[Feature] Integrate Form attachments and signatures through governed providers #3

New Issue

2026-08-01T16:38:41+02:00

zemion commented

2026-08-01 16:38:41 +02:00

Outcome

Turn the existing attachment/signature reference contract into usable upload, signing, verification, and recovery flows without moving bytes or key custody into Forms Runtime.

Decisions required

First Files/object-storage and signature provider, accepted signature assurance levels, and legal contexts.
Upload scanning/quarantine, file limits, classification, retention, deletion, legal hold, and failed-provider behavior.
Signature challenge, signer identity, timestamping, revocation, verification evidence, and recovery custody.
Whether optional providers may be external and what target certification is required.

Acceptance criteria after selection

Runtime requests short-lived provider grants and stores only same-tenant immutable evidence references.
Final validation re-checks current provider evidence, classification, signature validity, and policy.
Pending, rejected, expired, revoked, outcome-unknown, and unavailable states are visible and reconcilable.
Events/logs exclude file contents, credentials, challenges, and submitted values.
Provider declarations, health/freshness, secret handling, target tests, backup/restore, and accessibility satisfy platform gates.

## Outcome Turn the existing attachment/signature reference contract into usable upload, signing, verification, and recovery flows without moving bytes or key custody into Forms Runtime. ## Decisions required - First Files/object-storage and signature provider, accepted signature assurance levels, and legal contexts. - Upload scanning/quarantine, file limits, classification, retention, deletion, legal hold, and failed-provider behavior. - Signature challenge, signer identity, timestamping, revocation, verification evidence, and recovery custody. - Whether optional providers may be external and what target certification is required. ## Acceptance criteria after selection - Runtime requests short-lived provider grants and stores only same-tenant immutable evidence references. - Final validation re-checks current provider evidence, classification, signature validity, and policy. - Pending, rejected, expired, revoked, outcome-unknown, and unavailable states are visible and reconcilable. - Events/logs exclude file contents, credentials, challenges, and submitted values. - Provider declarations, health/freshness, secret handling, target tests, backup/restore, and accessibility satisfy platform gates.

zemion added the module/forms-runtime

status

needs-info

codex/needs-human area/security

area/webui area/api labels 2026-08-01 16:38:41 +02:00

zemion commented

2026-08-04 13:17:18 +02:00

Codex State: ready

Summary

Product/security profile approved on 2026-08-04: Files is the first attachment provider and owns bytes, quarantine, scanning, classification, retention, and legal-hold state.
Forms Runtime stores only immutable same-tenant evidence references and fails closed when a required attachment is pending, rejected, expired, unavailable, or unverified.
The first native signature profile is authenticated acknowledgement and must not be presented as an advanced or qualified electronic signature. Advanced/qualified signatures require an external trust-service provider and explicit assurance evidence.
Required signature/provider states fail closed; configurable attachment limits and provider health remain policy inputs.

Next / Blocked

The decision blocker is resolved; implement Files grants/evidence verification first and keep advanced/qualified signature providers separately selectable.

Suggested status label: status/ready

## Codex State: ready ### Summary - Product/security profile approved on 2026-08-04: Files is the first attachment provider and owns bytes, quarantine, scanning, classification, retention, and legal-hold state. - Forms Runtime stores only immutable same-tenant evidence references and fails closed when a required attachment is pending, rejected, expired, unavailable, or unverified. - The first native signature profile is authenticated acknowledgement and must not be presented as an advanced or qualified electronic signature. Advanced/qualified signatures require an external trust-service provider and explicit assurance evidence. - Required signature/provider states fail closed; configurable attachment limits and provider health remain policy inputs. ### Next / Blocked - The decision blocker is resolved; implement Files grants/evidence verification first and keep advanced/qualified signature providers separately selectable. Suggested status label: `status/ready`

zemion added

and removed

codex/needs-human labels 2026-08-04 13:18:30 +02:00

zemion commented

2026-08-06 12:47:31 +02:00

Codex State: complete

Summary

Files is now the selected attachment provider: Forms Runtime requests a short-lived purpose-bound grant and stores only an exact same-tenant asset/version/checksum evidence reference.
Final submission revalidates provider state, classification, integrity and the exact Form/submission binding; expired, rejected, unavailable or mismatched required evidence fails closed.
Added attachment capture to authenticated and public Form surfaces and a native payload-bound authenticated acknowledgement. The UI and documentation explicitly state that this is not an advanced or qualified electronic signature.
Advanced/qualified signatures remain optional external trust-service profiles and therefore do not weaken the completed native profile.

Verification

125 Files tests, 17 Forms Runtime tests and the full focused platform gate passed.
Commits: govoplan-core@b5f5be1, govoplan-files@aa9f90c, govoplan-forms-runtime@3c292b8.

## Codex State: complete ### Summary - Files is now the selected attachment provider: Forms Runtime requests a short-lived purpose-bound grant and stores only an exact same-tenant asset/version/checksum evidence reference. - Final submission revalidates provider state, classification, integrity and the exact Form/submission binding; expired, rejected, unavailable or mismatched required evidence fails closed. - Added attachment capture to authenticated and public Form surfaces and a native payload-bound authenticated acknowledgement. The UI and documentation explicitly state that this is not an advanced or qualified electronic signature. - Advanced/qualified signatures remain optional external trust-service profiles and therefore do not weaken the completed native profile. ### Verification - `125 Files tests`, `17 Forms Runtime tests` and the full focused platform gate passed. - Commits: `govoplan-core@b5f5be1`, `govoplan-files@aa9f90c`, `govoplan-forms-runtime@3c292b8`.

zemion closed this issue

2026-08-06 12:47:32 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-forms-runtime#3