Release Core v0.1.35 configuration package safeguards

docs/CONFIGURATION_PACKAGES.md

@@ -157,6 +157,16 @@ The initial implementation includes provider-neutral orchestration helpers:
 - `apply_configuration_package(...)`
 - `export_configuration_package(...)`
 
+Portable fragments may bind deployment-specific operator input without placing
+that value in the signed reusable definition. A payload value of
+`{"$data": "requirement_key"}` references a key declared in the manifest's
+`data_requirements`. Preflight fails before invoking the owning provider when a
+reference is malformed, undeclared, or unresolved. Once supplied, Core replaces
+the reference in memory and passes only the resolved fragment to the provider.
+This mechanism is for deployment bindings and wording, not plaintext secrets:
+credential-envelope or environment references remain the normal portable
+boundary.
+
 The first concrete provider is `govoplan_access.backend.configuration_provider`.
 It supports access-owned `roles`, `groups`, and `group_role_assignments`
 fragments and applies them idempotently. Mail and Files also register providers
@@ -212,6 +222,14 @@ The admin wizard backend starts with these routes:
 10. Store import provenance, package version, supplied non-secret metadata, and
     audit events.
 
+Provider applies may commit independently. Core therefore stops at the first
+apply or health blocker and reports an explicit rollback state. A blocked
+preflight or a no-op needs no recovery; a successful multi-provider mutation
+retains the reviewed pre-apply database snapshot as its generic rollback path;
+a later-provider failure is reported as a partial apply that requires snapshot
+recovery or an explicitly supported module-owned compensation. The generic
+wizard never claims atomic cross-module undo.
+
 The wizard should display everything necessary and nothing unnecessary. Generic
 sections should cover package trust, dependency plan, required data, conflicts,
 review, and result. Module-specific fields should appear only when the selected
@@ -262,6 +280,11 @@ Exported packages should record provenance: source GovOPlaN version, module
 versions, exporter identity, timestamp, selected scope, redactions, and
 validation status.
 
+The orchestrator emits this provenance independently of provider payloads and
+lists secret requirement keys as redacted without serializing their supplied
+values. Providers still own the deeper rule that credentials, tokens, and
+decrypted envelope contents must never appear in exported fragments.
+
 ## Catalogs And Trust
 
 Configuration catalogs should follow the existing module package catalog model: