feat(campaigns): add governed collaboration thread

docs/CAMPAIGN_HANDBOOK.md

@@ -45,7 +45,8 @@ Campaign owns:
 - message and attachment rules for a version;
 - validation, review, build, queue, and delivery-control state;
 - the durable jobs and attempts needed to explain delivery outcomes; and
-- campaign-specific reports, shares, and frozen execution evidence.
+- campaign-specific reports, shares, frozen execution evidence, and governed
+  human collaboration entries.
 
 Campaign does not own:
 
@@ -111,6 +112,32 @@ action.
 
 ## User tasks
 
+### Discuss campaign work
+
+Open **Collaboration** inside a Campaign to keep human coordination beside the
+work without changing its version history. Discussion access is independent
+from Campaign editing: parent Campaign read access remains mandatory, while
+`campaigns:discussion:read`, `campaigns:discussion:post`, and
+`campaigns:discussion:moderate` separately control reading, posting, and
+moderation. A read share is sufficient as the parent grant and a comment never
+turns that share into write access.
+
+Comments are append-only and bounded to 8,000 characters. They can carry one
+validated reference to an immutable Campaign version, saved recipient import,
+attachment rule, delivery job, or report. References to version-bound evidence
+include the exact version ID and never edit that version. Authors can withdraw
+their own comments; moderators can redact comments and use moderator-only
+visibility. Both operations remove displayed text but preserve a tombstone,
+content hash, actor snapshot, timestamp, reference context, and bounded Audit
+event. There is deliberately no comment-edit API.
+
+Mentions are limited to 20 active users who already have Campaign ownership or
+share access. When Notifications is installed and healthy, Campaign emits a
+content-free in-app mention notification. Collaboration remains usable without
+Notifications. The thread displays only human discussion; approvals, workflow
+state, delivery events, and durable system evidence remain on their owning
+surfaces and in Tenant audit.
+
 ### Prepare a campaign
 
 1. Create a campaign and confirm its owner or owning group.
@@ -563,7 +590,10 @@ namespaced Campaign references have been independently authorized and
 corroborated, the provider searches only the effective tenant and isolates the
 matching recipient entries and jobs. Its JSON result includes safe Campaign,
 version, delivery-attempt, schedule, report-projection, share, import-mapping,
-attachment, and generated-artifact metadata. Generated EML bytes and paths,
+attachment, generated-artifact, and relevant collaboration metadata. It also
+finds collaboration entries authored, mentioned, or moderated by the subject.
+Text authored by the subject is included; somebody else's text is not copied
+merely because the subject was mentioned. Generated EML bytes and paths,
 storage locators, delivery target snapshots, worker claims, idempotency
 material, credentials, secret-like values, and unrelated recipients are never
 embedded in that result. Authorized Campaign and Files review surfaces remain
@@ -577,7 +607,9 @@ version JSON, jobs, generated messages, and managed files. The provider can
 idempotently revoke an active share aimed at the subject and delete the
 subject's personal recipient-import mapping profile. It does not rewrite
 delivery evidence, delete generated artifacts, or report derived Campaign
-counts as a separate store. Re-running an approved action is safe: already
+counts as a separate store. Collaboration withdrawal and redaction retain the
+tombstone, content hash, context, and Audit evidence; the DSAR workflow does
+not rewrite these append-only records. Re-running an approved action is safe: already
 revoked or absent data is reported as unchanged, and tenant, subject, and row
 ownership are revalidated immediately before mutation.
 

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "govoplan-campaign"
-version = "0.1.19"
+version = "0.1.20"
 description = "GovOPlaN campaigns module with backend and WebUI integration."
 readme = "README.md"
 requires-python = ">=3.12"

src/govoplan_campaign/backend/capabilities.py

@@ -28,6 +28,7 @@ from govoplan_campaign.backend.db.models import (
     AttachmentInstance,
     CampaignIssue,
     Campaign,
+    CampaignCollaborationEntry,
     CampaignJob,
     CampaignMessageAction,
     CampaignMessageActionAttempt,
@@ -41,7 +42,13 @@ from govoplan_campaign.backend.db.models import (
 )
 
 
-READ_ACTIONS = {"campaigns:campaign:read", "campaign:read"}
+READ_ACTIONS = {
+    "campaigns:campaign:read",
+    "campaign:read",
+    "campaigns:discussion:read",
+    "campaigns:discussion:post",
+    "campaigns:discussion:moderate",
+}
 CAMPAIGN_RESOURCE_TYPES = {
     "campaign",
     "campaign_object",
@@ -51,6 +58,10 @@ CAMPAIGN_VERSION_RESOURCE_TYPES = {
     "campaign_version",
     "campaigns:version",
 }
+CAMPAIGN_COLLABORATION_RESOURCE_TYPES = {
+    "campaign_collaboration_entry",
+    "campaigns:collaboration_entry",
+}
 CAMPAIGN_DELIVERY_JOB_RESOURCE_TYPES = {
     "campaign_delivery_job",
     "campaign_job",
@@ -558,6 +569,52 @@ class CampaignAccessService(CampaignAccessProvider):
             return tuple(items)
         if normalized_type in CAMPAIGN_RESOURCE_TYPES:
             campaign = session.get(Campaign, resource_id)  # type: ignore[attr-defined]
+        elif normalized_type in CAMPAIGN_COLLABORATION_RESOURCE_TYPES:
+            entry = session.get(CampaignCollaborationEntry, resource_id)  # type: ignore[attr-defined]
+            if entry is None:
+                return _missing_resource_provenance(
+                    principal,
+                    resource_type="campaign_collaboration_entry",
+                    resource_id=resource_id,
+                )
+            campaign = session.get(Campaign, entry.campaign_id)  # type: ignore[attr-defined]
+            normalized_action = action.strip().lower()
+            required_actions = (
+                ("campaigns:discussion:moderate",)
+                if normalized_action.endswith(":moderate")
+                else (
+                    ("campaigns:discussion:post",)
+                    if normalized_action.endswith(":post")
+                    else ("campaigns:discussion:read",)
+                )
+            )
+            child_item = _child_provenance(
+                principal,
+                resource_id=entry.id,
+                source="campaigns.collaboration_entry",
+                label="Campaign collaboration entry",
+                campaign=campaign,
+                version_id=entry.campaign_version_id,
+                details={
+                    "resource_type": "campaign_collaboration_entry",
+                    "visibility": entry.visibility,
+                    "reference_kind": entry.reference_kind,
+                    "reference_id": entry.reference_id,
+                    "state": (
+                        "redacted"
+                        if entry.redacted_at
+                        else "withdrawn" if entry.withdrawn_at else "posted"
+                    ),
+                    "content_disclosed": False,
+                    "actor_identity_disclosed": False,
+                    "permission_classes": {
+                        "read": ["campaigns:discussion:read"],
+                        "post": ["campaigns:discussion:post"],
+                        "moderate": ["campaigns:discussion:moderate"],
+                    },
+                },
+                required_actions=required_actions,
+            )
         elif normalized_type in CAMPAIGN_SHARE_RESOURCE_TYPES:
             share = session.get(CampaignShare, resource_id)  # type: ignore[attr-defined]
             if share is None:

src/govoplan_campaign/backend/db/models.py

@@ -168,6 +168,61 @@ class CampaignShare(Base, TimestampMixin):
     revoked_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True, index=True)
 
 
+class CampaignCollaborationEntry(Base, TimestampMixin):
+    __tablename__ = "campaign_collaboration_entries"
+    __table_args__ = (
+        Index(
+            "ix_campaign_collaboration_entries_thread",
+            "tenant_id",
+            "campaign_id",
+            "created_at",
+            "id",
+        ),
+    )
+
+    id: Mapped[str] = mapped_column(String(36), primary_key=True, default=new_uuid)
+    tenant_id: Mapped[str] = mapped_column(String(36), nullable=False, index=True)
+    campaign_id: Mapped[str] = mapped_column(
+        ForeignKey("campaigns.id", ondelete="CASCADE"),
+        nullable=False,
+        index=True,
+    )
+    campaign_version_id: Mapped[str | None] = mapped_column(
+        ForeignKey("campaign_versions.id", ondelete="RESTRICT"),
+        nullable=True,
+        index=True,
+    )
+    reference_kind: Mapped[str | None] = mapped_column(String(40), nullable=True, index=True)
+    reference_id: Mapped[str | None] = mapped_column(String(500), nullable=True)
+    reference_label: Mapped[str | None] = mapped_column(String(255), nullable=True)
+    actor_user_id: Mapped[str | None] = mapped_column(
+        ForeignKey("access_users.id", ondelete="SET NULL"),
+        nullable=True,
+        index=True,
+    )
+    actor_label_snapshot: Mapped[str] = mapped_column(String(255), nullable=False)
+    visibility: Mapped[str] = mapped_column(
+        String(30),
+        default="collaborators",
+        nullable=False,
+        index=True,
+    )
+    content: Mapped[str | None] = mapped_column(Text, nullable=True)
+    content_sha256: Mapped[str] = mapped_column(String(64), nullable=False)
+    mention_user_ids: Mapped[list[str]] = mapped_column(JSON, default=list, nullable=False)
+    withdrawn_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True, index=True)
+    withdrawn_by_user_id: Mapped[str | None] = mapped_column(
+        ForeignKey("access_users.id", ondelete="SET NULL"),
+        nullable=True,
+    )
+    redacted_at: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True, index=True)
+    redacted_by_user_id: Mapped[str | None] = mapped_column(
+        ForeignKey("access_users.id", ondelete="SET NULL"),
+        nullable=True,
+    )
+    tombstone_reason: Mapped[str | None] = mapped_column(String(500), nullable=True)
+
+
 class CampaignSchedule(Base, TimestampMixin):
     __tablename__ = "campaign_schedules"
     __table_args__ = (

src/govoplan_campaign/backend/documentation.py

@@ -25,6 +25,9 @@ _CAMPAIGN_USER_SCOPES = (
     "campaigns:campaign:send",
     "campaigns:campaign:retry",
     "campaigns:campaign:reconcile",
+    "campaigns:discussion:read",
+    "campaigns:discussion:post",
+    "campaigns:discussion:moderate",
     "campaigns:recipient:read",
     "campaigns:recipient:write",
     "campaigns:recipient:import",
@@ -195,6 +198,50 @@ CAMPAIGN_USER_DOCUMENTATION = (
             }
         },
     ),
+    _workflow_topic(
+        topic_id="campaigns.workflow.collaborate-on-campaign",
+        title="Discuss campaign work without changing its evidence",
+        summary="Use the governed collaboration thread for human discussion linked to stable Campaign evidence.",
+        body="Collaboration is governed independently from Campaign editing. A discussion reader still needs access to the parent Campaign; posting and moderation use separate permissions. Posted text is append-only. Authors can withdraw their own entry and moderators can redact an entry, but both actions leave the actor, timestamp, reference, evidence hash, tombstone, and audit record. A comment may reference a Campaign version, recipient import batch, attachment rule, delivery job, or report. The reference never edits the historical version. Mentions create an in-app notification only when Notifications is available and only for active users who already have Campaign access. Human discussion is not system state and never replaces Audit evidence.",
+        order=33,
+        audience=("campaign_manager", "campaign_reviewer", "campaign_sender"),
+        required_scopes=("campaigns:campaign:read", "campaigns:discussion:read"),
+        route="/campaigns/{campaign_id}/activity",
+        screen="Campaign collaboration",
+        help_contexts=(
+            "campaign.activity",
+            "campaign.activity.composer",
+            "campaign.activity.action.post",
+            "campaign.activity.action.withdraw",
+            "campaign.activity.action.redact",
+        ),
+        prerequisites=(
+            "You can read the Campaign and its discussion.",
+            "Posting requires the separate campaign discussion-post permission.",
+        ),
+        steps=(
+            "Open Collaboration in the selected Campaign workspace.",
+            "Optionally select a stable version or enter the stable ID of another supported Campaign evidence reference.",
+            "Mention only collaborators who already have access, then post the bounded comment.",
+            "Withdraw your own mistaken entry or ask an authorized moderator to redact content that must no longer be displayed.",
+            "Use Tenant audit for system events and durable action evidence; do not treat discussion as workflow state.",
+        ),
+        outcome="An attributable human discussion entry that does not mutate Campaign versions or impersonate audit evidence.",
+        verification="Reload Collaboration, follow the typed reference, and confirm any withdrawal or redaction appears as a tombstone while the referenced version remains unchanged.",
+        required_capabilities=(),
+        related_modules=("notifications", "audit"),
+        limitations=(
+            "Notifications is optional; the discussion remains available when mention delivery is not configured.",
+            "Comments do not approve, validate, build, queue, send, or otherwise transition a Campaign.",
+        ),
+        translations={
+            "de": {
+                "title": "Kampagnenarbeit besprechen, ohne Nachweise zu verändern",
+                "summary": "Den geregelten Diskussionsverlauf für menschliche Abstimmung mit stabilen Kampagnennachweisen verwenden.",
+                "body": "Die Zusammenarbeit wird unabhängig von der Kampagnenbearbeitung berechtigt. Lesende benötigen weiterhin Zugriff auf die übergeordnete Kampagne; Veröffentlichung und Moderation verwenden eigene Berechtigungen. Veröffentlichter Text ist unveränderlich. Verfassende können eigene Einträge zurücknehmen, Moderierende können Einträge schwärzen. Dabei bleiben Person, Zeitstempel, Referenz, Nachweis-Hash, Platzhalter und Auditnachweis erhalten. Kommentare können Kampagnenversionen, Empfänger-Importläufe, Anlagenregeln, Sendeaufträge oder Berichte referenzieren, ohne historische Versionen zu verändern. Erwähnungen erzeugen nur bei verfügbarem Benachrichtigungsmodul eine interne Benachrichtigung und nur für aktive Personen mit bestehendem Kampagnenzugriff. Diskussion ist kein Systemzustand und ersetzt keinen Auditnachweis.",
+            }
+        },
+    ),
     _workflow_topic(
         topic_id="campaigns.workflow.reuse-content-library",
         title="Reuse Campaign content through Templates",

