159 lines
7.3 KiB
Markdown
159 lines
7.3 KiB
Markdown
# Forms Runtime Domain Boundary
|
|
|
|
## Purpose
|
|
|
|
Runtime form submissions for validation, drafts, attachments, signatures, status tracking, and handoff to domain modules.
|
|
|
|
## Owns
|
|
|
|
- form submissions
|
|
- draft state
|
|
- runtime validation results
|
|
- attachment references
|
|
- signature state
|
|
- handoff status
|
|
|
|
## Does Not Own
|
|
|
|
- form definition authoring
|
|
- document storage
|
|
- domain-specific adjudication
|
|
|
|
## Required Integrations
|
|
|
|
- access
|
|
- forms
|
|
|
|
## Optional Integration Candidates
|
|
|
|
- files
|
|
- approvals
|
|
- workflow engine
|
|
- portal
|
|
- cases
|
|
- policy
|
|
- audit
|
|
|
|
## Implemented State
|
|
|
|
- exact immutable Form-definition resolution through `forms.definitions`
|
|
- tenant-bound instance identities and append-only revisions/status events
|
|
- server-side type, option, constraint, required, attachment, signature, and
|
|
optional policy validation
|
|
- `started` launch sessions and definition-controlled draft persistence
|
|
- final submission receipts, handoff references, replay safety, and OCC
|
|
- actor-bound idempotency that permits an exact retry after definition
|
|
supersession without exposing another participant's submission
|
|
- owner-restricted participant access plus manager scopes
|
|
- bounded list/detail/history/event APIs and accessible definition-driven WebUI
|
|
- `forms_runtime.service_launcher` retaining exact Service and binding
|
|
provenance
|
|
- native Case and Workflow handoffs that commit a durable effect intent before
|
|
invoking the owner capability, use stable provider idempotency keys, and
|
|
reconcile outcome-unknown execution
|
|
- invitation and explicitly enabled anonymous public-intake profiles with
|
|
hash-only bearer tokens, bounded profile-level rate limits, 14-day invitation
|
|
expiry, 30-day draft expiry, isolated synthetic actors, and no anonymous
|
|
identity-claim path
|
|
- an administrator-only public-intake dialog that selects exact published Form
|
|
revisions, configures expiry/rate limits, enables or disables profiles, and
|
|
exposes invitation secrets only once
|
|
- Files-owned one-time evidence upload grants bound to the tenant, exact Form
|
|
instance and definition revision, purpose, custodian, size, media types, and a
|
|
maximum 15-minute upload window
|
|
- final-submission evidence inspection that rejects wrong-submission, deleted,
|
|
quarantined, unverifiable, cross-tenant, or checksum-mismatched managed files
|
|
- authenticated acknowledgement evidence bound to the acting account,
|
|
statement/version, exact Form revision, submitted values, and attachments
|
|
- authenticated and public WebUI attachment capture through the shared drop
|
|
target; changing values or attachments invalidates the local acknowledgement
|
|
selection before submission
|
|
- migrations, uninstall guards, tenant summaries, events, recovery notes, and
|
|
tenant/replay/stale-write/validation/handoff tests
|
|
|
|
## Security And Policy
|
|
|
|
Authenticated accounts receive only the participant role by default. It permits
|
|
access to their own instances; tenant-wide reads and review/handoff transitions
|
|
require manager scopes. Event payloads exclude submitted values. Exact
|
|
definition lookup, publication state, tenant, current authorization, and
|
|
optional policy references are re-evaluated for each consequential operation.
|
|
Definition providers must return the requested owner, tenant, object, and exact
|
|
revision; a mismatched provider response fails closed.
|
|
Policy-referenced definitions fail closed when no compatible
|
|
`forms_runtime.policy_evaluator` is active.
|
|
|
|
Files and signature providers retain their own content and key custody. Runtime
|
|
stores only same-tenant evidence references and bounded inspection snapshots.
|
|
Files stores only upload-token digests and never grants a public intake actor
|
|
general Files permissions. Cases and Workflow Engine retain
|
|
their own target state; Runtime stores only a permitted same-tenant handoff
|
|
reference and status evidence.
|
|
|
|
Administrators create public profiles from the Forms Runtime workspace. An
|
|
anonymous profile has one reusable public URL. An invitation profile creates a
|
|
new one-time bearer URL for each participant. The UI can copy a newly issued
|
|
secret but cannot retrieve it later. Disabling a profile prevents new starts;
|
|
already submitted revisions and their evidence remain governed records.
|
|
|
|
## Approved Intake And Evidence Profiles
|
|
|
|
The product and security profile approved on 2026-08-04 sets the next
|
|
implementation boundary:
|
|
|
|
- authenticated-account and invitation-token intake are the first public entry
|
|
profiles;
|
|
- anonymous intake is available only through an explicit per-form policy
|
|
opt-in, while a pseudonymous profile remains deferred;
|
|
- an anonymous submission cannot later be claimed by an identity; an invitation
|
|
submission can be linked only with explicit consent and proof of that
|
|
invitation;
|
|
- invitation tokens are hashed, tenant/form bound, replay safe, rate limited,
|
|
and expire after 14 days by default;
|
|
- drafts expire after 30 days by default, while every service/form must declare
|
|
submitted-data retention explicitly; and
|
|
- CAPTCHA remains an optional privacy-approved provider instead of a mandatory
|
|
external dependency.
|
|
|
|
Files is the first attachment provider and retains byte storage, quarantine,
|
|
scanning, classification, retention, and legal-hold ownership. Runtime stores
|
|
only immutable same-tenant evidence references and must fail closed when a
|
|
required item is pending, rejected, expired, unavailable, or unverifiable.
|
|
|
|
The first native signature profile is an authenticated acknowledgement. It is
|
|
not an advanced or qualified electronic signature. Those assurance levels
|
|
require a separately selected external trust-service provider and current
|
|
provider evidence; a required signature never silently degrades.
|
|
|
|
## Search
|
|
|
|
When Search is enabled, `forms_runtime.submissions` indexes only the Form
|
|
definition identity and revision, lifecycle state, receipt identifier, Service
|
|
reference, and route back to the instance. Submitted field values and managed
|
|
evidence content are never copied into the search index. Workspace readers may
|
|
resolve tenant submissions; participants may resolve only instances owned by
|
|
their current actor identity. Every result receives a current authorization
|
|
recheck before disclosure.
|
|
|
|
## Recovery And Operations
|
|
|
|
Database recovery restores identities, revisions, and events together. After
|
|
restore, verify one current revision per instance, monotonically increasing
|
|
revision history, matching event revisions, resolvable exact Form and Service
|
|
references, and referenced evidence availability. A replay with the original
|
|
idempotency key and request hash must return the original revision; a changed
|
|
request must conflict. Failed handoffs leave the prior revision current.
|
|
|
|
Destructive retirement is blocked while state exists and requires a verified
|
|
database snapshot plus an export or retention decision for referenced evidence.
|
|
No local generated files are required, so API and worker nodes remain stateless.
|
|
|
|
Public intake, Files-backed attachment evidence, and authenticated
|
|
acknowledgements implement the approved first profiles. Conditional multi-page
|
|
definitions are resolved from Forms, and native Case/Workflow handoffs execute
|
|
automatically when the exact owner capability is installed. CAPTCHA,
|
|
pseudonymous intake, advanced or qualified electronic signatures, richer
|
|
attachment classification/retention controls, and additional target kinds
|
|
remain provider or product depth; none may weaken the implemented owner and
|
|
security boundaries.
|