Prove reference journey compositions

packages/product/governed-data-assurance/README.md

@@ -12,7 +12,7 @@ review.
 1. Register a typed datasource with source authority, purpose, classification,
    owner, freshness, and correction policy.
 2. Acquire or upload an immutable source state.
-3. execute a versioned flow and retain intermediate materializations and
+3. Execute a versioned flow and retain intermediate materializations and
    provenance;
 4. publish a report or decision input against exact source and flow revisions;
 5. link obligation, governed object, risk, control, evidence, finding,
@@ -39,3 +39,24 @@ The artifact remains a `product` package. Promotion to `reference` requires:
 
 Optional Connectors, Files, Notifications, and Workflow Engine integrations
 must remain capability-based and absence-safe.
+
+## Executable evidence
+
+- `tools/checks/check-datasource-composition.py` composes Connector snapshots,
+  governed Datasources, queued Dataflow execution, frozen publication,
+  idempotent replay, and recovery evidence.
+- `govoplan-dataflow/fixtures/golden/monthly-reconciliation` pins synthetic
+  monthly inputs, stable reconciliation hashes, reviewed decisions, expected
+  output, source fingerprints, and output hashes.
+- `tools/checks/check-sanctions-screening-composition.py` composes an immutable
+  Connector acquisition, idempotent Risk Compliance import and screening,
+  independent disposition, a cleared gate, changed-source invalidation, and
+  the rescreening queue through the registered versioned capabilities.
+- `govoplan-dataflow/fixtures/golden/sanctions-screening` independently proves
+  the deterministic normalization and matching graph with exact expected
+  output.
+
+These checks use synthetic data and run without network access. They prove the
+module contracts and durable state transitions; they do not replace the
+deployment, security, privacy, accessibility, and operator evidence still
+listed above.

packages/product/governed-data-assurance/package.json

@@ -28,7 +28,17 @@
       "kind": "documentation",
       "reference": "packages/product/governed-data-assurance/README.md",
       "summary": "Defines the package boundary, provenance chain, and reference-readiness gates."
+    },
+    {
+      "kind": "target_test",
+      "reference": "tools/checks/check-datasource-composition.py",
+      "summary": "Proves governed Connector acquisition, Datasource registration, queued Dataflow execution, frozen publication, idempotency, and recovery evidence."
+    },
+    {
+      "kind": "target_test",
+      "reference": "tools/checks/check-sanctions-screening-composition.py",
+      "summary": "Proves immutable sanctions acquisition, import, screening replay, independent review, freshness gates, and rescreening across module capabilities."
     }
   ],
-  "tags": ["datasources", "dataflow", "reporting", "assurance"]
+  "tags": ["datasources", "dataflow", "reporting", "sanctions", "assurance"]
 }

packages/product/service-to-decision/README.md

@@ -24,19 +24,31 @@ grant cross-module table access and can omit optional presentation, work,
 deliberation, delivery, or records modules while retaining explicit references
 to externally performed steps.
 
+When Records is present, Forms Runtime, Cases, and Decisions expose exact,
+digest-bound source snapshots for explicit filing. The source module rechecks
+current access, Records chooses the destination and preserves chronology, and
+the filed reference never becomes an editable copy. When Search is present,
+the same three owners contribute rebuildable metadata-only projections. Form
+values, evidence payloads, Decision reasoning, operative results, and
+conditions are excluded; every candidate is authorized again before it is
+shown.
+
 ## Security And Recovery
 
 Every provider is tenant-bound. Missing or conflicting authority fails closed.
 Protected Decision content has a separate permission. Writes are replay-safe
 and OCC-guarded. Database restore is the semantic-state recovery unit; file and
 communication effects remain governed by their owning providers and are linked
-through requested/observed effect, evidence, and audit references.
+through requested/observed effect, evidence, and audit references. Search is a
+derived recovery unit and can be rebuilt from authoritative module state.
 
 The executable fixture in
 `tests/test_institutional_governance_journey.py` proves SQL-backed Service,
 Case, Party, Mandate, Committee meeting/agendum/vote/minute, and Decision state.
 `tests/test_institutional_service_journey.py` separately proves exact Portal
 Form launch, persisted submission provenance, and idempotent replay.
-Target-environment accessibility, security, operator, privacy,
-delivery-provider, and recovery evidence are still required before this product
-package may claim `reference_ready` maturity.
+Module-level Records source tests prove exact Form submission, Case revision,
+and Decision revision filing. Target-environment browser accessibility,
+resumable work guidance, production identity and delivery, a named archive
+profile, and recovery evidence are still required before this product package
+may claim `reference_ready` maturity.

packages/product/service-to-decision/package.json

@@ -35,6 +35,7 @@
     {"module_id": "forms_runtime"},
     {"module_id": "postbox"},
     {"module_id": "records"},
+    {"module_id": "search"},
     {"module_id": "tasks"},
     {"module_id": "workflow_engine"}
   ],