src/govoplan_campaign/backend/dsar_provider.py

@@ -10,6 +10,7 @@ from sqlalchemy.orm import Session
 from govoplan_campaign.backend.db.models import (
     AttachmentInstance,
     Campaign,
+    CampaignCollaborationEntry,
     CampaignIssue,
     CampaignJob,
     CampaignMessageAction,
@@ -646,6 +647,62 @@ class CampaignDsarProvider:
         version_ids: set[str],
     ) -> None:
         if subject_user_id is not None:
+            collaboration_rows = _bounded_rows(
+                db.query(CampaignCollaborationEntry)
+                .filter(
+                    CampaignCollaborationEntry.tenant_id == tenant_id,
+                    or_(
+                        CampaignCollaborationEntry.actor_user_id == subject_user_id,
+                        CampaignCollaborationEntry.withdrawn_by_user_id == subject_user_id,
+                        CampaignCollaborationEntry.redacted_by_user_id == subject_user_id,
+                        cast(CampaignCollaborationEntry.mention_user_ids, Text).contains(
+                            f'"{subject_user_id}"'
+                        ),
+                    ),
+                )
+                .order_by(CampaignCollaborationEntry.id)
+            )
+            for entry in collaboration_rows:
+                match_fields = _matching_fields(
+                    entry,
+                    subject_user_id,
+                    (
+                        "actor_user_id",
+                        "withdrawn_by_user_id",
+                        "redacted_by_user_id",
+                    ),
+                )
+                if subject_user_id in (entry.mention_user_ids or []):
+                    match_fields.append("mention_user_ids")
+                authored = entry.actor_user_id == subject_user_id
+                append(  # type: ignore[operator]
+                    _record(
+                        "campaign_collaboration_entry",
+                        entry.id,
+                        "campaign_collaboration_evidence",
+                        "Campaign collaboration entry",
+                        {
+                            "match_fields": match_fields,
+                            "campaign_id": entry.campaign_id,
+                            "campaign_version_id": entry.campaign_version_id,
+                            "visibility": entry.visibility,
+                            "reference_kind": entry.reference_kind,
+                            "reference_id": entry.reference_id,
+                            "posted_text": entry.content if authored else None,
+                            "content_disclosed": authored and entry.content is not None,
+                            "content_sha256": entry.content_sha256,
+                            "withdrawn_at": _iso(entry.withdrawn_at),
+                            "redacted_at": _iso(entry.redacted_at),
+                        },
+                        observed_at=entry.updated_at,
+                        immutable=True,
+                        retention_reason=(
+                            "Append-only discussion identity, reference, hash, tombstone, and moderation evidence are retained with Campaign access and Audit evidence."
+                        ),
+                        source_path=f"/campaigns/{entry.campaign_id}/activity",
+                    )
+                )
+
             shares = _bounded_rows(
                 db.query(CampaignShare)
                 .filter(

src/govoplan_campaign/backend/manifest.py

@@ -50,6 +50,7 @@ from govoplan_core.core.templates import (
     CAPABILITY_TEMPLATE_RENDERER,
 )
 from govoplan_core.core.operations import OperationalCheckProviderRegistration
+from govoplan_core.core.notifications import CAPABILITY_NOTIFICATIONS_DISPATCH
 from govoplan_core.core.provider_governance import declared_module_architecture
 from govoplan_core.core.views import ViewSurface
 from govoplan_core.db.base import Base
@@ -102,6 +103,24 @@ PERMISSIONS = (
         "Open campaign metadata, versions and permitted message summaries.",
         "Campaigns",
     ),
+    _permission(
+        "campaigns:discussion:read",
+        "View campaign discussions",
+        "Read human collaboration entries attached to campaigns the user can already access.",
+        "Campaign collaboration",
+    ),
+    _permission(
+        "campaigns:discussion:post",
+        "Post campaign discussions",
+        "Post and withdraw the user's own append-only campaign collaboration entries.",
+        "Campaign collaboration",
+    ),
+    _permission(
+        "campaigns:discussion:moderate",
+        "Moderate campaign discussions",
+        "Read moderator-only entries and redact campaign collaboration content while retaining tombstones.",
+        "Campaign collaboration",
+    ),
     _permission(
         "campaigns:campaign:create",
         "Create campaigns",
@@ -302,6 +321,9 @@ ROLE_TEMPLATES = (
             "campaigns:campaign:validate",
             "campaigns:campaign:build",
             "campaigns:ownership:accept_group",
+            "campaigns:discussion:read",
+            "campaigns:discussion:post",
+            "campaigns:discussion:moderate",
             "campaigns:recipient:read",
             "campaigns:recipient:write",
             "campaigns:recipient:import",
@@ -316,6 +338,8 @@ ROLE_TEMPLATES = (
             "campaigns:campaign:read",
             "campaigns:campaign:validate",
             "campaigns:campaign:review",
+            "campaigns:discussion:read",
+            "campaigns:discussion:post",
             "campaigns:recipient:read",
             "campaigns:report:read",
         ),
@@ -332,6 +356,8 @@ ROLE_TEMPLATES = (
             "campaigns:campaign:send",
             "campaigns:campaign:retry",
             "campaigns:campaign:reconcile",
+            "campaigns:discussion:read",
+            "campaigns:discussion:post",
             "campaigns:diagnostic:read",
             "campaigns:recipient:read",
             "campaigns:report:read",
@@ -385,7 +411,7 @@ def _campaigns_router(context: ModuleContext):
 manifest = ModuleManifest(
     id="campaigns",
     name="Campaigns",
-    version="0.1.19",
+    version="0.1.20",
     required_capabilities=(
         CAPABILITY_AUTH_PRINCIPAL_RESOLVER,
         CAPABILITY_AUTH_PERMISSION_EVALUATOR,
@@ -393,6 +419,7 @@ manifest = ModuleManifest(
     optional_capabilities=(
         CAPABILITY_ACCESS_REFERENCE_OPTIONS,
         CAPABILITY_APPROVAL_REQUESTS,
+        CAPABILITY_NOTIFICATIONS_DISPATCH,
     ),
     optional_dependencies=(
         "files",
@@ -517,6 +544,12 @@ manifest = ModuleManifest(
             version_max_exclusive="0.2.0",
             optional=True,
         ),
+        ModuleInterfaceRequirement(
+            name=CAPABILITY_NOTIFICATIONS_DISPATCH,
+            version_min="0.1.0",
+            version_max_exclusive="0.2.0",
+            optional=True,
+        ),
         ModuleInterfaceRequirement(
             name="search.source",
             version_min="1.0.0",
@@ -606,11 +639,19 @@ manifest = ModuleManifest(
                     "campaigns.route.operator-redirect",
                     OPERATOR_QUEUE_SURFACE_ID,
                     REPORTS_SURFACE_ID,
+                    "campaigns.page.activity",
                 ),
                 order=40,
             ),
         ),
         view_surfaces=(
+            ViewSurface(
+                id="campaigns.page.activity",
+                module_id="campaigns",
+                kind="page",
+                label="Campaign collaboration",
+                order=45,
+            ),
             ViewSurface(
                 id="campaigns.widget.activity",
                 module_id="campaigns",
@@ -656,6 +697,7 @@ manifest = ModuleManifest(
             campaign_models.CampaignSchedule,
             campaign_models.CampaignScheduleOccurrence,
             campaign_models.CampaignShare,
+            campaign_models.CampaignCollaborationEntry,
             campaign_models.RecipientImportMappingProfile,
             campaign_models.CampaignVersion,
             campaign_models.CampaignJob,
@@ -678,6 +720,7 @@ manifest = ModuleManifest(
             campaign_models.CampaignSchedule,
             campaign_models.CampaignScheduleOccurrence,
             campaign_models.CampaignShare,
+            campaign_models.CampaignCollaborationEntry,
             campaign_models.RecipientImportMappingProfile,
             campaign_models.CampaignVersion,
             campaign_models.CampaignJob,
@@ -737,14 +780,71 @@ manifest = ModuleManifest(
                 "help_contexts": ["campaigns.quick_access.campaigns"],
             },
         ),
+        DocumentationTopic(
+            id="campaigns.admin.collaboration-governance",
+            title="Govern Campaign collaboration permissions and retention",
+            summary="Configure discussion access separately from Campaign editing and retain auditable moderation tombstones.",
+            body=(
+                "Campaign collaboration uses separate read, post, and moderate permissions in addition to parent Campaign read access. "
+                "The built-in manager role can moderate, while reviewer and sender roles can read and post without receiving Campaign edit permission. "
+                "A read share is sufficient as the parent resource grant; comments never upgrade it to write access. Moderator-only visibility is filtered server-side. "
+                "Posted content has no edit API. Author withdrawal and moderator redaction remove displayed content while retaining the stable entry, SHA-256 evidence, actor snapshot, timestamp, typed reference, tombstone, and bounded Audit event. "
+                "Mention targets are restricted to active users who already have Campaign ownership or share access. If the optional Notifications dispatch capability is available, Campaign emits content-free inbox notifications; provider failure does not make Notifications a required Campaign dependency. "
+                "Operators must apply institutional retention and privacy policy to collaboration rows and Audit evidence together and must not represent comments as approvals, workflow transitions, or system events."
+            ),
+            layer="configured",
+            documentation_types=("admin",),
+            audience=("campaign_manager", "module_admin", "privacy_officer", "records_manager"),
+            order=41,
+            conditions=(
+                DocumentationCondition(
+                    required_modules=("campaigns",),
+                    any_scopes=(
+                        "campaigns:discussion:moderate",
+                        "access:roles:manage",
+                    ),
+                ),
+            ),
+            links=(
+                DocumentationLink(
+                    label="Campaign collaboration",
+                    href="/campaigns",
+                    kind="runtime",
+                ),
+                DocumentationLink(
+                    label="Campaign handbook",
+                    href="govoplan-campaign/docs/CAMPAIGN_HANDBOOK.md",
+                    kind="repository",
+                ),
+            ),
+            related_modules=("access", "audit", "notifications"),
+            metadata={
+                "kind": "configuration",
+                "route": "/campaigns/{campaign_id}/activity",
+                "screen": "Campaign collaboration",
+                "help_contexts": [
+                    "campaign.activity",
+                    "campaign.activity.composer",
+                    "campaign.activity.action.post",
+                    "campaign.activity.action.withdraw",
+                    "campaign.activity.action.redact",
+                ],
+                "permission_scopes": [
+                    "campaigns:discussion:read",
+                    "campaigns:discussion:post",
+                    "campaigns:discussion:moderate",
+                ],
+                "verification": "Test a read-only collaborator, a poster without Campaign edit, and a moderator; confirm moderator visibility, mention access filtering, tombstones, and Audit records.",
+            },
+        ),
         DocumentationTopic(
             id="campaigns.privacy.data-subject-requests",
             title="Review Campaign data in a data-subject request",
-            summary="Collect recipient, version, delivery, report, and artifact metadata without rewriting immutable evidence.",
+            summary="Collect recipient, collaboration, version, delivery, report, and artifact metadata without rewriting immutable evidence.",
             body=(
                 "Campaign's DSAR provider searches the effective tenant by normalized recipient email, direct membership references, and namespaced Campaign job, entry, version, or Campaign references. "
-                "It isolates matching inline-recipient fields and job metadata, and reports built versions, delivery attempts, Postbox and print outcomes, message-action corrections, recipient-specific report projections, generated-message digests, and attachment metadata. It does not export EML bytes, object or local paths, provider target snapshots, worker claims, idempotency material, secrets, credentials, or unrelated recipient addresses. "
-                "Built, locked, published, terminal, delivered, or corrected records remain retained with a reason and continue through Campaign's configured retention/redaction process. Draft recipient content and user-owned attachment content require coordinated manual review because the same data may occur in version JSON, jobs, and generated artifacts. The provider can idempotently delete a personal recipient-import mapping profile and revoke an active Campaign share aimed at the subject. It never rewrites delivered evidence or deletes generated artifacts directly. Campaign reports are derived projections rather than a separate personal-data store."
+                "It isolates matching inline-recipient fields and job metadata, and reports built versions, delivery attempts, Postbox and print outcomes, message-action corrections, recipient-specific report projections, generated-message digests, attachment metadata, and collaboration entries authored, mentioned, or moderated by the subject. Authored collaboration text is included; text authored by somebody else is not copied merely because the subject was mentioned. It does not export EML bytes, object or local paths, provider target snapshots, worker claims, idempotency material, secrets, credentials, or unrelated recipient addresses. "
+                "Built, locked, published, terminal, delivered, corrected, withdrawn, or redacted records remain retained with a reason and continue through Campaign's configured retention/redaction process. Collaboration tombstones, hashes, and Audit evidence remain immutable. Draft recipient content and user-owned attachment content require coordinated manual review because the same data may occur in version JSON, jobs, and generated artifacts. The provider can idempotently delete a personal recipient-import mapping profile and revoke an active Campaign share aimed at the subject. It never rewrites delivered evidence or deletes generated artifacts directly. Campaign reports are derived projections rather than a separate personal-data store."
             ),
             layer="configured",
             documentation_types=("admin",),

src/govoplan_campaign/backend/migrations/versions/c7d8e9f0a1b2_v0120_campaign_collaboration.py

@@ -0,0 +1,89 @@
+"""add governed campaign collaboration entries
+
+revision = "c7d8e9f0a1b2"
+down_revision = "b6c7d8e9f0a1"
+"""
+
+from __future__ import annotations
+
+import sqlalchemy as sa
+from alembic import op
+
+
+revision = "c7d8e9f0a1b2"
+down_revision = "b6c7d8e9f0a1"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    inspector = sa.inspect(op.get_bind())
+    if inspector.has_table("campaign_collaboration_entries"):
+        return
+    op.create_table(
+        "campaign_collaboration_entries",
+        sa.Column("id", sa.String(length=36), nullable=False),
+        sa.Column("tenant_id", sa.String(length=36), nullable=False),
+        sa.Column("campaign_id", sa.String(length=36), nullable=False),
+        sa.Column("campaign_version_id", sa.String(length=36), nullable=True),
+        sa.Column("reference_kind", sa.String(length=40), nullable=True),
+        sa.Column("reference_id", sa.String(length=500), nullable=True),
+        sa.Column("reference_label", sa.String(length=255), nullable=True),
+        sa.Column("actor_user_id", sa.String(length=36), nullable=True),
+        sa.Column("actor_label_snapshot", sa.String(length=255), nullable=False),
+        sa.Column(
+            "visibility",
+            sa.String(length=30),
+            nullable=False,
+            server_default="collaborators",
+        ),
+        sa.Column("content", sa.Text(), nullable=True),
+        sa.Column("content_sha256", sa.String(length=64), nullable=False),
+        sa.Column("mention_user_ids", sa.JSON(), nullable=False, server_default="[]"),
+        sa.Column("withdrawn_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("withdrawn_by_user_id", sa.String(length=36), nullable=True),
+        sa.Column("redacted_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("redacted_by_user_id", sa.String(length=36), nullable=True),
+        sa.Column("tombstone_reason", sa.String(length=500), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), nullable=False),
+        sa.ForeignKeyConstraint(["actor_user_id"], ["access_users.id"], ondelete="SET NULL"),
+        sa.ForeignKeyConstraint(["campaign_id"], ["campaigns.id"], ondelete="CASCADE"),
+        sa.ForeignKeyConstraint(
+            ["campaign_version_id"],
+            ["campaign_versions.id"],
+            ondelete="RESTRICT",
+        ),
+        sa.ForeignKeyConstraint(
+            ["redacted_by_user_id"],
+            ["access_users.id"],
+            ondelete="SET NULL",
+        ),
+        sa.ForeignKeyConstraint(
+            ["withdrawn_by_user_id"],
+            ["access_users.id"],
+            ondelete="SET NULL",
+        ),
+        sa.PrimaryKeyConstraint("id"),
+    )
+    for name, columns in (
+        ("ix_campaign_collaboration_entries_tenant_id", ["tenant_id"]),
+        ("ix_campaign_collaboration_entries_campaign_id", ["campaign_id"]),
+        ("ix_campaign_collaboration_entries_campaign_version_id", ["campaign_version_id"]),
+        ("ix_campaign_collaboration_entries_reference_kind", ["reference_kind"]),
+        ("ix_campaign_collaboration_entries_actor_user_id", ["actor_user_id"]),
+        ("ix_campaign_collaboration_entries_visibility", ["visibility"]),
+        ("ix_campaign_collaboration_entries_withdrawn_at", ["withdrawn_at"]),
+        ("ix_campaign_collaboration_entries_redacted_at", ["redacted_at"]),
+        (
+            "ix_campaign_collaboration_entries_thread",
+            ["tenant_id", "campaign_id", "created_at", "id"],
+        ),
+    ):
+        op.create_index(name, "campaign_collaboration_entries", columns, unique=False)
+
+
+def downgrade() -> None:
+    inspector = sa.inspect(op.get_bind())
+    if inspector.has_table("campaign_collaboration_entries"):
+        op.drop_table("campaign_collaboration_entries")

