feat: define governed tenant erasure contracts

docs/ACCESS_RBAC_MODEL.md

@@ -142,6 +142,7 @@ system:tenants:read
 system:tenants:create
 system:tenants:update
 system:tenants:suspend
+system:tenants:erase
 
 system:accounts:read
 system:accounts:create

docs/CONFIGURATION_PACKAGES.md

@@ -200,6 +200,19 @@ Feature providers remain responsible for their own semantics:
 Ops projects the same Core-validated receipt. It must not maintain a second
 parser with different validation or secret-handling rules.
 
+Core also defines the inverse, read-only dependency-inventory contract used
+before the installer changes one of those infrastructure capabilities. An
+enabled module registers
+`infrastructure.dependency_inventory.<module_id>` and returns bounded, stable
+references to its persisted configuration or data, a lifecycle state, scope,
+numeric metrics, and a required operator action. Providers must not return
+secrets or use this read to migrate state. The Core collector validates provider
+identity and capability coverage, orders records deterministically, and marks
+the complete inventory failed when any provider raises or violates the
+contract. Ops is the authorized projection boundary; the installer remains the
+consumer and must match installation id, freshness, completion and impacted
+capability coverage before apply.
+
 The admin wizard backend starts with these routes:
 
 - `GET /api/v1/admin/configuration-packages/catalog`

docs/LOCALIZATION_AND_HELP_QUALITY.md

@@ -103,6 +103,14 @@ modal at narrow widths, closes with Escape, and restores focus to the triggering
 control. Module journeys should add their own exact high-risk mappings; they do
 not need to reimplement the keyboard or dialog mechanics.
 
+The same conformance suite mounts the production Forms Runtime self-service and
+assisted Anwohnerparkausweis surfaces with German module translations. Desktop
+and mobile runs traverse native controls by keyboard, inspect accessible names
+and landmarks, run WCAG 2.1 A/AA automation, verify responsive overflow, and
+retain independent per-field assisted provenance. Physical assistive-technology
+spot checks remain release evidence rather than being represented as browser
+automation.
+
 ## Verification
 
 ```bash

docs/MODULE_ARCHITECTURE.md

@@ -128,6 +128,8 @@ The following contracts are the baseline API that modules can rely on:
 - bounded reference-option search provider contract
 - single-tenant and optional batched tenant summary provider contracts
 - tenant delete-veto provider contract
+- provider-neutral tenant-erasure preview, step, idempotency, and
+  reconciliation contracts in `govoplan_core.core.tenant_erasure`
 - WebUI module contribution contract
 - navigation metadata contract
 - command/event envelope contract
@@ -149,6 +151,17 @@ Destructive tenant lifecycle planning deliberately continues to use the
 single-tenant path so it invokes every registered provider for the target
 tenant, independent of ordinary list-page projections.
 
+Governed populated-tenant erasure is separate from ordinary delete vetoes.
+Modules contribute `tenancy.erasure_provider.<module_id>` capabilities with a
+bounded resource inventory, explicit erase/retain/legal-hold/external/key/
+backup dispositions, ordered destructive warnings, idempotent step execution,
+and reconciliation. The collector fails closed when a provider is invalid or
+fails. A module with nonzero tenant summary counts and no erasure capability is
+reported as unsupported and blocks execution; modules with neither contract
+are explicitly projected as outside tenant-persistence scope. Provider
+evidence contains counts and stable references only and must never contain
+secrets or erased subject data.
+
 This list is the Milestone A kernel-contract freeze baseline. New module work
 may extend the kernel by adding explicit contracts, but existing contracts must
 remain source-compatible through the 0.1.x split line unless a migration shim

docs/UI_UX_DECISION_LEDGER.md

@@ -236,7 +236,9 @@ instead of reproducing their behavior.
   not self-explanatory.
 - `help` content is contextual guidance, not the accessible name. The persisted
   `show_inline_help_hints` user preference hides only the `InlineHelp` marker by
-  applying `ui-hide-help-hints` at the document root.
+  applying `ui-hide-help-hints` at the document root. When shown, the shared
+  marker is a labelled, keyboard-focusable help control and exposes its tooltip
+  on focus as well as pointer hover.
 - Shared action-bearing components accept an optional disabled reason. In
   particular, `MailServerSettingsPanel` forwards protocol-specific test
   blockers into the shared focusable disabled-action tooltip; modules provide

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "govoplan-core"
-version = "0.1.40"
+version = "0.1.43"
 description = "Reusable GovOPlaN platform core, access, tenancy, and RBAC components."
 readme = "README.md"
 requires-python = ">=3.12"

src/govoplan_core/core/infrastructure_capabilities.py

@@ -2,14 +2,18 @@ from __future__ import annotations
 
 from collections.abc import Mapping
 from dataclasses import dataclass
+from datetime import UTC, datetime
 import json
 import os
 from pathlib import Path
 import re
-from typing import Any
+from typing import Any, Protocol, runtime_checkable
 
 
 DEPLOYMENT_CAPABILITIES_ENV = "GOVOPLAN_DEPLOYMENT_CAPABILITIES_PATH"
+INFRASTRUCTURE_DEPENDENCY_PROVIDER_CAPABILITY_PREFIX = (
+    "infrastructure.dependency_inventory."
+)
 MAX_CAPABILITY_DOCUMENT_BYTES = 256 * 1024
 CAPABILITY_STATES = frozenset(
     {
@@ -20,12 +24,125 @@ CAPABILITY_STATES = frozenset(
     }
 )
 _ENV_REFERENCE_RE = re.compile(r"^env:[A-Za-z_][A-Za-z0-9_]*$")
+_DEPENDENCY_STATES = frozenset(
+    {"active", "inactive", "data_present", "pending_work", "runtime_binding"}
+)
 
 
 class InfrastructureCapabilityReceiptError(ValueError):
     pass
 
 
+@dataclass(frozen=True, slots=True)
+class InfrastructureDependency:
+    """A non-secret module-owned dependency on deployment infrastructure."""
+
+    capability_id: str
+    module_id: str
+    dependency_type: str
+    dependency_ref: str
+    state: str
+    scope: str
+    summary: str
+    metrics: Mapping[str, int]
+    required_action: str
+
+    def __post_init__(self) -> None:
+        for field_name, value, maximum in (
+            ("capability_id", self.capability_id, 120),
+            ("module_id", self.module_id, 120),
+            ("dependency_type", self.dependency_type, 120),
+            ("dependency_ref", self.dependency_ref, 240),
+            ("scope", self.scope, 120),
+            ("summary", self.summary, 1000),
+            ("required_action", self.required_action, 1000),
+        ):
+            if (
+                not value.strip()
+                or len(value) > maximum
+                or any(ord(char) < 32 for char in value)
+            ):
+                raise ValueError(
+                    f"Infrastructure dependency {field_name} is invalid."
+                )
+        if self.state not in _DEPENDENCY_STATES:
+            raise ValueError(
+                f"Infrastructure dependency state is unsupported: {self.state!r}."
+            )
+        if len(self.metrics) > 20 or any(
+            not isinstance(key, str)
+            or not key.strip()
+            or len(key) > 80
+            or any(ord(char) < 32 for char in key)
+            or type(value) is not int
+            or value < 0
+            for key, value in self.metrics.items()
+        ):
+            raise ValueError("Infrastructure dependency metrics are invalid.")
+
+    def to_dict(self) -> dict[str, object]:
+        return {
+            "capability_id": self.capability_id,
+            "module_id": self.module_id,
+            "dependency_type": self.dependency_type,
+            "dependency_ref": self.dependency_ref,
+            "state": self.state,
+            "scope": self.scope,
+            "summary": self.summary,
+            "metrics": dict(sorted(self.metrics.items())),
+            "required_action": self.required_action,
+        }
+
+
+@runtime_checkable
+class InfrastructureDependencyProvider(Protocol):
+    module_id: str
+    capability_ids: tuple[str, ...]
+
+    def infrastructure_dependencies(self) -> tuple[InfrastructureDependency, ...]:
+        ...
+
+
+@dataclass(frozen=True, slots=True)
+class InfrastructureDependencyProviderReport:
+    module_id: str
+    capability_ids: tuple[str, ...]
+    state: str
+    dependency_count: int
+    error: str | None = None
+
+    def to_dict(self) -> dict[str, object]:
+        return {
+            "module_id": self.module_id,
+            "capability_ids": list(self.capability_ids),
+            "state": self.state,
+            "dependency_count": self.dependency_count,
+            "error": self.error,
+        }
+
+
+@dataclass(frozen=True, slots=True)
+class InfrastructureDependencyInventory:
+    installation_id: str
+    generated_at: str
+    complete: bool
+    inspected_capability_ids: tuple[str, ...]
+    providers: tuple[InfrastructureDependencyProviderReport, ...]
+    dependencies: tuple[InfrastructureDependency, ...]
+    schema_version: int = 1
+
+    def to_dict(self) -> dict[str, object]:
+        return {
+            "schema_version": self.schema_version,
+            "installation_id": self.installation_id,
+            "generated_at": self.generated_at,
+            "complete": self.complete,
+            "inspected_capability_ids": list(self.inspected_capability_ids),
+            "providers": [item.to_dict() for item in self.providers],
+            "dependencies": [item.to_dict() for item in self.dependencies],
+        }
+
+
 @dataclass(frozen=True, slots=True)
 class InfrastructureCapability:
     id: str
@@ -214,6 +331,134 @@ def deployment_capability_status(
     }
 
 
+def collect_infrastructure_dependency_inventory(
+    registry: object,
+    *,
+    installation_id: str,
+    observed_at: datetime | None = None,
+) -> InfrastructureDependencyInventory:
+    """Collect actual module-owned dependencies without importing module internals."""
+
+    normalized_installation_id = installation_id.strip()
+    if not normalized_installation_id or len(normalized_installation_id) > 100:
+        raise ValueError("Infrastructure dependency installation id is invalid.")
+    capability_names = getattr(registry, "capability_names", None)
+    capability = getattr(registry, "capability", None)
+    if not callable(capability_names) or not callable(capability):
+        raise ValueError("Infrastructure dependency inventory requires a module registry.")
