[Feature] Establish generic ownership transfer and recovery-authority workflow #276

New Issue

2026-07-30T05:26:17+02:00

zemion commented

2026-07-30 05:26:17 +02:00

Objective

Provide one platform contract for consensual ownership hand-over, ownership requests, and exceptional administrative recovery without conflating business ownership, access administration, and cryptographic key control.

First consumer: GovOPlaN/govoplan-campaign#21.

Required state machines

Owner-initiated transfer

Current owner proposes target and optional expiry/reason.
Target is notified and may accept or decline.
Acceptance atomically changes the resource owner and emits audit/domain events.

Target-initiated request

Requester asks the current owner.
Current owner approves or declines.
After approval, the requester must still accept the responsibility; acceptance atomically changes ownership.

Both paths support cancellation, expiry, idempotent decisions, and an immutable decision history. No state may leave a resource without an owner.

Recovery authority

A separately permissioned administrator may initiate a reasoned takeover/recovery path when no usable owner remains.
Recovery authority is not ordinary ownership and must be visible in policy provenance and audit.
Sensitive deployments may require MFA, dual control/quorum, delay, or notification before completion.
Taking business ownership never silently grants access to E2EE plaintext or private keys.

Module boundary

Core owns generic DTOs, state transitions, transactional events, idempotency, and provider/capability contracts.
Resource modules own their owner field, authorization checks, transfer side effects, and resource-specific UI.
Notifications is an optional delivery capability; absence must not invalidate the durable transfer state.
Audit consumes events when enabled; the transaction still retains minimum decision provenance.
Policy supplies effective expiry, recovery authority, quorum, and provenance.
E2EE/key hand-over remains with govoplan-postbox#15, govoplan-postbox#25, govoplan-identity-trust#1, and govoplan-core#11; do not imply a universal server decryption key.

Acceptance criteria

Stable resource reference and owner-subject DTOs support user and group owners.
Durable transfer/request model implements the states above with compare-and-set completion.
Provider contract lets a module validate and atomically apply a completed transfer without a module-to-module import.
Permissions distinguish propose, approve, accept, cancel, and exceptional recovery.
Notifications and audit events contain no protected resource content.
Campaign replaces direct owner mutation with this workflow.
UI explains pending party, expiry, provenance, and consequences.

Decisions still required

Who may accept on behalf of a group owner: any authorized manager, a configured representative, or quorum?
Default expiry and whether the initiator may shorten/extend it.
Minimum assurance/quorum for administrative recovery by deployment profile.

## Objective Provide one platform contract for consensual ownership hand-over, ownership requests, and exceptional administrative recovery without conflating business ownership, access administration, and cryptographic key control. First consumer: `GovOPlaN/govoplan-campaign#21`. ## Required state machines ### Owner-initiated transfer 1. Current owner proposes target and optional expiry/reason. 2. Target is notified and may accept or decline. 3. Acceptance atomically changes the resource owner and emits audit/domain events. ### Target-initiated request 1. Requester asks the current owner. 2. Current owner approves or declines. 3. After approval, the requester must still accept the responsibility; acceptance atomically changes ownership. Both paths support cancellation, expiry, idempotent decisions, and an immutable decision history. No state may leave a resource without an owner. ## Recovery authority - A separately permissioned administrator may initiate a reasoned takeover/recovery path when no usable owner remains. - Recovery authority is not ordinary ownership and must be visible in policy provenance and audit. - Sensitive deployments may require MFA, dual control/quorum, delay, or notification before completion. - Taking business ownership never silently grants access to E2EE plaintext or private keys. ## Module boundary - Core owns generic DTOs, state transitions, transactional events, idempotency, and provider/capability contracts. - Resource modules own their owner field, authorization checks, transfer side effects, and resource-specific UI. - Notifications is an optional delivery capability; absence must not invalidate the durable transfer state. - Audit consumes events when enabled; the transaction still retains minimum decision provenance. - Policy supplies effective expiry, recovery authority, quorum, and provenance. - E2EE/key hand-over remains with `govoplan-postbox#15`, `govoplan-postbox#25`, `govoplan-identity-trust#1`, and `govoplan-core#11`; do not imply a universal server decryption key. ## Acceptance criteria - [ ] Stable resource reference and owner-subject DTOs support user and group owners. - [ ] Durable transfer/request model implements the states above with compare-and-set completion. - [ ] Provider contract lets a module validate and atomically apply a completed transfer without a module-to-module import. - [ ] Permissions distinguish propose, approve, accept, cancel, and exceptional recovery. - [ ] Notifications and audit events contain no protected resource content. - [ ] Campaign replaces direct owner mutation with this workflow. - [ ] UI explains pending party, expiry, provenance, and consequences. ## Decisions still required - Who may accept on behalf of a group owner: any authorized manager, a configured representative, or quorum? - Default expiry and whether the initiator may shorten/extend it. - Minimum assurance/quorum for administrative recovery by deployment profile.

zemion added the module/campaign

status

needs-info

area/governance codex/needs-human

module/core labels 2026-07-30 05:26:17 +02:00

zemion commented

2026-07-30 14:37:28 +02:00

Decision briefing and recommended baseline

Group ownership should use policy-driven acceptance assurance rather than one hard-coded rule:

Default: one currently authorized group manager with the dedicated accept permission may act for the group. The immutable decision records that person, while the group becomes owner.
Higher assurance: Policy may require a designated representative or an N-of-M quorum. Ordinary group membership alone never grants acceptance authority.
A target-initiated request still requires a final acceptance after owner approval so changed terms/expiry are acknowledged. High-assurance profiles may require a different actor or quorum.