src/govoplan_campaign/backend/router.py

@@ -4,6 +4,7 @@ from fastapi import APIRouter
 
 from govoplan_campaign.backend.routes.attachments import router as attachments_router
 from govoplan_campaign.backend.routes.campaigns import router as campaigns_router
+from govoplan_campaign.backend.routes.collaboration import router as collaboration_router
 from govoplan_campaign.backend.routes.delivery import router as delivery_router
 from govoplan_campaign.backend.routes.jobs import router as jobs_router
 from govoplan_campaign.backend.routes.operations import router as operations_router
@@ -17,6 +18,7 @@ router = APIRouter()
 for workflow_router in (
     operations_router,
     campaigns_router,
+    collaboration_router,
     versions_router,
     jobs_router,
     reports_router,

src/govoplan_campaign/backend/routes/collaboration.py

@@ -0,0 +1,571 @@
+from __future__ import annotations
+
+import base64
+import binascii
+import hashlib
+import json
+from datetime import UTC, datetime
+from typing import Literal
+
+from fastapi import APIRouter, Depends, HTTPException, Query, status
+from sqlalchemy import and_, or_
+from sqlalchemy.orm import Session
+
+from govoplan_campaign.backend.db.models import (
+    Campaign,
+    CampaignCollaborationEntry,
+    CampaignJob,
+    CampaignShare,
+    CampaignVersion,
+)
+from govoplan_campaign.backend.path_security import _attachment_rules
+from govoplan_campaign.backend.route_support import (
+    _access_directory,
+    _get_campaign_for_principal,
+    _require_permission,
+)
+from govoplan_campaign.backend.runtime import get_registry
+from govoplan_campaign.backend.schemas import (
+    CampaignCollaborationCreateRequest,
+    CampaignCollaborationEntryResponse,
+    CampaignCollaborationListResponse,
+    CampaignCollaborationModerationRequest,
+    CampaignCollaborationReferenceInput,
+    CampaignCollaborationReferenceResponse,
+)
+from govoplan_core.api.v1.schemas import (
+    ReferenceOptionListResponse,
+    ReferenceOptionResponse,
+)
+from govoplan_core.audit.logging import audit_from_principal
+from govoplan_core.auth import ApiPrincipal, has_scope, require_scope
+from govoplan_core.core.notifications import (
+    NotificationDispatchRequest,
+    notification_dispatch_provider,
+)
+from govoplan_core.core.references import (
+    access_scope_reference_page,
+    access_scope_reference_provider_available,
+)
+from govoplan_core.db.session import get_session
+from govoplan_core.security.time import utc_now
+
+
+router = APIRouter(prefix="/campaigns", tags=["campaign collaboration"])
+
+
+@router.get(
+    "/{campaign_id}/collaboration/mention-options",
+    response_model=ReferenceOptionListResponse,
+)
+def search_campaign_collaboration_mentions(
+    campaign_id: str,
+    q: str = "",
+    selected: list[str] = Query(default=[]),
+    limit: int = Query(default=50, ge=1, le=100),
+    cursor: str | None = None,
+    session: Session = Depends(get_session),
+    principal: ApiPrincipal = Depends(require_scope("campaigns:discussion:post")),
+) -> ReferenceOptionListResponse:
+    campaign = _get_campaign_for_principal(session, campaign_id, principal)
+    _require_permission(principal, "campaigns:campaign:read")
+    try:
+        page = access_scope_reference_page(
+            get_registry(),
+            principal,
+            scope_type="user",
+            reference_kind="membership",
+            query=q,
+            selected_values=selected,
+            limit=limit,
+            cursor=cursor,
+            administrative=True,
+            session=session,
+        )
+    except ValueError as exc:
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+            detail=str(exc),
+        ) from exc
+    allowed = [
+        option
+        for option in page.options
+        if _mentioned_user_has_campaign_access(
+            session,
+            campaign=campaign,
+            user_id=option.value,
+        )
+    ]
+    return ReferenceOptionListResponse(
+        options=[ReferenceOptionResponse(**option.to_dict()) for option in allowed],
+        provider_available=access_scope_reference_provider_available(get_registry()),
+        next_cursor=page.next_cursor,
+        has_more=page.has_more,
+    )
+
+
+@router.get(
+    "/{campaign_id}/collaboration",
+    response_model=CampaignCollaborationListResponse,
+)
+def list_campaign_collaboration(
+    campaign_id: str,
+    limit: int = Query(default=25, ge=1, le=50),
+    cursor: str | None = None,
+    session: Session = Depends(get_session),
+    principal: ApiPrincipal = Depends(require_scope("campaigns:discussion:read")),
+) -> CampaignCollaborationListResponse:
+    campaign = _get_campaign_for_principal(session, campaign_id, principal)
+    _require_permission(principal, "campaigns:campaign:read")
+    query = session.query(CampaignCollaborationEntry).filter(
+        CampaignCollaborationEntry.tenant_id == principal.tenant_id,
+        CampaignCollaborationEntry.campaign_id == campaign.id,
+    )
+    if not has_scope(principal, "campaigns:discussion:moderate"):
+        query = query.filter(CampaignCollaborationEntry.visibility == "collaborators")
+    if cursor:
+        created_at, entry_id = _decode_cursor(cursor)
+        query = query.filter(
+            or_(
+                CampaignCollaborationEntry.created_at < created_at,
+                and_(
+                    CampaignCollaborationEntry.created_at == created_at,
+                    CampaignCollaborationEntry.id < entry_id,
+                ),
+            )
+        )
+    rows = (
+        query.order_by(
+            CampaignCollaborationEntry.created_at.desc(),
+            CampaignCollaborationEntry.id.desc(),
+        )
+        .limit(limit + 1)
+        .all()
+    )
+    has_more = len(rows) > limit
+    items = rows[:limit]
+    return CampaignCollaborationListResponse(
+        items=[_entry_response(item) for item in items],
+        next_cursor=_encode_cursor(items[-1]) if has_more and items else None,
+        has_more=has_more,
+    )
+
+
+@router.post(
+    "/{campaign_id}/collaboration",
+    response_model=CampaignCollaborationEntryResponse,
+    status_code=status.HTTP_201_CREATED,
+)
+def create_campaign_collaboration_entry(
+    campaign_id: str,
+    payload: CampaignCollaborationCreateRequest,
+    session: Session = Depends(get_session),
+    principal: ApiPrincipal = Depends(require_scope("campaigns:discussion:post")),
+) -> CampaignCollaborationEntryResponse:
+    campaign = _get_campaign_for_principal(session, campaign_id, principal)
+    _require_permission(principal, "campaigns:campaign:read")
+    if payload.visibility == "moderators":
+        _require_permission(principal, "campaigns:discussion:moderate")
+    reference = _validated_reference(
+        session,
+        campaign=campaign,
+        reference=payload.reference,
+    )
+    mentions = _validated_mentions(
+        session,
+        campaign=campaign,
+        user_ids=payload.mention_user_ids,
+        actor_user_id=principal.user.id,
+    )
+    actor_label = (
+        getattr(principal.user, "display_name", None)
+        or getattr(principal.user, "email", None)
+        or principal.user.id
+    )
+    entry = CampaignCollaborationEntry(
+        tenant_id=principal.tenant_id,
+        campaign_id=campaign.id,
+        campaign_version_id=reference[0] if reference else None,
+        reference_kind=reference[1] if reference else None,
+        reference_id=reference[2] if reference else None,
+        reference_label=reference[3] if reference else None,
+        actor_user_id=principal.user.id,
+        actor_label_snapshot=str(actor_label)[:255],
+        visibility=payload.visibility,
+        content=payload.content,
+        content_sha256=hashlib.sha256(payload.content.encode("utf-8")).hexdigest(),
+        mention_user_ids=mentions,
+    )
+    session.add(entry)
+    session.flush()
+    _enqueue_mention_notifications(
+        session,
+        campaign=campaign,
+        entry=entry,
+        mention_user_ids=mentions,
+    )
+    audit_from_principal(
+        session,
+        principal,
+        action="campaign.collaboration.posted",
+        object_type="campaign_collaboration_entry",
+        object_id=entry.id,
+        details={
+            "campaign_id": campaign.id,
+            "campaign_version_id": entry.campaign_version_id,
+            "visibility": entry.visibility,
+            "reference_kind": entry.reference_kind,
+            "reference_id": entry.reference_id,
+            "mention_count": len(mentions),
+            "content_sha256": entry.content_sha256,
+            "content_disclosed": False,
+        },
+        commit=True,
+    )
+    session.refresh(entry)
+    return _entry_response(entry)
+
+
+@router.post(
+    "/{campaign_id}/collaboration/{entry_id}/withdraw",
+    response_model=CampaignCollaborationEntryResponse,
+)
+def withdraw_campaign_collaboration_entry(
+    campaign_id: str,
+    entry_id: str,
+    payload: CampaignCollaborationModerationRequest,
+    session: Session = Depends(get_session),
+    principal: ApiPrincipal = Depends(require_scope("campaigns:discussion:post")),
+) -> CampaignCollaborationEntryResponse:
+    _get_campaign_for_principal(session, campaign_id, principal)
+    _require_permission(principal, "campaigns:campaign:read")
+    entry = _entry_for_campaign(session, campaign_id=campaign_id, entry_id=entry_id, principal=principal)
+    if entry.actor_user_id != principal.user.id:
+        raise HTTPException(
+            status_code=status.HTTP_403_FORBIDDEN,
+            detail="Only the author can withdraw this collaboration entry.",
+        )
+    if entry.redacted_at is not None or entry.withdrawn_at is not None:
+        return _entry_response(entry)
+    entry.content = None
+    entry.withdrawn_at = utc_now()
+    entry.withdrawn_by_user_id = principal.user.id
+    entry.tombstone_reason = payload.reason
+    audit_from_principal(
+        session,
+        principal,
+        action="campaign.collaboration.withdrawn",
+        object_type="campaign_collaboration_entry",
+        object_id=entry.id,
+        details={
+            "campaign_id": campaign_id,
+            "content_sha256": entry.content_sha256,
+            "reason_recorded": bool(payload.reason),
+            "content_disclosed": False,
+        },
+        commit=True,
+    )
+    session.refresh(entry)
+    return _entry_response(entry)
+
+
+@router.post(
+    "/{campaign_id}/collaboration/{entry_id}/redact",
+    response_model=CampaignCollaborationEntryResponse,
+)
+def redact_campaign_collaboration_entry(
+    campaign_id: str,
+    entry_id: str,
+    payload: CampaignCollaborationModerationRequest,
+    session: Session = Depends(get_session),
+    principal: ApiPrincipal = Depends(require_scope("campaigns:discussion:moderate")),
+) -> CampaignCollaborationEntryResponse:
+    _get_campaign_for_principal(session, campaign_id, principal)
+    _require_permission(principal, "campaigns:campaign:read")
+    entry = _entry_for_campaign(session, campaign_id=campaign_id, entry_id=entry_id, principal=principal)
+    if entry.redacted_at is not None:
+        return _entry_response(entry)
+    entry.content = None
+    entry.redacted_at = utc_now()
+    entry.redacted_by_user_id = principal.user.id
+    entry.tombstone_reason = payload.reason
+    audit_from_principal(
+        session,
+        principal,
+        action="campaign.collaboration.redacted",
+        object_type="campaign_collaboration_entry",
+        object_id=entry.id,
+        details={
+            "campaign_id": campaign_id,
+            "content_sha256": entry.content_sha256,
+            "reason_recorded": bool(payload.reason),
+            "previously_withdrawn": entry.withdrawn_at is not None,
+            "content_disclosed": False,
+        },
+        commit=True,
+    )
+    session.refresh(entry)
+    return _entry_response(entry)
+
+
+def _entry_for_campaign(
+    session: Session,
+    *,
+    campaign_id: str,
+    entry_id: str,
+    principal: ApiPrincipal,
+) -> CampaignCollaborationEntry:
+    entry = session.get(CampaignCollaborationEntry, entry_id)
+    if (
+        entry is None
+        or entry.tenant_id != principal.tenant_id
+        or entry.campaign_id != campaign_id
+    ):
+        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="Collaboration entry not found")
+    return entry
+
+
+def _validated_reference(
+    session: Session,
+    *,
+    campaign: Campaign,
+    reference: CampaignCollaborationReferenceInput | None,
+) -> tuple[str | None, str, str, str] | None:
+    if reference is None:
+        return None
+    kind = reference.kind
+    reference_id = reference.id
+    version: CampaignVersion | None = None
+    default_label = kind.replace("_", " ").title()
+    if kind == "campaign_version":
+        version = session.get(CampaignVersion, reference_id)
+        if version is not None:
+            default_label = f"Version {version.version_number}"
+    elif kind == "delivery_job":
+        job = session.get(CampaignJob, reference_id)
+        if job is None or job.campaign_id != campaign.id or job.tenant_id != campaign.tenant_id:
+            raise _invalid_reference()
+        version = session.get(CampaignVersion, job.campaign_version_id)
+        default_label = f"Delivery job {job.id[:8]}"
+    elif kind in {"recipient_import_batch", "attachment_rule"}:
+        version_id, separator, child_id = reference_id.partition(":")
+        if not separator or not version_id or not child_id:
+            raise _invalid_reference()
+        version = session.get(CampaignVersion, version_id)
+        if version is not None and kind == "recipient_import_batch":
+            raw = version.raw_json if isinstance(version.raw_json, dict) else {}
+            entries = raw.get("entries") if isinstance(raw.get("entries"), dict) else {}
+            imports = entries.get("imports") if isinstance(entries, dict) else []
+            if not any(isinstance(item, dict) and str(item.get("id") or "") == child_id for item in imports or []):
+                raise _invalid_reference()
+            default_label = "Recipient import batch"
+        elif version is not None:
+            raw = version.raw_json if isinstance(version.raw_json, dict) else {}
+            if child_id not in {path for path, _rule in _attachment_rules(raw)}:
+                raise _invalid_reference()
+            default_label = "Attachment rule"
+    else:
+        referenced_campaign_id, separator, remainder = reference_id.partition(":")
+        version_id, separator_two, report_kind = remainder.partition(":")
+        if (
+            not separator
+            or not separator_two
+            or referenced_campaign_id != campaign.id
+            or not version_id
+            or not report_kind
+        ):
+            raise _invalid_reference()
+        version = session.get(CampaignVersion, version_id)
+        default_label = report_kind.replace("_", " ").title()
+    if version is None or version.campaign_id != campaign.id:
+        raise _invalid_reference()
+    return version.id, kind, reference_id, default_label[:255]
+
+
+def _invalid_reference() -> HTTPException:
+    return HTTPException(
+        status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+        detail="The collaboration reference is not stable evidence owned by this campaign.",
+    )
+
+
+def _validated_mentions(
+    session: Session,
+    *,
+    campaign: Campaign,
+    user_ids: list[str],
+    actor_user_id: str,
+) -> list[str]:
+    mentions = [user_id for user_id in user_ids if user_id != actor_user_id]
+    invalid = [
+        user_id
+        for user_id in mentions
+        if not _mentioned_user_has_campaign_access(
+            session,
+            campaign=campaign,
+            user_id=user_id,
+        )
+    ]
+    if invalid:
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+            detail="Mentioned users must be active and already have access to this campaign.",
+        )
+    return mentions
+
+
+def _mentioned_user_has_campaign_access(
+    session: Session,
+    *,
+    campaign: Campaign,
+    user_id: str,
+) -> bool:
+    directory = _access_directory()
+    user = next(
+        (candidate for candidate in directory.users_for_tenant(campaign.tenant_id) if candidate.id == user_id),
+        None,
+    )
+    if user is None or user.status != "active":
+        return False
+    if campaign.owner_user_id == user_id:
+        return True
+    group_ids = {
+        group.id
+        for group in directory.groups_for_user(user_id, tenant_id=campaign.tenant_id)
+    }
+    if campaign.owner_group_id and campaign.owner_group_id in group_ids:
+        return True
+    clauses = [
+        and_(
+            CampaignShare.target_type == "user",
+            CampaignShare.target_id == user_id,
+        )
+    ]
+    if group_ids:
+        clauses.append(
+            and_(
+                CampaignShare.target_type == "group",
+                CampaignShare.target_id.in_(sorted(group_ids)),
+            )
+        )
+    return (
+        session.query(CampaignShare.id)
+        .filter(
+            CampaignShare.tenant_id == campaign.tenant_id,
+            CampaignShare.campaign_id == campaign.id,
+            CampaignShare.revoked_at.is_(None),
+            or_(*clauses),
+        )
+        .first()
+        is not None
+    )
+
+
+def _enqueue_mention_notifications(
+    session: Session,
+    *,
+    campaign: Campaign,
+    entry: CampaignCollaborationEntry,
+    mention_user_ids: list[str],
+) -> None:
+    provider = notification_dispatch_provider(get_registry())
+    if provider is None or not mention_user_ids:
+        return
+    try:
+        with session.begin_nested():
+            for user_id in mention_user_ids:
+                provider.enqueue_notification(
+                    session,
+                    NotificationDispatchRequest(
+                        tenant_id=campaign.tenant_id,
+                        source_module="campaigns",
+                        source_resource_type="campaign_collaboration_entry",
+                        source_resource_id=entry.id,
+                        event_kind="campaign.collaboration.mentioned",
+                        channel="inbox",
+                        recipient_type="user",
+                        recipient_id=user_id,
+                        subject=f"Mentioned in campaign: {campaign.name}",
+                        body_text=(
+                            f"{entry.actor_label_snapshot} mentioned you in the campaign collaboration thread."
+                        ),
+                        action_url=f"/campaigns/{campaign.id}/activity",
+                        payload={
+                            "campaign_id": campaign.id,
+                            "entry_id": entry.id,
+                            "content_disclosed": False,
+                        },
+                    ),
+                    enqueue_delivery=False,
+                )
+    except Exception:
+        # Collaboration remains available when the optional Notifications
+        # provider is absent or temporarily unhealthy.
+        return
+
+
+def _entry_response(entry: CampaignCollaborationEntry) -> CampaignCollaborationEntryResponse:
+    tombstone: Literal["withdrawn", "redacted"] | None = None
+    if entry.redacted_at is not None:
+        tombstone = "redacted"
+    elif entry.withdrawn_at is not None:
+        tombstone = "withdrawn"
+    reference = None
+    if entry.reference_kind and entry.reference_id:
+        reference = CampaignCollaborationReferenceResponse(
+            kind=entry.reference_kind,  # type: ignore[arg-type]
+            id=entry.reference_id,
+            label=entry.reference_label,
+        )
+    return CampaignCollaborationEntryResponse(
+        id=entry.id,
+        campaign_id=entry.campaign_id,
+        actor_user_id=entry.actor_user_id,
+        actor_label=entry.actor_label_snapshot,
+        visibility=entry.visibility,  # type: ignore[arg-type]
+        content=entry.content if tombstone is None else None,
+        content_sha256=entry.content_sha256,
+        mention_user_ids=list(entry.mention_user_ids or []),
+        reference=reference,
+        tombstone=tombstone,
+        tombstone_reason=entry.tombstone_reason,
+        withdrawn_at=entry.withdrawn_at,
+        redacted_at=entry.redacted_at,
+        created_at=entry.created_at,
+    )
+
+
+def _encode_cursor(entry: CampaignCollaborationEntry) -> str:
+    created_at = entry.created_at
+    if created_at.tzinfo is None:
+        # SQLite returns timezone-aware columns as naive UTC values.
+        created_at = created_at.replace(tzinfo=UTC)
+    payload = json.dumps(
+        {"created_at": created_at.astimezone(UTC).isoformat(), "id": entry.id},
+        separators=(",", ":"),
+        sort_keys=True,
+    ).encode("utf-8")
+    return base64.urlsafe_b64encode(payload).decode("ascii").rstrip("=")
+
+
+def _decode_cursor(value: str) -> tuple[datetime, str]:
+    try:
+        padded = value + "=" * (-len(value) % 4)
+        payload = json.loads(base64.urlsafe_b64decode(padded).decode("utf-8"))
+        created_at = datetime.fromisoformat(str(payload["created_at"]))
+        entry_id = str(payload["id"])
+        if created_at.tzinfo is None or not entry_id or len(entry_id) > 36:
+            raise ValueError
+        return created_at, entry_id
+    except (
+        KeyError,
+        TypeError,
+        ValueError,
+        UnicodeDecodeError,
+        json.JSONDecodeError,
+        binascii.Error,
+    ) as exc:
+        raise HTTPException(
+            status_code=status.HTTP_422_UNPROCESSABLE_CONTENT,
+            detail="Invalid collaboration cursor.",
+        ) from exc

