feat: add governed cross-module reporting

docs/ADMIN_GUIDE.md

@@ -32,6 +32,36 @@ the Reporting publication-target contract. The target receives one immutable
 execution payload and an idempotency key. It must return bounded evidence and
 must not expose credentials in that evidence.
 
+## Cross-module provider governance
+
+Source modules register `reporting.report_provider.<provider-id>` capabilities;
+do not grant Reporting direct table access to those modules. Review every
+descriptor's result schema, required privacy transforms, retention class,
+export formats, and re-identification risk before enabling it in production.
+Provider authorization remains mandatory even when the Reporting role allows
+the user to run reports.
+
+When Policy is enabled, configure `reporting_governance_policy` in system or
+tenant settings. Tenant settings may only tighten the system result. Supported
+fields are:
+
+```json
+{
+  "reporting_governance_policy": {
+    "allow_exports": true,
+    "allowed_export_formats": ["json"],
+    "allow_high_reidentification_risk": false,
+    "max_retention_days": 30,
+    "required_privacy_transforms": ["small_cell_suppression"]
+  }
+}
+```
+
+Malformed explicit policy fails closed. The ordinary privacy-retention setting
+`stored_report_detail_retention_days` is an additional ceiling. A tenant cannot
+re-enable an export format, high-risk report, or longer retention period that
+the system policy denied.
+
 ## Import assessments
 
 Import assessment accepts declarative metadata only. Native datasets,

docs/OPERATIONS.md

@@ -12,6 +12,15 @@ claim bounded batches, retain success or failure state, and advance interval
 time from the claimed occurrence. Providers must use the same tenant and
 principal context and must enforce their source-side authorization.
 
+Provider-report executions and exports are database evidence. Each execution
+stores the exact provider/report revision, request hash, source revisions,
+effective scope, applied privacy transforms, governance decision provenance,
+generation actor/time, retention expiry, and output hash. Export rows retain
+their own purpose, audience, actor/time, format, and hash. Expired provider
+results are rejected by retrieval and export paths; run the platform privacy
+retention process on schedule to remove or minimize expired stored detail in
+accordance with the active Policy.
+
 ## Security controls
 
 - The semantic engine never evaluates Python, browser code, raw SQL, stored
@@ -25,6 +34,10 @@ principal context and must enforce their source-side authorization.
 - Freshness, schema, fingerprints, quality gates, definition hashes, source
   provenance, actor, and output hash are retained with every run.
 - CSV formula injection is neutralized before direct download.
+- Provider exceptions are isolated in catalogue diagnostics; an unavailable
+  optional provider cannot take down the global report catalogue.
+- High re-identification-risk provider reports fail closed unless an installed
+  Policy capability explicitly permits them.
 
 ## Backup and restore
 

docs/REPORTING_BOUNDARY.md

@@ -87,6 +87,29 @@ Reporting does not own:
 - `reporting.publication_target:*` capabilities can accept immutable result
   payloads without Reporting importing the target module.
 
+### Cross-module report providers
+
+Source modules contribute aggregate or otherwise minimized reports through
+`reporting.report_provider.<provider-id>`. Core owns contract version `1.0` and
+the provider-neutral DTOs. A provider must declare stable report and revision
+IDs, typed parameters, the complete result schema, privacy transforms,
+retention class, export formats, and re-identification risk. It must enforce
+source access before listing options or producing a result and must return
+source revisions, effective tenant scope, applied transforms, generation time,
+and bounded provenance.
+
+Reporting discovers these capabilities by prefix. It validates descriptors,
+rejects undeclared output fields, requires every mandatory transform, records
+purpose and effective audience, and persists immutable execution and export
+evidence. The optional `policy.reporting_governance` capability can tighten
+retention, export formats, required transforms, and high-risk handling. If
+Policy is absent, Reporting applies its restrictive built-in baseline and
+denies high-risk provider reports.
+
+This direction is intentionally one-way: source modules import only Core's
+contract and remain usable when Reporting is absent. Reporting never imports
+the source module or reads its ORM tables.
+
 ## Implemented Vertical
 
 The first complete vertical persists datasets, semantic models, reports,
@@ -120,6 +143,11 @@ unsupported executable behavior remains.
 The WebUI uses the platform module loader and common controls. It exposes a
 report catalogue, parameter and semantic-query controls, result visualization
 and table views, history/provenance, saved views, schedules, and downloads.
+The global `/reports` route is owned only by Reporting. `/reporting` is a
+documented compatibility path. Campaign's module-local aggregate view remains
+at `/campaigns/reports`; when both modules are enabled, the same safe aggregate
+projection is also contributed to the global catalogue through the provider
+contract.
 
 ## Remaining Product Depth
 

docs/USER_GUIDE.md

@@ -2,8 +2,9 @@
 
 ## Open and run a report
 
-Open **Reporting** and choose an active report from the left catalogue. The
-header identifies the immutable report revision that will be used. Select a
+Open **Reporting** at `/reports` and choose a report from the left catalogue.
+The catalogue separates source-module reports from Reporting semantic reports.
+The header identifies the immutable report revision that will be used. Select a
 summary, detail, or pivot shape, choose dimensions and measures, enter any
 report parameters, and select **Run**.
 
@@ -30,3 +31,18 @@ spreadsheet formula marker are escaped.
 Users with scheduling permission can create an hourly, daily, weekly, or
 30-day interval from the current revision, parameters, and query. Scheduled
 runs continue to use those exact pins until the schedule is edited.
+
+## Run a module report
+
+Module reports retain their source module's access rules. Select the source
+object and any optional parameters, enter the concrete purpose for the run,
+and verify the effective tenant audience before selecting **Run**. Reporting
+will refuse a result that does not carry the declared privacy transforms,
+source revision, and tenant scope.
+
+The result groups declared metrics and details without exposing undeclared
+provider data. The Governance panel explains the risk class, permitted export
+formats, retention ceiling, contract version, and required privacy transforms.
+An export records a separate purpose, actor, audience, time, format, and output
+hash. A missing or restricted module report is not replaced with a less
+protected client-side query.