feat: add workflow engine contribution contracts

tests/test_module_system.py

@@ -101,7 +101,7 @@ from govoplan_core.core.module_package_catalog import (
 )
 from govoplan_core.core.modules import FrontendModule, FrontendRoute, MigrationRetirementPlan, ModuleCompatibility, ModuleMigrationTask, ModuleMigrationTaskContext, ModuleMigrationTaskResult, ModuleUninstallGuardResult, PublicFrontendRoute
 from govoplan_core.core.module_guards import drop_table_retirement_provider
-from govoplan_core.core.modules import MigrationSpec, ModuleInterfaceProvider, ModuleInterfaceRequirement, ModuleManifest, RoleTemplate
+from govoplan_core.core.modules import MigrationSpec, ModuleInterfaceProvider, ModuleInterfaceRequirement, ModuleManifest, PermissionDefinition, RoleTemplate
 from govoplan_core.core.registry import PlatformRegistry, RegistryError
 from govoplan_core.admin.models import SystemSettings
 from govoplan_core.db.base import Base
@@ -363,6 +363,56 @@ class ModuleSystemTests(unittest.TestCase):
         with self.assertRaisesRegex(RegistryError, "unsupported manifest contract version"):
             registry.validate()
 
+    def test_manifest_can_preserve_a_legacy_permission_namespace(self) -> None:
+        registry = PlatformRegistry()
+        registry.register(
+            ModuleManifest(
+                id="workflow_engine",
+                name="Workflow Engine",
+                version="test",
+                permission_namespace="workflow",
+                permissions=(
+                    PermissionDefinition(
+                        scope="workflow:definition:read",
+                        label="Read workflows",
+                        description="Read workflow definitions.",
+                        category="Workflow",
+                        level="tenant",
+                        module_id="workflow",
+                        resource="definition",
+                        action="read",
+                    ),
+                ),
+            )
+        )
+
+        registry.validate()
+
+    def test_manifest_rejects_an_undeclared_permission_namespace(self) -> None:
+        registry = PlatformRegistry()
+        registry.register(
+            ModuleManifest(
+                id="workflow_engine",
+                name="Workflow Engine",
+                version="test",
+                permissions=(
+                    PermissionDefinition(
+                        scope="workflow:definition:read",
+                        label="Read workflows",
+                        description="Read workflow definitions.",
+                        category="Workflow",
+                        level="tenant",
+                        module_id="workflow",
+                        resource="definition",
+                        action="read",
+                    ),
+                ),
+            )
+        )
+
+        with self.assertRaisesRegex(RegistryError, "expected 'workflow_engine'"):
+            registry.validate()
+
     def test_default_authenticated_role_templates_are_managed_tenant_roles(self) -> None:
         for template, message in (
             (