src/govoplan_campaign/backend/schemas.py

@@ -42,6 +42,97 @@ class CampaignUpdateRequest(BaseModel):
     description: str | None = None
 
 
+CampaignCollaborationReferenceKind = Literal[
+    "campaign_version",
+    "recipient_import_batch",
+    "attachment_rule",
+    "delivery_job",
+    "report",
+]
+
+
+class CampaignCollaborationReferenceInput(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    kind: CampaignCollaborationReferenceKind
+    id: str = Field(min_length=1, max_length=500)
+
+    @field_validator("id")
+    @classmethod
+    def strip_reference_text(cls, value: str) -> str:
+        clean = value.strip()
+        if not clean:
+            raise ValueError("A collaboration reference ID cannot be empty.")
+        return clean
+
+
+class CampaignCollaborationCreateRequest(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    content: str = Field(min_length=1, max_length=8_000)
+    visibility: Literal["collaborators", "moderators"] = "collaborators"
+    reference: CampaignCollaborationReferenceInput | None = None
+    mention_user_ids: list[str] = Field(default_factory=list, max_length=20)
+
+    @field_validator("content")
+    @classmethod
+    def strip_content(cls, value: str) -> str:
+        if not value.strip():
+            raise ValueError("A collaboration entry cannot be empty.")
+        return value.strip()
+
+    @field_validator("mention_user_ids")
+    @classmethod
+    def normalize_mentions(cls, value: list[str]) -> list[str]:
+        normalized = list(dict.fromkeys(item.strip() for item in value if item.strip()))
+        if len(normalized) > 20:
+            raise ValueError("A collaboration entry can mention at most 20 users.")
+        if any(len(item) > 64 for item in normalized):
+            raise ValueError("A collaboration mention contains an invalid user ID.")
+        return normalized
+
+
+class CampaignCollaborationModerationRequest(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    reason: str | None = Field(default=None, max_length=500)
+
+    @field_validator("reason")
+    @classmethod
+    def strip_reason(cls, value: str | None) -> str | None:
+        clean = value.strip() if value is not None else None
+        return clean or None
+
+
+class CampaignCollaborationReferenceResponse(BaseModel):
+    kind: CampaignCollaborationReferenceKind
+    id: str
+    label: str | None = None
+
+
+class CampaignCollaborationEntryResponse(BaseModel):
+    id: str
+    campaign_id: str
+    actor_user_id: str | None = None
+    actor_label: str
+    visibility: Literal["collaborators", "moderators"]
+    content: str | None = None
+    content_sha256: str
+    mention_user_ids: list[str] = Field(default_factory=list)
+    reference: CampaignCollaborationReferenceResponse | None = None
+    tombstone: Literal["withdrawn", "redacted"] | None = None
+    tombstone_reason: str | None = None
+    withdrawn_at: datetime | None = None
+    redacted_at: datetime | None = None
+    created_at: datetime
+
+
+class CampaignCollaborationListResponse(BaseModel):
+    items: list[CampaignCollaborationEntryResponse]
+    next_cursor: str | None = None
+    has_more: bool = False
+
+
 class CampaignLifecycleMutationRequest(BaseModel):
     model_config = ConfigDict(extra="forbid")
 

tests/test_access_provider.py

@@ -21,6 +21,7 @@ from govoplan_campaign.backend.db.models import (
     AttachmentBlob,
     AttachmentInstance,
     Campaign,
+    CampaignCollaborationEntry,
     CampaignIssue,
     CampaignJob,
     CampaignMessageAction,
@@ -46,6 +47,61 @@ GROUP_ID = "group-1"
 
 
 class CampaignAccessProviderTests(unittest.TestCase):
+    def test_collaboration_access_is_explained_independently_from_campaign_edit(self) -> None:
+        session = _session()
+        self.addCleanup(_close_session, session)
+        _seed_access_subjects(session)
+        campaign = Campaign(
+            id="campaign-collaboration",
+            tenant_id=TENANT_ID,
+            owner_user_id=OTHER_USER_ID,
+            external_id="collaboration",
+            name="Collaboration campaign",
+        )
+        entry = CampaignCollaborationEntry(
+            id="discussion-1",
+            tenant_id=TENANT_ID,
+            campaign_id=campaign.id,
+            actor_user_id=OTHER_USER_ID,
+            actor_label_snapshot="Other user",
+            visibility="collaborators",
+            content="Not disclosed by provenance",
+            content_sha256="a" * 64,
+        )
+        session.add_all(
+            [
+                campaign,
+                entry,
+                CampaignShare(
+                    id="share-collaboration",
+                    tenant_id=TENANT_ID,
+                    campaign_id=campaign.id,
+                    target_type="group",
+                    target_id=GROUP_ID,
+                    permission="read",
+                ),
+            ]
+        )
+        session.commit()
+
+        items = CampaignAccessService().explain_resource_provenance(
+            session,
+            _principal(
+                scopes={"campaigns:campaign:read", "campaigns:discussion:post"},
+                group_ids={GROUP_ID},
+            ),
+            resource_type="campaign_collaboration_entry",
+            resource_id=entry.id,
+            action="campaigns:discussion:post",
+        )
+
+        discussion = next(item for item in items if item.source == "campaigns.collaboration_entry")
+        self.assertEqual(["campaigns:discussion:post"], discussion.details["permission_actions"])
+        self.assertFalse(discussion.details["content_disclosed"])
+        self.assertTrue(any(item.id == "share-collaboration" for item in items))
+        self.assertNotIn("campaigns:campaign:update", repr(discussion.details))
+        self.assertNotIn("Not disclosed", repr(items))
+
     def test_campaign_access_provider_explains_owner_share_admin_and_missing_resources(self) -> None:
         session = _session()
         self.addCleanup(_close_session, session)
@@ -918,6 +974,7 @@ def _session():
             Group.__table__,
             Campaign.__table__,
             CampaignShare.__table__,
+            CampaignCollaborationEntry.__table__,
             CampaignVersion.__table__,
             CampaignJob.__table__,
             CampaignIssue.__table__,