+
+    provider_names = tuple(
+        name
+        for name in capability_names()
+        if isinstance(name, str)
+        and name.startswith(INFRASTRUCTURE_DEPENDENCY_PROVIDER_CAPABILITY_PREFIX)
+    )
+    reports: list[InfrastructureDependencyProviderReport] = []
+    dependencies: list[InfrastructureDependency] = []
+    inspected_capability_ids: set[str] = set()
+    complete = True
+
+    for provider_name in sorted(provider_names):
+        expected_module_id = provider_name.removeprefix(
+            INFRASTRUCTURE_DEPENDENCY_PROVIDER_CAPABILITY_PREFIX
+        )
+        module_id = expected_module_id or "unknown"
+        declared_ids: tuple[str, ...] = ()
+        try:
+            provider = capability(provider_name)
+            if not isinstance(provider, InfrastructureDependencyProvider):
+                raise TypeError("provider does not implement the inventory contract")
+            module_id = provider.module_id.strip()
+            declared_ids = tuple(
+                sorted(
+                    {
+                        item.strip()
+                        for item in provider.capability_ids
+                        if isinstance(item, str) and item.strip()
+                    }
+                )
+            )
+            if (
+                module_id != expected_module_id
+                or len(module_id) > 120
+                or any(ord(char) < 32 for char in module_id)
+                or not declared_ids
+                or len(declared_ids) > 30
+                or any(
+                    len(item) > 120 or any(ord(char) < 32 for char in item)
+                    for item in declared_ids
+                )
+            ):
+                raise ValueError("provider identity or capability declaration is invalid")
+            provider_dependencies = tuple(provider.infrastructure_dependencies())
+            if len(provider_dependencies) > 10_000:
+                raise ValueError("provider dependency inventory is too large")
+            seen_refs: set[tuple[str, str, str]] = set()
+            for item in provider_dependencies:
+                if not isinstance(item, InfrastructureDependency):
+                    raise TypeError("provider returned an invalid dependency")
+                if item.module_id != module_id or item.capability_id not in declared_ids:
+                    raise ValueError("provider returned a dependency outside its declaration")
+                identity = (
+                    item.capability_id,
+                    item.dependency_type,
+                    item.dependency_ref,
+                )
+                if identity in seen_refs:
+                    raise ValueError("provider returned a duplicate dependency")
+                seen_refs.add(identity)
+            if len(dependencies) + len(provider_dependencies) > 10_000:
+                raise ValueError("combined dependency inventory is too large")
+            dependencies.extend(provider_dependencies)
+            inspected_capability_ids.update(declared_ids)
+            reports.append(
+                InfrastructureDependencyProviderReport(
+                    module_id=module_id,
+                    capability_ids=declared_ids,
+                    state="complete",
+                    dependency_count=len(provider_dependencies),
+                )
+            )
+        except Exception as exc:
+            complete = False
+            inspected_capability_ids.update(declared_ids)
+            reports.append(
+                InfrastructureDependencyProviderReport(
+                    module_id=module_id,
+                    capability_ids=declared_ids,
+                    state="error",
+                    dependency_count=0,
+                    error=(
+                        f"{type(exc).__name__}: provider inventory could not be completed"
+                    ),
+                )
+            )
+
+    timestamp = observed_at or datetime.now(UTC)
+    if timestamp.tzinfo is None:
+        timestamp = timestamp.replace(tzinfo=UTC)
+    return InfrastructureDependencyInventory(
+        installation_id=normalized_installation_id,
+        generated_at=timestamp.astimezone(UTC).isoformat(),
+        complete=complete,
+        inspected_capability_ids=tuple(sorted(inspected_capability_ids)),
+        providers=tuple(
+            sorted(reports, key=lambda item: (item.module_id, item.capability_ids))
+        ),
+        dependencies=tuple(
+            sorted(
+                dependencies,
+                key=lambda item: (
+                    item.capability_id,
+                    item.module_id,
+                    item.dependency_type,
+                    item.dependency_ref,
+                ),
+            )
+        ),
+    )
+
+
 def _capability(value: object) -> InfrastructureCapability:
     if not isinstance(value, Mapping):
         raise InfrastructureCapabilityReceiptError(
@@ -352,10 +597,16 @@ def _unavailable_status(*, configured: bool, error: str | None) -> dict[str, obj
 __all__ = [
     "CAPABILITY_STATES",
     "DEPLOYMENT_CAPABILITIES_ENV",
+    "INFRASTRUCTURE_DEPENDENCY_PROVIDER_CAPABILITY_PREFIX",
     "InfrastructureCapability",
     "InfrastructureCapabilityReceipt",
     "InfrastructureCapabilityReceiptError",
+    "InfrastructureDependency",
+    "InfrastructureDependencyInventory",
+    "InfrastructureDependencyProvider",
+    "InfrastructureDependencyProviderReport",
     "InfrastructurePostInstallTask",
+    "collect_infrastructure_dependency_inventory",
     "deployment_capability_status",
     "infrastructure_capability_receipt_from_mapping",
     "load_infrastructure_capability_receipt",

src/govoplan_core/core/tenant_erasure.py

@@ -0,0 +1,467 @@
+from __future__ import annotations
+
+from collections.abc import Mapping
+from dataclasses import dataclass, field
+from datetime import UTC, datetime
+from typing import Literal, Protocol, runtime_checkable
+
+
+TENANT_ERASURE_PROVIDER_CAPABILITY_PREFIX = "tenancy.erasure_provider."
+
+TenantErasureDisposition = Literal[
+    "erase",
+    "retain",
+    "legal_hold",
+    "external_cleanup",
+    "key_destroy",
+    "backup_expiry",
+    "unavailable",
+]
+TenantErasureStepKind = Literal[
+    "export",
+    "erase",
+    "retain",
+    "external_cleanup",
+    "key_destroy",
+    "backup_expiry",
+    "verify",
+]
+TenantErasureResultState = Literal[
+    "completed",
+    "pending",
+    "blocked",
+    "outcome_unknown",
+]
+
+_DISPOSITIONS = frozenset(
+    {
+        "erase",
+        "retain",
+        "legal_hold",
+        "external_cleanup",
+        "key_destroy",
+        "backup_expiry",
+        "unavailable",
+    }
+)
+_STEP_KINDS = frozenset(
+    {
+        "export",
+        "erase",
+        "retain",
+        "external_cleanup",
+        "key_destroy",
+        "backup_expiry",
+        "verify",
+    }
+)
+_RESULT_STATES = frozenset(
+    {"completed", "pending", "blocked", "outcome_unknown"}
+)
+
+
+def _text(value: str, label: str, *, maximum: int) -> str:
+    normalized = value.strip()
+    if (
+        not normalized
+        or len(normalized) > maximum
+        or any(ord(character) < 32 for character in normalized)
+    ):
+        raise ValueError(f"Tenant erasure {label} is invalid.")
+    return normalized
+
+
+def _texts(
+    values: tuple[str, ...],
+    label: str,
+    *,
+    maximum_items: int = 100,
+    maximum_length: int = 500,
+) -> tuple[str, ...]:
+    if len(values) > maximum_items:
+        raise ValueError(f"Tenant erasure {label} has too many entries.")
+    normalized = tuple(
+        _text(value, label, maximum=maximum_length) for value in values
+    )
+    if len(normalized) != len(set(normalized)):
+        raise ValueError(f"Tenant erasure {label} contains duplicates.")
+    return normalized
+
+
+def _metrics(values: Mapping[str, int]) -> dict[str, int]:
+    if len(values) > 30:
+        raise ValueError("Tenant erasure metrics has too many entries.")
+    normalized: dict[str, int] = {}
+    for key, value in values.items():
+        normalized_key = _text(key, "metric key", maximum=80)
+        if type(value) is not int or value < 0:
+            raise ValueError("Tenant erasure metric values must be non-negative integers.")
+        normalized[normalized_key] = value
+    return normalized
+
+
+@dataclass(frozen=True, slots=True)
+class TenantErasureResource:
+    resource_type: str
+    count: int
+    disposition: TenantErasureDisposition
+    summary: str
+    governance_ref: str | None = None
+    external: bool = False
+
+    def __post_init__(self) -> None:
+        _text(self.resource_type, "resource type", maximum=120)
+        _text(self.summary, "resource summary", maximum=1000)
+        if type(self.count) is not int or self.count < 0:
+            raise ValueError("Tenant erasure resource count is invalid.")
+        if self.disposition not in _DISPOSITIONS:
+            raise ValueError("Tenant erasure resource disposition is invalid.")
+        if self.governance_ref is not None:
+            _text(self.governance_ref, "governance reference", maximum=300)
+
+    def to_dict(self) -> dict[str, object]:
+        return {
+            "resource_type": self.resource_type,
+            "count": self.count,
+            "disposition": self.disposition,
+            "summary": self.summary,
+            "governance_ref": self.governance_ref,
+            "external": self.external,
+        }
+
+
+@dataclass(frozen=True, slots=True)
+class TenantErasureStep:
+    step_id: str
+    kind: TenantErasureStepKind
+    summary: str
+    destructive: bool
+    irreversible: bool
+    requires_reconciliation: bool = False
+    depends_on: tuple[str, ...] = ()
+
+    def __post_init__(self) -> None:
+        _text(self.step_id, "step id", maximum=160)
+        _text(self.summary, "step summary", maximum=1000)
+        if self.kind not in _STEP_KINDS:
+            raise ValueError("Tenant erasure step kind is invalid.")
+        _texts(self.depends_on, "step dependencies", maximum_length=160)
+        if self.step_id in self.depends_on:
+            raise ValueError("Tenant erasure step cannot depend on itself.")
+        if self.irreversible and not self.destructive:
+            raise ValueError("An irreversible tenant erasure step must be destructive.")
+
+    def to_dict(self) -> dict[str, object]:
+        return {
+            "step_id": self.step_id,
+            "kind": self.kind,
+            "summary": self.summary,
+            "destructive": self.destructive,
+            "irreversible": self.irreversible,
+            "requires_reconciliation": self.requires_reconciliation,
+            "depends_on": list(self.depends_on),
+        }
+
+
+@dataclass(frozen=True, slots=True)
+class TenantErasurePreview:
+    module_id: str
+    complete: bool
+    resources: tuple[TenantErasureResource, ...] = ()
+    steps: tuple[TenantErasureStep, ...] = ()
+    blockers: tuple[str, ...] = ()
+    warnings: tuple[str, ...] = ()
+    provider_revision: str = "1"
+
+    def __post_init__(self) -> None:
+        _text(self.module_id, "module id", maximum=120)
+        _text(self.provider_revision, "provider revision", maximum=120)
+        _texts(self.blockers, "blockers", maximum_length=1000)
+        _texts(self.warnings, "warnings", maximum_length=1000)
+        if len(self.resources) > 500 or len(self.steps) > 500:
+            raise ValueError("Tenant erasure preview is too large.")
+        resource_types = [item.resource_type for item in self.resources]
+        if len(resource_types) != len(set(resource_types)):
+            raise ValueError("Tenant erasure preview repeats a resource type.")
