feat: add institutional governance and recovery contracts

docs/MODULE_ARCHITECTURE.md

@@ -13,6 +13,10 @@ Policy decision, source provenance, and explain-response contracts are tracked
 in [`POLICY_CONTRACTS.md`](POLICY_CONTRACTS.md).
 The experimental remote WebUI bundle loading design is tracked in
 [`REMOTE_WEBUI_BUNDLES.md`](REMOTE_WEBUI_BUNDLES.md).
+The cross-product semantic layers, source-authority modes, and candidate
+Mandates, Services, Parties, and Decisions boundaries are canonical in the
+meta repository's
+[`INSTITUTIONAL_GOVERNANCE_TARGET_ARCHITECTURE.md`](../../govoplan/docs/INSTITUTIONAL_GOVERNANCE_TARGET_ARCHITECTURE.md).
 
 ## Layer Model
 
@@ -24,6 +28,36 @@ The experimental remote WebUI bundle loading design is tracked in
 | Business modules | Public-sector workflows | campaigns, cases, forms, approvals, appointments |
 | Connector modules | External system integration | FIT-Connect, XÖV/XTA, DMS/eAkte, ERP, IDM |
 
+This table is the technical composition model. The product portfolio uses a
+more detailed institutional layer model, but it does not change dependency
+direction: Core provides contracts and composition; modules own semantics;
+packages compose modules.
+
+## Institutional Semantic Boundaries
+
+Cross-module references must keep these answers distinct:
+
+- Organizations owns where structures, units, and functions exist.
+- Identity owns who a subject is; Access owns accounts, roles, permissions,
+  and authorization decisions; IDM owns effective function assignments.
+- A Mandates capability will answer why a unit or function is competent for a
+  task, jurisdiction, subject, or period. It must not become another RBAC
+  system.
+- A Services capability will own versioned institutional service definitions;
+  Portal presents and starts them.
+- A Parties capability will own procedure-local participant roles,
+  representation, and delivery authority; it must reference rather than copy
+  Identity, Organizations, and Addresses subjects.
+- A Decisions capability will own formal institutional outcomes and their
+  authority, facts, rules, reasoning, effects, correction, and review.
+  Approvals owns review gates, Committee owns deliberation/votes, and Workflow
+  Engine owns coordination.
+
+Start each missing concept as a versioned DTO/provider contract used by a
+bounded journey. A repository is justified only when the concept gains
+independent persistence, lifecycle, security/operations behavior, release
+reason, and reuse. Core must not store these domain objects.
+
 ## Kernel Responsibilities
 
 The kernel target owns:
@@ -98,6 +132,11 @@ The following contracts are the baseline API that modules can rely on:
 - navigation metadata contract
 - command/event envelope contract
 - policy decision and source provenance contract in `govoplan_core.core.policy`
+- external object reference and integration-maturity contract in
+  `govoplan_core.core.external_references`
+- action/effect preview and execution contract in
+  `govoplan_core.core.automation`
+- workflow definition contribution and runtime-worker contracts
 
 Changes to these contracts must be versioned or accompanied by compatibility shims.
 
@@ -115,6 +154,30 @@ may extend the kernel by adding explicit contracts, but existing contracts must
 remain source-compatible through the 0.1.x split line unless a migration shim
 and deprecation note are provided.
 
+### Architecture Metadata
+
+`ModuleManifest.architecture` is the backward-compatible, versioned product-
+portfolio declaration for:
+
+- module kind and institutional architecture layer;
+- evidence-backed maturity claim (`concept`, `scaffold`, `vertical_slice`,
+  `reference_ready`, `supported`, or `lts`);
+- owned and explicitly non-owned concepts;
+- supported source-authority modes;
+- reference packages, tested providers, and known limits;
+- migration, upgrade, recovery, security, operations, and documentation
+  evidence references.
+
+Core validates the claim and all provider references during registry startup.
+`reference_ready`, `supported`, and `lts` claims require a named reference
+package and the cumulative evidence set; target-tested providers additionally
+require provider evidence. A supported module with migrations must include
+migration evidence. Signed release catalogs retain and revalidate the
+declaration. The meta manifest check validates repository evidence paths and
+provides an opt-in `--require-architecture` rollout gate. Platform metadata,
+Docs, and Ops project the same declaration. A module cannot make itself
+supported solely by changing its maturity string.
+
 Known access-related capability names are defined in
 `govoplan_core.core.access`, including:
 
@@ -180,6 +243,45 @@ intended for SemVer major-version lines. Missing optional interfaces are
 allowed, but an installed provider with an incompatible version blocks
 activation because the integration would otherwise bind to an unsafe API.
 
