[Feature] Implement generic approval chains and separation-of-duties capability #1

New Issue

2026-07-31T22:52:20+02:00

zemion commented

2026-07-31 22:52:20 +02:00

Goal

Provide the reusable approval runtime that Campaign and other modules can use for sign-off chains, delegation/substitution, escalation, and separation-of-duties enforcement without implementing module-local approval engines.

Parent consumer: Campaign #22.

Boundary

Approvals owns requests, immutable subject revision/digest references, ordered steps, eligible authority, quorum, decisions, expiry, delegation/substitution evidence, escalation, and signature references.
Policy may constrain or select approval templates through a capability; Approvals must remain usable without Policy.
Consuming modules expose stable subject/action evidence through Core contracts and consume an approval result through a capability. They do not import Approvals internals.
Audit owns the durable event trail; Workflow Engine may orchestrate long-running human tasks without becoming the approval authority.

Acceptance Criteria

Persist versioned approval templates, requests, steps, eligible actors/groups/functions, quorum, decisions, expiry, and terminal state.
Bind every request to a stable module/resource ID plus revision and content digest; changed content invalidates prior approval.
Enforce configurable four-eyes constraints against consuming-module action evidence such as author, validator, builder, reviewer, and sender.
Record the effective actor, acting/delegated context, authority provenance, decision reason, timestamp, and signature reference.
Provide idempotent capability/API operations with optimistic concurrency and audit events.
Provide an approval inbox/detail UI with actionable explanations for unavailable decisions.
Add module-permutation tests proving consumers degrade clearly when Approvals or Policy is absent.
Integrate Campaign approval gates only after this generic runtime is available.

Decisions To Confirm

Default Campaign chain and which actor pairs are distinct by default.
Whether group/function authority requires one decision or configurable quorum.
Default expiry/escalation windows and administrative recovery authority.
Which signing profiles are evidence references now, before cryptographic signing is supplied by Identity Trust/Encryption.

## Goal Provide the reusable approval runtime that Campaign and other modules can use for sign-off chains, delegation/substitution, escalation, and separation-of-duties enforcement without implementing module-local approval engines. Parent consumer: [Campaign #22](https://git.add-ideas.de/GovOPlaN/govoplan-campaign/issues/22). ## Boundary - Approvals owns requests, immutable subject revision/digest references, ordered steps, eligible authority, quorum, decisions, expiry, delegation/substitution evidence, escalation, and signature references. - Policy may constrain or select approval templates through a capability; Approvals must remain usable without Policy. - Consuming modules expose stable subject/action evidence through Core contracts and consume an approval result through a capability. They do not import Approvals internals. - Audit owns the durable event trail; Workflow Engine may orchestrate long-running human tasks without becoming the approval authority. ## Acceptance Criteria - [ ] Persist versioned approval templates, requests, steps, eligible actors/groups/functions, quorum, decisions, expiry, and terminal state. - [ ] Bind every request to a stable module/resource ID plus revision and content digest; changed content invalidates prior approval. - [ ] Enforce configurable four-eyes constraints against consuming-module action evidence such as author, validator, builder, reviewer, and sender. - [ ] Record the effective actor, acting/delegated context, authority provenance, decision reason, timestamp, and signature reference. - [ ] Provide idempotent capability/API operations with optimistic concurrency and audit events. - [ ] Provide an approval inbox/detail UI with actionable explanations for unavailable decisions. - [ ] Add module-permutation tests proving consumers degrade clearly when Approvals or Policy is absent. - [ ] Integrate Campaign approval gates only after this generic runtime is available. ## Decisions To Confirm - Default Campaign chain and which actor pairs are distinct by default. - Whether group/function authority requires one decision or configurable quorum. - Default expiry/escalation windows and administrative recovery authority. - Which signing profiles are evidence references now, before cryptographic signing is supplied by Identity Trust/Encryption.

zemion added the module/approvals

status

triage

area/api codex/needs-human area/governance area/security

labels 2026-07-31 22:52:20 +02:00

zemion referenced this issue from GovOPlaN/govoplan-campaign

2026-07-31 22:54:26 +02:00

[Feature] Add approval workflow and separation-of-duties gates #22

zemion commented

2026-08-01 21:02:37 +02:00

Codex State: done

Summary

Implemented the generic SQL-backed approval runtime: immutable templates and exact-subject requests, ordered/quorum steps, trusted selectors/delegation, configurable four-eyes rules, expiry/escalation, signature references, OCC/idempotency, lifecycle evidence, API, inbox/detail WebUI, and recovery documentation.
Campaign is the first consuming consequential-action gate. Policy remains optional. Pushed as GovOPlaN/govoplan-approvals@62d0f30.

Changed Files

src/govoplan_approvals/backend/service.py
webui/src/features/approvals/ApprovalsPage.tsx
docs/APPROVALS_DOMAIN_BOUNDARY.md

Verification

Approvals runtime and fresh Alembic migration suite passed (6 tests).
Campaign-only, Approvals-only, and full-product module permutations passed.

## Codex State: done ### Summary - Implemented the generic SQL-backed approval runtime: immutable templates and exact-subject requests, ordered/quorum steps, trusted selectors/delegation, configurable four-eyes rules, expiry/escalation, signature references, OCC/idempotency, lifecycle evidence, API, inbox/detail WebUI, and recovery documentation. - Campaign is the first consuming consequential-action gate. Policy remains optional. Pushed as GovOPlaN/govoplan-approvals@62d0f30. ### Changed Files - `src/govoplan_approvals/backend/service.py` - `webui/src/features/approvals/ApprovalsPage.tsx` - `docs/APPROVALS_DOMAIN_BOUNDARY.md` ### Verification - `Approvals runtime and fresh Alembic migration suite passed (6 tests).` - `Campaign-only, Approvals-only, and full-product module permutations passed.`

zemion closed this issue

2026-08-01 21:02:38 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-approvals#1