+        resources_requiring_action = tuple(
+            item for item in self.resources if item.count > 0
+        )
+        if resources_requiring_action and not self.steps and not self.blockers:
+            raise ValueError(
+                "Tenant erasure resources require steps or an explicit blocker."
+            )
+        if any(
+            item.count > 0 and item.disposition == "unavailable"
+            for item in self.resources
+        ) and not self.blockers:
+            raise ValueError(
+                "Unavailable tenant erasure resources require an explicit blocker."
+            )
+        if not self.complete and not self.blockers:
+            raise ValueError(
+                "An incomplete tenant erasure preview requires an explicit blocker."
+            )
+        step_ids = [item.step_id for item in self.steps]
+        if len(step_ids) != len(set(step_ids)):
+            raise ValueError("Tenant erasure preview repeats a step id.")
+        known_step_ids = set(step_ids)
+        if any(
+            dependency not in known_step_ids
+            for step in self.steps
+            for dependency in step.depends_on
+        ):
+            raise ValueError("Tenant erasure step references an unknown dependency.")
+        remaining = {
+            step.step_id: set(step.depends_on)
+            for step in self.steps
+        }
+        resolved: set[str] = set()
+        while remaining:
+            ready = sorted(
+                step_id
+                for step_id, dependencies in remaining.items()
+                if dependencies.issubset(resolved)
+            )
+            if not ready:
+                raise ValueError("Tenant erasure step dependencies contain a cycle.")
+            resolved.update(ready)
+            for step_id in ready:
+                remaining.pop(step_id)
+
+    @property
+    def allowed(self) -> bool:
+        return self.complete and not self.blockers
+
+    def to_dict(self) -> dict[str, object]:
+        return {
+            "module_id": self.module_id,
+            "complete": self.complete,
+            "allowed": self.allowed,
+            "provider_revision": self.provider_revision,
+            "resources": [item.to_dict() for item in self.resources],
+            "steps": [item.to_dict() for item in self.steps],
+            "blockers": list(self.blockers),
+            "warnings": list(self.warnings),
+        }
+
+
+@dataclass(frozen=True, slots=True)
+class TenantErasureStepResult:
+    state: TenantErasureResultState
+    summary: str
+    receipt_ref: str | None = None
+    metrics: Mapping[str, int] = field(default_factory=dict)
+
+    def __post_init__(self) -> None:
+        if self.state not in _RESULT_STATES:
+            raise ValueError("Tenant erasure result state is invalid.")
+        _text(self.summary, "result summary", maximum=1000)
+        if self.receipt_ref is not None:
+            _text(self.receipt_ref, "receipt reference", maximum=500)
+        _metrics(self.metrics)
+
+    def to_dict(self) -> dict[str, object]:
+        return {
+            "state": self.state,
+            "summary": self.summary,
+            "receipt_ref": self.receipt_ref,
+            "metrics": dict(sorted(_metrics(self.metrics).items())),
+        }
+
+
+@runtime_checkable
+class TenantErasureProvider(Protocol):
+    module_id: str
+
+    def preview_tenant_erasure(
+        self,
+        session: object,
+        tenant_id: str,
+    ) -> TenantErasurePreview:
+        ...
+
+    def execute_tenant_erasure_step(
+        self,
+        session: object,
+        tenant_id: str,
+        step_id: str,
+        idempotency_key: str,
+    ) -> TenantErasureStepResult:
+        ...
+
+    def reconcile_tenant_erasure_step(
+        self,
+        session: object,
+        tenant_id: str,
+        step_id: str,
+        idempotency_key: str,
+    ) -> TenantErasureStepResult:
+        ...
+
+
+@dataclass(frozen=True, slots=True)
+class TenantErasureInventory:
+    tenant_id: str
+    generated_at: datetime
+    complete: bool
+    modules: tuple[TenantErasurePreview, ...]
+
+    @property
+    def allowed(self) -> bool:
+        return self.complete and all(item.allowed for item in self.modules)
+
+    def to_dict(self) -> dict[str, object]:
+        generated_at = self.generated_at
+        if generated_at.tzinfo is None:
+            generated_at = generated_at.replace(tzinfo=UTC)
+        return {
+            "schema_version": 1,
+            "tenant_id": self.tenant_id,
+            "generated_at": generated_at.astimezone(UTC).isoformat(),
+            "complete": self.complete,
+            "allowed": self.allowed,
+            "modules": [item.to_dict() for item in self.modules],
+        }
+
+
+def tenant_erasure_providers(registry: object) -> dict[str, TenantErasureProvider]:
+    capability_names = getattr(registry, "capability_names", None)
+    capability = getattr(registry, "capability", None)
+    if not callable(capability_names) or not callable(capability):
+        raise ValueError("Tenant erasure requires a module registry.")
+    providers: dict[str, TenantErasureProvider] = {}
+    for capability_name in sorted(capability_names()):
+        if not capability_name.startswith(TENANT_ERASURE_PROVIDER_CAPABILITY_PREFIX):
+            continue
+        expected_module_id = capability_name.removeprefix(
+            TENANT_ERASURE_PROVIDER_CAPABILITY_PREFIX
+        )
+        provider = capability(capability_name)
+        if not isinstance(provider, TenantErasureProvider):
+            raise TypeError(
+                f"Tenant erasure provider {expected_module_id or 'unknown'} is invalid."
+            )
+        module_id = _text(provider.module_id, "provider module id", maximum=120)
+        if module_id != expected_module_id or module_id in providers:
+            raise ValueError("Tenant erasure provider identity is invalid.")
+        providers[module_id] = provider
+    return providers
+
+
+def collect_tenant_erasure_inventory(
+    registry: object,
+    session: object,
+    tenant_id: str,
+    *,
+    observed_at: datetime | None = None,
+) -> TenantErasureInventory:
+    normalized_tenant_id = _text(tenant_id, "tenant id", maximum=120)
+    manifests = getattr(registry, "manifests", None)
+    summary_providers = getattr(registry, "tenant_summary_providers", None)
+    if not callable(manifests) or not callable(summary_providers):
+        raise ValueError("Tenant erasure inventory requires a module registry.")
+    provider_by_module = tenant_erasure_providers(registry)
+    summary_by_module = dict(summary_providers())
+    manifest_ids = {
+        str(manifest.id)
+        for manifest in manifests()
+        if getattr(manifest, "id", None)
+    }
+    module_ids = manifest_ids | set(summary_by_module) | set(provider_by_module)
+    previews: list[TenantErasurePreview] = []
+    complete = True
+    for module_id in sorted(module_ids):
+        provider = provider_by_module.get(module_id)
+        if provider is not None:
+            try:
+                preview = provider.preview_tenant_erasure(session, normalized_tenant_id)
+                if not isinstance(preview, TenantErasurePreview):
+                    raise TypeError("provider returned an invalid preview")
+                if preview.module_id != module_id:
+                    raise ValueError("provider returned another module's preview")
+            except Exception as exc:
+                complete = False
+                preview = TenantErasurePreview(
+                    module_id=module_id,
+                    complete=False,
+                    blockers=(
+                        f"{type(exc).__name__}: provider preview could not be completed",
+                    ),
+                )
+            previews.append(preview)
+            complete = complete and preview.complete
+            continue
+        summary_provider = summary_by_module.get(module_id)
+        if summary_provider is None:
+            previews.append(
+                TenantErasurePreview(
+                    module_id=module_id,
+                    complete=True,
+                    warnings=(
+                        "Module declares no tenant-owned summary or erasure provider; no tenant persistence is in scope.",
+                    ),
+                    provider_revision="manifest-no-tenant-data",
+                )
+            )
+            continue
+        try:
+            raw_counts = summary_provider(session, normalized_tenant_id)
+            counts = _metrics({str(key): int(value) for key, value in raw_counts.items()})
+            resources = tuple(
+                TenantErasureResource(
+                    resource_type=resource_type,
+                    count=count,
+                    disposition="unavailable" if count else "erase",
+                    summary=(
+                        "Tenant-owned data requires a module erasure provider."
+                        if count
+                        else "The module reported no tenant-owned records."
