feat(connectors): govern RSS and Atom publication

2026-08-21 17:36:19 +02:00
parent de8e74b866
commit e6ab8291ec
9 changed files with 182 additions and 18 deletions
@@ -46,6 +46,15 @@ recovery contract requires stable idempotency, provider verification, and
 operator reconciliation, but no connector currently claims a production write
 or delete path.

+RSS and Atom emission is a bounded renderer, not an authority shortcut. Every
+selected entry declares whether it came from a GovOPlaN event, publication,
+case, or report and carries an opaque owning-module reference and optional
+revision. Public-feed permission can render only public entries. Tenant and
+private audiences require a separate restricted-feed permission, and the API
+derives the allowed visibility set from that audience instead of accepting a
+caller-controlled allow-list. Portal or Reporting remains responsible for any
+durable public or authenticated route and must re-authorize restricted access.
+
 The governed connector runtime adds immutable definition revisions,
 revision-pinned tenant configurations, protected local overrides, explicit
 package-update adoption, bounded dry-runs and simulations, redacted provenance,