Implement unified work inbox module

docs/TASKS_DOMAIN.md

@@ -0,0 +1,65 @@
+# Tasks Domain And Unified Work Inbox
+
+## Boundary
+
+Tasks owns explicit work items, their typed assignments, due dates, priorities,
+state transitions, source references, and the unified work-inbox presentation.
+It does not own the state of a Workflow instance, approval, notification,
+Postbox message, Case, Campaign, record, or any other contributed object.
+
+Modules contribute currently authorized `WorkItem` projections through Core's
+versioned provider-registration contract. The projection links back to the
+source owner, which remains responsible for commands, validation, concurrency,
+audit, retention, and recovery. A failing provider is isolated and shown as an
+unavailable work source; it cannot make other work disappear.
+
+## Explicit Tasks
+
+An explicit task has:
+
+- a tenant and replay-safe idempotency key;
+- title, optional summary, priority, due date, and required action;
+- one or more account, group, role, function, function-assignment, or broad
+  tenant assignments;
+- typed source references and provenance;
+- an optimistic-concurrency revision and immutable transition evidence.
+
+Function assignments are resolved at read time through the optional IDM
+directory. This lets work assigned to an institutional function follow current
+responsibility without turning an incumbent into the permanent owner. When IDM
+is absent, account, group, role, and explicit assignment references continue to
+work; unresolved function work fails closed.
+
+## State And Recovery
+
+Supported states are `open`, `in_progress`, `deferred`, `blocked`, `completed`,
+and `cancelled`. Consequential transitions require a strong `If-Match`
+precondition and compare-and-set the revision. Replaying task creation with the
+same idempotency key returns the same task only when the canonical request is
+identical.
+
+Task changes emit Core change-sequence events so optional Notifications,
+Workflow Engine, Search, Audit, or reporting consumers can react transactionally.
+Database backup and restore is the recovery unit. Domain effects linked from a
+task remain subject to the recovery rules of their owner.
+
+## Permissions
+
+- `tasks:item:read`: discover assigned explicit and contributed work;
+- `tasks:item:write`: create explicit tasks and advance visible task state;
+- `tasks:item:admin`: inspect and recover tenant-wide explicit work.
+
+Current authorization is always rechecked, including for historical or deferred
+work. The inbox never widens the permissions of its sources.
+
+## User And Administrator Guidance
+
+Users open **Work**, filter the current inbox, inspect the responsible source,
+and either open the source-owned action or advance an explicit task. Completed
+and cancelled work is hidden from the default view but remains available through
+the history filter.
+
+Administrators assign the Work participant or Work supervisor role and ensure
+that IDM is enabled when function-bound work is required. Disabling Tasks
+preserves explicit task state. Contributed source work remains with each source
+module and becomes visible again when Tasks is re-enabled.