Publish complete signed module catalogs

docs/SYSTEM_ADMINISTRATOR_LIFECYCLE_USER_STORY.md

@@ -4,7 +4,8 @@
 
 > As a system administrator, I can execute one shell command that downloads a
 > verified GovOPlaN distribution and starts a completely configured Core control
-> plane without optional modules. In the WebUI I can browse compatible signed
+> plane with the official package directory available but only the protected
+> baseline active. In the WebUI I can browse compatible signed
 > module releases, select the modules for this installation, and follow every
 > download, validation, migration, installation, activation, and health-check
 > step. When an update is available, I can review its impact and confirm it.
@@ -25,7 +26,8 @@ The canonical backlog item is
 
 - **Core control plane:** the smallest bootable distribution: Core API, Core
   WebUI, PostgreSQL, Redis, installer worker, migration runner, and durable
-  storage configuration. No optional GovOPlaN module package is installed.
+  storage configuration. An immutable image may carry the full verified package
+  profile, but optional modules are not active or tenant-entitled by implication.
 - **Bootstrap administrator:** a single-use, time-limited installation identity
   that may access only first-run and module-lifecycle functions. It is retired
   when the selected identity/access configuration becomes healthy.
@@ -55,7 +57,9 @@ The canonical backlog item is
 5. It prints the local URL and one-time bootstrap credential. Re-running the
    command is idempotent and shows or repairs the existing installation rather
    than creating another identity or database.
-6. No optional module is installed or enabled at this point.
+6. Only the protected baseline is enabled. Installed package availability does
+   not grant permissions, tenant entitlement, View visibility, or capability
+   opt-in.
 
 ### Module selection, installation, and update
 
@@ -160,19 +164,22 @@ Implementation status as of the current source tree:
   ledger and deployment operation journal. Automatic database backup and broad
   adoption by module-owned external effects remain open work.
 
-1. **Reproducible Core-only distribution.** Publish pinned multi-architecture
-   images, signed distribution manifest, Core-only Compose profile, bootstrap
+1. **Reproducible Core-baseline distribution.** Publish pinned multi-architecture
+   full-package images, signed distribution manifest, Core-baseline Compose profile, bootstrap
    preflight, generated secrets, readiness, and idempotent rerun/repair.
 2. **First-run control plane.** Add the restricted bootstrap administrator,
    one-time enrollment, initial catalog/keyring configuration, and retirement
    after durable administrator access is established.
-3. **Read-only online module directory.** Move the existing catalog and module
-   directory contracts into the installed Core WebUI with compatibility,
-   provenance, release-note, and update-state presentation.
-4. **Durable module plan and install.** Reuse the existing installer queue,
-   locks, signed-package validator, rollback drill, and run evidence behind a
-   plan/confirm/progress UI. Add initial catalog-entry synthesis and artifact
-   acquisition where the current release console still assumes local sources.
+3. **Read-only online module directory (implemented foundation).** Admin falls
+   back to the signed public stable directory, presents installed/update state,
+   compatibility and provenance, and retains operator-configured catalogs as an
+   explicit override.
+4. **Durable module plan and install (implemented local boundary).** Catalog
+   selection creates a reviewed plan; the installer queue, lock, preflight,
+   maintenance gate, digest-verified artifact cache, rollback drill, and run
+   evidence remain separate from the API process. Shared deployments convert
+   the same intent into a new immutable release composition instead of mutating
+   one replica.
 5. **Safe module update.** Add drain/maintenance coordination, backup gate,
    migration compatibility window, reconnectable progress, health verification,
    retry/recovery, and update notification.
@@ -194,7 +201,8 @@ Implementation status as of the current source tree:
 
 ## Explicit non-goals for the first distribution slice
 
-- Shipping optional modules in the Core image.
+- Activating, tenant-entitling, or exposing optional modules merely because the
+  immutable image carries their verified packages.
 - Exporting secrets or production business data with configuration.
 - Pretending every schema migration can be reversed automatically.
 - Building a proprietary orchestrator instead of supporting Compose and a