+### Source Authority And Provider Operations
+
+Integration maturity and configured authority are independent. The existing
+external-reference maturity ladder describes whether an adapter can discover,
+link, search, read, publish, synchronize, migrate, or replace. A binding must
+also state whether GovOPlaN is native authoritative, the external system is
+authoritative, GovOPlaN keeps a mirror, both sides use governed sync, GovOPlaN
+adds only a governance overlay, or the object is link-only.
+
+`ModuleManifest.external_providers` composes existing contracts rather than
+replacing them. Each declaration describes owned object/field groups, authority modes,
+operations, revisions, freshness, health, limits, idempotency, conflicts,
+outcome-unknown handling, evidence, correction/compensation, reconciliation,
+outage behavior, classification, purpose, retention, and secret requirements.
+Core owns the typed declaration and validation. Connectors and domain modules
+own the actual protocol and domain behavior; configuration packages select the
+effective mode and block missing/incompatible/unhealthy providers; Docs and Ops
+explain the result. Effect-capable declarations fail validation unless their
+retry, concurrency, outcome-unknown, correction, reconciliation, evidence,
+audit, timeout, outage, classification, purpose, retention, and secret behavior
+is explicit.
+
+Declarations are release-time capability claims. Configured state is projected
+separately through `ModuleManifest.external_provider_state_providers`. A state
+provider receives a bounded tenant context and returns one sanitized observation
+per configured binding: stable binding reference, effective authority mode,
+active/configured state, health, freshness, conflict, recovery readiness,
+observation/last-success time, and scalar metrics. Core validates and aggregates
+those observations, isolates provider failures, and never accepts URLs,
+credentials, or arbitrary nested metadata as runtime-state fields. Docs removes
+binding-level detail from ordinary-user projections; Ops may show the full
+sanitized operator projection.
+
+Configuration-package preflight selects the exact requested binding from this
+runtime state before evaluating authority, health, freshness, and recovery. A
+healthy sibling binding therefore cannot mask an unhealthy required binding.
+Providers with multiple configurations must use non-secret, stable references
+such as `calendar:sync-source:<id>`.
+
 Current named interfaces, generated from the source manifests by the workspace
 contract checks, are:
 
@@ -593,6 +695,39 @@ Rules:
   one migration run, and do not switch a database between tracks unless it is a
   disposable development database.
 
+### Shared State And Runtime Ordering
+
+Multi-host application roles use the `shared` state profile. In that profile,
+PostgreSQL, Redis, a stable installation identifier, and S3-compatible object
+storage are mandatory. Module durable artifacts must use Core's object-storage
+contract and module-owned opaque key namespaces; node-local paths are limited
+to temporary materialization. Same-host replicas may use the `host-shared`
+profile and one shared volume.
+
+Only the migration command mutates schema. PostgreSQL migration runs acquire a
+deployment-wide advisory lock before module pre-tasks, Alembic, and post-tasks.
+API, worker, and scheduler roles wait for exact configured migration heads and
+fail closed instead of applying migrations during startup.
+
+Runtime roles register identity, software/module composition, queues, heartbeat,
+and drain state in PostgreSQL. Singleton work must use a distributed lease and
+validate its monotonically increasing fencing token at the consequential
+commit. See `STATE_AND_RECOVERY_CONTRACT.md` for the complete contract.
+
+### Recovery Evidence
+
+Operations spanning transactions, object storage, queues, or external systems
+must choose an explicit Core recovery mode: atomic, compensation,
+snapshot-restore, forward-recovery, or irreversible. Plans require verification
+steps and mode-specific recovery material. Use idempotency keys, append-only
+evidence checkpoints, and a runtime fence where work may race across nodes.
+
+The recovery ledger is a shared primitive, not automatic coverage. A module may
+claim its guarantees only after its operation records preconditions before side
+effects, transitions partial/unknown outcomes honestly, and records verified
+completion or recovery. Plaintext secrets must never enter recovery metadata or
+evidence.
+
 ## Install, Uninstall, And Catalogs
 
 Core owns the install plan, signed catalog validation, license entitlement
@@ -962,7 +1097,7 @@ from workflow semantics.
 - form definitions, schemas, validation rules, field visibility rules,
   localization, versioning, admin editing, and reusable form package fragments
 
-`govoplan-forms-runtime` owns, when implemented:
+`govoplan-forms-runtime` owns:
 
 - public/internal submissions, drafts, submitted values, validation evidence,
   attachment references, submission receipts, and handoff events
@@ -975,6 +1110,16 @@ Boundary:
 - Reporting/dataflow may consume submitted data through governed DTOs or
   source lifecycle contracts.
 
+Implemented contract:
+
+- Core owns the provider-neutral `FormDefinition`/`FormFieldDefinition` DTOs.
+- Forms persists immutable exact definitions and provides `forms.definitions`.
+- Forms Runtime resolves that capability, persists revisioned instances and
+  events, validates draft/final values, and provides
+  `forms_runtime.service_launcher`.
+- Portal delegates exact `<form-id>/<revision>` bindings and never writes either
+  owner's tables.
+
 ### OpenDesk Integration Profile
 
 Tracking: `govoplan-core#195`, `govoplan-connectors#5`,
@@ -1219,6 +1364,9 @@ the same restart/health set after restoring package and database snapshots.
 The installer preflight is intentionally conservative:
 
 - maintenance mode must be active;
+- the `shared` state profile blocks in-place package mutation; clustered
+  installations must roll one verified immutable module composition across all
+  replicas;
 - installed module manifests must be compatible with the supported manifest
   contract and current core version;
 - uninstalling `tenancy`, `access`, or `admin` is blocked;