# d.velop d3 integration profile

GovOPlaN's first concrete DMS product profile targets the d.velop d3 DMSApp HTTP interface. The slice deliberately separates discovery and request planning from effects.

## Configuration boundary

A tenant binding contains the HTTPS API base URL, repository ID, calling `Origin`, d3 source category, stable source ID, mapping revision, and an Access credential-envelope reference. The bearer token is resolved only for an outbound call and is never persisted in the DMS binding, plan, evidence, or diagnostics.

The source category and source properties must be mapped by the d3 tenant administrator. GovOPlaN does not infer a document type from a repository response or silently adapt when that mapping changes.

## Preflight and plan

Preflight reads the DMSApp repository catalog, the selected repository, and its object definitions. It records observation time and canonical response digests. A successful preflight means that discovery and authentication worked; it does not prove that a source mapping accepts GovOPlaN data.

The store-plan builder produces the documented `o2m` request shape with stable GovOPlaN package, record, revision, manifest digest, purpose, and mapping-revision properties. It never sends the request. The plan digest is the review boundary for a later target-tested write implementation.

## Enablement gates

Real Records dispatch remains fail-closed until target evidence demonstrates all of the following:

- repository and object-definition discovery through the deployed gateway;
- administrator-reviewed source-property mapping;
- successful storage and correlation lookup by package ID and manifest digest;
- an unambiguous custody receipt or an explicit statement that d3 is only a DMS copy target;
- timeout and unknown-outcome reconciliation before retry;
- correction, quarantine, and recovery exercises; and
- credential rotation without exposing bearer values.

Until those gates are met, the `records.archive.dvelop_d3` capability reports unhealthy and rejects dispatch. Records retains its approved, digest-bound package and does not claim external custody.