55 lines
3.6 KiB
Markdown
55 lines
3.6 KiB
Markdown
# Postbox Interface Pattern Migration
|
|
|
|
This document records the bounded migration of Postbox-owned WebUI surfaces to
|
|
the GovOPlaN interface pattern language. Core owns shared controls and host
|
|
shells. Postbox owns function-bound addresses, messages, receipts, delivery
|
|
evidence, personal inbox projections, and reusable address templates.
|
|
|
|
## Surface Inventory
|
|
|
|
| Surface | Archetype | Consequence class | Contract |
|
|
| --- | --- | --- | --- |
|
|
| `/postbox` directory | Directory and hierarchy-context selector | Change query projection | Shared selection list, explicit assignment blocker, contextual help, guarded reload |
|
|
| `/postbox` messages | Searchable work queue | Read, acknowledge, reply, or author | Shared filters/pagination/status/alerts, explained unavailable actions, privacy-safe retained states |
|
|
| Message detail and composer | Record detail and consequential editor | Deliver institutional message | Source/function provenance, classification boundary, guarded draft, stable field help |
|
|
| Unified-view dialog | Personal configuration editor | Change or delete query projection | Shared dialog/toggle/confirmation; deletion never changes source messages or evidence |
|
|
| `postbox.admin.templates` | Versioned definition library | Publish or retire immutable template revision | Shared admin layout, durable consequence explanations, guarded editor, contextual help |
|
|
| Materialized Postbox administration | Repeated administration | Create or archive durable address | Organization/function selector, prerequisite blocker, destructive confirmation, retained-evidence explanation |
|
|
| `postbox.widget.inbox` | Dashboard summary | Navigate to unread work | Shared widget loading/error/list contract and localized accessible attachment metadata |
|
|
|
|
## Consequence And Availability Rules
|
|
|
|
- A Postbox address belongs to an organization function, not to an account.
|
|
Current effective IDM assignments determine access without changing the
|
|
durable message or address record.
|
|
- Publishing freezes an immutable template revision. Retiring a template stops
|
|
future revision and materialization work but leaves existing addresses
|
|
intact.
|
|
- Archiving an address stops new delivery while preserving messages, receipts,
|
|
access events, and delivery evidence.
|
|
- Unified inbox views are personal projections. Deleting one does not move or
|
|
delete source Postboxes, messages, acknowledgements, or evidence.
|
|
- Hierarchy copies are separate, bounded deliveries. Vacancy escalation is a
|
|
separately scheduled and auditable route, not an implicit personal grant.
|
|
- Withdrawal and expiry prevent future content access while retaining only the
|
|
metadata the current actor may inspect. Already exported or printed plaintext
|
|
cannot be retracted.
|
|
- Disabled actions state whether the blocker is loading, another operation, a
|
|
missing permission, a missing assignment, an unavailable message, or a
|
|
lifecycle constraint.
|
|
|
|
## State And Accessibility Evidence
|
|
|
|
The module uses Core admin/page shells, selection lists, pagination, dialogs,
|
|
confirmations, alerts, status badges, action blockers, contextual field help,
|
|
disabled reasons, and unsaved-change guards. Shared dialogs retain keyboard
|
|
focus and return behavior. Existing responsive workspace CSS keeps directory,
|
|
message list, and detail regions bounded and independently scrollable.
|
|
|
|
English and German catalogues cover module metadata, accessible attributes,
|
|
workspaces, dialogs, fields, lifecycle states, and dashboard output. Dates use
|
|
the selected platform locale. Manifest topics publish stable route, surface,
|
|
field, blocker, privacy, and consequence references. Focused backend and WebUI
|
|
tests pin these contracts without importing optional sibling modules.
|
|
|