Sync Repo-docs-COMMITTEE-DOMAIN-BOUNDARY from project files

Repo-docs-COMMITTEE-DOMAIN-BOUNDARY.-.md

@@ -1,4 +1,4 @@
-<!-- codex-wiki-sync:e2438007d08d70f088f89d50 -->
+<!-- codex-wiki-sync:0baa16eaf3bf296e2dbbb931 -->
 
 > Mirrored from `/mnt/DATA/git/govoplan-committee/docs/COMMITTEE_DOMAIN_BOUNDARY.md`.
 > Origin: `repository`.
@@ -38,7 +38,7 @@ Committee, board, council, and senate workflows for meetings, agendas, minutes,
 - workflow
 - approvals
 
-## Current Headless Slice
+## Current Persistent Backend Slice
 
 The current repository state is intentionally bounded:
 
@@ -46,18 +46,47 @@ The current repository state is intentionally bounded:
 - tenant-level permission definitions
 - manager and viewer role templates
 - documentation topic and architecture/evidence declaration
-- `committee.decision_path` interface and capability
+- `committee.workspace` and `committee.decision_path` interfaces and capabilities
+- tenant-scoped body, meeting, agenda-item, vote-result, and minute persistence
+- immutable revisions, OCC, replay-safe lifecycle events, migrations, uninstall
+  guards, API routes, and tenant summary counts
 - a governed assembler for one formal committee outcome
+- a protected local Decision projection when the optional Decisions provider is
+  absent
+- a three-pane `/committee` workspace for bodies, meetings, agendas, governed
+  vote results, and minutes
+- a provider-neutral ballot-finalization contract for external and secret
+  ballots that retains aggregate evidence rather than individual ballots
 - Gitea issue workflow templates
 - manifest and decision reconstruction contract tests
 
-No runtime API, database model, migration, WebUI route, or navigation item is
+The decision path accepts or resolves one effective
-registered yet. The headless decision path accepts or resolves one effective
 Mandate covering the deciding unit, function, and jurisdiction; requires
 approval, fact evidence, versioned legal bases, operative
 result, and reasoning, and emits the shared formal Decision contract. If a
-Decision registry is installed it records there; otherwise the result remains
+Decision registry is installed it records there; otherwise the result is
-a reconstructable return value for a future Committee-owned local projection.
+retained in the Committee-owned fallback projection and is available only
+through the protected-read permission.
+
+The workspace records the result of a governed vote rather than becoming a
+general remote-balloting system. Local closure requires unique choices,
+eligible/cast counts, matching result counts, an explicit quorum result, an
+Approval reference, and evidence. Decided agenda items require a formal
+Decision reference, and meetings cannot close while agenda items remain
+unfinished. Accepted or corrected minutes require a Records reference,
+Approval, and evidence.
+
+A provider-bound vote is finalized only through
+`committee.ballot_adapter.<provider>`. The adapter receives tenant, vote,
+choices, eligible count, external ballot reference, request time, and
+idempotency key. Its result must cover exactly the configured choices, sum to
+the cast count, stay within eligibility, carry same-tenant evidence, and supply
+a lowercase SHA-256 result digest plus provider receipt. Committee persists
+that aggregate and does not persist voter choices or provider credentials.
+
+Database restore is the module's semantic recovery unit. Calendar events,
+documents, records, tasks, approvals, and externally conducted votes remain
+recoverable through their owning providers and are linked by stable references.
 
 ## Decision Reconstruction Proof
 
@@ -67,3 +96,8 @@ information governance, responsible actor/automation assurance, and a protected
 reconstruction payload. A vote remains
 an approval reference and is not made indistinguishable from the formal
 institutional outcome.
+
+`tests/test_workspace.py` proves parent and lifecycle constraints, immutable
+history, replay and stale-write rejection, tenant isolation, committed-only
+events, vote/quorum evidence, adapter-only provider closure, aggregate-only
+secret-ballot persistence, minutes, and the local Decision projection.