[Feature] Integrate Form attachments and signatures through governed providers #3

New Issue

2026-08-01T16:38:41+02:00

zemion commented

2026-08-01 16:38:41 +02:00

Outcome

Turn the existing attachment/signature reference contract into usable upload, signing, verification, and recovery flows without moving bytes or key custody into Forms Runtime.

Decisions required

First Files/object-storage and signature provider, accepted signature assurance levels, and legal contexts.
Upload scanning/quarantine, file limits, classification, retention, deletion, legal hold, and failed-provider behavior.
Signature challenge, signer identity, timestamping, revocation, verification evidence, and recovery custody.
Whether optional providers may be external and what target certification is required.

Acceptance criteria after selection

Runtime requests short-lived provider grants and stores only same-tenant immutable evidence references.
Final validation re-checks current provider evidence, classification, signature validity, and policy.
Pending, rejected, expired, revoked, outcome-unknown, and unavailable states are visible and reconcilable.
Events/logs exclude file contents, credentials, challenges, and submitted values.
Provider declarations, health/freshness, secret handling, target tests, backup/restore, and accessibility satisfy platform gates.

## Outcome Turn the existing attachment/signature reference contract into usable upload, signing, verification, and recovery flows without moving bytes or key custody into Forms Runtime. ## Decisions required - First Files/object-storage and signature provider, accepted signature assurance levels, and legal contexts. - Upload scanning/quarantine, file limits, classification, retention, deletion, legal hold, and failed-provider behavior. - Signature challenge, signer identity, timestamping, revocation, verification evidence, and recovery custody. - Whether optional providers may be external and what target certification is required. ## Acceptance criteria after selection - Runtime requests short-lived provider grants and stores only same-tenant immutable evidence references. - Final validation re-checks current provider evidence, classification, signature validity, and policy. - Pending, rejected, expired, revoked, outcome-unknown, and unavailable states are visible and reconcilable. - Events/logs exclude file contents, credentials, challenges, and submitted values. - Provider declarations, health/freshness, secret handling, target tests, backup/restore, and accessibility satisfy platform gates.

zemion added the module/forms-runtime

status

needs-info

codex/needs-human area/security

area/webui area/api labels 2026-08-01 16:38:41 +02:00

Sign in to join this conversation.