[Security] Explain delivery evidence and reconciliation sub-object access #86

New Issue

2026-07-30T17:34:16+02:00

zemion commented

2026-07-30 17:34:16 +02:00

Follow-up to #50. Add first-class access explanations for delivery jobs beyond the current built-message projection: SMTP attempts, IMAP append attempts, Postbox attempts/receipts, message actions, and reconciliation decisions.

Acceptance criteria

Stable identifiers bind every attempt to its Campaign version and immutable job.
Read, diagnostic, report, and export permissions are distinguished.
Explanations expose status/provenance without transport secrets or unrelated recipient data.
Retry and reconciliation descendants cannot escape the parent Campaign tenant/access boundary.
Tests cover inherited access, independently restricted evidence, unavailable optional modules, and hidden objects.

See docs/ACCESS_EXPLANATION_COVERAGE.md.

Follow-up to #50. Add first-class access explanations for delivery jobs beyond the current built-message projection: SMTP attempts, IMAP append attempts, Postbox attempts/receipts, message actions, and reconciliation decisions. ## Acceptance criteria - Stable identifiers bind every attempt to its Campaign version and immutable job. - Read, diagnostic, report, and export permissions are distinguished. - Explanations expose status/provenance without transport secrets or unrelated recipient data. - Retry and reconciliation descendants cannot escape the parent Campaign tenant/access boundary. - Tests cover inherited access, independently restricted evidence, unavailable optional modules, and hidden objects. See `docs/ACCESS_EXPLANATION_COVERAGE.md`.

zemion added the module/campaign

type

task

area/api codex/ready area/security

labels 2026-07-30 17:34:16 +02:00

zemion referenced this issue

2026-07-30 17:46:45 +02:00

Decide campaign sub-object resource access explanation scope #50

zemion commented

2026-08-19 20:30:27 +02:00

Implemented and pushed in 14e9487.

The Campaign access-explanation provider now covers send, IMAP, Postbox, and print attempts; message actions/attempts; and reconciliation decisions. Read, reporting, diagnostics, and export permissions are surfaced separately. Explanations expose bounded status/provenance only—never secrets, transport locators, recipient data, or reconciliation notes—and optional delivery evidence uses a single unavailable_or_hidden result so module availability cannot be probed.

Verification:

Campaign suite: 100 tests passed
Core access contract suite: 13 tests passed
manifest registry: 68/68 passed
static module contract scan passed
Ruff and diff checks passed

Implemented and pushed in `14e9487`. The Campaign access-explanation provider now covers send, IMAP, Postbox, and print attempts; message actions/attempts; and reconciliation decisions. Read, reporting, diagnostics, and export permissions are surfaced separately. Explanations expose bounded status/provenance only—never secrets, transport locators, recipient data, or reconciliation notes—and optional delivery evidence uses a single `unavailable_or_hidden` result so module availability cannot be probed. Verification: - Campaign suite: 100 tests passed - Core access contract suite: 13 tests passed - manifest registry: 68/68 passed - static module contract scan passed - Ruff and diff checks passed

zemion closed this issue

2026-08-19 20:30:28 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-campaign#86