govoplan-committee/docs/COMMITTEE_DOMAIN_BOUNDARY.md

Committee Domain Boundary

Purpose

Committee, board, council, and senate workflows for meetings, agendas, minutes, decisions, voting, and follow-up tasks.

Owns

• committee bodies
• meeting agendas
• minutes
• deliberation and vote context plus references to formal decision records
• votes
• follow-up assignments

Does Not Own

• generic task execution
• document storage
• calendar event storage
• generic approval gates
• the cross-domain formal decision lifecycle, including authority, facts, applicable rules, reasoning, effects, review, correction, and revocation

Integration Candidates

• calendar
• docs
• files
• tasks
• workflow
• approvals

Current Persistent Backend Slice

The current repository state is intentionally bounded:

• module manifest and entry point
• tenant-level permission definitions
• manager and viewer role templates
• documentation topic and architecture/evidence declaration
• committee.workspace and committee.decision_path interfaces and capabilities
• tenant-scoped body, meeting, agenda-item, vote-result, and minute persistence
• immutable revisions, OCC, replay-safe lifecycle events, migrations, uninstall guards, API routes, and tenant summary counts
• a governed assembler for one formal committee outcome
• a protected local Decision projection when the optional Decisions provider is absent
• a three-pane /committee workspace for bodies, meetings, agendas, governed vote results, and minutes
• a provider-neutral ballot-finalization contract for external and secret ballots that retains aggregate evidence rather than individual ballots
• an optional primary integration with Voting, which owns frozen electorates, vote casting/replacement, tally, certification, challenge, and annulment
• Gitea issue workflow templates
• manifest and decision reconstruction contract tests

The decision path accepts or resolves one effective Mandate covering the deciding unit, function, and jurisdiction; requires approval, fact evidence, versioned legal bases, operative result, and reasoning, and emits the shared formal Decision contract. If a Decision registry is installed it records there; otherwise the result is retained in the Committee-owned fallback projection and is available only through the protected-read permission.

The workspace records the result of a governed vote rather than becoming a general remote-balloting system. Local closure requires unique choices, eligible/cast counts, matching result counts, an explicit quorum result, an Approval reference, and evidence. Decided agenda items require a formal Decision reference, and meetings cannot close while agenda items remain unfinished. Accepted or corrected minutes require a Records reference, Approval, and evidence.

A governed ballot is delegated to voting.ballots when Voting is installed; Committee retains the meeting/agendum linkage and verified aggregate result. For provider-backed Voting ballots, Committee also snapshots the assurance profile, provider and ballot references, and sanitized provider evidence. A reference local_confidential result remains explicitly uncertified; its server-encrypted casts do not satisfy secret-ballot, anonymity, coercion-resistance, or legal-certification requirements. The following direct provider path remains a 0.1 compatibility contract only. A provider-bound vote on that path is finalized through committee.ballot_adapter.<provider>. The adapter receives tenant, vote, choices, eligible count, external ballot reference, request time, and idempotency key. Its result must cover exactly the configured choices, sum to the cast count, stay within eligibility, carry same-tenant evidence, and supply a lowercase SHA-256 result digest plus provider receipt. Committee persists that aggregate and does not persist voter choices or provider credentials.

Database restore is the module's semantic recovery unit. Calendar events, documents, records, tasks, approvals, and externally conducted votes remain recoverable through their owning providers and are linked by stable references.

Decision Reconstruction Proof

tests/test_decision_path.py proves effective-time authority, organization, function, and jurisdiction coverage, approval, legal basis/evidence versions, requested effects, information governance, responsible actor/automation assurance, and a protected reconstruction payload. A vote remains an approval reference and is not made indistinguishable from the formal institutional outcome.

tests/test_workspace.py proves parent and lifecycle constraints, immutable history, replay and stale-write rejection, tenant isolation, committed-only events, vote/quorum evidence, adapter-only provider closure, aggregate-only secret-ballot persistence, minutes, and the local Decision projection.