feat(dms): add dvelop d3 integration profile

2026-08-23 10:58:06 +02:00
parent 76c2fbd654
commit 7c689b6939
10 changed files with 1003 additions and 0 deletions
@@ -0,0 +1,30 @@
+# d.velop d3 integration profile
+
+GovOPlaN's first concrete DMS product profile targets the d.velop d3 DMSApp HTTP interface. The slice deliberately separates discovery and request planning from effects.
+
+## Configuration boundary
+
+A tenant binding contains the HTTPS API base URL, repository ID, calling `Origin`, d3 source category, stable source ID, mapping revision, and an Access credential-envelope reference. The bearer token is resolved only for an outbound call and is never persisted in the DMS binding, plan, evidence, or diagnostics.
+
+The source category and source properties must be mapped by the d3 tenant administrator. GovOPlaN does not infer a document type from a repository response or silently adapt when that mapping changes.
+
+## Preflight and plan
+
+Preflight reads the DMSApp repository catalog, the selected repository, and its object definitions. It records observation time and canonical response digests. A successful preflight means that discovery and authentication worked; it does not prove that a source mapping accepts GovOPlaN data.
+
+The store-plan builder produces the documented `o2m` request shape with stable GovOPlaN package, record, revision, manifest digest, purpose, and mapping-revision properties. It never sends the request. The plan digest is the review boundary for a later target-tested write implementation.
+
+## Enablement gates
+
+Real Records dispatch remains fail-closed until target evidence demonstrates all of the following:
+
+- repository and object-definition discovery through the deployed gateway;
+- administrator-reviewed source-property mapping;
+- successful storage and correlation lookup by package ID and manifest digest;
+- an unambiguous custody receipt or an explicit statement that d3 is only a DMS copy target;
+- timeout and unknown-outcome reconciliation before retry;
+- correction, quarantine, and recovery exercises; and
+- credential rotation without exposing bearer values.
+
+Until those gates are met, the `records.archive.dvelop_d3` capability reports unhealthy and rejects dispatch. Records retains its approved, digest-bound package and does not claim external custody.
+