tests/test_campaign_collaboration.py

@@ -0,0 +1,382 @@
+from __future__ import annotations
+
+import importlib
+from types import SimpleNamespace
+from unittest.mock import patch
+
+import pytest
+from alembic.migration import MigrationContext
+from alembic.operations import Operations
+from fastapi import HTTPException
+from sqlalchemy import create_engine, inspect, text
+from sqlalchemy.orm import Session, sessionmaker
+
+from govoplan_access.backend.db.models import Account, Group, User
+from govoplan_campaign.backend.db.models import (
+    Campaign,
+    CampaignCollaborationEntry,
+    CampaignJob,
+    CampaignShare,
+    CampaignVersion,
+)
+from govoplan_campaign.backend.routes.collaboration import (
+    create_campaign_collaboration_entry,
+    list_campaign_collaboration,
+    redact_campaign_collaboration_entry,
+    withdraw_campaign_collaboration_entry,
+)
+from govoplan_campaign.backend.schemas import (
+    CampaignCollaborationCreateRequest,
+    CampaignCollaborationModerationRequest,
+    CampaignCollaborationReferenceInput,
+)
+from govoplan_core.core.access import GroupRef, UserRef
+from govoplan_core.core.change_sequence import ChangeSequenceEntry
+from govoplan_core.db.base import Base
+
+
+TENANT_ID = "tenant-1"
+
+
+class _Principal:
+    tenant_id = TENANT_ID
+    api_key = None
+
+    def __init__(self, user_id: str, *scopes: str) -> None:
+        self.user = SimpleNamespace(
+            id=user_id,
+            display_name=f"User {user_id}",
+            email=f"{user_id}@example.test",
+        )
+        self.scopes = frozenset(scopes)
+
+    def has(self, scope: str) -> bool:
+        return scope in self.scopes or "tenant:*" in self.scopes
+
+
+class _Directory:
+    users = (
+        UserRef(id="user-1", account_id="account-1", tenant_id=TENANT_ID, display_name="Author"),
+        UserRef(id="user-2", account_id="account-2", tenant_id=TENANT_ID, display_name="Collaborator"),
+        UserRef(id="user-3", account_id="account-3", tenant_id=TENANT_ID, display_name="Unrelated"),
+    )
+
+    def users_for_tenant(self, tenant_id: str):
+        return self.users if tenant_id == TENANT_ID else ()
+
+    def groups_for_user(self, user_id: str, *, tenant_id: str):
+        if tenant_id == TENANT_ID and user_id == "user-2":
+            return (GroupRef(id="group-1", tenant_id=TENANT_ID, name="Collaborators"),)
+        return ()
+
+
+class _Notifications:
+    def __init__(self) -> None:
+        self.requests = []
+
+    def enqueue_notification(self, _session, request, *, enqueue_delivery: bool = True):
+        self.requests.append((request, enqueue_delivery))
+        return {"id": f"notification-{len(self.requests)}"}
+
+
+class _UnavailableNotifications:
+    def enqueue_notification(self, _session, _request, *, enqueue_delivery: bool = True):
+        raise RuntimeError("Notifications is temporarily unavailable")
+
+
+@pytest.fixture()
+def session() -> Session:
+    engine = create_engine("sqlite+pysqlite:///:memory:")
+    Base.metadata.create_all(
+        engine,
+        tables=[
+            Account.__table__,
+            User.__table__,
+            Group.__table__,
+            ChangeSequenceEntry.__table__,
+            Campaign.__table__,
+            CampaignVersion.__table__,
+            CampaignJob.__table__,
+            CampaignShare.__table__,
+            CampaignCollaborationEntry.__table__,
+        ],
+    )
+    session_factory = sessionmaker(bind=engine, class_=Session, expire_on_commit=False)
+    database = session_factory()
+    database.add_all(
+        [
+            Account(id=f"account-{number}", email=f"user-{number}@example.test", normalized_email=f"user-{number}@example.test")
+            for number in range(1, 4)
+        ]
+    )
+    database.flush()
+    database.add_all(
+        [
+            User(id=f"user-{number}", tenant_id=TENANT_ID, account_id=f"account-{number}", email=f"user-{number}@example.test")
+            for number in range(1, 4)
+        ]
+    )
+    database.add(Group(id="group-1", tenant_id=TENANT_ID, slug="collaborators", name="Collaborators"))
+    campaign = Campaign(
+        id="campaign-1",
+        tenant_id=TENANT_ID,
+        owner_user_id="user-1",
+        external_id="campaign-1",
+        name="Campaign One",
+        current_version_id="version-1",
+    )
+    version = CampaignVersion(
+        id="version-1",
+        campaign_id=campaign.id,
+        version_number=1,
+        raw_json={
+            "version": "1.0",
+            "entries": {"imports": [{"id": "import-1", "source_type": "csv"}]},
+            "attachments": {"global": [{"label": "Notice"}]},
+        },
+    )
+    database.add_all(
+        [
+            campaign,
+            version,
+            CampaignShare(
+                id="share-1",
+                tenant_id=TENANT_ID,
+                campaign_id=campaign.id,
+                target_type="group",
+                target_id="group-1",
+                permission="read",
+            ),
+            CampaignJob(
+                id="job-1",
+                tenant_id=TENANT_ID,
+                campaign_id=campaign.id,
+                campaign_version_id=version.id,
+                entry_index=0,
+            ),
+        ]
+    )
+    database.commit()
+    try:
+        yield database
+    finally:
+        database.close()
+        engine.dispose()
+
+
+def _commit_audit(session: Session, *_args, **_kwargs) -> None:
+    session.commit()
+
+
+def _principal(user_id: str = "user-1", *, moderate: bool = False) -> _Principal:
+    scopes = [
+        "campaigns:campaign:read",
+        "campaigns:discussion:read",
+        "campaigns:discussion:post",
+    ]
+    if moderate:
+        scopes.append("campaigns:discussion:moderate")
+    return _Principal(user_id, *scopes)
+
+
+def test_post_is_append_only_references_a_version_and_notifies_authorized_mentions(session: Session) -> None:
+    notifications = _Notifications()
+    original_version = dict(session.get(CampaignVersion, "version-1").raw_json)
+    with (
+        patch("govoplan_campaign.backend.routes.collaboration._access_directory", return_value=_Directory()),
+        patch("govoplan_campaign.backend.routes.collaboration.notification_dispatch_provider", return_value=notifications),
+        patch("govoplan_campaign.backend.routes.collaboration.audit_from_principal", side_effect=_commit_audit) as audit,
+    ):
+        response = create_campaign_collaboration_entry(
+            "campaign-1",
+            CampaignCollaborationCreateRequest(
+                content="Please review the frozen version.",
+                mention_user_ids=["user-2", "user-1", "user-2"],
+                reference=CampaignCollaborationReferenceInput(
+                    kind="campaign_version",
+                    id="version-1",
+                ),
+            ),
+            session,
+            _principal(),
+        )
+
+    assert response.content == "Please review the frozen version."
+    assert response.reference is not None
+    assert response.reference.label == "Version 1"
+    assert response.mention_user_ids == ["user-2"]
+    assert session.get(CampaignVersion, "version-1").raw_json == original_version
+    assert len(notifications.requests) == 1
+    notification, enqueue_delivery = notifications.requests[0]
+    assert notification.recipient_id == "user-2"
+    assert notification.payload["content_disclosed"] is False
+    assert enqueue_delivery is False
+    details = audit.call_args.kwargs["details"]
+    assert details["content_disclosed"] is False
+    assert "Please review" not in repr(details)
+
+
+def test_mentions_reject_users_without_campaign_access(session: Session) -> None:
+    with patch("govoplan_campaign.backend.routes.collaboration._access_directory", return_value=_Directory()):
+        with pytest.raises(HTTPException) as raised:
+            create_campaign_collaboration_entry(
+                "campaign-1",
+                CampaignCollaborationCreateRequest(content="No leak", mention_user_ids=["user-3"]),
+                session,
+                _principal(),
+            )
+    assert raised.value.status_code == 422
+    assert session.query(CampaignCollaborationEntry).count() == 0
+
+
+def test_notification_failure_does_not_block_or_roll_back_collaboration(session: Session) -> None:
+    with (
+        patch("govoplan_campaign.backend.routes.collaboration._access_directory", return_value=_Directory()),
+        patch(
+            "govoplan_campaign.backend.routes.collaboration.notification_dispatch_provider",
+            return_value=_UnavailableNotifications(),
+        ),
+        patch("govoplan_campaign.backend.routes.collaboration.audit_from_principal", side_effect=_commit_audit),
+    ):
+        response = create_campaign_collaboration_entry(
+            "campaign-1",
+            CampaignCollaborationCreateRequest(
+                content="This discussion entry must survive an optional integration outage.",
+                mention_user_ids=["user-2"],
+            ),
+            session,
+            _principal(),
+        )
+
+    stored = session.get(CampaignCollaborationEntry, response.id)
+    assert stored is not None
+    assert stored.content == response.content
+    assert stored.mention_user_ids == ["user-2"]
+
+
+def test_collaboration_migration_is_repeatable_and_creates_thread_index() -> None:
+    migration = importlib.import_module(
+        "govoplan_campaign.backend.migrations.versions."
+        "c7d8e9f0a1b2_v0120_campaign_collaboration"
+    )
+    engine = create_engine("sqlite+pysqlite:///:memory:")
+    with engine.begin() as connection:
+        connection.execute(text("CREATE TABLE access_users (id VARCHAR(36) PRIMARY KEY)"))
+        connection.execute(text("CREATE TABLE campaigns (id VARCHAR(36) PRIMARY KEY)"))
+        connection.execute(
+            text(
+                "CREATE TABLE campaign_versions ("
+                "id VARCHAR(36) PRIMARY KEY, campaign_id VARCHAR(36) NOT NULL)"
+            )
+        )
+        context = MigrationContext.configure(connection)
+        with patch.object(migration, "op", Operations(context)):
+            migration.upgrade()
+            migration.upgrade()
+
+        inspector = inspect(connection)
+        columns = {
+            column["name"]
+            for column in inspector.get_columns("campaign_collaboration_entries")
+        }
+        indexes = {
+            index["name"]
+            for index in inspector.get_indexes("campaign_collaboration_entries")
+        }
+
+        assert {
+            "campaign_id",
+            "campaign_version_id",
+            "content_sha256",
+            "mention_user_ids",
+            "withdrawn_at",
+            "redacted_at",
+        }.issubset(columns)
+        assert "ix_campaign_collaboration_entries_thread" in indexes
+
+        with patch.object(migration, "op", Operations(context)):
+            migration.downgrade()
+        assert not inspect(connection).has_table("campaign_collaboration_entries")
+
+
+def test_visibility_pagination_withdrawal_and_redaction_leave_tombstones(session: Session) -> None:
+    with (
+        patch("govoplan_campaign.backend.routes.collaboration.notification_dispatch_provider", return_value=None),
+        patch("govoplan_campaign.backend.routes.collaboration.audit_from_principal", side_effect=_commit_audit),
+    ):
+        public_entry = create_campaign_collaboration_entry(
+            "campaign-1",
+            CampaignCollaborationCreateRequest(content="Visible discussion"),
+            session,
+            _principal(),
+        )
+        moderator_entry = create_campaign_collaboration_entry(
+            "campaign-1",
+            CampaignCollaborationCreateRequest(content="Restricted discussion", visibility="moderators"),
+            session,
+            _principal(moderate=True),
+        )
+        ordinary = list_campaign_collaboration("campaign-1", 1, None, session, _principal())
+        moderated = list_campaign_collaboration("campaign-1", 1, None, session, _principal(moderate=True))
+        withdrawn = withdraw_campaign_collaboration_entry(
+            "campaign-1",
+            public_entry.id,
+            CampaignCollaborationModerationRequest(reason="Posted in error"),
+            session,
+            _principal(),
+        )
+        redacted = redact_campaign_collaboration_entry(
+            "campaign-1",
+            moderator_entry.id,
+            CampaignCollaborationModerationRequest(reason="Contains restricted material"),
+            session,
+            _principal(moderate=True),
+        )
+
+    assert [entry.id for entry in ordinary.items] == [public_entry.id]
+    assert ordinary.has_more is False
+    assert [entry.id for entry in moderated.items] == [moderator_entry.id]
+    assert moderated.has_more is True
+    assert moderated.next_cursor
+    second_page = list_campaign_collaboration(
+        "campaign-1",
+        1,
+        moderated.next_cursor,
+        session,
+        _principal(moderate=True),
+    )
+    assert [entry.id for entry in second_page.items] == [public_entry.id]
+    assert withdrawn.tombstone == "withdrawn"
+    assert withdrawn.content is None
+    assert redacted.tombstone == "redacted"
+    assert redacted.content is None
+    assert session.get(CampaignCollaborationEntry, public_entry.id).content is None
+    assert session.get(CampaignCollaborationEntry, redacted.id).content_sha256 == redacted.content_sha256
+
+
+@pytest.mark.parametrize(
+    ("kind", "reference_id"),
+    [
+        ("recipient_import_batch", "version-1:import-1"),
+        ("attachment_rule", "version-1:attachments.global[0]"),
+        ("delivery_job", "job-1"),
+        ("report", "campaign-1:version-1:delivery"),
+    ],
+)
+def test_supported_reference_contexts_are_validated(session: Session, kind: str, reference_id: str) -> None:
+    with (
+        patch("govoplan_campaign.backend.routes.collaboration.notification_dispatch_provider", return_value=None),
+        patch("govoplan_campaign.backend.routes.collaboration.audit_from_principal", side_effect=_commit_audit),
+    ):
+        response = create_campaign_collaboration_entry(
+            "campaign-1",
+            CampaignCollaborationCreateRequest(
+                content="Reference context",
+                reference=CampaignCollaborationReferenceInput(kind=kind, id=reference_id),  # type: ignore[arg-type]
+            ),
+            session,
+            _principal(),
+        )
+    assert response.reference is not None
+    assert response.reference.kind == kind
+    assert response.reference.id == reference_id

tests/test_documentation.py

@@ -476,6 +476,11 @@ def test_static_campaign_handbook_has_unique_ids_help_contexts_and_no_planned_re
         "campaign.report",
         "campaign.audit",
             "campaign.json",
+            "campaign.activity",
+            "campaign.activity.composer",
+            "campaign.activity.action.post",
+            "campaign.activity.action.withdraw",
+            "campaign.activity.action.redact",
         }
 
     assert len(ids) == len(set(ids))

tests/test_dsar_provider.py

@@ -11,6 +11,7 @@ from govoplan_campaign.backend.db.models import (
     AttachmentBlob,
     AttachmentInstance,
     Campaign,
+    CampaignCollaborationEntry,
     CampaignIssue,
     CampaignJob,
     CampaignMessageAction,
@@ -100,6 +101,7 @@ class CampaignDsarProviderTests(unittest.TestCase):
                 DataSubjectRequest.__table__,
                 Campaign.__table__,
                 CampaignShare.__table__,
+                CampaignCollaborationEntry.__table__,
                 CampaignVersion.__table__,
                 CampaignJob.__table__,
                 CampaignIssue.__table__,
@@ -337,6 +339,21 @@ class CampaignDsarProviderTests(unittest.TestCase):
             permission="read",
             created_by_user_id=self.other_user.id,
         )
+        collaboration = CampaignCollaborationEntry(
+            id="collaboration-1",
+            tenant_id="tenant-1",
+            campaign_id=self.campaign.id,
+            campaign_version_id=self.version.id,
+            actor_user_id=self.user.id,
+            actor_label_snapshot="Subject",
+            visibility="collaborators",
+            content="Subject-authored discussion text",
+            content_sha256="9" * 64,
+            mention_user_ids=[self.other_user.id],
+            reference_kind="campaign_version",
+            reference_id=self.version.id,
+            reference_label="Version 1",
+        )
         self.profile = RecipientImportMappingProfile(
             id="mapping-1",
             tenant_id="tenant-1",
@@ -410,6 +427,7 @@ class CampaignDsarProviderTests(unittest.TestCase):
                 postbox_attempt,
                 print_attempt,
                 self.share,
+                collaboration,
                 self.profile,
                 blob,
                 attachment,
@@ -456,11 +474,22 @@ class CampaignDsarProviderTests(unittest.TestCase):
                 "campaign_print_attempt",
                 "campaign_report_projection",
                 "campaign_share",
+                "campaign_collaboration_entry",
                 "recipient_import_mapping_profile",
                 "campaign_schedule",
                 "campaign_attachment",
             }.issubset(resource_types)
         )
+        collaboration_record = next(
+            record
+            for record in records
+            if record.resource_type == "campaign_collaboration_entry"
+        )
+        self.assertEqual(
+            "Subject-authored discussion text",
+            collaboration_record.data["posted_text"],
+        )
+        self.assertTrue(collaboration_record.immutable_evidence)
         report = next(
             record
             for record in records

tests/test_route_registration.py

@@ -5,6 +5,7 @@ from collections import Counter
 from govoplan_campaign.backend.router import router
 from govoplan_campaign.backend.routes.attachments import router as attachments_router
 from govoplan_campaign.backend.routes.campaigns import router as campaigns_router
+from govoplan_campaign.backend.routes.collaboration import router as collaboration_router
 from govoplan_campaign.backend.routes.delivery import router as delivery_router
 from govoplan_campaign.backend.routes.jobs import router as jobs_router
 from govoplan_campaign.backend.routes.operations import router as operations_router
@@ -26,6 +27,7 @@ def test_campaign_router_composes_every_workflow_operation_once() -> None:
     workflow_routers = (
         operations_router,
         campaigns_router,
+        collaboration_router,
         versions_router,
         jobs_router,
         reports_router,
@@ -42,7 +44,7 @@ def test_campaign_router_composes_every_workflow_operation_once() -> None:
     actual = _operation_keys(router)
 
     assert actual == expected
-    assert len(actual) == 81
+    assert len(actual) == 86
     assert not [operation for operation, count in Counter(actual).items() if count > 1]
 
