[Feature] Add bounded hierarchy copy, visibility, escalation, and vacancy routing rules #18

New Issue

zemion · 2026-07-28T18:59:05+02:00

zemion commented

2026-07-28 18:59:05 +02:00

Outcome

Postbox can route attention or an explicit linked copy to a function postbox higher in a selected organization hierarchy without granting unlimited ancestor access.

Acceptance criteria

Default to no hierarchy propagation.
Model copy, attention/escalation, and shared visibility as distinct semantics; do not treat them as interchangeable.
For the first production slice, implement explicit linked-copy routing with source provenance, maximum depth, stop unit/type, selected structure/relation, target function mapping, and loop/deduplication protection.
Evaluate and snapshot the route at delivery time. A later organization move does not retroactively expose an old message.
Gate routing by message classification, tenant policy, sender authority, retention, and target availability.
Represent vacancy separately from failure; allow bounded escalation after a configured delay without granting plaintext access to a personal account.
Keep source and copy states linked but independently readable/acknowledgeable; make fan-out visible in delivery evidence.
Provide a dry-run explanation API and tests for no route, one parent, depth limit, parallel structures, vacancy, duplicate paths, restricted classification, and tenant isolation.

Dependencies

Organizations hierarchy contract
Function-scoped templates and addresses (#17)
Parent user story: [User Story] Deliver campaign messages to organizational function postboxes (#16)

## Outcome Postbox can route attention or an explicit linked copy to a function postbox higher in a selected organization hierarchy without granting unlimited ancestor access. ## Acceptance criteria - Default to no hierarchy propagation. - Model `copy`, `attention/escalation`, and `shared visibility` as distinct semantics; do not treat them as interchangeable. - For the first production slice, implement explicit linked-copy routing with source provenance, maximum depth, stop unit/type, selected structure/relation, target function mapping, and loop/deduplication protection. - Evaluate and snapshot the route at delivery time. A later organization move does not retroactively expose an old message. - Gate routing by message classification, tenant policy, sender authority, retention, and target availability. - Represent vacancy separately from failure; allow bounded escalation after a configured delay without granting plaintext access to a personal account. - Keep source and copy states linked but independently readable/acknowledgeable; make fan-out visible in delivery evidence. - Provide a dry-run explanation API and tests for no route, one parent, depth limit, parallel structures, vacancy, duplicate paths, restricted classification, and tenant isolation. ## Dependencies - [Organizations hierarchy contract](https://git.add-ideas.de/GovOPlaN/govoplan-organizations/issues/5) - Function-scoped templates and addresses (#17) - Parent user story: #16

zemion added the