[Privacy] Provide governed Campaign DSAR coverage #94

New Issue

2026-08-20T22:43:08+02:00

zemion commented

2026-08-20 22:43:08 +02:00

Objective

Adopt the Core data-subject request provider contract for Campaign recipient, version, delivery, report-projection, and artifact metadata without weakening immutable delivery evidence or retention policy.

Acceptance criteria

Search is bounded and tenant-scoped, supports normalized recipient email and namespaced Campaign references, and covers membership-owned Campaign resources.
Export isolates matching recipient data and excludes EML bytes/paths, storage keys, claims, provider secrets, and unrelated recipients.
Campaign versions, jobs, send/Postbox/print/IMAP attempts, report source evidence, and owned attachment metadata receive explicit retention or manual-review classifications.
Reversible user-owned mapping-profile deletion and subject-targeted share revocation are idempotent and revalidated; delivered evidence is never silently rewritten.
Derived report coverage and artifact/retention limitations are documented.
Provider discovery, disabled-module behavior, retry/stale action handling, and full workspace checks pass.

Parent: GovOPlaN/govoplan#47. ## Objective Adopt the Core data-subject request provider contract for Campaign recipient, version, delivery, report-projection, and artifact metadata without weakening immutable delivery evidence or retention policy. ## Acceptance criteria - [ ] Search is bounded and tenant-scoped, supports normalized recipient email and namespaced Campaign references, and covers membership-owned Campaign resources. - [ ] Export isolates matching recipient data and excludes EML bytes/paths, storage keys, claims, provider secrets, and unrelated recipients. - [ ] Campaign versions, jobs, send/Postbox/print/IMAP attempts, report source evidence, and owned attachment metadata receive explicit retention or manual-review classifications. - [ ] Reversible user-owned mapping-profile deletion and subject-targeted share revocation are idempotent and revalidated; delivered evidence is never silently rewritten. - [ ] Derived report coverage and artifact/retention limitations are documented. - [ ] Provider discovery, disabled-module behavior, retry/stale action handling, and full workspace checks pass.

zemion added the area/db area/governance area/security codex/ready module/campaign

labels 2026-08-20 22:43:19 +02:00

zemion commented

2026-08-20 23:16:32 +02:00

Implemented and pushed in govoplan-campaign@73cfad2.

Evidence:

bounded tenant-scoped search by normalized recipient email, membership references, and namespaced Campaign references
recipient-specific version/job/report projections with generated-message digest/size metadata only
EML bytes and locators, attachment locators, target snapshots, worker claims, idempotency material, credentials, secrets, and unrelated recipients excluded
immutable delivery/version/attempt/schedule/artifact evidence retained; draft/coordinated content sent to manual review
subject-targeted share revocation and user-owned mapping deletion are tenant-bound, revalidated, idempotent, and covered for stale actions
Core discovery/execution and disabled-module behavior covered end to end
documentation baseline and Campaign handbook updated

Verification: Campaign 419 passed plus 26 subtests; DSAR/docs 28 passed; manifest registry 68/68; complete tools/checks/check-focused.sh green, including 59 WebUI permutations, full-product bundle budgets, and 7 Playwright conformance tests.

Implemented and pushed in govoplan-campaign@73cfad2. Evidence: - bounded tenant-scoped search by normalized recipient email, membership references, and namespaced Campaign references - recipient-specific version/job/report projections with generated-message digest/size metadata only - EML bytes and locators, attachment locators, target snapshots, worker claims, idempotency material, credentials, secrets, and unrelated recipients excluded - immutable delivery/version/attempt/schedule/artifact evidence retained; draft/coordinated content sent to manual review - subject-targeted share revocation and user-owned mapping deletion are tenant-bound, revalidated, idempotent, and covered for stale actions - Core discovery/execution and disabled-module behavior covered end to end - documentation baseline and Campaign handbook updated Verification: Campaign 419 passed plus 26 subtests; DSAR/docs 28 passed; manifest registry 68/68; complete tools/checks/check-focused.sh green, including 59 WebUI permutations, full-product bundle budgets, and 7 Playwright conformance tests.

zemion closed this issue

2026-08-20 23:16:32 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-campaign#94