[Feature] Add governed autonomous delivery mode to recurring Campaign schedules #93

New Issue

2026-08-07T14:50:48+02:00

zemion commented

2026-08-07 14:50:48 +02:00

Context

Campaign #43 now provides durable once/daily/weekly/monthly schedules that prepare immutable draft occurrences with timezone handling, source snapshots, occurrence ledgers, optimistic concurrency, coalescing, pause-on-failure, operator controls, and audit evidence. It intentionally does not send autonomously: preparing a draft is recoverable, while an ungoverned retry around external delivery can duplicate a legally relevant message.

Required Work

Add an explicitly opted-in autonomous delivery mode on top of the proven schedule and delivery lifecycle.

Require an immutable approved campaign/version snapshot for every occurrence.
Re-evaluate Policy, approval validity, sender credentials, Mail capability health, and recipient/attachment gates before acceptance.
Allocate a durable occurrence/delivery idempotency key before the external effect.
Never retry automatically after an accepted or outcome-unknown transport result.
Persist recovery-ledger and operator evidence for prepared, accepted, uncertain, failed, skipped, and superseded occurrences.
Pause the schedule on systemic or policy failures and notify accountable operators.
Expose explicit autonomous/manual mode, next occurrence, last outcome, and recovery state in the Campaign UI.
Add concurrency, failover, clock/timezone, and duplicate-delivery regression tests.

Acceptance Criteria

Autonomous delivery is opt-in, policy-governed, horizontally safe, auditable, and demonstrably at-most-once after transport acceptance. Manual scheduled draft preparation remains available without Mail.

Follow-up to Campaign #43.

## Context Campaign #43 now provides durable once/daily/weekly/monthly schedules that prepare immutable draft occurrences with timezone handling, source snapshots, occurrence ledgers, optimistic concurrency, coalescing, pause-on-failure, operator controls, and audit evidence. It intentionally does not send autonomously: preparing a draft is recoverable, while an ungoverned retry around external delivery can duplicate a legally relevant message. ## Required Work Add an explicitly opted-in autonomous delivery mode on top of the proven schedule and delivery lifecycle. - [ ] Require an immutable approved campaign/version snapshot for every occurrence. - [ ] Re-evaluate Policy, approval validity, sender credentials, Mail capability health, and recipient/attachment gates before acceptance. - [ ] Allocate a durable occurrence/delivery idempotency key before the external effect. - [ ] Never retry automatically after an accepted or outcome-unknown transport result. - [ ] Persist recovery-ledger and operator evidence for prepared, accepted, uncertain, failed, skipped, and superseded occurrences. - [ ] Pause the schedule on systemic or policy failures and notify accountable operators. - [ ] Expose explicit autonomous/manual mode, next occurrence, last outcome, and recovery state in the Campaign UI. - [ ] Add concurrency, failover, clock/timezone, and duplicate-delivery regression tests. ## Acceptance Criteria Autonomous delivery is opt-in, policy-governed, horizontally safe, auditable, and demonstrably at-most-once after transport acceptance. Manual scheduled draft preparation remains available without Mail. Follow-up to Campaign #43.

zemion added the module/campaign area/governance

area/api labels 2026-08-07 14:50:48 +02:00

zemion referenced this issue

2026-08-07 15:09:40 +02:00

[Task] Scheduling and recurring campaigns after real send lifecycle is proven #43

zemion commented

2026-08-20 21:11:00 +02:00

Implemented and pushed governed autonomous Campaign schedules.

Commits:

GovOPlaN/govoplan-core@4b0737e — worker result/recovery contract and tests
GovOPlaN/govoplan-campaign@2a00d91 — autonomous scheduling lifecycle, migration, UI, documentation, retention, and regression coverage

Acceptance evidence:

Explicit manual/autonomous mode; manual remains the default and works without Mail.
Autonomous creation requires queue/send/Mail authority plus a built Mail-only version with a valid explicit Approval.
Every occurrence binds the approved execution hash, source/version identity, schedule snapshot hash, frozen job manifest, and occurrence/job idempotency keys before Mail can perform an external effect.
Approval, effective policy fingerprint, Mail transport/credential revision, live SMTP health, recipients, attachments, and EML integrity are rechecked before each occurrence.
Mail-owned durable commands preserve at-most-once behavior after acceptance/outcome-unknown; pending occurrences defer recurrence, uncertain/systemic outcomes pause and notify, and recovery evidence records prepared/accepted/uncertain/failed/skipped/superseded states.
Active and paused unfinished autonomous schedules protect their source EML from Campaign retention.
Campaign UI exposes mode, next occurrence, last outcome, recovery state, and safety guidance.

Validation:

Campaign: 412 tests plus 26 subtests passed.
New scheduling suite: 10 tests covering duplicate/failover recovery, pending deferral, Mail capability loss, unknown outcomes, bounded recurrence, and timezone/month-end behavior.
Core worker contract: 3 tests passed.
Manifest registry: 68/68; strict platform interface inventory passed.
Full focused workspace gate passed, including integrated migrations, 59 WebUI module permutations, full-product build/bundle budgets, and 7 Playwright conformance tests.

Implemented and pushed governed autonomous Campaign schedules. Commits: - GovOPlaN/govoplan-core@4b0737e — worker result/recovery contract and tests - GovOPlaN/govoplan-campaign@2a00d91 — autonomous scheduling lifecycle, migration, UI, documentation, retention, and regression coverage Acceptance evidence: - Explicit manual/autonomous mode; manual remains the default and works without Mail. - Autonomous creation requires queue/send/Mail authority plus a built Mail-only version with a valid explicit Approval. - Every occurrence binds the approved execution hash, source/version identity, schedule snapshot hash, frozen job manifest, and occurrence/job idempotency keys before Mail can perform an external effect. - Approval, effective policy fingerprint, Mail transport/credential revision, live SMTP health, recipients, attachments, and EML integrity are rechecked before each occurrence. - Mail-owned durable commands preserve at-most-once behavior after acceptance/outcome-unknown; pending occurrences defer recurrence, uncertain/systemic outcomes pause and notify, and recovery evidence records prepared/accepted/uncertain/failed/skipped/superseded states. - Active and paused unfinished autonomous schedules protect their source EML from Campaign retention. - Campaign UI exposes mode, next occurrence, last outcome, recovery state, and safety guidance. Validation: - Campaign: 412 tests plus 26 subtests passed. - New scheduling suite: 10 tests covering duplicate/failover recovery, pending deferral, Mail capability loss, unknown outcomes, bounded recurrence, and timezone/month-end behavior. - Core worker contract: 3 tests passed. - Manifest registry: 68/68; strict platform interface inventory passed. - Full focused workspace gate passed, including integrated migrations, 59 WebUI module permutations, full-product build/bundle budgets, and 7 Playwright conformance tests.

zemion closed this issue

2026-08-20 21:11:01 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-campaign#93