-package dry-run resolves installed module providers and reports missing modules, capabilities, deployment data, conflicts, and policy blockers before any provider is invoked for apply. Portable $data references are accepted only when the package declares the corresponding requirement; their supplied values are resolved in memory and are not added to export provenance. Apply remains subject to the configuration-change approval policy. Providers may commit independently, so processing stops at the first apply or health blocker and the response distinguishes blocked-before-apply, no-op, snapshot rollback, and partial-apply recovery states. Export invokes only selected module providers, preserves their secret redaction rules, and adds bounded provenance without serializing supplied credentials."
+        ),
+        layer="configured",
+        documentation_types=("admin",),
+        audience=("system_admin", "operator", "security_reviewer"),
+        order=28,
+        conditions=(
+            DocumentationCondition(
+                required_modules=("access", "admin"),
+                any_scopes=(
+                    "admin:settings:read",
+                    "admin:settings:write",
+                    "system:settings:read",
+                    "system:settings:write",
+                    "system:governance:read",
+                    "system:governance:write",
+                ),
+            ),
+        ),
+        links=(
+            DocumentationLink(label="Configuration package preflight", href="/api/v1/admin/configuration-packages/dry-run", kind="api"),
+            DocumentationLink(label="Configuration package apply", href="/api/v1/admin/configuration-packages/apply", kind="api"),
+            DocumentationLink(label="Configuration package export", href="/api/v1/admin/configuration-packages/export", kind="api"),
+        ),
+        related_modules=("admin", "audit", "ops"),
+        translations={
+            "de": {
+                "title": "Konfigurationspakete vorprüfen und anwenden",
+                "summary": "Access stellt die gesteuerte Admin-API bereit, die Modul-Provider auflöst, die Ausführungsberechtigung prüft und Anwendungsnachweise festhält.",
+                "body": (
+                    "Die Vorprüfung eines Konfigurationspakets löst die Provider installierter Module auf und meldet fehlende Module, Fähigkeiten, Einsatzdaten, Konflikte und Richtlinienblocker, bevor eine Anwendung beginnt. "
+                    "Portable $data-Verweise sind nur zulässig, wenn das Paket die zugehörige Anforderung deklariert; bereitgestellte Werte werden ausschließlich im Arbeitsspeicher aufgelöst und nicht in den Herkunftsnachweis des Exports aufgenommen. "
+                    "Das Anwenden unterliegt weiterhin der Freigaberichtlinie für Konfigurationsänderungen. Provider können unabhängig festschreiben. Deshalb endet die Verarbeitung beim ersten Anwendungs- oder Gesundheitsblocker; die Antwort unterscheidet Blockierung vor Anwendung, Leerlauf, Snapshot-Rücksetzung und Wiederherstellung nach Teilanwendung. "
+                    "Der Export ruft nur die ausgewählten Modul-Provider auf, wahrt deren Regeln zur Geheimnisschwärzung und ergänzt einen begrenzten Herkunftsnachweis, ohne bereitgestellte Zugangsdaten zu serialisieren."
+                ),
+            }
+        },
+        metadata={
+            "kind": "workflow",
+            "help_contexts": ["admin.configuration-packages"],
+            "limitations": [
+                "Package apply does not install missing modules.",
+                "Cross-provider apply is not an atomic distributed transaction.",
+                "Generic rollback depends on a retained pre-apply database snapshot.",
+            ],
+            "operational_consequences": [
+                "A stale or blocked preflight must be rerun before apply.",
+                "A partial apply requires recovery before the package is retried.",
+                "Secret values remain outside portable fragments and provenance.",
+            ],
+        },
+    ),
     DocumentationTopic(
         id="access.operator.enroll-first-administrator",
         title="Enroll the first production administrator",
@@ -1254,7 +1311,7 @@ def _people_search(context: ModuleContext) -> object:
 manifest = ModuleManifest(
     id="access",
     name="Access",
-    version="0.1.19",
+    version="0.1.20",
     optional_dependencies=("identity", "organizations", "tenancy", "idm"),
     provides_interfaces=(
         ModuleInterfaceProvider(name=CAPABILITY_ACCESS_PEOPLE_SEARCH, version="0.1.0"),