[Feature] Define governed public and anonymous Form intake profiles #2

New Issue

2026-08-01T16:38:36+02:00

zemion commented

2026-08-01 16:38:36 +02:00

Outcome

Support public Form entry without weakening tenant isolation, abuse controls, provenance, privacy, or later identity linking.

Decisions required

Which profiles are supported: authenticated public account, invitation/token, pseudonymous, or fully anonymous.
Required assurance, CAPTCHA/rate-limit/abuse controls, duplicate-submission policy, and token lifetime.
Whether and how a later authenticated identity may claim or link a submission.
Data-minimization, draft retention, deletion, legal hold, receipt disclosure, and support/recovery rules.
Which services may enable each profile and which Policy authority approves it.

Acceptance criteria after decisions

Each definition/service selects an explicit profile; no installation-wide implicit anonymous mode exists.
Start, draft, submit, receipt, and recovery paths are tenant-bound and replay-safe.
Secrets/tokens are hashed or delegated to the appropriate trust owner and never logged.
Public APIs expose bounded errors and do not disclose account, tenant, schema, or submission existence.
Accessibility, privacy, abuse, expiry, replay, ownership-linking, and recovery tests cover the selected profiles.

## Outcome Support public Form entry without weakening tenant isolation, abuse controls, provenance, privacy, or later identity linking. ## Decisions required - Which profiles are supported: authenticated public account, invitation/token, pseudonymous, or fully anonymous. - Required assurance, CAPTCHA/rate-limit/abuse controls, duplicate-submission policy, and token lifetime. - Whether and how a later authenticated identity may claim or link a submission. - Data-minimization, draft retention, deletion, legal hold, receipt disclosure, and support/recovery rules. - Which services may enable each profile and which Policy authority approves it. ## Acceptance criteria after decisions - Each definition/service selects an explicit profile; no installation-wide implicit anonymous mode exists. - Start, draft, submit, receipt, and recovery paths are tenant-bound and replay-safe. - Secrets/tokens are hashed or delegated to the appropriate trust owner and never logged. - Public APIs expose bounded errors and do not disclose account, tenant, schema, or submission existence. - Accessibility, privacy, abuse, expiry, replay, ownership-linking, and recovery tests cover the selected profiles.

zemion added the module/forms-runtime

status

needs-info

codex/needs-human area/security

area/webui area/api labels 2026-08-01 16:38:36 +02:00

zemion commented

2026-08-04 13:17:05 +02:00

Codex State: ready

Summary

Product/security profile approved on 2026-08-04: implement authenticated-account and invitation-token intake first, with anonymous intake available only as an explicit per-form policy opt-in; pseudonymous intake remains a later profile.
Anonymous submissions cannot later be claimed. Invitation submissions may link to an authenticated identity only with explicit consent and proof of the invitation.
Tokens are hashed, tenant/form bound, replay safe, rate limited, and expiring; CAPTCHA is an optional privacy-approved provider rather than a hard dependency.
Technical defaults are 30-day draft expiry and 14-day invitation expiry. Submitted-data retention must be declared by each service/form policy.

Next / Blocked

The decision blocker is resolved; implementation can proceed against this profile.

Suggested status label: status/ready

## Codex State: ready ### Summary - Product/security profile approved on 2026-08-04: implement authenticated-account and invitation-token intake first, with anonymous intake available only as an explicit per-form policy opt-in; pseudonymous intake remains a later profile. - Anonymous submissions cannot later be claimed. Invitation submissions may link to an authenticated identity only with explicit consent and proof of the invitation. - Tokens are hashed, tenant/form bound, replay safe, rate limited, and expiring; CAPTCHA is an optional privacy-approved provider rather than a hard dependency. - Technical defaults are 30-day draft expiry and 14-day invitation expiry. Submitted-data retention must be declared by each service/form policy. ### Next / Blocked - The decision blocker is resolved; implementation can proceed against this profile. Suggested status label: `status/ready`

zemion added

and removed

codex/needs-human labels 2026-08-04 13:18:29 +02:00

zemion commented

2026-08-06 12:47:31 +02:00

Codex State: complete

Summary

Preserved the authenticated-account runtime and added explicit per-Form invitation and anonymous opt-in profiles; no installation-wide anonymous mode exists.
Added hash-only tenant/Form-bound bearer tokens, one-time invitation disclosure, 14-day invitation and 30-day draft defaults, bounded profile rate limits, expiry, replay-safe idempotency and non-enumerating public errors.
Added administrator profile/invitation UI and the accessible public Form surface. Anonymous submissions cannot be claimed; pseudonymous intake remains a separate future profile.
Public sessions use isolated synthetic actors and exact published Form revisions, while authenticated intake continues through the normal principal-bound runtime.

Verification

17 Forms Runtime tests passed, including invitation/anonymous expiry, hashing, replay and tenant isolation.
Full platform manifest, inventory, module-permutation and full-product build gates passed.
Commit: govoplan-forms-runtime@3c292b8.

## Codex State: complete ### Summary - Preserved the authenticated-account runtime and added explicit per-Form invitation and anonymous opt-in profiles; no installation-wide anonymous mode exists. - Added hash-only tenant/Form-bound bearer tokens, one-time invitation disclosure, 14-day invitation and 30-day draft defaults, bounded profile rate limits, expiry, replay-safe idempotency and non-enumerating public errors. - Added administrator profile/invitation UI and the accessible public Form surface. Anonymous submissions cannot be claimed; pseudonymous intake remains a separate future profile. - Public sessions use isolated synthetic actors and exact published Form revisions, while authenticated intake continues through the normal principal-bound runtime. ### Verification - `17 Forms Runtime tests passed`, including invitation/anonymous expiry, hashing, replay and tenant isolation. - Full platform manifest, inventory, module-permutation and full-product build gates passed. - Commit: `govoplan-forms-runtime@3c292b8`.

zemion closed this issue

2026-08-06 12:47:31 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-forms-runtime#2