+                    ),
+                )
+                for resource_type, count in sorted(counts.items())
+            )
+            blockers = (
+                ("Tenant-owned data exists but the module has no erasure provider.",)
+                if any(counts.values())
+                else ()
+            )
+            preview = TenantErasurePreview(
+                module_id=module_id,
+                complete=True,
+                resources=resources,
+                blockers=blockers,
+                provider_revision="tenant-summary-fallback",
+            )
+        except Exception as exc:
+            complete = False
+            preview = TenantErasurePreview(
+                module_id=module_id,
+                complete=False,
+                blockers=(
+                    f"{type(exc).__name__}: tenant summary could not be completed",
+                ),
+                provider_revision="tenant-summary-fallback",
+            )
+        previews.append(preview)
+    timestamp = observed_at or datetime.now(UTC)
+    if timestamp.tzinfo is None:
+        timestamp = timestamp.replace(tzinfo=UTC)
+    return TenantErasureInventory(
+        tenant_id=normalized_tenant_id,
+        generated_at=timestamp,
+        complete=complete,
+        modules=tuple(previews),
+    )
+
+
+__all__ = [
+    "TENANT_ERASURE_PROVIDER_CAPABILITY_PREFIX",
+    "TenantErasureInventory",
+    "TenantErasurePreview",
+    "TenantErasureProvider",
+    "TenantErasureResource",
+    "TenantErasureStep",
+    "TenantErasureStepResult",
+    "collect_tenant_erasure_inventory",
+    "tenant_erasure_providers",
+]

src/govoplan_core/security/module_permissions.py

@@ -27,6 +27,7 @@ LEGACY_TO_MODULE_SCOPES: dict[str, str] = {
     "system:tenants:create": "access:tenant:create",
     "system:tenants:update": "access:tenant:update",
     "system:tenants:suspend": "access:tenant:suspend",
+    "system:tenants:erase": "access:tenant:erase",
     "system:accounts:read": "access:account:read",
     "system:accounts:create": "access:account:create",
     "system:accounts:update": "access:account:update",

src/govoplan_core/security/permissions.py

@@ -78,6 +78,7 @@ SYSTEM_PERMISSIONS: tuple[PermissionDefinition, ...] = (
     PermissionDefinition("system:tenants:create", "Create tenants", "Create new tenant spaces.", "System administration", "system"),
     PermissionDefinition("system:tenants:update", "Update tenants", "Edit tenant metadata and governance overrides.", "System administration", "system"),
     PermissionDefinition("system:tenants:suspend", "Suspend tenants", "Activate or suspend tenant spaces while preserving evidence.", "System administration", "system"),
+    PermissionDefinition("system:tenants:erase", "Erase tenants", "Preview, approve, execute, and reconcile governed destructive tenant erasure.", "System administration", "system"),
     PermissionDefinition("system:accounts:read", "View accounts", "List global login accounts and memberships.", "System administration", "system"),
     PermissionDefinition("system:accounts:create", "Create accounts", "Create global login accounts.", "System administration", "system"),
     PermissionDefinition("system:accounts:update", "Update accounts", "Edit global account metadata.", "System administration", "system"),

tests/test_infrastructure_capabilities.py

@@ -2,6 +2,7 @@ from __future__ import annotations
 
 import json
 import os
+from datetime import UTC, datetime
 from pathlib import Path
 import tempfile
 import unittest
@@ -9,12 +10,53 @@ from unittest.mock import patch
 
 from govoplan_core.core.infrastructure_capabilities import (
     InfrastructureCapabilityReceiptError,
+    InfrastructureDependency,
+    collect_infrastructure_dependency_inventory,
     deployment_capability_status,
     infrastructure_capability_receipt_from_mapping,
     load_infrastructure_capability_receipt,
 )
 
 
+class _InventoryProvider:
+    module_id = "mail"
+    capability_ids = ("mail.smtp",)
+
+    def infrastructure_dependencies(self) -> tuple[InfrastructureDependency, ...]:
+        return (
+            InfrastructureDependency(
+                capability_id="mail.smtp",
+                module_id="mail",
+                dependency_type="smtp_endpoint",
+                dependency_ref="mail-server:server-1",
+                state="active",
+                scope="system",
+                summary="One active SMTP endpoint uses the deployment relay.",
+                metrics={"credential_binding_count": 1},
+                required_action="Rebind or retire the endpoint before removal.",
+            ),
+        )
+
+
+class _FailingInventoryProvider:
+    module_id = "files"
+    capability_ids = ("files.storage",)
+
+    def infrastructure_dependencies(self) -> tuple[InfrastructureDependency, ...]:
+        raise RuntimeError("database URL must not escape")
+
+
+class _Registry:
+    def __init__(self, providers: dict[str, object]) -> None:
+        self.providers = providers
+
+    def capability_names(self) -> tuple[str, ...]:
+        return tuple(self.providers)
+
+    def capability(self, name: str) -> object | None:
+        return self.providers.get(name)
+
+
 def _receipt_payload() -> dict[str, object]:
     return {
         "schema_version": 1,
@@ -48,6 +90,40 @@ def _receipt_payload() -> dict[str, object]:
 
 
 class InfrastructureCapabilityReceiptTests(unittest.TestCase):
+    def test_collects_non_secret_provider_dependency_inventory(self) -> None:
+        inventory = collect_infrastructure_dependency_inventory(
+            _Registry(
+                {
+                    "infrastructure.dependency_inventory.mail": _InventoryProvider(),
+                    "unrelated.capability": object(),
+                }
+            ),
+            installation_id="govoplan-test",
+            observed_at=datetime(2026, 8, 24, 12, 0, tzinfo=UTC),
+        )
+
+        self.assertTrue(inventory.complete)
+        self.assertEqual(("mail.smtp",), inventory.inspected_capability_ids)
+        self.assertEqual("mail-server:server-1", inventory.dependencies[0].dependency_ref)
+        self.assertEqual("2026-08-24T12:00:00+00:00", inventory.generated_at)
+        self.assertNotIn("database URL", json.dumps(inventory.to_dict()))
+
+    def test_provider_failure_makes_inventory_incomplete_without_leaking_error(self) -> None:
+        inventory = collect_infrastructure_dependency_inventory(
+            _Registry(
+                {
+                    "infrastructure.dependency_inventory.files": (
+                        _FailingInventoryProvider()
+                    )
+                }
+            ),
+            installation_id="govoplan-test",
+        )
+
+        self.assertFalse(inventory.complete)
+        self.assertEqual("error", inventory.providers[0].state)
+        self.assertNotIn("database URL", str(inventory.providers[0].error))
+
     def test_parses_typed_capability_and_task_lookup(self) -> None:
         receipt = infrastructure_capability_receipt_from_mapping(_receipt_payload())
 

tests/test_module_system.py

@@ -344,6 +344,18 @@ class ModuleSystemTests(unittest.TestCase):
         self.assertTrue(scopes_grant_compatible(["access:membership:read"], "admin:users:read"))
         self.assertTrue(scopes_grant_compatible(["admin:users:read"], "access:membership:read"))
         self.assertTrue(scopes_grant_compatible(["access:tenant:read"], "system:tenants:read"))
+        self.assertTrue(
+            scopes_grant_compatible(
+                ["access:tenant:erase"],
+                "system:tenants:erase",
+            )
+        )
+        self.assertFalse(
+            scopes_grant_compatible(
+                ["system:tenants:write"],
+                "system:tenants:erase",
+            )
+        )
         self.assertTrue(scopes_grant_compatible(["system:*"], "access:tenant:read"))
         self.assertTrue(
             scopes_grant_compatible(
@@ -1015,8 +1027,10 @@ finally:
                         json={"mode": "destroy", "reason": "not supported"},
                     )
                     self.assertEqual(409, destructive.status_code, destructive.text)
-                    issue_codes = {item["code"] for item in destructive.json()["detail"]["plan"]["issues"]}
-                    self.assertIn("tenant_data_present", issue_codes)
+                    self.assertIn(
+                        "Direct destructive deletion is disabled",
+                        destructive.json()["detail"]["message"],
+                    )
 
                     with database.session() as session:
                         empty_tenant = Tenant(
@@ -1029,15 +1043,43 @@ finally:
                         session.commit()
                         empty_tenant_id = empty_tenant.id
 
-                    destroyed = client.request(
-                        "DELETE",
-                        f"/api/v1/admin/tenants/{empty_tenant_id}",
+                    erasure_policy = client.patch(
+                        "/api/v1/admin/tenant-erasure-policy",
                         headers=headers,
-                        json={"mode": "destroy", "reason": "empty tenant cleanup"},
+                        json={
+                            "production_profile": False,
+                            "required_approvals": 1,
+                            "preview_ttl_seconds": 900,
+                            "recent_authentication_seconds": 900,
+                        },
                     )
-                    self.assertEqual(200, destroyed.status_code, destroyed.text)
-                    self.assertEqual("destroy", destroyed.json()["plan"]["action"])
-                    self.assertTrue(destroyed.json()["plan"]["destructive_supported"])
+                    self.assertEqual(200, erasure_policy.status_code, erasure_policy.text)
+                    erasure_preview = client.post(
+                        f"/api/v1/admin/tenants/{empty_tenant_id}/erasure-operations",
+                        headers=headers,
+                        json={
+                            "idempotency_key": f"empty-destroy-{name}",
+                            "reason": "empty tenant cleanup",
+                        },
+                    )
+                    self.assertEqual(201, erasure_preview.status_code, erasure_preview.text)
+                    self.assertTrue(erasure_preview.json()["preview"]["allowed"])
+                    operation_id = erasure_preview.json()["id"]
+                    approved_erasure = client.post(
+                        f"/api/v1/admin/tenants/{empty_tenant_id}/erasure-operations/{operation_id}/approve",
+                        headers=headers,
+                        json={"confirmation": f"empty-destroy-{name}"},
+                    )
+                    self.assertEqual(200, approved_erasure.status_code, approved_erasure.text)
+                    self.assertEqual("ready", approved_erasure.json()["state"])
+                    executed_erasure = client.post(
+                        f"/api/v1/admin/tenants/{empty_tenant_id}/erasure-operations/{operation_id}/execute",
+                        headers=headers,
+                        json={"confirmation": f"empty-destroy-{name}"},
+                    )
+                    self.assertEqual(200, executed_erasure.status_code, executed_erasure.text)
+                    self.assertEqual("completed", executed_erasure.json()["state"])
+                    self.assertIsNone(executed_erasure.json()["reason"])
 
                     retired = client.request(
                         "DELETE",

tests/test_tenant_erasure_contract.py

@@ -0,0 +1,180 @@
+from __future__ import annotations
+
+from datetime import UTC, datetime
+from types import SimpleNamespace
+
+import pytest
+
+from govoplan_core.core.tenant_erasure import (
+    TENANT_ERASURE_PROVIDER_CAPABILITY_PREFIX,
+    TenantErasurePreview,
+    TenantErasureResource,
+    TenantErasureStep,
+    TenantErasureStepResult,
+    collect_tenant_erasure_inventory,
+    tenant_erasure_providers,
+)
+
+
+class _Provider:
+    module_id = "files"
+
+    def preview_tenant_erasure(self, session, tenant_id: str) -> TenantErasurePreview:
+        del session
+        assert tenant_id == "tenant-1"
+        return TenantErasurePreview(
