feat: implement governed cases workspace

README.md

@@ -4,7 +4,7 @@
 **Repository type:** module (domain).
 <!-- govoplan-repository-type:end -->
 
-`govoplan-cases` will own formal administrative case records for GovOPlaN.
+`govoplan-cases` owns formal administrative case context for GovOPlaN.
 
 The module should stay focused on case identity, lifecycle state, assignments,
 deadlines, participants, evidence links, and case-level audit context. It should
@@ -12,4 +12,29 @@ not own forms, files, workflow execution, task queues, templates, payments, or
 mail delivery; those are integrated through GovOPlaN capabilities, events,
 commands, and DTOs.
 
+The executable backend slice now exposes:
+
+- `cases.service_intake`, which converts one published, effective Service
+  definition into a case intake plan while retaining the exact service,
+  mandate, jurisdiction, legal-basis, form, workflow, result, evidence, and
+  deadline references; and
+- `cases.party_context`, which consumes an optional procedure-party provider
+  or a bounded Cases-only compatibility projection and emits policy-filtered,
+  frozen contact snapshot references for downstream delivery; and
+- `cases.registry` plus `/api/v1/cases`, which persist tenant-local case/status
+  catalogs, stable case identities, immutable OCC-guarded revisions, stable
+  assignment/evidence/Decision/record references, and replay-safe lifecycle
+  events; and
+- `cases.service_launcher`, which opens exactly one deterministic case from an
+  exact published Service revision and safely replays the same Portal launch.
+
+Cases does not own institutional Service, Party, representation, identity,
+address, Mandate, Decision, file, workflow, or task lifecycles. The `/cases`
+workspace now supplies list/detail, status/title revision, history, and timeline
+surfaces. A case can remain tenant-visible or become restricted to its creator,
+case administrators, explicit user/group grants, and assignment-derived
+function, function-assignment, or organization-unit grants. The detail surface
+uses the shared reference selector to manage those grants; list, detail,
+history, timeline, and update paths all apply the same fail-closed ACL.
+
 See [docs/CONCEPT.md](docs/CONCEPT.md) for the current module concept.