[Feature] Add per-user unified Postbox grouping without merging source containers #19

New Issue

2026-07-28T18:59:05+02:00

zemion commented

2026-07-28 18:59:05 +02:00

Outcome

A user with several effective function postboxes can group selected sources into unified inbox views while keeping sensitive or unrelated responsibilities separate.

Acceptance criteria

Persist named per-user grouping definitions that reference visible postbox addresses; support a default group and explicitly separate sources.
A unified group is a query/view projection only. Messages, read/ack state, retention, address, function/unit context, and audit evidence remain attached to the source postbox.
Re-evaluate membership when IDM assignments start, expire, or are revoked; retain harmless preferences for temporarily unavailable sources without leaking metadata.
Provide aggregate unread counts, filtering, search, and deterministic pagination without duplicate messages.
Show source function/unit and acting/delegated context on every item and action.
Allow administrators/Policy to require separation for classifications or functions and explain that provenance.
Make group selection available to the future Views module so a task-focused View can choose a Postbox projection without changing access.
Tests cover multiple functions, overlapping groups, delegation expiry, hidden sources, classification separation, and stable pagination.

Dependencies

Builds on the inbox slice (#11), the effective IDM assignment contract, and parent user story #16.

## Outcome A user with several effective function postboxes can group selected sources into unified inbox views while keeping sensitive or unrelated responsibilities separate. ## Acceptance criteria - Persist named per-user grouping definitions that reference visible postbox addresses; support a default group and explicitly separate sources. - A unified group is a query/view projection only. Messages, read/ack state, retention, address, function/unit context, and audit evidence remain attached to the source postbox. - Re-evaluate membership when IDM assignments start, expire, or are revoked; retain harmless preferences for temporarily unavailable sources without leaking metadata. - Provide aggregate unread counts, filtering, search, and deterministic pagination without duplicate messages. - Show source function/unit and acting/delegated context on every item and action. - Allow administrators/Policy to require separation for classifications or functions and explain that provenance. - Make group selection available to the future Views module so a task-focused View can choose a Postbox projection without changing access. - Tests cover multiple functions, overlapping groups, delegation expiry, hidden sources, classification separation, and stable pagination. ## Dependencies Builds on the inbox slice (#11), the effective IDM assignment contract, and parent user story #16.

zemion added the module/views area/api module/postbox module/idm area/webui area/db area/security codex/ready

labels 2026-07-28 18:59:05 +02:00

zemion referenced this issue

2026-07-28 18:59:07 +02:00

[Feature] Build an inbox view for visible postboxes, messages, and role-bound access explanation #11

zemion referenced this issue

2026-07-28 19:03:42 +02:00

[User Story] Deliver campaign messages to organizational function postboxes #16

zemion commented

2026-07-29 00:19:20 +02:00

Codex State: progress

Per-account named/default groupings and source-preserving aggregate message queries are implemented with search, state filters, deterministic pagination, and no message/receipt merging. Updating a grouping now retains temporarily inaccessible source preferences server-side without exposing hidden metadata; a regression test covers assignment loss and restoration. Policy/Views-enforced separation and aggregate unread counters remain open.

## Codex State: progress Per-account named/default groupings and source-preserving aggregate message queries are implemented with search, state filters, deterministic pagination, and no message/receipt merging. Updating a grouping now retains temporarily inaccessible source preferences server-side without exposing hidden metadata; a regression test covers assignment loss and restoration. Policy/Views-enforced separation and aggregate unread counters remain open.

zemion added

and removed

labels 2026-07-29 00:20:19 +02:00

zemion referenced this issue

2026-07-31 15:21:56 +02:00

[Feature] Add unified Postbox projections and explicit hierarchy-copy routing #24

zemion commented

2026-08-06 12:47:33 +02:00

Codex State: progress

Unified personal Postbox projections now expose batched total and unread counts per grouping without merging source containers or issuing one count query per group. The source Postbox continues to own messages, receipts, retention and provenance.

Commit: govoplan-postbox@d107c09.