+            module_id=self.module_id,
+            complete=True,
+            resources=(
+                TenantErasureResource(
+                    resource_type="file_blobs",
+                    count=2,
+                    disposition="erase",
+                    summary="Two tenant-owned file blobs will be erased.",
+                ),
+            ),
+            steps=(
+                TenantErasureStep(
+                    step_id="erase-blobs",
+                    kind="erase",
+                    summary="Erase tenant-owned file blobs.",
+                    destructive=True,
+                    irreversible=True,
+                ),
+            ),
+        )
+
+    def execute_tenant_erasure_step(
+        self, session, tenant_id: str, step_id: str, idempotency_key: str
+    ) -> TenantErasureStepResult:
+        del session, tenant_id, step_id, idempotency_key
+        return TenantErasureStepResult(
+            state="completed",
+            summary="Tenant file blobs erased.",
+            metrics={"deleted": 2},
+        )
+
+    def reconcile_tenant_erasure_step(
+        self, session, tenant_id: str, step_id: str, idempotency_key: str
+    ) -> TenantErasureStepResult:
+        return self.execute_tenant_erasure_step(
+            session, tenant_id, step_id, idempotency_key
+        )
+
+
+class _Registry:
+    def __init__(self, *, provider: object | None = None, counts: dict[str, int] | None = None):
+        self._provider = provider
+        self._counts = counts
+
+    def manifests(self):
+        return (
+            SimpleNamespace(id="core"),
+            SimpleNamespace(id="files"),
+            SimpleNamespace(id="wiki"),
+        )
+
+    def capability_names(self):
+        if self._provider is None:
+            return ()
+        return (f"{TENANT_ERASURE_PROVIDER_CAPABILITY_PREFIX}files",)
+
+    def capability(self, name: str):
+        assert name.endswith("files")
+        return self._provider
+
+    def tenant_summary_providers(self):
+        if self._counts is None:
+            return {}
+        return {"files": lambda _session, _tenant_id: self._counts}
+
+
+def test_contract_rejects_unsafe_irreversible_step() -> None:
+    with pytest.raises(ValueError, match="must be destructive"):
+        TenantErasureStep(
+            step_id="unsafe",
+            kind="erase",
+            summary="Invalid step.",
+            destructive=False,
+            irreversible=True,
+        )
+
+
+def test_contract_rejects_cyclic_step_dependencies() -> None:
+    with pytest.raises(ValueError, match="contain a cycle"):
+        TenantErasurePreview(
+            module_id="files",
+            complete=True,
+            steps=(
+                TenantErasureStep(
+                    step_id="first",
+                    kind="erase",
+                    summary="First.",
+                    destructive=True,
+                    irreversible=True,
+                    depends_on=("second",),
+                ),
+                TenantErasureStep(
+                    step_id="second",
+                    kind="verify",
+                    summary="Second.",
+                    destructive=False,
+                    irreversible=False,
+                    depends_on=("first",),
+                ),
+            ),
+        )
+
+
+def test_contract_requires_action_or_blocker_for_tenant_data() -> None:
+    resource = TenantErasureResource(
+        resource_type="files",
+        count=1,
+        disposition="erase",
+        summary="One file exists.",
+    )
+    with pytest.raises(ValueError, match="steps or an explicit blocker"):
+        TenantErasurePreview(
+            module_id="files",
+            complete=True,
+            resources=(resource,),
+        )
+
+
+def test_inventory_collects_provider_and_marks_non_data_modules() -> None:
+    inventory = collect_tenant_erasure_inventory(
+        _Registry(provider=_Provider()),
+        object(),
+        "tenant-1",
+        observed_at=datetime(2026, 8, 24, 12, 0, tzinfo=UTC),
+    )
+
+    assert inventory.complete
+    assert inventory.allowed
+    assert [item.module_id for item in inventory.modules] == ["core", "files", "wiki"]
+    assert inventory.modules[1].steps[0].irreversible
+    assert inventory.to_dict()["generated_at"] == "2026-08-24T12:00:00+00:00"
+
+
+def test_summary_fallback_blocks_when_data_exists() -> None:
+    inventory = collect_tenant_erasure_inventory(
+        _Registry(counts={"file_blobs": 3}),
+        object(),
+        "tenant-1",
+    )
+
+    files = next(item for item in inventory.modules if item.module_id == "files")
+    assert inventory.complete
+    assert not inventory.allowed
+    assert files.resources[0].disposition == "unavailable"
+    assert files.blockers == (
+        "Tenant-owned data exists but the module has no erasure provider.",
+    )
+
+
+def test_provider_identity_must_match_capability_suffix() -> None:
+    provider = _Provider()
+    provider.module_id = "mail"
+
+    with pytest.raises(ValueError, match="identity"):
+        tenant_erasure_providers(_Registry(provider=provider))

webui/conformance/ConformanceApp.tsx

@@ -1,6 +1,9 @@
 import { useMemo, useState } from "react";
 import { FileText, GitBranch, Inbox, Search, ShieldCheck } from "lucide-react";
 import { useLocation } from "react-router";
+import FormInstancePage from "../../../govoplan-forms-runtime/webui/src/features/forms/FormInstancePage";
+import FormsRuntimePage from "../../../govoplan-forms-runtime/webui/src/features/forms/FormsRuntimePage";
+import PublicFormPage from "../../../govoplan-forms-runtime/webui/src/features/forms/PublicFormPage";
 import QuickAccessRail from "../../../govoplan-quick-access/webui/src/components/QuickAccessRail";
 import ActionToolbar from "../src/components/ActionToolbar";
 import Button from "../src/components/Button";
@@ -40,6 +43,16 @@ export default function ConformanceApp() {
   const [editorDirty, setEditorDirty] = useState(true);
   const [metricDrilldown, setMetricDrilldown] = useState("");
 
+  if (location.pathname.startsWith("/forms/public/")) {
+    return <PublicFormPage settings={CONFORMANCE_SETTINGS} auth={FORMS_RUNTIME_AUTH} />;
+  }
+  if (location.pathname === "/forms-runtime") {
+    return <FormsRuntimePage settings={CONFORMANCE_SETTINGS} auth={FORMS_RUNTIME_AUTH} />;
+  }
+  if (location.pathname.startsWith("/forms-runtime/")) {
+    return <FormInstancePage settings={CONFORMANCE_SETTINGS} auth={FORMS_RUNTIME_AUTH} />;
+  }
+
   return (
     <main className="conformance-root" data-conformance-id="shared-ui-lab">
       <PageLayout
@@ -290,6 +303,16 @@ const CONFORMANCE_AUTH = {
   groups_loaded: true
 } satisfies AuthInfo;
 
+const FORMS_RUNTIME_AUTH = {
+  ...CONFORMANCE_AUTH,
+  scopes: [
+    "forms_runtime:submission:assist",
+    "forms_runtime:submission:participate",
+    "forms_runtime:workspace:read",
+    "forms_runtime:workspace:write"
+  ]
+} satisfies AuthInfo;
+
 const CONFORMANCE_SETTINGS: ApiSettings = {
   apiBaseUrl: "",
   apiKey: "",

webui/conformance/QuickAccessCoreFacade.ts

@@ -1,20 +1,52 @@
-// Narrow facade used only by the conformance build. It lets the optional
-// Quick Access module exercise its real rail without pulling the composed
-// application's generated module catalogue into this isolated test bundle.
-export { apiFetch } from "../src/api/client";
+// Narrow facade used only by the conformance build. It lets optional modules
+// exercise their real task surfaces without pulling the composed application's
+// generated module catalogue into this isolated test bundle.
+export { apiFetch, apiPath } from "../src/api/client";
+export { default as ActionBlockerHint } from "../src/components/ActionBlockerHint";
+export { default as ActionToolbar } from "../src/components/ActionToolbar";
+export { default as Button } from "../src/components/Button";
+export { default as ConfirmDialog } from "../src/components/ConfirmDialog";
+export { default as DescriptionList, DescriptionItem } from "../src/components/DescriptionList";
+export { default as Dialog } from "../src/components/Dialog";
+export { DialogForm, DialogSection } from "../src/components/DialogAnatomy";
 export { default as DismissibleAlert } from "../src/components/DismissibleAlert";
 export { default as DocumentationHelpLink } from "../src/components/help/DocumentationHelpLink";
+export type { DocumentationHelpReference } from "../src/components/help/documentationHelp";
+export { default as FileDropZone } from "../src/components/FileDropZone";
+export { default as FormField } from "../src/components/FormField";
+export { FormGrid } from "../src/components/ContentGrid";
 export { default as IconButton } from "../src/components/IconButton";
 export { default as LoadingFrame } from "../src/components/LoadingFrame";
-export { useGuardedNavigate } from "../src/components/UnsavedChangesGuard";
-export { usePlatformLanguage } from "../src/i18n/LanguageContext";
+export { default as LoadingIndicator } from "../src/components/LoadingIndicator";
+export { default as PageScrollViewport } from "../src/components/PageScrollViewport";
+export {
+  default as SelectionList,
+  SelectionListItem,
+  SelectionListItemContent
+} from "../src/components/SelectionList";
+export { default as StatePanel } from "../src/components/StatePanel";
+export { default as StatusBadge } from "../src/components/StatusBadge";
+export { default as ToggleSwitch } from "../src/components/ToggleSwitch";
+export {
+  useGuardedNavigate,
+  useUnsavedDraftGuard
+} from "../src/components/UnsavedChangesGuard";
+export {
+  i18nMessage,
+  usePlatformLanguage
+} from "../src/i18n/LanguageContext";
+export { usePlatformModuleInstalled } from "../src/platform/ModuleContext";
 export {
   dispatchQuickAccessResult,
   quickAccessLaunchState
 } from "../src/platform/launchContext";
-export { i18nMessage } from "../src/i18n/LanguageContext";
+export { hasScope } from "../src/utils/permissions";
+export { default as WorkspaceActionBar } from "../src/components/WorkspaceActionBar";
+export { default as WorkspaceFrame } from "../src/components/WorkspaceFrame";
 export type {
   ApiSettings,
+  PlatformRouteContext,
+  PlatformTranslations,
   QuickAccessRailProps,
   QuickAccessToolsUiCapability
 } from "../src/types";

webui/conformance/main.tsx

@@ -1,7 +1,8 @@
 import React from "react";
 import ReactDOM from "react-dom/client";
-import { BrowserRouter } from "react-router";
+import { BrowserRouter, Route, Routes } from "react-router";
 import ConformanceApp from "./ConformanceApp";
+import { generatedTranslations as formsRuntimeTranslations } from "../../../govoplan-forms-runtime/webui/src/i18n/generatedTranslations";
 import { UnsavedChangesProvider } from "../src/components/UnsavedChangesGuard";
 import { PlatformLanguageProvider } from "../src/i18n/LanguageContext";
 import { PlatformModulesProvider } from "../src/platform/ModuleContext";
@@ -14,6 +15,7 @@ import "../src/styles/badges.css";
 import "../src/styles/components.css";
 import "../src/styles/dialogs.css";
 import "@govoplan/quick-access-webui/styles/quick-access.css";
+import "../../../govoplan-forms-runtime/webui/src/styles/forms-runtime.css";
 import "./conformance.css";
 
 const theme = new URLSearchParams(window.location.search).get("theme");
@@ -35,9 +37,15 @@ ReactDOM.createRoot(document.getElementById("root")!).render(
   <React.StrictMode>
     <BrowserRouter>
       <PlatformModulesProvider modules={CONFORMANCE_MODULES}>
-        <PlatformLanguageProvider preferredLanguageCode="de">
+        <PlatformLanguageProvider
+          preferredLanguageCode="de"
+          moduleTranslations={[formsRuntimeTranslations]}>
           <UnsavedChangesProvider>
-            <ConformanceApp />
+            <Routes>
+              <Route path="/forms/public/:publicId" element={<ConformanceApp />} />
+              <Route path="/forms-runtime/:instanceId" element={<ConformanceApp />} />
+              <Route path="*" element={<ConformanceApp />} />
+            </Routes>
           </UnsavedChangesProvider>
         </PlatformLanguageProvider>
       </PlatformModulesProvider>

webui/conformance/tests/ui-conformance.spec.ts

@@ -19,6 +19,125 @@ async function expectNoAccessibilityViolations(page: import("@playwright/test").