 
@@ -53,6 +55,7 @@ def test_key_routes_are_owned_by_their_focused_router() -> None:
             ("POST", "/campaigns/operations/artifacts/reconcile"),
         ),
         (campaigns_router, ("GET", "/campaigns/{campaign_id}/workspace")),
+        (collaboration_router, ("POST", "/campaigns/{campaign_id}/collaboration")),
         (versions_router, ("POST", "/campaigns/versions/{version_id}/build")),
         (jobs_router, ("GET", "/campaigns/{campaign_id}/jobs")),
         (reports_router, ("GET", "/campaigns/{campaign_id}/report")),

webui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@govoplan/campaign-webui",
-  "version": "0.1.19",
+  "version": "0.1.20",
   "private": true,
   "type": "module",
   "main": "src/index.ts",
@@ -35,7 +35,8 @@
     "test:aggregate-report": "tsc -p tsconfig.aggregate-report-tests.json && node tests/aggregate-report-ui-structure.test.mjs",
     "test:wizards": "node tests/wizard-directory-ui-structure.test.mjs",
     "test:accessibility-contract": "node tests/accessibility-contract.test.mjs",
-    "test:campaign-lifecycle": "node tests/campaign-lifecycle-ui-structure.test.mjs"
+    "test:campaign-lifecycle": "node tests/campaign-lifecycle-ui-structure.test.mjs",
+    "test:campaign-collaboration": "node tests/campaign-collaboration-ui-structure.test.mjs"
   },
   "devDependencies": {
     "typescript": "^5.7.2"

webui/src/api/campaigns.ts

@@ -38,6 +38,49 @@ export type CampaignShare = {
 export type CampaignShareTarget = {id: string;name: string;secondary?: string | null;};
 export type CampaignShareTargets = {users: CampaignShareTarget[];groups: CampaignShareTarget[];};
 
+export type CampaignCollaborationReferenceKind =
+  | "campaign_version"
+  | "recipient_import_batch"
+  | "attachment_rule"
+  | "delivery_job"
+  | "report";
+
+export type CampaignCollaborationReference = {
+  kind: CampaignCollaborationReferenceKind;
+  id: string;
+  label?: string | null;
+};
+
+export type CampaignCollaborationEntry = {
+  id: string;
+  campaign_id: string;
+  actor_user_id?: string | null;
+  actor_label: string;
+  visibility: "collaborators" | "moderators";
+  content?: string | null;
+  content_sha256: string;
+  mention_user_ids: string[];
+  reference?: CampaignCollaborationReference | null;
+  tombstone?: "withdrawn" | "redacted" | null;
+  tombstone_reason?: string | null;
+  withdrawn_at?: string | null;
+  redacted_at?: string | null;
+  created_at: string;
+};
+
+export type CampaignCollaborationListResponse = {
+  items: CampaignCollaborationEntry[];
+  next_cursor?: string | null;
+  has_more: boolean;
+};
+
+export type CampaignCollaborationCreate = {
+  content: string;
+  visibility?: CampaignCollaborationEntry["visibility"];
+  reference?: Pick<CampaignCollaborationReference, "kind" | "id"> | null;
+  mention_user_ids?: string[];
+};
+
 export type CampaignArchiveEncryptionPolicy = {
   available: boolean;
   allowed_password_encryption_methods: Array<"aes" | "zip_standard">;
@@ -1763,6 +1806,65 @@ export async function getCampaignShareTargets(settings: ApiSettings, campaignId:
   return apiFetch<CampaignShareTargets>(settings, `/api/v1/campaigns/${campaignId}/share-targets`);
 }
 
+export async function listCampaignCollaboration(
+  settings: ApiSettings,
+  campaignId: string,
+  options: {cursor?: string | null;limit?: number;} = {}
+): Promise<CampaignCollaborationListResponse> {
+  const params = new URLSearchParams({ limit: String(options.limit ?? 25) });
+  if (options.cursor) params.set("cursor", options.cursor);
+  return apiFetch<CampaignCollaborationListResponse>(
+    settings,
+    `/api/v1/campaigns/${encodeURIComponent(campaignId)}/collaboration?${params.toString()}`
+  );
+}
+
+export async function createCampaignCollaborationEntry(
+  settings: ApiSettings,
+  campaignId: string,
+  payload: CampaignCollaborationCreate
+): Promise<CampaignCollaborationEntry> {
+  return apiFetch<CampaignCollaborationEntry>(
+    settings,
+    `/api/v1/campaigns/${encodeURIComponent(campaignId)}/collaboration`,
+    { method: "POST", body: JSON.stringify(payload) }
+  );
+}
+
+export async function withdrawCampaignCollaborationEntry(
+  settings: ApiSettings,
+  campaignId: string,
+  entryId: string
+): Promise<CampaignCollaborationEntry> {
+  return apiFetch<CampaignCollaborationEntry>(
+    settings,
+    `/api/v1/campaigns/${encodeURIComponent(campaignId)}/collaboration/${encodeURIComponent(entryId)}/withdraw`,
+    { method: "POST", body: JSON.stringify({}) }
+  );
+}
+
+export async function redactCampaignCollaborationEntry(
+  settings: ApiSettings,
+  campaignId: string,
+  entryId: string
+): Promise<CampaignCollaborationEntry> {
+  return apiFetch<CampaignCollaborationEntry>(
+    settings,
+    `/api/v1/campaigns/${encodeURIComponent(campaignId)}/collaboration/${encodeURIComponent(entryId)}/redact`,
+    { method: "POST", body: JSON.stringify({}) }
+  );
+}
+
+export function campaignCollaborationMentionProvider(
+  settings: ApiSettings,
+  campaignId: string
+): ReferenceOptionProvider {
+  return apiReferenceOptionProvider(
+    settings,
+    `/api/v1/campaigns/${encodeURIComponent(campaignId)}/collaboration/mention-options`
+  );
+}
+
 export function campaignShareTargetProvider(
   settings: ApiSettings,
   campaignId: string,

webui/src/features/campaigns/CampaignCollaborationPage.tsx

@@ -0,0 +1,426 @@
+import { useCallback, useEffect, useMemo, useState } from "react";
+import { MessageSquare, ShieldCheck, UserRound } from "lucide-react";
+import {
+  Button,
+  Card,
+  ConfirmDialog,
+  DismissibleAlert,
+  FormField,
+  PageActionBar,
+  PageLayout,
+  ReferenceMultiSelect,
+  StatusBadge,
+  hasScope
+} from "@govoplan/core-webui";
+import type { ApiSettings, AuthInfo } from "../../types";
+import {
+  campaignCollaborationMentionProvider,
+  createCampaignCollaborationEntry,
+  listCampaignCollaboration,
+  redactCampaignCollaborationEntry,
+  withdrawCampaignCollaborationEntry,
+  type CampaignCollaborationCreate,
+  type CampaignCollaborationEntry,
+  type CampaignCollaborationReferenceKind
+} from "../../api/campaigns";
+import { useCampaignWorkspaceData } from "./hooks/useCampaignWorkspaceData";
+
+type PendingTombstone = {
+  action: "withdraw" | "redact";
+  entry: CampaignCollaborationEntry;
+} | null;
+
+export default function CampaignCollaborationPage({
+  settings,
+  auth,
+  campaignId
+}: {
+  settings: ApiSettings;
+  auth: AuthInfo;
+  campaignId: string;
+}) {
+  const workspace = useCampaignWorkspaceData(settings, campaignId);
+  const [entries, setEntries] = useState<CampaignCollaborationEntry[]>([]);
+  const [nextCursor, setNextCursor] = useState<string | null>(null);
+  const [hasMore, setHasMore] = useState(false);
+  const [loadingThread, setLoadingThread] = useState(true);
+  const [loadingMore, setLoadingMore] = useState(false);
+  const [error, setError] = useState("");
+  const [message, setMessage] = useState("");
+  const [content, setContent] = useState("");
+  const [visibility, setVisibility] = useState<CampaignCollaborationEntry["visibility"]>("collaborators");
+  const [mentionUserIds, setMentionUserIds] = useState<string[]>([]);
+  const [referenceKind, setReferenceKind] = useState<CampaignCollaborationReferenceKind | "">("");
+  const [referenceId, setReferenceId] = useState("");
+  const [posting, setPosting] = useState(false);
+  const [pendingTombstone, setPendingTombstone] = useState<PendingTombstone>(null);
+  const [tombstoneBusy, setTombstoneBusy] = useState(false);
+  const canPost = hasScope(auth, "campaigns:discussion:post");
+  const canModerate = hasScope(auth, "campaigns:discussion:moderate");
+  const mentionProvider = useMemo(
+    () => campaignCollaborationMentionProvider(settings, campaignId),
+    [campaignId, settings]
+  );
+
+  const loadThread = useCallback(async () => {
+    setLoadingThread(true);
+    setError("");
+    try {
+      const response = await listCampaignCollaboration(settings, campaignId);
+      setEntries(response.items);
+      setNextCursor(response.next_cursor ?? null);
+      setHasMore(response.has_more);
+    } catch (err) {
+      setError(errorText(err));
+    } finally {
+      setLoadingThread(false);
+    }
+  }, [campaignId, settings]);
+
+  useEffect(() => {
+    void loadThread();
+  }, [loadThread]);
+
+  async function reload() {
+    setMessage("");
+    await Promise.all([loadThread(), workspace.reload({ force: true })]);
+  }
+
+  async function loadOlder() {
+    if (!nextCursor || loadingMore) return;
+    setLoadingMore(true);
+    setError("");
+    try {
+      const response = await listCampaignCollaboration(settings, campaignId, {
+        cursor: nextCursor
+      });
+      setEntries((current) => [
+        ...current,
+        ...response.items.filter((entry) => !current.some((item) => item.id === entry.id))
+      ]);
+      setNextCursor(response.next_cursor ?? null);
+      setHasMore(response.has_more);
+    } catch (err) {
+      setError(errorText(err));
+    } finally {
+      setLoadingMore(false);
+    }
+  }
+
+  async function postEntry() {
+    const cleanContent = content.trim();
+    if (!cleanContent || posting || (referenceKind && !referenceId.trim())) return;
+    setPosting(true);
+    setError("");
+    setMessage("");
+    try {
+      const payload: CampaignCollaborationCreate = {
+        content: cleanContent,
+        visibility,
+        mention_user_ids: mentionUserIds
+      };
+      if (referenceKind) {
+        payload.reference = {
+          kind: referenceKind,
+          id: referenceId.trim()
+        };
+      }
+      const created = await createCampaignCollaborationEntry(settings, campaignId, payload);
+      setEntries((current) => [created, ...current.filter((entry) => entry.id !== created.id)]);
+      setContent("");
+      setVisibility("collaborators");
+      setMentionUserIds([]);
+      setReferenceKind("");
+      setReferenceId("");
+      setMessage("i18n:govoplan-campaign.collaboration_posted");
+    } catch (err) {
+      setError(errorText(err));
+    } finally {
+      setPosting(false);
+    }
+  }
+
+  async function applyTombstone() {
+    if (!pendingTombstone || tombstoneBusy) return;
+    setTombstoneBusy(true);
+    setError("");
+    try {
+      const updated = pendingTombstone.action === "withdraw"
+        ? await withdrawCampaignCollaborationEntry(settings, campaignId, pendingTombstone.entry.id)
+        : await redactCampaignCollaborationEntry(settings, campaignId, pendingTombstone.entry.id);
+      setEntries((current) => current.map((entry) => entry.id === updated.id ? updated : entry));
+      setMessage(pendingTombstone.action === "withdraw"
+        ? "i18n:govoplan-campaign.collaboration_withdrawn"
+        : "i18n:govoplan-campaign.collaboration_redacted");
+      setPendingTombstone(null);
+    } catch (err) {
+      setError(errorText(err));
+    } finally {
+      setTombstoneBusy(false);
+    }
+  }
+
+  const referenceNeedsTypedId = Boolean(referenceKind && referenceKind !== "campaign_version");
+
+  return (
+    <PageLayout
+      archetype="collection"
+      mode="workspace"
+      interfaceId="campaigns.page.activity"
+      helpContextId="campaign.activity"
+      helpModuleId="campaign"
+      title="i18n:govoplan-campaign.collaboration"
+      description="i18n:govoplan-campaign.collaboration_description"
+      loading={loadingThread || workspace.loading}
+      loadingLabel="i18n:govoplan-campaign.loading_collaboration"
+      error={error || workspace.error}
+      success={message}
+      actions={
+        <PageActionBar
+          variant="collection"
+          refreshable
+          reloadAction={{
+            onReload: () => void reload(),
+            loading: loadingThread || workspace.loading
+          }}
+        />
+      }
+    >
+      <DismissibleAlert tone="info" resetKey={campaignId}>
+        i18n:govoplan-campaign.collaboration_audit_boundary
+      </DismissibleAlert>
+
+      {canPost ? (
+        <Card
+          title="i18n:govoplan-campaign.new_collaboration_entry"
+          interfaceId="campaigns.activity.composer"
+          helpContextId="campaign.activity.composer"
+          helpModuleId="campaign"
+        >
+          <div className="campaign-collaboration-composer">
+            <FormField
+              label="i18n:govoplan-campaign.comment"
+              help="i18n:govoplan-campaign.comment_help"
+            >
+              <textarea
+                rows={5}
+                maxLength={8000}
+                value={content}
+                onChange={(event) => setContent(event.target.value)}
+                disabled={posting}
+              />
+            </FormField>
+            <div className="campaign-collaboration-counter" aria-live="polite">
+              {content.length} / 8000
+            </div>
+            <div className="campaign-collaboration-options">
+              {canModerate ? (
+                <FormField
+                  label="i18n:govoplan-campaign.visibility"
+                  help="i18n:govoplan-campaign.visibility_help"
+                >
+                  <select
+                    value={visibility}
+                    onChange={(event) => setVisibility(event.target.value as CampaignCollaborationEntry["visibility"])}
+                    disabled={posting}
+                  >
+                    <option value="collaborators">i18n:govoplan-campaign.visibility_collaborators</option>
+                    <option value="moderators">i18n:govoplan-campaign.visibility_moderators</option>
+                  </select>
+                </FormField>
+              ) : null}
+              <FormField
+                label="i18n:govoplan-campaign.reference_context"
+                help="i18n:govoplan-campaign.reference_context_help"
+              >
+                <select
+                  value={referenceKind}
+                  onChange={(event) => {
+                    setReferenceKind(event.target.value as CampaignCollaborationReferenceKind | "");
+                    setReferenceId("");
+                  }}
+                  disabled={posting}
+                >
+                  <option value="">i18n:govoplan-campaign.no_reference</option>
+                  <option value="campaign_version">i18n:govoplan-campaign.reference_campaign_version</option>
+                  <option value="recipient_import_batch">i18n:govoplan-campaign.reference_recipient_import</option>
+                  <option value="attachment_rule">i18n:govoplan-campaign.reference_attachment_rule</option>
+                  <option value="delivery_job">i18n:govoplan-campaign.reference_delivery_job</option>
+                  <option value="report">i18n:govoplan-campaign.reference_report</option>
+                </select>
+              </FormField>
+              {referenceKind === "campaign_version" ? (
+                <FormField label="i18n:govoplan-campaign.campaign_version">
+                  <select
+                    value={referenceId}
+                    onChange={(event) => setReferenceId(event.target.value)}
+                    disabled={posting}
+                  >
+                    <option value="">i18n:govoplan-campaign.select_version</option>
+                    {workspace.data.versions.map((version) => (
+                      <option key={version.id} value={version.id}>
+                        Version {version.version_number}
+                      </option>
+                    ))}
+                  </select>
+                </FormField>
+              ) : null}
+              {referenceNeedsTypedId ? (
+                <FormField
+                  label="i18n:govoplan-campaign.stable_reference_id"
+                  help="i18n:govoplan-campaign.stable_reference_id_help"
+                >
+                  <input
+                    value={referenceId}
+                    maxLength={500}
+                    onChange={(event) => setReferenceId(event.target.value)}
+                    disabled={posting}
+                  />
+                </FormField>
+              ) : null}
+              <FormField
+                label="i18n:govoplan-campaign.mentions"
+                help="i18n:govoplan-campaign.mentions_help"
+              >
+                <ReferenceMultiSelect
+                  values={mentionUserIds}
+                  onChange={setMentionUserIds}
+                  provider={mentionProvider}
+                  disabled={posting}
+                  aria-label="Mention campaign collaborators"
+                  placeholder="i18n:govoplan-campaign.add_mention"
+                  searchLimit={20}
+                />
+              </FormField>
+            </div>
+            <div className="button-row compact-actions campaign-collaboration-submit">
+              <Button
+                variant="primary"
+                onClick={() => void postEntry()}
+                disabled={posting || !content.trim() || Boolean(referenceKind && !referenceId.trim())}
+                helpContextId="campaign.activity.action.post"
+                helpModuleId="campaign"
+              >
+                <MessageSquare size={16} aria-hidden="true" />
+                {posting ? "i18n:govoplan-campaign.posting" : "i18n:govoplan-campaign.post_comment"}
+              </Button>
+            </div>
+          </div>
+        </Card>
+      ) : (
+        <DismissibleAlert tone="info" resetKey={`${campaignId}:read-only`}>
+          i18n:govoplan-campaign.collaboration_read_only
+        </DismissibleAlert>
+      )}
+
+      <Card title="i18n:govoplan-campaign.discussion" interfaceId="campaigns.activity.thread">
+        {entries.length === 0 ? (
+          <p className="muted">i18n:govoplan-campaign.no_collaboration_entries</p>
+        ) : (
+          <ol className="campaign-collaboration-thread" aria-label="Campaign collaboration thread">
+            {entries.map((entry) => {
+              const ownEntry = entry.actor_user_id === auth.user.id;
+              return (
+                <li key={entry.id} className="campaign-collaboration-entry">
+                  <article aria-labelledby={`campaign-collaboration-${entry.id}-actor`}>
+                    <header className="campaign-collaboration-entry-header">
+                      <span className="campaign-collaboration-actor" id={`campaign-collaboration-${entry.id}-actor`}>
+                        <UserRound size={16} aria-hidden="true" />
+                        {entry.actor_label}
+                      </span>
+                      <time dateTime={entry.created_at}>{formatDateTime(entry.created_at)}</time>
+                      {entry.visibility === "moderators" ? (
+                        <StatusBadge status="restricted" label="i18n:govoplan-campaign.moderators_only" />
+                      ) : null}
+                    </header>
+                    {entry.tombstone ? (
+                      <div className="campaign-collaboration-tombstone" role="status">
+                        <ShieldCheck size={17} aria-hidden="true" />
+                        <span>
+                          {entry.tombstone === "redacted"
+                            ? "i18n:govoplan-campaign.entry_redacted_tombstone"
+                            : "i18n:govoplan-campaign.entry_withdrawn_tombstone"}
+                        </span>
+                      </div>
+                    ) : (
+                      <p className="campaign-collaboration-content">{entry.content}</p>
+                    )}
+                    {entry.reference ? (
+                      <p className="campaign-collaboration-reference">
+                        <strong>i18n:govoplan-campaign.reference_label</strong>{" "}
+                        {entry.reference.label || entry.reference.kind.replaceAll("_", " ")}
+                        <code>{entry.reference.id}</code>
+                      </p>
+                    ) : null}
+                    {!entry.tombstone && (ownEntry || canModerate) ? (
+                      <div className="button-row compact-actions campaign-collaboration-entry-actions">
+                        {ownEntry && canPost ? (
+                          <Button
+                            onClick={() => setPendingTombstone({ action: "withdraw", entry })}
+                            helpContextId="campaign.activity.action.withdraw"
+                            helpModuleId="campaign"
+                          >
+                            i18n:govoplan-campaign.withdraw
+                          </Button>
+                        ) : null}
+                        {canModerate ? (
+                          <Button
+                            variant="danger"
+                            onClick={() => setPendingTombstone({ action: "redact", entry })}
+                            helpContextId="campaign.activity.action.redact"
+                            helpModuleId="campaign"
+                          >
+                            i18n:govoplan-campaign.redact
+                          </Button>
+                        ) : null}
+                      </div>
+                    ) : null}
+                  </article>
+                </li>
+              );
+            })}
+          </ol>
+        )}
+        {hasMore ? (
+          <div className="button-row compact-actions campaign-collaboration-load-more">
+            <Button onClick={() => void loadOlder()} disabled={loadingMore}>
+              {loadingMore ? "i18n:govoplan-campaign.loading_older_entries" : "i18n:govoplan-campaign.load_older_entries"}
+            </Button>
+          </div>
+        ) : null}
+      </Card>
+
+      <ConfirmDialog
+        open={Boolean(pendingTombstone)}
+        title={pendingTombstone?.action === "redact"
+          ? "i18n:govoplan-campaign.redact_collaboration_entry"
+          : "i18n:govoplan-campaign.withdraw_collaboration_entry"}
+        message={pendingTombstone?.action === "redact"
+          ? "i18n:govoplan-campaign.redact_collaboration_entry_confirmation"
+          : "i18n:govoplan-campaign.withdraw_collaboration_entry_confirmation"}
+        confirmLabel={pendingTombstone?.action === "redact"
+          ? "i18n:govoplan-campaign.redact"
+          : "i18n:govoplan-campaign.withdraw"}
+        tone="danger"
+        busy={tombstoneBusy}
+        helpContextId={pendingTombstone?.action === "redact"
+          ? "campaign.activity.action.redact"
+          : "campaign.activity.action.withdraw"}
+        helpModuleId="campaign"
+        onCancel={() => !tombstoneBusy && setPendingTombstone(null)}
+        onConfirm={() => void applyTombstone()}
+      />
+    </PageLayout>
+  );
+}
+
+function formatDateTime(value: string): string {
+  return new Intl.DateTimeFormat(undefined, {
+    dateStyle: "medium",
+    timeStyle: "short"
+  }).format(new Date(value));
+}
+
+function errorText(error: unknown): string {
+  return error instanceof Error ? error.message : String(error);
+}

