[Debt] Decompose organization-function assignment updates #6

New Issue

2026-07-29T13:25:59+02:00

zemion commented

2026-07-29 13:25:59 +02:00

Problem

update_organization_function_assignment remains a D/24 path that combines authorization, identity/function/unit resolution, lifecycle validation, mutation, and response/event assembly. This is a sensitive integration boundary for Postbox and other function-aware modules.

Acceptance criteria

Resolution and validation are pure/testable apart from persistence.
Effective-date and conflicting-assignment rules have decision-table coverage.
Mutation and lifecycle event publication are transactionally consistent.
Consumers continue to use public capabilities rather than cross-module ORM imports.
IDM passes the configured Xenon threshold.

## Problem `update_organization_function_assignment` remains a D/24 path that combines authorization, identity/function/unit resolution, lifecycle validation, mutation, and response/event assembly. This is a sensitive integration boundary for Postbox and other function-aware modules. ## Acceptance criteria - Resolution and validation are pure/testable apart from persistence. - Effective-date and conflicting-assignment rules have decision-table coverage. - Mutation and lifecycle event publication are transactionally consistent. - Consumers continue to use public capabilities rather than cross-module ORM imports. - IDM passes the configured Xenon threshold.

zemion added the

type

debt

module/idm area/api area/rbac source/security-audit codex/ready

labels 2026-07-29 13:25:59 +02:00

zemion commented

2026-07-29 14:24:41 +02:00

Codex State: reviewed

Reviewed after published IDM 01c1f7e. This remains open: fresh Xenon still reports update_organization_function_assignment at rank D. Validation, transition planning, mutation, lifecycle emission, and audit response assembly still need separation.

## Codex State: reviewed Reviewed after published IDM `01c1f7e`. This remains open: fresh Xenon still reports `update_organization_function_assignment` at rank D. Validation, transition planning, mutation, lifecycle emission, and audit response assembly still need separation.

zemion commented

2026-07-29 18:57:53 +02:00

Implemented and pushed in 15559a8.

The route now delegates to a pure immutable transition plan and source/lifecycle validators. Validation completes before ORM mutation, required-null/effective-date/source rules have decision-table coverage, and assignment mutation, configuration-control history, audit records, and platform outbox events commit atomically. Public capabilities remain unchanged.

Verification: all 13 IDM tests, Ruff, Xenon --max-absolute C --max-modules B --max-average A, and diff checks pass.

Implemented and pushed in `15559a8`. The route now delegates to a pure immutable transition plan and source/lifecycle validators. Validation completes before ORM mutation, required-null/effective-date/source rules have decision-table coverage, and assignment mutation, configuration-control history, audit records, and platform outbox events commit atomically. Public capabilities remain unchanged. Verification: all 13 IDM tests, Ruff, Xenon `--max-absolute C --max-modules B --max-average A`, and diff checks pass.

zemion removed the

status

ready

codex/ready labels 2026-07-29 18:57:54 +02:00

zemion closed this issue

2026-07-29 18:57:54 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-idm#6