   expect(violations).toEqual([]);
 }
 
+for (const viewport of [
+  { name: "desktop", width: 1280, height: 900 },
+  { name: "mobile", width: 390, height: 844 }
+]) {
+  test(`resident permit self-service is keyboard and accessibility conformant on ${viewport.name}`, async ({ page }) => {
+    const journey = await mockPublicResidentPermitJourney(page);
+    await page.setViewportSize(viewport);
+    await page.goto("/forms/public/resident-parking-permit?theme=light");
+
+    await expect(page.getByRole("heading", { level: 1, name: "Anwohnerparkausweis beantragen" })).toBeVisible();
+    await expectNoAccessibilityViolations(page);
+
+    const name = page.getByLabel("Name der antragstellenden Person");
+    await name.focus();
+    await page.keyboard.type("Ada Lovelace");
+    await page.keyboard.press("Tab");
+    await expect(page.getByLabel("E-Mail-Adresse")).toBeFocused();
+    await page.keyboard.type("ada.lovelace@example.test");
+    await page.keyboard.press("Tab");
+    await expect(page.getByLabel("Hauptwohnsitz")).toBeFocused();
+    await page.keyboard.type("Musterstraße 17, 10115 Berlin");
+    await page.keyboard.press("Tab");
+    await expect(page.getByLabel("Kfz-Kennzeichen")).toBeFocused();
+    await page.keyboard.type("B-AL 1843");
+    await page.keyboard.press("Tab");
+    await expect(page.getByRole("button", { name: "Entwurf speichern" })).toBeFocused();
+    await page.keyboard.press("Enter");
+    await expect.poll(() => journey.savedValues()).toEqual({
+      applicant_name: "Ada Lovelace",
+      applicant_email: "ada.lovelace@example.test",
+      residence_address: "Musterstraße 17, 10115 Berlin",
+      licence_plate: "B-AL 1843"
+    });
+
+    await page.getByRole("button", { name: "Absenden" }).click();
+    const confirm = page.getByRole("alertdialog", { name: "Formular absenden" });
+    await expect(confirm).toBeVisible();
+    await expectNoAccessibilityViolations(page);
+    await confirm.getByRole("button", { name: "Absenden" }).click();
+    await expect(page.getByText("Übermittlung eingegangen")).toBeVisible();
+    await expect(page.getByText("receipt-rpp-2026-0001")).toBeVisible();
+    await expectNoHorizontalOverflow(page);
+  });
+
+  test(`resident permit assisted intake preserves per-field provenance on ${viewport.name}`, async ({ page }) => {
+    const journey = await mockAssistedResidentPermitJourney(page);
+    await page.setViewportSize(viewport);
+    await page.goto("/forms-runtime?theme=light");
+
+    await page.getByRole("button", { name: "Assistierte Erfassung" }).click();
+    const startDialog = page.getByRole("dialog", { name: "Assistierte Erfassung starten" });
+    await expect(startDialog).toBeVisible();
+    await expectNoAccessibilityViolations(page);
+    await startDialog.getByLabel("Referenz der betroffenen Partei").fill("party:resident-ada-lovelace");
+    await startDialog.getByLabel("Referenz der zuständigen Funktion").fill("function:parking-permits");
+    await startDialog.getByLabel("Zweck").fill("Anwohnerparkausweis beantragen");
+    await startDialog.getByLabel("Referenz der Rechtsgrundlage").fill("law:resident-parking-permit");
+    await startDialog.getByLabel("Barrierefreiheits- oder Kommunikationsunterstützung").fill("Leichte Sprache");
+    const notice = startDialog.getByRole("checkbox", { name: "Datenschutz- und Verfahrenshinweis wurde erteilt" });
+    await notice.focus();
+    await page.keyboard.press("Space");
+    await expect(notice).toBeChecked();
+    await startDialog.getByLabel("Referenz der betroffenen Partei").focus();
+    await page.keyboard.press("Tab");
+    await expect(page.locator(":focus")).toHaveAttribute("aria-label", "Feldhilfe anzeigen");
+    await page.keyboard.press("Tab");
+    await expect(startDialog.getByLabel("Referenz der vertretenen Partei")).toBeFocused();
+    await startDialog.getByRole("button", { name: "Sitzung starten" }).click();
+
+    await expect(page).toHaveURL(/\/forms-runtime\/assisted-rpp-1$/);
+    await expect(page.getByRole("heading", { level: 1, name: "Anwohnerparkausweis beantragen" })).toBeVisible();
+    await page.getByLabel("Name der antragstellenden Person").fill("Ada Lovelace");
+    await page.getByLabel("E-Mail-Adresse").fill("ada.lovelace@example.test");
+    await page.getByLabel("Hauptwohnsitz").fill("Musterstraße 17, 10115 Berlin");
+    await page.getByLabel("Kfz-Kennzeichen").fill("B-AL 1843");
+    await page.getByLabel("Änderungsgrund").fill("Angaben gemeinsam mit der antragstellenden Person erfasst.");
+    await page.getByRole("button", { name: "Entwurf speichern" }).click();
+
+    await page.getByRole("button", { name: "Rücklesen und absenden" }).click();
+    const readback = page.getByRole("dialog", { name: "Assistiertes Rücklesen erfassen" });
+    await expect(readback).toBeVisible();
+    await expect(readback.getByRole("group", { name: "Hauptwohnsitz" })).toBeVisible();
+    await expectNoAccessibilityViolations(page);
+
+    const addressSource = readback.getByRole("group", { name: "Hauptwohnsitz" });
+    await addressSource.getByLabel("Wertquelle").selectOption("document");
+    await addressSource.getByLabel("Quellenvertrauen").selectOption("verified");
+    await addressSource.getByLabel("Erklärende Partei oder Quellenreferenz").fill("files:residence-proof-2026");
+    const plateSource = readback.getByRole("group", { name: "Kfz-Kennzeichen" });
+    await plateSource.getByLabel("Wertquelle").focus();
+    await page.keyboard.press("ArrowDown");
+    await page.keyboard.press("ArrowDown");
+    await page.keyboard.press("ArrowDown");
+    await page.keyboard.press("Enter");
+    await plateSource.getByLabel("Quellenvertrauen").selectOption("verified");
+    await plateSource.getByLabel("Erklärende Partei oder Quellenreferenz").fill("register:vehicle-B-AL-1843");
+    await readback.getByRole("button", { name: "Erfassen und fortfahren" }).click();
+
+    await expect.poll(() => journey.confirmationSources()).toMatchObject({
+      applicant_name: { source: "person_statement", confidence: "stated" },
+      residence_address: {
+        source: "document",
+        confidence: "verified",
+        declared_by_ref: "files:residence-proof-2026"
+      },
+      licence_plate: {
+        source: "system",
+        confidence: "verified",
+        declared_by_ref: "register:vehicle-B-AL-1843"
+      }
+    });
+    const submit = page.getByRole("alertdialog", { name: "Formular absenden" });
+    await submit.getByRole("button", { name: "Absenden" }).click();
+    await expect(page.getByText("receipt-assisted-rpp-2026-0001")).toBeVisible();
+    await expect(page.getByText("Rücklesen erfasst")).toBeVisible();
+    await expectNoHorizontalOverflow(page);
+  });
+}
+
 test("shared components remain accessible and keyboard operable", async ({ page }) => {
   await page.goto("/?theme=light");
   await expect(page.getByRole("heading", { level: 1, name: "Zentrale GovOPlaN-Oberflächen" })).toBeVisible();
@@ -229,6 +348,301 @@ test("narrow layout preserves task order without horizontal overflow", async ({
   await expect(page.locator("[data-conformance-id='shared-ui-lab']")).toHaveScreenshot("shared-ui-light-narrow.png", { animations: "disabled", maxDiffPixelRatio: 0.005 });
 });
 
+async function expectNoHorizontalOverflow(page: import("@playwright/test").Page) {
+  const overflowing = await page.evaluate(() => Array.from(document.querySelectorAll<HTMLElement>("body *"))
+    .filter((element) => {
+      const style = window.getComputedStyle(element);
+      return style.display !== "none" && style.visibility !== "hidden";
+    })
+    .map((element) => {
+      const rect = element.getBoundingClientRect();
+      return {
+        element: `${element.tagName.toLowerCase()}.${Array.from(element.classList).join(".")}`,
+        left: Math.round(rect.left),
+        right: Math.round(rect.right)
+      };
+    })
+    .filter(({ left, right }) => left < -1 || right > window.innerWidth + 1)
+    .slice(0, 20));
+  expect(overflowing).toEqual([]);
+}
+
+async function mockPublicResidentPermitJourney(page: import("@playwright/test").Page) {
+  let current = residentPermitInstance("public-rpp-1", "started", 1, {});
+  let savedValues: Record<string, unknown> = {};
+
+  await page.route("**/api/v1/forms-runtime/**", async (route) => {
+    const request = route.request();
+    const path = new URL(request.url()).pathname;
+    const method = request.method();
+    if (path.endsWith("/public/profiles/resident-parking-permit/start") && method === "POST") {
+      return fulfillJson(route, {
+        session_id: "session-public-rpp-1",
+        mode: "anonymous",
+        status: "active",
+        expires_at: "2026-08-25T10:00:00Z",
+        instance: current,
+        token: "public-rpp-token",
+        replayed: false
+      });
+    }
+    if (path.endsWith("/public/intake") && method === "GET") {
+      return fulfillJson(route, { instance: current, definition: residentPermitDefinition() });
+    }
+    if (path.endsWith("/public/intake") && method === "PATCH") {
+      const payload = request.postDataJSON() as { values: Record<string, unknown> };
+      savedValues = payload.values;
+      current = residentPermitInstance("public-rpp-1", "draft", 2, payload.values);
+      return fulfillJson(route, current);
+    }
+    if (path.endsWith("/public/intake/submit") && method === "POST") {
+      const payload = request.postDataJSON() as { values: Record<string, unknown> };
+      current = {
+        ...residentPermitInstance("public-rpp-1", "submitted", 3, payload.values),
+        receipt_id: "receipt-rpp-2026-0001"
+      };
+      return fulfillJson(route, current);
+    }
+    return route.abort("failed");
+  });
+
+  return { savedValues: () => savedValues };
+}
+
+async function mockAssistedResidentPermitJourney(page: import("@playwright/test").Page) {
+  let current = residentPermitInstance("assisted-rpp-1", "started", 1, {}, true);
+  let confirmationSources: Record<string, unknown> = {};
+  let confirmations: unknown[] = [];
+
+  await page.route("**/api/v1/forms-runtime/**", async (route) => {
+    const request = route.request();
+    const path = new URL(request.url()).pathname;
+    const method = request.method();
+
+    if (path.endsWith("/instances") && method === "GET") {
+      return fulfillJson(route, { instances: [], total: 0, offset: 0, limit: 200 });
+    }
+    if (path.endsWith("/assisted-intake/profiles") && method === "GET") {
+      return fulfillJson(route, { profiles: [{
+        profile_id: "assisted-profile-rpp",
+        public_id: "resident-parking-permit",
+        definition_ref: residentPermitDefinition().reference,
+        mode: "assisted",
+        enabled: true,
+        revision: 1,