webui/src/features/campaigns/CampaignWorkspace.tsx

@@ -3,10 +3,11 @@ import { Navigate, Route, Routes, useLocation, useNavigate, useParams } from "re
 import {
   ConcurrencyConflictProvider,
   WorkspaceLayout,
+  hasScope,
   useGuardedNavigate
 } from "@govoplan/core-webui";
-import type { ApiSettings, AuthInfo, CampaignWorkspaceSection } from "../../types";
-import SectionSidebar from "../../layout/SectionSidebar";
+import type { ApiSettings, AuthInfo } from "../../types";
+import SectionSidebar, { type CampaignWorkspaceNavigationSection } from "../../layout/SectionSidebar";
 
 const CampaignOverviewPage = lazy(() => import("./CampaignOverviewPage"));
 const CampaignFieldsPage = lazy(() => import("./CampaignFieldsPage"));
@@ -23,8 +24,9 @@ const WizardDirectoryPage = lazy(() => import("./wizard/WizardDirectoryPage"));
 const CampaignJsonView = lazy(() => import("./CampaignJsonView"));
 const CampaignReportPage = lazy(() => import("./CampaignReportPage"));
 const CampaignAuditPage = lazy(() => import("./CampaignAuditPage"));
+const CampaignCollaborationPage = lazy(() => import("./CampaignCollaborationPage"));
 
-const sectionPaths: Record<CampaignWorkspaceSection, string> = {
+const sectionPaths: Record<CampaignWorkspaceNavigationSection, string> = {
   overview: "",
   campaign: "recipients",
   "global-settings": "global-settings",
@@ -38,6 +40,7 @@ const sectionPaths: Record<CampaignWorkspaceSection, string> = {
   "mail-policy": "mail-policy",
   review: "review",
   report: "report",
+  activity: "activity",
   audit: "audit",
   json: "json"
 };
@@ -73,7 +76,7 @@ function CampaignWorkspaceInner({ settings, auth }: { settings: ApiSettings; aut
     navigate(`${location.pathname}?${params.toString()}`, { replace: true });
   }, [location.pathname, location.search, navigate, selectedVersionId, urlVersionId]);
 
-  function select(section: CampaignWorkspaceSection) {
+  function select(section: CampaignWorkspaceNavigationSection) {
     const path = sectionPaths[section];
     const pathname = path ? `/campaigns/${campaignId}/${path}` : `/campaigns/${campaignId}`;
     const params = new URLSearchParams(location.search);
@@ -87,7 +90,7 @@ function CampaignWorkspaceInner({ settings, auth }: { settings: ApiSettings; aut
 
   return (
     <WorkspaceLayout
-      primary={<SectionSidebar active={active} onSelect={select} />}
+      primary={<SectionSidebar active={active} onSelect={select} canReadActivity={hasScope(auth, "campaigns:discussion:read")} />}
       primaryLabel="Campaign sections"
       contentLabel="Campaign workspace"
       interfaceId="campaign.workspace"
@@ -112,6 +115,7 @@ function CampaignWorkspaceInner({ settings, auth }: { settings: ApiSettings; aut
           <Route path="review" element={<ReviewSendPage settings={settings} auth={auth} campaignId={campaignId || ""} />} />
           <Route path="send" element={<Navigate to="../review" replace />} />
           <Route path="report" element={<CampaignReportPage settings={settings} campaignId={campaignId || ""} />} />
+          <Route path="activity" element={hasScope(auth, "campaigns:discussion:read") ? <CampaignCollaborationPage settings={settings} auth={auth} campaignId={campaignId || ""} /> : <Navigate to="../" replace />} />
           <Route path="reports" element={<Navigate to="../report" replace />} />
           <Route path="audit" element={<CampaignAuditPage settings={settings} campaignId={campaignId || ""} />} />
           <Route path="json" element={<CampaignJsonView settings={settings} campaignId={campaignId || ""} />} />
@@ -130,7 +134,7 @@ function CampaignWorkspaceInner({ settings, auth }: { settings: ApiSettings; aut
   );
 }
 
-function sectionFromPath(pathname: string): CampaignWorkspaceSection {
+function sectionFromPath(pathname: string): CampaignWorkspaceNavigationSection {
   const segments = pathname.split("/").filter(Boolean);
   const section = segments[2];
 
@@ -148,6 +152,7 @@ function sectionFromPath(pathname: string): CampaignWorkspaceSection {
   if (section === "review") return "review";
   if (section === "send") return "review";
   if (section === "report" || section === "reports") return "report";
+  if (section === "activity" || section === "collaboration") return "activity";
   if (section === "audit") return "audit";
   if (section === "json") return "json";
   return "overview";

webui/src/i18n/generatedTranslations.ts

@@ -2,6 +2,52 @@ import type { PlatformTranslations } from "@govoplan/core-webui";
 
