Release v0.1.16

docs/ASSISTED_AND_NON_DIGITAL_CHANNELS.md

@@ -0,0 +1,167 @@
+# Assisted and Non-Digital Channels
+
+## Purpose
+
+GovOPlaN must support people who cannot or do not use a self-service portal.
+Telephone, paper, in-person service, authorized representation, mobile staff,
+interpreters, and temporary offline work are not exceptional side systems.
+They are governed channels into the same service, case, workflow, record, and
+decision.
+
+The goal is equivalent institutional treatment, not forced channel identity.
+The system preserves which channel was used and which evidence is available
+without giving digitally confident users stronger substantive rights.
+
+The first end-to-end journey is tracked in
+[GovOPlaN #42](https://git.add-ideas.de/GovOPlaN/govoplan/issues/42).
+
+## Actor Model
+
+Every assisted interaction distinguishes:
+
+- the affected person or organization;
+- the real staff member or external helper entering information;
+- the represented party and representation basis;
+- an interpreter, witness, guardian, or support person where relevant;
+- the responsible institutional function;
+- the channel and location;
+- the person who reviewed or confirmed the captured information.
+
+"Entered by" is not "declared by". "Declared by" is not "verified by".
+Authentication assurance, representation authority, and evidence quality are
+separate fields.
+
+## Channel-Neutral Intake Contract
+
+All channels create the same versioned service/form submission contract with
+additional provenance:
+
+- service, form, schema, language, and accessibility version;
+- valid and recorded time;
+- channel (`portal`, `counter`, `telephone`, `paper`, `email`, `mobile`,
+  `representative`, `offline_import`, or configured extension);
+- affected and represented parties;
+- capture actor and responsible function;
+- consent, notice, purpose, legal basis, and information source;
+- field-level source and confidence where staff transcribed or inferred data;
+- attachments, scans, originals, signatures, recordings, and attestations as
+  governed evidence references;
+- read-back/confirmation result and correction path;
+- receipt and chosen return channels;
+- duplicate/matching assessment and any manual resolution.
+
+Forms Runtime owns the submission lifecycle. Parties owns procedural capacity
+and representation. Identity/Addresses own subject and contact references.
+Cases owns the matter. Records owns filing and retention. Audit preserves the
+action/effect evidence.
+
+## Assisted Session
+
+An assisted session is a resumable work item, not a privileged bypass. It:
+
+1. selects service, language, channel, affected party, and represented capacity;
+2. shows the staff member only fields and evidence relevant to the service;
+3. explains why sensitive data is requested and what evidence quality is
+   required;
+4. records source per value when information comes from speech, paper, an
+   existing register, or staff observation;
+5. validates and previews consequences before submission;
+6. supports read-back, correction, confirmation, and a second-person check
+   where policy requires it;
+7. generates an accessible receipt through the requested channel;
+8. creates follow-up tasks when original documents, signatures, translation,
+   or verification remain outstanding.
+
+The helper's normal account and represented function remain in the audit
+chain. Assistance never grants access to unrelated records about the person.
+
+## Paper And Scanning
+
+- Register receipt before scanning so custody and deadlines do not depend on
+  successful OCR.
+- Store the original scan or external archive reference with digest, pages,
+  capture device/provider, time, operator, and quality assessment.
+- Treat OCR and extracted fields as derived data with confidence and source
+  coordinates. A person confirms consequential values.
+- Support separation, ordering, missing-page, duplicate, malware, and
+  readability review.
+- File the resulting document and submission into the appropriate eAkte;
+  retain or return the physical original according to policy.
+- Produce cover sheets, barcodes, and return instructions through Templates,
+  not a separate print domain.
+
+## Telephone And In-Person Handling
+
+- Show a scripted but adaptable interview from the same Form definition.
+- Record how identity and representation were checked; do not equate caller ID
+  with identity proof.
+- Require explicit confirmation of consequential declarations and capture the
+  method (read-back, signed summary, one-time code, witness, later letter).
+- Record call audio only when a lawful, declared profile permits it; an
+  interaction note is the default.
+- Make interrupted sessions resumable without exposing prior answers to an
+  unauthorized caller or visitor.
+
+## Offline And Mobile Work
+
+Offline packages are encrypted, device-bound, time-limited, purpose-limited,
+and contain only the required forms/reference data. Synchronization uses
+idempotent intents and exposes conflicts rather than last-write-wins. Device
+loss, expiry, revocation, duplicate submission, clock drift, and outcome
+unknown have explicit recovery paths.
+
+## Outbound Non-Digital Delivery
+
+Campaign and Postbox model one delivery intent with channel choices and policy:
+
+- portal/postbox delivery;
+- email;
+- print and postal fulfillment through a managed provider or local handoff;
+- in-person collection;
+- telephone notification followed by durable confirmation;
+- accessible or language-specific variants.
+
+Distribution preferences are purpose- and service-specific, effective-dated,
+and may be overridden only by a documented legal or urgent-delivery rule. A
+fallback occurs only before a channel has accepted the effect unless policy
+explicitly authorizes duplicate delivery. Receipts distinguish creation,
+provider acceptance, dispatch, delivery, return, and acknowledgement.
+
+## Accessibility And Equality
+
+- The person can request language, easy-language, large-print, screen-reader,
+  sign-language, relay, interpreter, or representative support without those
+  preferences becoming a general-purpose profile visible everywhere.
+- Staff interfaces support keyboard-only capture, clear focus, error summary,
+  read-back, and printable/offline alternatives.
+- Channel choice and need for assistance must not be used as an adverse risk
+  signal.
+- Reports compare completion, wait, correction, abandonment, and outcome by
+  channel only under a declared equality/service-quality purpose and with
+  privacy thresholds.
+
+## Security And Abuse Controls
+
+- purpose-aware field access and session timeout;
+- current authority checks for every read and effect;
+- dual control for high-risk identity, payment, address, or representation
+  changes;
+- immutable source/attestation evidence and correction history;
+- rate and anomaly controls that do not silently reject a person;
+- explicit safe handling of domestic-abuse, protected-address, witness, or
+  sealed-record cases;
+- no secret answers or full documents in ordinary operational logs.
+
+## First Reference Journey
+
+Implement the permit-to-payment/service-to-decision journey through three
+equivalent starts:
+
+1. self-service portal submission;
+2. staff-assisted counter/telephone submission;
+3. paper receipt, scan, extraction, confirmation, and filing.
+
+All three must create the same Case and Workflow contract, preserve different
+provenance, support correction, produce a receipt, file an eAkte, reach the same
+decision rules, and prove accessibility, privacy, recovery, and channel
+fallback in browser and operator tests.