+        draft_ttl_seconds: 2_592_000,
+        invitation_ttl_seconds: 1_209_600,
+        rate_limit_per_minute: 60,
+        metadata: { definition_title: "Anwohnerparkausweis beantragen" }
+      }] });
+    }
+    if (path.endsWith("/assisted-intake/start") && method === "POST") {
+      return fulfillJson(route, {
+        session_id: "assisted-session-rpp-1",
+        mode: "assisted",
+        status: "active",
+        expires_at: "2026-08-25T10:00:00Z",
+        instance: current,
+        token: null,
+        replayed: false
+      });
+    }
+    if (path.endsWith("/instances/assisted-rpp-1/definition") && method === "GET") {
+      return fulfillJson(route, residentPermitDefinition());
+    }
+    if (path.endsWith("/instances/assisted-rpp-1/history") && method === "GET") {
+      return fulfillJson(route, { revisions: [current] });
+    }
+    if (path.endsWith("/instances/assisted-rpp-1/events") && method === "GET") {
+      return fulfillJson(route, { events: [{
+        event_id: `event-${current.revision}`,
+        event_type: current.status === "submitted" ? "submitted" : "draft_saved",
+        instance_revision: current.revision,
+        status: current.status,
+        occurred_at: current.recorded_at,
+        actor_id: "operator-1",
+        payload: {}
+      }] });
+    }
+    if (path.endsWith("/instances/assisted-rpp-1/handoffs") && method === "GET") {
+      return fulfillJson(route, { handoffs: [] });
+    }
+    if (path.endsWith("/instances/assisted-rpp-1/assisted-confirmations") && method === "GET") {
+      return fulfillJson(route, { confirmations });
+    }
+    if (path.endsWith("/instances/assisted-rpp-1/assisted-confirmations") && method === "POST") {
+      const payload = request.postDataJSON() as { field_sources: Record<string, unknown> };
+      confirmationSources = payload.field_sources;
+      const confirmation = {
+        confirmation_id: "confirmation-rpp-1",
+        instance_id: "assisted-rpp-1",
+        instance_revision: current.revision,
+        outcome: "confirmed",
+        method: "spoken_readback",
+        confirmed_by_ref: "party:resident-ada-lovelace",
+        operator_actor_id: "operator-1",
+        confirmed_at: "2026-08-24T10:10:00Z",
+        payload_sha256: "a".repeat(64),
+        correction_note: null,
+        metadata: { field_sources: confirmationSources }
+      };
+      confirmations = [confirmation];
+      return fulfillJson(route, confirmation);
+    }
+    if (path.endsWith("/instances/assisted-rpp-1/submit") && method === "POST") {
+      const payload = request.postDataJSON() as { values: Record<string, unknown> };
+      current = {
+        ...residentPermitInstance("assisted-rpp-1", "submitted", current.revision + 1, payload.values, true),
+        receipt_id: "receipt-assisted-rpp-2026-0001"
+      };
+      return fulfillJson(route, current);
+    }
+    if (path.endsWith("/instances/assisted-rpp-1") && method === "PATCH") {
+      const payload = request.postDataJSON() as { values: Record<string, unknown> };
+      current = residentPermitInstance("assisted-rpp-1", "draft", current.revision + 1, payload.values, true);
+      return fulfillJson(route, current);
+    }
+    if (path.endsWith("/instances/assisted-rpp-1") && method === "GET") {
+      return fulfillJson(route, current);
+    }
+    return route.abort("failed");
+  });
+
+  return { confirmationSources: () => confirmationSources };
+}
+
+function residentPermitDefinition() {
+  return {
+    reference: {
+      kind: "form",
+      owner_module: "forms",
+      object_id: "resident-parking-permit-application",
+      tenant_id: "tenant-1",
+      version: "3",
+      label: "Anwohnerparkausweis beantragen"
+    },
+    key: "resident_parking_permit.apply",
+    temporal: { revision: "3", recorded_at: "2026-08-24T10:00:00Z" },
+    title: "Resident parking permit application",
+    description: "Apply digitally or together with an authorized service worker.",
+    fields: [
+      residentPermitField("applicant_name", "Applicant name", "text", { min_length: 2, max_length: 200 }),
+      residentPermitField("applicant_email", "Applicant email", "email", { format: "email" }),
+      residentPermitField("residence_address", "Primary residence", "text", { max_length: 500 }),
+      residentPermitField("licence_plate", "Licence plate", "text", { max_length: 20 })
+    ],
+    publication_state: "published",
+    allow_drafts: true,
+    max_attachments: 0,
+    signature_requirement: "none",
+    policy_refs: ["law:resident-parking-permit"],
+    handoff_kinds: [],
+    fallback_locale: "de",
+    localizations: [{
+      locale: "de",
+      title: "Anwohnerparkausweis beantragen",
+      description: "Beantragen Sie den Anwohnerparkausweis digital oder gemeinsam mit einer berechtigten Servicestelle.",
+      field_labels: {
+        applicant_name: "Name der antragstellenden Person",
+        applicant_email: "E-Mail-Adresse",
+        residence_address: "Hauptwohnsitz",
+        licence_plate: "Kfz-Kennzeichen"
+      },
+      field_help_texts: {},
+      option_labels: {},
+      page_titles: {},
+      section_titles: {}
+    }]
+  };
+}
+
+function residentPermitField(
+  key: string,
+  label: string,
+  valueType: "text" | "email",
+  constraints: Record<string, unknown>
+) {
+  return {
+    key,
+    label,
+    value_type: valueType,
+    required: true,
+    help_text: null,
+    options: [],
+    constraints,
+    default_value: null,
+    visibility_condition: null
+  };
+}
+
+function residentPermitInstance(
+  instanceId: string,
+  status: string,
+  revision: number,
+  values: Record<string, unknown>,
+  assisted = false
+) {
+  return {
+    reference: {
+      kind: "form_instance",
+      owner_module: "forms_runtime",
+      object_id: instanceId,
+      tenant_id: "tenant-1",
+      version: String(revision),
+      label: "Anwohnerparkausweis beantragen"
+    },
+    tenant_id: "tenant-1",
+    instance_id: instanceId,
+    revision,
+    status,
+    definition_ref: residentPermitDefinition().reference,
+    values,
+    validation_results: [],
+    attachment_refs: [],
+    signature_refs: [],
+    handoff_refs: [],
+    service_ref: null,
+    receipt_id: null as string | null,
+    recorded_at: "2026-08-24T10:00:00Z",
+    change_reason: revision === 1 ? "Assisted session started." : "Draft saved.",
+    created_by: "operator-1",
+    changed_by: "operator-1",
+    metadata: assisted ? {
+      intake: {
+        session_id: "assisted-session-rpp-1",
+        profile_id: "assisted-profile-rpp",
+        mode: "assisted",
+        channel: "counter",
+        affected_party_ref: "party:resident-ada-lovelace",
+        represented_party_ref: null,
+        authority_basis: "self",
+        purpose: "Anwohnerparkausweis beantragen",
+        legal_basis_ref: "law:resident-parking-permit",
+        consent_basis: "in-person-confirmation",
+        notice_given: true,
+        responsible_function_ref: "function:parking-permits",
+        language: "de",
+        accessibility_needs: ["Leichte Sprache"],
+        field_sources: {},
+        operator: { actor_id: "operator-1", auth_method: "session" }
+      }
+    } : {},
+    status_access: null,
+    replayed: false
+  };
+}
+
+async function fulfillJson(
+  route: import("@playwright/test").Route,
+  body: unknown
+) {
+  await route.fulfill({
+    status: 200,
+    contentType: "application/json",
+    body: JSON.stringify(body)
+  });
+}
+
 function quickAccessPayload(includeMessages: boolean) {
   const files = {
     id: "files",

webui/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@govoplan/core-webui",
-  "version": "0.1.40",
+  "version": "0.1.43",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@govoplan/core-webui",
-      "version": "0.1.40",
+      "version": "0.1.43",
       "dependencies": {
         "@govoplan/access-webui": "file:../../govoplan-access/webui",
         "@govoplan/addresses-webui": "file:../../govoplan-addresses/webui",
@@ -378,7 +378,7 @@
     },
     "../../govoplan-forms-runtime/webui": {
       "name": "@govoplan/forms-runtime-webui",
-      "version": "0.1.18",
+      "version": "0.1.20",
       "peerDependencies": {
         "@govoplan/core-webui": "^0.1.18",
         "lucide-react": "^1.23.0",

webui/package-lock.release.json

@@ -1,28 +1,28 @@
 {
   "name": "@govoplan/core-webui",
-  "version": "0.1.40",
+  "version": "0.1.43",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@govoplan/core-webui",
-      "version": "0.1.40",
+      "version": "0.1.43",
       "dependencies": {
-        "@govoplan/access-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-access.git#v0.1.23",
+        "@govoplan/access-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-access.git#v0.1.24",
         "@govoplan/admin-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-admin.git#v0.1.22",
-        "@govoplan/audit-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-audit.git#v0.1.18",
+        "@govoplan/audit-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-audit.git#v0.1.20",
         "@govoplan/calendar-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-calendar.git#v0.1.22",
         "@govoplan/campaign-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-campaign.git#v0.1.27",
         "@govoplan/cases-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-cases.git#v0.1.20",
-        "@govoplan/dashboard-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-dashboard.git#v0.1.18",
+        "@govoplan/dashboard-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-dashboard.git#v0.1.20",
         "@govoplan/docs-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-docs.git#v0.1.22",
-        "@govoplan/files-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-files.git#v0.1.23",
+        "@govoplan/files-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-files.git#v0.1.24",
         "@govoplan/helpdesk-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-helpdesk.git#v0.1.20",
         "@govoplan/idm-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-idm.git#v0.1.24",
-        "@govoplan/mail-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-mail.git#v0.1.25",
-        "@govoplan/ops-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-ops.git#v0.1.18",
+        "@govoplan/mail-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-mail.git#v0.1.26",
+        "@govoplan/ops-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-ops.git#v0.1.21",
         "@govoplan/organizations-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-organizations.git#v0.1.20",
-        "@govoplan/policy-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-policy.git#v0.1.18",