Recommended expiry: seven days by default; Policy defines minimum/maximum. The initiator may shorten within policy but cannot extend a pending transfer beyond the policy maximum. Extension creates a replacement proposal so the target accepts the actual terms.

Recommended recovery profiles:

Development/single-admin: one recovery officer, explicit insecure profile.
Standard: dedicated recovery permission, recent MFA/re-authentication, reason, owner notifications, 24-hour delay, and 2-of-N recovery officers.
High assurance: stronger quorum/hardware-backed authentication and a separate cryptographic recovery ceremony.

Business ownership recovery never grants encryption keys. A future broad govoplan-encryption module may own vaults, key wrapping, rotation, and E2EE profiles. Disabling it must be blocked until protected content is transactionally decrypted/migrated and verified; it cannot simply strand ciphertext or expose a universal key. Final module creation and profile choice remain deferred.

## Decision briefing and recommended baseline Group ownership should use policy-driven acceptance assurance rather than one hard-coded rule: - Default: one currently authorized group manager with the dedicated accept permission may act for the group. The immutable decision records that person, while the group becomes owner. - Higher assurance: Policy may require a designated representative or an N-of-M quorum. Ordinary group membership alone never grants acceptance authority. - A target-initiated request still requires a final acceptance after owner approval so changed terms/expiry are acknowledged. High-assurance profiles may require a different actor or quorum. Recommended expiry: seven days by default; Policy defines minimum/maximum. The initiator may shorten within policy but cannot extend a pending transfer beyond the policy maximum. Extension creates a replacement proposal so the target accepts the actual terms. Recommended recovery profiles: - Development/single-admin: one recovery officer, explicit insecure profile. - Standard: dedicated recovery permission, recent MFA/re-authentication, reason, owner notifications, 24-hour delay, and 2-of-N recovery officers. - High assurance: stronger quorum/hardware-backed authentication and a separate cryptographic recovery ceremony. Business ownership recovery never grants encryption keys. A future broad `govoplan-encryption` module may own vaults, key wrapping, rotation, and E2EE profiles. Disabling it must be blocked until protected content is transactionally decrypted/migrated and verified; it cannot simply strand ciphertext or expose a universal key. Final module creation and profile choice remain deferred.

zemion commented

2026-07-30 17:46:45 +02:00

Implemented and pushed in Core f0898fc, with the first resource consumer in Campaign 5f75035.

Core now owns stable resource/owner references, durable owner-initiated, requester-initiated and administrative-recovery state machines, bounded idempotency, expiry, immutable decisions, transactional events, provider registration, API routes, and optimistic owner application. Campaign removed direct owner mutation, validates targets through Access, distinguishes action authority, resets owner-scoped mail selection on completion, and explains pending party, expiry and consequences in the UI.

Accepted defaults are encoded: dedicated group-manager acceptance authority; 7-day default expiry (policy-bounded); standard recovery requires recent authentication, 2 independent approvals and a 24-hour delay; development may use one officer; recovery never transfers encryption keys.

Verification: 137 Core ownership/migration/registry/wheel tests, 289 Campaign tests, the production WebUI build, and all 31 module permutations pass.

Implemented and pushed in Core `f0898fc`, with the first resource consumer in Campaign `5f75035`. Core now owns stable resource/owner references, durable owner-initiated, requester-initiated and administrative-recovery state machines, bounded idempotency, expiry, immutable decisions, transactional events, provider registration, API routes, and optimistic owner application. Campaign removed direct owner mutation, validates targets through Access, distinguishes action authority, resets owner-scoped mail selection on completion, and explains pending party, expiry and consequences in the UI. Accepted defaults are encoded: dedicated group-manager acceptance authority; 7-day default expiry (policy-bounded); standard recovery requires recent authentication, 2 independent approvals and a 24-hour delay; development may use one officer; recovery never transfers encryption keys. Verification: 137 Core ownership/migration/registry/wheel tests, 289 Campaign tests, the production WebUI build, and all 31 module permutations pass.

zemion closed this issue

2026-07-30 17:46:45 +02:00

zemion removed the codex/needs-human

status

needs-info

labels 2026-07-30 17:46:58 +02:00

zemion commented

2026-07-30 21:48:54 +02:00

Codex State: note

Summary

Decision confirmed: group acceptance authority is explicitly delegated, transfer offers expire, and administrative recovery requires assured authority plus quorum for protected resources.

## Codex State: note ### Summary - Decision confirmed: group acceptance authority is explicitly delegated, transfer offers expire, and administrative recovery requires assured authority plus quorum for protected resources.

zemion commented

2026-07-30 21:49:18 +02:00

Codex State: note

Summary

Decision confirmed: group acceptance authority is explicitly delegated, transfer offers expire, and administrative recovery requires assured authority plus quorum for protected resources.

## Codex State: note ### Summary - Decision confirmed: group acceptance authority is explicitly delegated, transfer offers expire, and administrative recovery requires assured authority plus quorum for protected resources.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-core#276