[Privacy] Provide governed Scheduling DSAR coverage #9

New Issue

2026-08-20T23:18:24+02:00

zemion commented

2026-08-20 23:18:24 +02:00

Objective

Adopt the Core data-subject request provider contract for Scheduling requests, participants, candidate context, notification evidence, and public enrollment governance while preserving Poll and Calendar ownership boundaries.

Acceptance criteria

Search is bounded and tenant-scoped and supports participant email, respondent/account membership references, organizer references, and namespaced Scheduling references.
Export isolates the subject participant and omits Poll invitation ids, bearer/proof/password hashes, Calendar/Poll internals, notification payloads/errors, metadata secrets, and unrelated participants.
Participant, request, candidate-slot, notification, and public-link records receive explicit retention or manual-review classifications, with Poll responses identified as Poll-owned coverage.
An unengaged participant projection can be revalidated and idempotently anonymized only when no Poll invitation, response, or notification evidence exists; coordinated records remain manual review.
Provider discovery, disabled-module behavior, stale/retry handling, documentation, and focused checks pass.

Parent: GovOPlaN/govoplan#47. ## Objective Adopt the Core data-subject request provider contract for Scheduling requests, participants, candidate context, notification evidence, and public enrollment governance while preserving Poll and Calendar ownership boundaries. ## Acceptance criteria - [ ] Search is bounded and tenant-scoped and supports participant email, respondent/account membership references, organizer references, and namespaced Scheduling references. - [ ] Export isolates the subject participant and omits Poll invitation ids, bearer/proof/password hashes, Calendar/Poll internals, notification payloads/errors, metadata secrets, and unrelated participants. - [ ] Participant, request, candidate-slot, notification, and public-link records receive explicit retention or manual-review classifications, with Poll responses identified as Poll-owned coverage. - [ ] An unengaged participant projection can be revalidated and idempotently anonymized only when no Poll invitation, response, or notification evidence exists; coordinated records remain manual review. - [ ] Provider discovery, disabled-module behavior, stale/retry handling, documentation, and focused checks pass.

zemion added the module/scheduling

type

task

area/db area/governance area/security codex/ready

labels 2026-08-20 23:18:24 +02:00

zemion commented

2026-08-20 23:37:51 +02:00

Implemented and pushed as 0fd2972 feat: add governed Scheduling DSAR coverage.

Evidence:

bounded tenant-scoped matching by normalized email, membership/identity/bound-account selectors, and namespaced Scheduling references
isolates matching participants, request/candidate context, and notification envelopes while excluding Poll/invitation identifiers, public-link/proof material, Calendar IDs/free-busy detail, password hashes, notification payload/error data, opaque metadata, unrelated participants, and unrelated tenants
Poll remains authoritative for response choices; Calendar remains authoritative for event/hold state
terminal/responded/notified state is retained; only a truly unengaged participant is executable, with tenant/identity/request/invitation/response/enrollment/notification revalidation and idempotent replay
static administrator and capability documentation plus active/disabled Core workflow coverage
focused DSAR/module-boundary tests: 8 passed
full Scheduling suite: 94 passed
workspace manifest registry: 68/68

Implemented and pushed as `0fd2972 feat: add governed Scheduling DSAR coverage`. Evidence: - bounded tenant-scoped matching by normalized email, membership/identity/bound-account selectors, and namespaced Scheduling references - isolates matching participants, request/candidate context, and notification envelopes while excluding Poll/invitation identifiers, public-link/proof material, Calendar IDs/free-busy detail, password hashes, notification payload/error data, opaque metadata, unrelated participants, and unrelated tenants - Poll remains authoritative for response choices; Calendar remains authoritative for event/hold state - terminal/responded/notified state is retained; only a truly unengaged participant is executable, with tenant/identity/request/invitation/response/enrollment/notification revalidation and idempotent replay - static administrator and capability documentation plus active/disabled Core workflow coverage - focused DSAR/module-boundary tests: `8 passed` - full Scheduling suite: `94 passed` - workspace manifest registry: `68/68`

zemion closed this issue

2026-08-20 23:37:51 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-scheduling#9