Policy/Views-enforced separation and the remaining classification/delegation matrix remain; keep this issue open.

## Codex State: progress Unified personal Postbox projections now expose batched total and unread counts per grouping without merging source containers or issuing one count query per group. The source Postbox continues to own messages, receipts, retention and provenance. Commit: `govoplan-postbox@d107c09`. Policy/Views-enforced separation and the remaining classification/delegation matrix remain; keep this issue open.

zemion commented

2026-08-06 16:17:45 +02:00

Codex State: progress

36530b6 adds an authorized postbox.unread work projection and centralizes current account/group/role/function/function-assignment resolution so source access and the unified work inbox cannot drift. Reading a message removes its unread projection without copying or completing Postbox state elsewhere.

This issue remains open. Policy-enforced grouping separation, assignment-churn coverage, and the full delegated/hidden-source browser matrix are still required by its acceptance criteria.

## Codex State: progress `36530b6` adds an authorized `postbox.unread` work projection and centralizes current account/group/role/function/function-assignment resolution so source access and the unified work inbox cannot drift. Reading a message removes its unread projection without copying or completing Postbox state elsewhere. This issue remains open. Policy-enforced grouping separation, assignment-churn coverage, and the full delegated/hidden-source browser matrix are still required by its acceptance criteria.

zemion commented

2026-08-20 04:25:05 +02:00

Implemented and verified governed unified-inbox grouping.

What is now complete:

named and default personal groups retain source Postbox identity and may overlap; hidden/expired delegated sources remain harmless preferences and never grant visibility
exact Postboxes and immutable template revisions carry an admin-configurable allow, same_classification, or separate grouping policy with optional rationale
policy is re-evaluated on every aggregate list/count query, including after later policy, classification, assignment, or delegation changes; conflicting existing groups expose constraints without composing counts/content
group editing prevents prohibited combinations and explains source-specific policy provenance; individual Postbox drill-down remains available
aggregate ordering/pagination is deterministic with no duplicate page membership
Quick Access and dashboard inbox projection conservatively omit governed sources and explain that they remain available in separated inbox views
the stable /postbox?grouping=<id> selector supports task-focused Views without bypassing current authorization
optimistic concurrency, audit evidence, and postbox.grouping.policy.updated.v1 cover administrative updates
user/admin documentation and German projection are included

Commits: Core be7b796, Postbox 41ea8d8.

Verification: full tools/checks/check-focused.sh passed (68 contracts/manifests, strict inventory, 1,763 Python files, backend and migration suites including 53 Postbox tests, 57 WebUI permutations including full product, seven Playwright conformance tests, and module UI checks).

Implemented and verified governed unified-inbox grouping. What is now complete: - named and default personal groups retain source Postbox identity and may overlap; hidden/expired delegated sources remain harmless preferences and never grant visibility - exact Postboxes and immutable template revisions carry an admin-configurable `allow`, `same_classification`, or `separate` grouping policy with optional rationale - policy is re-evaluated on every aggregate list/count query, including after later policy, classification, assignment, or delegation changes; conflicting existing groups expose constraints without composing counts/content - group editing prevents prohibited combinations and explains source-specific policy provenance; individual Postbox drill-down remains available - aggregate ordering/pagination is deterministic with no duplicate page membership - Quick Access and dashboard inbox projection conservatively omit governed sources and explain that they remain available in separated inbox views - the stable `/postbox?grouping=<id>` selector supports task-focused Views without bypassing current authorization - optimistic concurrency, audit evidence, and `postbox.grouping.policy.updated.v1` cover administrative updates - user/admin documentation and German projection are included Commits: Core `be7b796`, Postbox `41ea8d8`. Verification: full `tools/checks/check-focused.sh` passed (68 contracts/manifests, strict inventory, 1,763 Python files, backend and migration suites including 53 Postbox tests, 57 WebUI permutations including full product, seven Playwright conformance tests, and module UI checks).

zemion closed this issue

2026-08-20 04:25:05 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-postbox#19