 export const generatedTranslations: PlatformTranslations = {
   "en": {
+    "i18n:govoplan-campaign.collaboration": "Collaboration",
+    "i18n:govoplan-campaign.collaboration_description": "Bounded human discussion linked to stable Campaign evidence.",
+    "i18n:govoplan-campaign.loading_collaboration": "Loading campaign collaboration…",
+    "i18n:govoplan-campaign.collaboration_audit_boundary": "This thread contains human discussion only. System events and durable audit evidence remain in the Audit surface and are not replaced by comments.",
+    "i18n:govoplan-campaign.new_collaboration_entry": "New discussion entry",
+    "i18n:govoplan-campaign.comment": "Comment",
+    "i18n:govoplan-campaign.comment_help": "Posted text cannot be edited. Withdrawal or redaction removes the text and keeps an auditable tombstone.",
+    "i18n:govoplan-campaign.visibility": "Visibility",
+    "i18n:govoplan-campaign.visibility_help": "Collaborator entries are visible to discussion readers. Moderator entries require moderation authority.",
+    "i18n:govoplan-campaign.visibility_collaborators": "Campaign collaborators",
+    "i18n:govoplan-campaign.visibility_moderators": "Moderators only",
+    "i18n:govoplan-campaign.reference_context": "Reference context",
+    "i18n:govoplan-campaign.reference_context_help": "Optionally link the comment to stable Campaign evidence. The referenced version remains unchanged.",
+    "i18n:govoplan-campaign.no_reference": "No reference",
+    "i18n:govoplan-campaign.reference_campaign_version": "Campaign version",
+    "i18n:govoplan-campaign.reference_recipient_import": "Recipient import batch",
+    "i18n:govoplan-campaign.reference_attachment_rule": "Attachment rule",
+    "i18n:govoplan-campaign.reference_delivery_job": "Delivery job",
+    "i18n:govoplan-campaign.reference_report": "Report",
+    "i18n:govoplan-campaign.campaign_version": "Campaign version",
+    "i18n:govoplan-campaign.select_version": "Select a version",
+    "i18n:govoplan-campaign.stable_reference_id": "Stable reference ID",
+    "i18n:govoplan-campaign.stable_reference_id_help": "Use the ID shown by the referenced Campaign evidence. Version-bound references include the immutable version ID.",
+    "i18n:govoplan-campaign.mentions": "Mentions",
+    "i18n:govoplan-campaign.mentions_help": "Only active users who already have access to this Campaign can be mentioned.",
+    "i18n:govoplan-campaign.add_mention": "Add a campaign collaborator",
+    "i18n:govoplan-campaign.posting": "Posting…",
+    "i18n:govoplan-campaign.post_comment": "Post comment",
+    "i18n:govoplan-campaign.collaboration_posted": "The discussion entry was posted.",
+    "i18n:govoplan-campaign.collaboration_withdrawn": "The discussion entry was withdrawn; its tombstone remains.",
+    "i18n:govoplan-campaign.collaboration_redacted": "The discussion entry was redacted; its tombstone remains.",
+    "i18n:govoplan-campaign.collaboration_read_only": "You may read this discussion but do not have the separate permission required to post.",
+    "i18n:govoplan-campaign.discussion": "Discussion",
+    "i18n:govoplan-campaign.no_collaboration_entries": "No human discussion has been recorded for this Campaign.",
+    "i18n:govoplan-campaign.moderators_only": "Moderators only",
+    "i18n:govoplan-campaign.entry_redacted_tombstone": "This entry was redacted by an authorized moderator. Its timestamp and evidence hash remain.",
+    "i18n:govoplan-campaign.entry_withdrawn_tombstone": "This entry was withdrawn by its author. Its timestamp and evidence hash remain.",
+    "i18n:govoplan-campaign.reference_label": "Reference:",
+    "i18n:govoplan-campaign.withdraw": "Withdraw",
+    "i18n:govoplan-campaign.redact": "Redact",
+    "i18n:govoplan-campaign.loading_older_entries": "Loading older entries…",
+    "i18n:govoplan-campaign.load_older_entries": "Load older entries",
+    "i18n:govoplan-campaign.redact_collaboration_entry": "Redact discussion entry",
+    "i18n:govoplan-campaign.withdraw_collaboration_entry": "Withdraw discussion entry",
+    "i18n:govoplan-campaign.redact_collaboration_entry_confirmation": "Redact this text? The text will be removed while its tombstone and audit evidence remain.",
+    "i18n:govoplan-campaign.withdraw_collaboration_entry_confirmation": "Withdraw this text? The text will be removed while its tombstone and audit evidence remain.",
     "i18n:govoplan-campaign.unassigned_file_policy": "Unassigned file policy",
     "i18n:govoplan-campaign.unassigned_files_detected": "Unassigned files detected",
     "i18n:govoplan-campaign.watched_sources": "Watched sources",
@@ -1346,6 +1392,52 @@ export const generatedTranslations: PlatformTranslations = {
     "i18n:govoplan-campaign.zipcrypto.03bf7fb4": "ZipCrypto"
   },
   "de": {
+    "i18n:govoplan-campaign.collaboration": "Zusammenarbeit",
+    "i18n:govoplan-campaign.collaboration_description": "Begrenzte menschliche Diskussion mit Bezug auf stabile Kampagnennachweise.",
+    "i18n:govoplan-campaign.loading_collaboration": "Kampagnenzusammenarbeit wird geladen…",
+    "i18n:govoplan-campaign.collaboration_audit_boundary": "Dieser Verlauf enthält nur menschliche Diskussionen. Systemereignisse und dauerhafte Auditnachweise bleiben im Audit-Bereich und werden nicht durch Kommentare ersetzt.",
+    "i18n:govoplan-campaign.new_collaboration_entry": "Neuer Diskussionseintrag",
+    "i18n:govoplan-campaign.comment": "Kommentar",
+    "i18n:govoplan-campaign.comment_help": "Veröffentlichter Text kann nicht bearbeitet werden. Rücknahme oder Schwärzung entfernt den Text und erhält einen auditierbaren Platzhalter.",
+    "i18n:govoplan-campaign.visibility": "Sichtbarkeit",
+    "i18n:govoplan-campaign.visibility_help": "Einträge für Mitwirkende sind für Diskussionsleser sichtbar. Moderationseinträge erfordern eine Moderationsberechtigung.",
+    "i18n:govoplan-campaign.visibility_collaborators": "Kampagnenmitwirkende",
+    "i18n:govoplan-campaign.visibility_moderators": "Nur Moderation",
+    "i18n:govoplan-campaign.reference_context": "Referenzkontext",
+    "i18n:govoplan-campaign.reference_context_help": "Der Kommentar kann optional mit einem stabilen Kampagnennachweis verknüpft werden. Die referenzierte Version bleibt unverändert.",
+    "i18n:govoplan-campaign.no_reference": "Keine Referenz",
+    "i18n:govoplan-campaign.reference_campaign_version": "Kampagnenversion",
+    "i18n:govoplan-campaign.reference_recipient_import": "Empfänger-Importlauf",
+    "i18n:govoplan-campaign.reference_attachment_rule": "Anlagenregel",
+    "i18n:govoplan-campaign.reference_delivery_job": "Sendeauftrag",
+    "i18n:govoplan-campaign.reference_report": "Bericht",
+    "i18n:govoplan-campaign.campaign_version": "Kampagnenversion",
+    "i18n:govoplan-campaign.select_version": "Version auswählen",
+    "i18n:govoplan-campaign.stable_reference_id": "Stabile Referenz-ID",
+    "i18n:govoplan-campaign.stable_reference_id_help": "Verwenden Sie die beim Kampagnennachweis angezeigte ID. Versionsgebundene Referenzen enthalten die unveränderliche Versions-ID.",
+    "i18n:govoplan-campaign.mentions": "Erwähnungen",
+    "i18n:govoplan-campaign.mentions_help": "Nur aktive Personen, die bereits Zugriff auf diese Kampagne haben, können erwähnt werden.",
+    "i18n:govoplan-campaign.add_mention": "Kampagnenmitwirkende hinzufügen",
+    "i18n:govoplan-campaign.posting": "Wird veröffentlicht…",
+    "i18n:govoplan-campaign.post_comment": "Kommentar veröffentlichen",
+    "i18n:govoplan-campaign.collaboration_posted": "Der Diskussionseintrag wurde veröffentlicht.",
+    "i18n:govoplan-campaign.collaboration_withdrawn": "Der Diskussionseintrag wurde zurückgenommen; sein Platzhalter bleibt erhalten.",
+    "i18n:govoplan-campaign.collaboration_redacted": "Der Diskussionseintrag wurde geschwärzt; sein Platzhalter bleibt erhalten.",
+    "i18n:govoplan-campaign.collaboration_read_only": "Sie dürfen diese Diskussion lesen, besitzen aber nicht die separate Berechtigung zum Veröffentlichen.",
+    "i18n:govoplan-campaign.discussion": "Diskussion",
+    "i18n:govoplan-campaign.no_collaboration_entries": "Für diese Kampagne wurde noch keine menschliche Diskussion erfasst.",
+    "i18n:govoplan-campaign.moderators_only": "Nur Moderation",
+    "i18n:govoplan-campaign.entry_redacted_tombstone": "Dieser Eintrag wurde durch eine berechtigte Moderation geschwärzt. Zeitstempel und Nachweis-Hash bleiben erhalten.",
+    "i18n:govoplan-campaign.entry_withdrawn_tombstone": "Dieser Eintrag wurde durch die verfassende Person zurückgenommen. Zeitstempel und Nachweis-Hash bleiben erhalten.",
+    "i18n:govoplan-campaign.reference_label": "Referenz:",
+    "i18n:govoplan-campaign.withdraw": "Zurücknehmen",
+    "i18n:govoplan-campaign.redact": "Schwärzen",
+    "i18n:govoplan-campaign.loading_older_entries": "Ältere Einträge werden geladen…",
+    "i18n:govoplan-campaign.load_older_entries": "Ältere Einträge laden",
+    "i18n:govoplan-campaign.redact_collaboration_entry": "Diskussionseintrag schwärzen",
+    "i18n:govoplan-campaign.withdraw_collaboration_entry": "Diskussionseintrag zurücknehmen",
+    "i18n:govoplan-campaign.redact_collaboration_entry_confirmation": "Diesen Text schwärzen? Der Text wird entfernt; Platzhalter und Auditnachweis bleiben erhalten.",
+    "i18n:govoplan-campaign.withdraw_collaboration_entry_confirmation": "Diesen Text zurücknehmen? Der Text wird entfernt; Platzhalter und Auditnachweis bleiben erhalten.",
     "i18n:govoplan-campaign.unassigned_file_policy": "Richtlinie für nicht zugeordnete Dateien",
     "i18n:govoplan-campaign.unassigned_files_detected": "Erkannte nicht zugeordnete Dateien",
     "i18n:govoplan-campaign.watched_sources": "Überwachte Quellen",

webui/src/layout/SectionSidebar.tsx

@@ -1,7 +1,9 @@
 import type { CampaignWorkspaceSection } from "../types";
 import { ModuleSubnav, type ModuleSubnavGroup } from "@govoplan/core-webui";
 
-const campaignSubnav: ModuleSubnavGroup<CampaignWorkspaceSection>[] = [
+export type CampaignWorkspaceNavigationSection = CampaignWorkspaceSection | "activity";
+
+const campaignSubnav: ModuleSubnavGroup<CampaignWorkspaceNavigationSection>[] = [
 {
   items: [{ id: "overview", label: "i18n:govoplan-campaign.overview.0efc2e6b", primary: true }]
 },
@@ -38,6 +40,7 @@ const campaignSubnav: ModuleSubnavGroup<CampaignWorkspaceSection>[] = [
   title: "i18n:govoplan-campaign.report.7b8ddb90",
   items: [
   { id: "report", label: "i18n:govoplan-campaign.report.ee45c303" },
+  { id: "activity", label: "i18n:govoplan-campaign.collaboration" },
   { id: "audit", label: "i18n:govoplan-campaign.audit_log.3cfc5f1c" }]
 
 },
@@ -49,10 +52,19 @@ const campaignSubnav: ModuleSubnavGroup<CampaignWorkspaceSection>[] = [
 
 export default function SectionSidebar({
   active,
-  onSelect
+  onSelect,
+  canReadActivity
 
 
 
-}: {active: CampaignWorkspaceSection;onSelect: (section: CampaignWorkspaceSection) => void;}) {
-  return <ModuleSubnav active={active} groups={campaignSubnav} onSelect={onSelect} />;
+}: {
+  active: CampaignWorkspaceNavigationSection;
+  onSelect: (section: CampaignWorkspaceNavigationSection) => void;
+  canReadActivity: boolean;
+}) {
+  const groups = campaignSubnav.map((group) => ({
+    ...group,
+    items: group.items.filter((item) => item.id !== "activity" || canReadActivity)
+  }));
+  return <ModuleSubnav active={active} groups={groups} onSelect={onSelect} />;
 }

webui/src/module.ts

@@ -91,6 +91,13 @@ export const campaignModule: PlatformWebModule = {
   optionalDependencies: ["files", "mail"],
   translations,
   viewSurfaces: [
+    {
+      id: "campaigns.page.activity",
+      moduleId: "campaigns",
+      kind: "page",
+      label: "Campaign collaboration",
+      order: 45
+    },
     {
       id: "campaigns.widget.activity",
       moduleId: "campaigns",

webui/src/styles/campaign-workspace.css

@@ -2780,3 +2780,28 @@
   .campaign-residual-file-form { grid-template-columns: minmax(0, 1fr); }
   .campaign-residual-file-wide { grid-column: auto; }
 }
+
+.campaign-collaboration-composer { display: grid; gap: 10px; }
+.campaign-collaboration-composer textarea { width: 100%; resize: vertical; }
+.campaign-collaboration-counter { justify-self: end; color: var(--muted); font-size: var(--font-size-sm); }
+.campaign-collaboration-options { display: grid; grid-template-columns: repeat(2, minmax(0, 1fr)); gap: 12px; }
+.campaign-collaboration-options input,
+.campaign-collaboration-options select { width: 100%; }
+.campaign-collaboration-submit { justify-content: flex-end; }
+.campaign-collaboration-thread { display: grid; gap: 12px; margin: 0; padding: 0; list-style: none; }
+.campaign-collaboration-entry { border: var(--border-line); border-radius: var(--radius-sm); background: var(--panel-bg); }
+.campaign-collaboration-entry article { display: grid; gap: 10px; padding: 14px; }
+.campaign-collaboration-entry-header { display: flex; flex-wrap: wrap; align-items: center; gap: 8px 12px; color: var(--muted); font-size: var(--font-size-sm); }
+.campaign-collaboration-actor { display: inline-flex; align-items: center; gap: 7px; color: var(--text); font-weight: 650; }
+.campaign-collaboration-content { margin: 0; white-space: pre-wrap; overflow-wrap: anywhere; line-height: 1.55; }
+.campaign-collaboration-reference { display: flex; flex-wrap: wrap; align-items: baseline; gap: 4px 8px; margin: 0; color: var(--muted); font-size: var(--font-size-sm); }
+.campaign-collaboration-reference code { overflow-wrap: anywhere; }
+.campaign-collaboration-tombstone { display: flex; align-items: center; gap: 8px; min-height: 42px; padding: 9px 11px; border: var(--border-line); border-radius: var(--radius-sm); color: var(--muted); background: var(--subtle-bg); font-style: italic; }
+.campaign-collaboration-entry-actions { justify-content: flex-end; padding-top: 4px; border-top: var(--border-line); }
+.campaign-collaboration-load-more { justify-content: center; margin-top: 14px; }
+
+@media (max-width: 760px) {
+  .campaign-collaboration-options { grid-template-columns: minmax(0, 1fr); }
+  .campaign-collaboration-submit,
+  .campaign-collaboration-entry-actions { justify-content: flex-start; }
+}

webui/tests/campaign-collaboration-ui-structure.test.mjs

@@ -0,0 +1,44 @@
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+const root = path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+const page = fs.readFileSync(
+  path.join(root, "src/features/campaigns/CampaignCollaborationPage.tsx"),
+  "utf8"
+);
+const workspace = fs.readFileSync(
+  path.join(root, "src/features/campaigns/CampaignWorkspace.tsx"),
+  "utf8"
+);
+const sidebar = fs.readFileSync(
+  path.join(root, "src/layout/SectionSidebar.tsx"),
+  "utf8"
+);
+const api = fs.readFileSync(path.join(root, "src/api/campaigns.ts"), "utf8");
+
+assert.match(page, /archetype="collection"/);
+assert.match(page, /variant="collection"/);
+assert.match(page, /refreshable/);
+assert.match(page, /ReferenceMultiSelect/);
+assert.match(page, /ConfirmDialog/);
+assert.match(page, /campaigns:discussion:post/);
+assert.match(page, /campaigns:discussion:moderate/);
+assert.match(page, /maxLength=\{8000\}/);
+assert.match(page, /<ol[^>]+aria-label="Campaign collaboration thread"/);
+assert.match(page, /entry\.tombstone/);
+assert.match(page, /collaboration_audit_boundary/);
+assert.doesNotMatch(page, /updateCampaignVersion|saveCampaignVersion/);
+
+assert.match(workspace, /path="activity"/);
+assert.match(workspace, /CampaignCollaborationPage/);
+assert.match(sidebar, /canReadActivity/);
+assert.match(sidebar, /id: "activity"/);
+
+assert.match(api, /\/collaboration\?/);
+assert.match(api, /\/withdraw/);
+assert.match(api, /\/redact/);
+assert.match(api, /\/collaboration\/mention-options/);
+
+console.log("Campaign collaboration UI structure checks passed.");