Add governed DSAR coverage for Committee attribution #4

New Issue

2026-08-21T11:55:23+02:00

zemion commented

2026-08-21 11:55:23 +02:00

Goal

Cover subject attribution in immutable Committee workspace, event, and fallback Decision projections through the Core data-subject request workflow tracked by GovOPlaN/govoplan#47.

Scope

provide and document privacy.dsar.committee
correlate exact actor identifiers with optional object narrowing
export minimized workspace revision, lifecycle event, and Decision projection attribution
exclude search text, deliberation payloads, minutes, ballots, hashes, and replay material
retain immutable institutional evidence and never traverse referenced provider records
add focused provider and Core workflow coverage

Acceptance criteria

object identifiers alone do not disclose Committee content
unrelated actors, objects, Decisions, and tenants remain excluded
erasure planning is retain-only and cannot rewrite institutional history
focused tests, Ruff, and manifest checks pass

## Goal Cover subject attribution in immutable Committee workspace, event, and fallback Decision projections through the Core data-subject request workflow tracked by GovOPlaN/govoplan#47. ## Scope - provide and document `privacy.dsar.committee` - correlate exact actor identifiers with optional object narrowing - export minimized workspace revision, lifecycle event, and Decision projection attribution - exclude search text, deliberation payloads, minutes, ballots, hashes, and replay material - retain immutable institutional evidence and never traverse referenced provider records - add focused provider and Core workflow coverage ## Acceptance criteria - object identifiers alone do not disclose Committee content - unrelated actors, objects, Decisions, and tenants remain excluded - erasure planning is retain-only and cannot rewrite institutional history - focused tests, Ruff, and manifest checks pass

zemion commented

2026-08-21 12:35:48 +02:00

Implemented and pushed in 049ea80.

Added privacy.dsar.committee for workspace/event/formal-decision attribution, object-level narrowing, deliberation and ballot exclusions, tests, and user/admin documentation.
Verified with the module test and lint suite.
Verified across the workspace with tools/checks/check-focused.sh: manifest and boundary checks, backend suites, 59 WebUI module permutations, seven Playwright conformance tests, and module-specific frontend checks all passed.

Implemented and pushed in `049ea80`. - Added privacy.dsar.committee for workspace/event/formal-decision attribution, object-level narrowing, deliberation and ballot exclusions, tests, and user/admin documentation. - Verified with the module test and lint suite. - Verified across the workspace with `tools/checks/check-focused.sh`: manifest and boundary checks, backend suites, 59 WebUI module permutations, seven Playwright conformance tests, and module-specific frontend checks all passed.

zemion closed this issue

2026-08-21 12:35:49 +02:00

zemion referenced this issue from GovOPlaN/govoplan

2026-08-21 12:36:23 +02:00

[Privacy] Complete DSAR provider coverage across data-owning modules #47

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-committee#4