+        "@govoplan/policy-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-policy.git#v0.1.22",
         "@govoplan/tickets-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-tickets.git#v0.1.22",
         "@govoplan/wiki-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-wiki.git#v0.1.22",
         "@tiptap/core": "^3.29.2",
@@ -757,8 +757,8 @@
       "optional": true
     },
     "node_modules/@govoplan/access-webui": {
-      "version": "0.1.23",
-      "resolved": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-access.git#e55434f406e953a2fa9e881abb8fb6dccbabd812",
+      "version": "0.1.24",
+      "resolved": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-access.git#0f8a05f8b95340de7e0aa1569a51589764b0776e",
       "peerDependencies": {
         "@govoplan/core-webui": "^0.1.18",
         "lucide-react": "^1.23.0",
@@ -789,8 +789,8 @@
       }
     },
     "node_modules/@govoplan/audit-webui": {
-      "version": "0.1.18",
-      "resolved": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-audit.git#6e63f6920ad5fb71f5d40e785eaed263905d658c",
+      "version": "0.1.20",
+      "resolved": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-audit.git#f2d7b9b29a497607d20f57886448247a8561df8d",
       "peerDependencies": {
         "@govoplan/core-webui": "^0.1.18",
         "lucide-react": "^1.23.0",
@@ -859,8 +859,8 @@
       }
     },
     "node_modules/@govoplan/dashboard-webui": {
-      "version": "0.1.18",
-      "resolved": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-dashboard.git#ede16c5439f71ed36b50994d5ad7f656212a43c4",
+      "version": "0.1.20",
+      "resolved": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-dashboard.git#ec240ed2199637a68751e348887908a82d4cfe65",
       "peerDependencies": {
         "@govoplan/core-webui": "^0.1.18",
         "lucide-react": "^1.23.0",
@@ -894,8 +894,8 @@
       }
     },
     "node_modules/@govoplan/files-webui": {
-      "version": "0.1.23",
-      "resolved": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-files.git#11b9b7c4c6d919b9f6649034445edfea0c77d042",
+      "version": "0.1.24",
+      "resolved": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-files.git#6176e9f40e070387f03c15d10b3b3d2f132508b5",
       "peerDependencies": {
         "@govoplan/core-webui": "^0.1.18",
         "@vitejs/plugin-react": "^5.2.0",
@@ -948,8 +948,8 @@
       }
     },
     "node_modules/@govoplan/mail-webui": {
-      "version": "0.1.25",
-      "resolved": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-mail.git#ecc1283de76f154919c786cb84354afb8f2299c1",
+      "version": "0.1.26",
+      "resolved": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-mail.git#c62c7783d6f522b7ec13063024885bb88e257012",
       "peerDependencies": {
         "@govoplan/core-webui": "^0.1.18",
         "lucide-react": "^1.23.0",
@@ -964,8 +964,8 @@
       }
     },
     "node_modules/@govoplan/ops-webui": {
-      "version": "0.1.18",
-      "resolved": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-ops.git#71666db45c8e602ea439495017e5849cad44ec4b",
+      "version": "0.1.21",
+      "resolved": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-ops.git#ac6b211827571c69b058fc857bbddd15125519c6",
       "peerDependencies": {
         "@govoplan/core-webui": "^0.1.18",
         "@vitejs/plugin-react": "^5.2.0",
@@ -1002,8 +1002,8 @@
       }
     },
     "node_modules/@govoplan/policy-webui": {
-      "version": "0.1.18",
-      "resolved": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-policy.git#65159dec5fb6594fddfc2c5f8ab199c1e23994a2",
+      "version": "0.1.22",
+      "resolved": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-policy.git#29a9aea3b186b45fcf1b7bed9ebbd1712390f5c6",
       "peerDependencies": {
         "@govoplan/core-webui": "^0.1.18",
         "lucide-react": "^1.23.0",
@@ -2127,9 +2127,9 @@
       }
     },
     "node_modules/electron-to-chromium": {
-      "version": "1.5.412",
-      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.412.tgz",
-      "integrity": "sha512-z4rMe3esBzlzovKHj4gxJnsCGZRK5l4baUvm+gCGJBPE+gsyUMKsuU9tnEUtI1dOebXz1ytAPGjvXhmQ7rIPwA==",
+      "version": "1.5.413",
+      "resolved": "https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.413.tgz",
+      "integrity": "sha512-F1XPKvt7HVfly5WND90ec16nFsdr4g5x/cVUP3EqjeyXynupabGDqpMa84wwvuYGDnldXLBz6DLXyZXWO9TPvw==",
       "license": "ISC"
     },
     "node_modules/esbuild": {
@@ -2289,9 +2289,9 @@
       }
     },
     "node_modules/lucide-react": {
-      "version": "1.33.0",
-      "resolved": "https://registry.npmjs.org/lucide-react/-/lucide-react-1.33.0.tgz",
-      "integrity": "sha512-MTRwMy0ZlL8Ur/vOAiJ9XGHE+kFPC7brq6MxAm0GiGXEBj0qy0jA/pG4N675oSzciO/UCdX8T+5yUQdmDeTLxg==",
+      "version": "1.34.0",
+      "resolved": "https://registry.npmjs.org/lucide-react/-/lucide-react-1.34.0.tgz",
+      "integrity": "sha512-vnjGJNI7Htk5+oWW8gXGuaLgwgAb0T6/iZbBrp9JCfRFwdNWZ0YTm3eyxjOLgwN6r8iyAf3UA70zNmBRBNv7yg==",
       "license": "ISC",
       "peerDependencies": {
         "react": "^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0"

webui/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@govoplan/core-webui",
-  "version": "0.1.40",
+  "version": "0.1.43",
   "private": true,
   "type": "module",
   "main": "src/index.ts",

webui/package.release.json

@@ -1,6 +1,6 @@
 {
   "name": "@govoplan/core-webui",
-  "version": "0.1.40",
+  "version": "0.1.43",
   "private": true,
   "type": "module",
   "main": "src/index.ts",
@@ -26,21 +26,21 @@
     "preview": "vite preview --host 127.0.0.1 --port 4173"
   },
   "dependencies": {
-    "@govoplan/access-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-access.git#v0.1.23",
+    "@govoplan/access-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-access.git#v0.1.24",
     "@govoplan/admin-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-admin.git#v0.1.22",
-    "@govoplan/audit-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-audit.git#v0.1.18",
+    "@govoplan/audit-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-audit.git#v0.1.20",
     "@govoplan/calendar-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-calendar.git#v0.1.22",
     "@govoplan/cases-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-cases.git#v0.1.20",
-    "@govoplan/dashboard-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-dashboard.git#v0.1.18",
+    "@govoplan/dashboard-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-dashboard.git#v0.1.20",
     "@govoplan/docs-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-docs.git#v0.1.22",
-    "@govoplan/files-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-files.git#v0.1.23",
+    "@govoplan/files-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-files.git#v0.1.24",
     "@govoplan/helpdesk-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-helpdesk.git#v0.1.20",
     "@govoplan/idm-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-idm.git#v0.1.24",
-    "@govoplan/mail-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-mail.git#v0.1.25",
+    "@govoplan/mail-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-mail.git#v0.1.26",
     "@govoplan/campaign-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-campaign.git#v0.1.27",
     "@govoplan/organizations-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-organizations.git#v0.1.20",
-    "@govoplan/ops-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-ops.git#v0.1.18",
-    "@govoplan/policy-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-policy.git#v0.1.18",
+    "@govoplan/ops-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-ops.git#v0.1.21",
+    "@govoplan/policy-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-policy.git#v0.1.22",
     "@govoplan/tickets-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-tickets.git#v0.1.22",
     "@govoplan/wiki-webui": "git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-wiki.git#v0.1.22",
     "@tiptap/core": "^3.29.2",

webui/src/components/HoverTooltip.tsx

@@ -207,6 +207,7 @@ export default function HoverTooltip({
       <span
         ref={triggerRef}
         className={className}
+        role={ariaLabel ? "button" : undefined}
         tabIndex={triggerTabIndex}
         aria-label={translatedAriaLabel}
         aria-describedby={isOpen ? tooltipId : undefined}

webui/src/components/help/InlineHelp.tsx

@@ -13,7 +13,7 @@ export default function InlineHelp({ children, className = "" }: InlineHelpProps
       content={children}
       className={`inline-help ${className}`.trim()}
       ariaLabel="i18n:govoplan-core.show_field_help.e3dfe98f"
-      triggerTabIndex={-1}>
+      triggerTabIndex={0}>
       <span className="inline-help-mark" aria-hidden="true">?</span>
     </HoverTooltip>
   );

webui/src/i18n/generatedTranslations.ts

@@ -1276,8 +1276,8 @@ export const generatedTranslations: PlatformTranslations = {
     "i18n:govoplan-core.share.09ca55ca": "Freigabe",
     "i18n:govoplan-core.set_concrete_system_retention_values_blank_day_f.98b9a627": "Set concrete system retention values. Blank day fields mean unlimited retention.",
     "i18n:govoplan-core.settings.c7f73bb5": "Einstellungen",
-    "i18n:govoplan-core.show_content.0528d8d2": "Show content",
-    "i18n:govoplan-core.show_field_help.e3dfe98f": "Show field help",
+    "i18n:govoplan-core.show_content.0528d8d2": "Inhalt anzeigen",
+    "i18n:govoplan-core.show_field_help.e3dfe98f": "Feldhilfe anzeigen",
     "i18n:govoplan-core.show_guided_warnings_while_editing.bc5dba85": "Show guided warnings while editing",
     "i18n:govoplan-core.show_header_only.24afefca": "Show header only",
     "i18n:govoplan-core.show_inline_guidance_and_warnings_while_campaign.a892f5e9": "Show inline guidance and warnings while campaign data is being edited.",

webui/src/styles/badges.css

@@ -1,5 +1,5 @@
 .status-badge { display: inline-flex; align-items: center; height: 24px; border-radius: var(--radius-pill); padding: 0 9px; font-size: 12px; font-weight: 800; background: var(--status-neutral-bg); color: var(--text-soft); text-transform: uppercase; }
-.status-ready, .status-sent, .status-appended, .status-success, .status-active { background: var(--success-soft); color: var(--success-text-strong); }
+.status-ready, .status-sent, .status-appended, .status-success, .status-active { background: var(--success-soft); color: var(--success-text); }
 .status-warning, .status-needs-review, .status-pending { background: var(--warning-soft); color: var(--warning-text-strong); }
 .status-blocked, .status-error, .status-danger, .status-failed, .status-failed-permanent { background: var(--danger-bg); color: var(--danger-text-strong); }
 .status-queued, .status-sending { background: var(--info-soft); color: var(--info-text-strong); }