Release v0.1.16

docs/INSTITUTIONAL_GOVERNANCE_TARGET_ARCHITECTURE.md

@@ -9,13 +9,17 @@ concepts prepared outside the repositories:
 - `software_big_picture.md`
 
 The source concepts describe GovOPlaN as an operational governance platform for
-public institutions. This document merges that direction with the implemented
-platform state as of 2026-08-01. It is the canonical repository version of the
-direction. Gitea issues remain the source of truth for delivery state.
+public institutions. This document is the canonical repository version of that
+durable architectural direction. Its implementation table records the accepted
+2026-08-01 baseline; it is not a rolling status report. Current reconciliation
+lives in [Strategy Status](STRATEGY_STATUS.md), and Gitea issues remain the
+source of truth for delivery state.
 
 Read this together with:
 
 - [Connected Governance Platform Roadmap](CONNECTED_GOVERNANCE_PLATFORM_ROADMAP.md)
+- [Platform Core Ideas](PLATFORM_CORE_IDEAS.md)
+- [Strategy Status](STRATEGY_STATUS.md)
 - [Reference Journey Program](REFERENCE_JOURNEY_PROGRAM.md)
 - [Module Contracts and Install Boundaries](MODULE_CONTRACTS_AND_INSTALLS.md)
 - [Datasource and Definition Graph Architecture](DATASOURCE_AND_DEFINITION_GRAPH_ARCHITECTURE.md)
@@ -70,7 +74,12 @@ compositions described here are now implemented. Subsequent work is
 **product depth and stronger maturity evidence**, not another runtime rewrite
 or an unimplemented architecture boundary.
 
-## Implementation status (2026-08-01)
+## Accepted implementation baseline (2026-08-01)
+
+This section is retained as the dated baseline against which the architecture
+decision was accepted. Later implementation must be reconciled in
+`STRATEGY_STATUS.md` rather than editing individual rows here into a competing
+status report.
 
 The architecture contract is implemented as a bounded, executable vertical
 slice. The portfolio declarations and provider governance gates apply to the
@@ -79,7 +88,7 @@ were proven now have independent persistent owners:
 
 | Area | Implemented state | Remaining rollout |
 | --- | --- | --- |
-| Module portfolio metadata | Core validates versioned architecture layer/kind, maturity evidence, known limits, ownership boundaries, authority modes, reference packages, target-tested providers, and migration/upgrade/recovery/security/operations documentation. | Complete for all 62 source manifests. Focused and release checks enforce `--require-architecture`; a new module cannot enter the workspace without truthful declaration and repository-local evidence. |
+| Module portfolio metadata | Core validates versioned architecture layer/kind, maturity evidence, known limits, ownership boundaries, authority modes, reference packages, target-tested providers, and migration/upgrade/recovery/security/operations documentation. | Complete for the source manifests in the 2026-08-01 snapshot. Focused and release checks enforce `--require-architecture`; current portfolio counts belong in `STRATEGY_STATUS.md`. |
 | External providers | Core validates provider objects/field groups, operations, integration maturity, source authority, bounded reads, freshness/health, idempotency, conflicts, outcome-unknown handling, evidence, correction, reconciliation, outage, classification, purpose, retention, and secret handling. Addresses/CardDAV, Files remote storage, Mail SMTP/IMAP, Calendar CalDAV/ICS/Graph/EWS, and Connectors tabular/sanctions providers declare the contract and tenant-bounded secret-free runtime state. | Registry validation rejects any declared external provider without a sanitized state provider. Future adapters must cross the same gate before activation. |
 | Institutional context | Core provides versioned temporal, actor/representation, institution/unit/function/task/mandate/jurisdiction/service/case/party/work-item/workflow/approval/decision/record, legal-basis, evidence, information-governance, external-source, presentation, and geographic references. Events, automation actions, audit records, and the transactional Audit outbox preserve the envelope. | Owning modules must progressively require the relevant subset for consequential operations. |
 | Semantic provider contracts | Provider-neutral DTOs and protocols cover Mandate resolution, versioned Service definitions, procedure Parties/representation, and formal Decisions. `govoplan-mandates`, `govoplan-services`, `govoplan-parties`, and `govoplan-decisions` now persist immutable revisions behind those contracts with tenant isolation, bounded reads, replay safety, OCC, migrations, uninstall guards, permissions, APIs, capability documentation, and recovery documentation. | The owners are deliberately headless. Procedure-specific UI remains with consuming modules. |
@@ -391,7 +400,9 @@ submodule, configuration fragment, package, or profile.
 
 - This reconciliation is canonical in the meta repository and mirrored to the
   Gitea wiki.
-- All 62 source manifests carry validated evidence-based architecture metadata.
+- All source manifests in the accepted 2026-08-01 baseline carried validated
+  evidence-based architecture metadata; current counts belong in
+  `STRATEGY_STATUS.md`.
 - External-reference, action/effect, operational-health, ownership, policy,
   audit, and documentation primitives compose into one enforced provider
   declaration and sanitized runtime-state contract.
@@ -446,7 +457,7 @@ submodule, configuration fragment, package, or profile.
   recovery, accessibility, privacy, security, and operator evidence. This is a
   maturity gate, not missing architecture implementation.
 
-## What remains after the executable architecture slice
+## What remains within the accepted 2026-08-01 architecture slice
 
 The remaining work is not another Core or cross-module architecture rewrite.
 It falls into two explicitly different categories, neither of which can be
@@ -487,12 +498,38 @@ persistence, migrations, recovery/disable semantics, documentation and focused
 tests. Their remaining tickets concern concrete providers, deeper adapters and
 target evidence, not an unresolved institutional architecture boundary.
 
-Everything else described as architecture in this document now has a
+Everything else described in the accepted baseline of this document now has a
 repository owner, versioned contract, bounded implementation, migration and
 recovery boundary where state exists, documentation, and executable evidence.
 Further work in those modules is product breadth, UX depth, provider adoption,
 and evidence renewal.
 
+## Strategic extensions accepted after the baseline
+
+The completed baseline does not imply that institutional product architecture
+can no longer grow. The 2026-08-05 strategic review accepted four extensions
+that consume the existing contracts without reopening the kernel or moving
+domain ownership into Core:
+
+- [Product Experience and Module Boundaries](PRODUCT_EXPERIENCE_AND_MODULE_BOUNDARIES.md)
+  separates technical package topology from stable task/object/product
+  surfaces; implementation is tracked in Core #283.
+- [Federated GovOPlaN Architecture](FEDERATED_GOVOPLAN_ARCHITECTURE.md)
+  defines governed exchange between autonomous installations; implementation
+  is tracked in GovOPlaN #41.
+- [Assisted and Non-Digital Channels](ASSISTED_AND_NON_DIGITAL_CHANNELS.md)
+  makes channel inclusion part of the service-to-decision journey; the first
+  reference proof is tracked in GovOPlaN #42.
+- [Institutional Digital Twin](INSTITUTIONAL_DIGITAL_TWIN.md) defines a
+  time-aware, policy-filtered projection over owner data; implementation is
+  tracked in GovOPlaN #43.
+
+The eAkte depth required by those journeys is owned by Records and specified in
+`govoplan-records/docs/EAKTE_ARCHITECTURE.md`, tracked in Records #1. These are
+new product-depth programs with bounded contracts and acceptance journeys, not
+evidence that the original institutional semantics or module architecture
+failed.
+
 ## Delivery tracking
 
 The completed cross-repository architecture epic is