chore(release): compose integration foundations

docs/evidence/snapshots/DSAR_PROVIDER_COVERAGE.generated.md

@@ -5,9 +5,9 @@ A migration-owning module must register and document its canonical DSAR provider
 Every other active module requires a reviewed explanation of why it owns no
 persistent subject-data store. Adding a migration invalidates that explanation.
 
-- Active modules: 68
+- Active modules: 70
 - Registered and documented DSAR providers: 48
-- Reviewed no-store rationales: 20
+- Reviewed no-store rationales: 22
 - Unexplained coverage gaps: 0
 
 | Module | Repository | Persistence | Coverage | Rationale |
@@ -32,6 +32,7 @@ persistent subject-data store. Adding a migration invalidates that explanation.
 | `datasources` | `govoplan-datasources` | Migration-owned | Provider | Provider `privacy.dsar.datasources` is registered and documented. |
 | `decisions` | `govoplan-decisions` | Migration-owned | Provider | Provider `privacy.dsar.decisions` is registered and documented. |
 | `dist_lists` | `govoplan-dist-lists` | Migration-owned | Provider | Provider `privacy.dsar.dist_lists` is registered and documented. |
+| `dms` | `govoplan-dms` | No module migration | Reviewed no-store rationale | Stateless integration-preview module: DMS retains no document, person, credential, or provider-response store; Files and Records remain the subject-data owners. Reassess before persisting a target binding, plan, receipt, or diagnostic. |
 | `docs` | `govoplan-docs` | Migration-owned | Provider | Provider `privacy.dsar.docs` is registered and documented. |
 | `encryption` | `govoplan-encryption` | Migration-owned | Provider | Provider `privacy.dsar.encryption` is registered and documented. |
 | `evaluation` | `govoplan-evaluation` | No module migration | Reviewed no-store rationale | Contract-only module: evaluation runs, responses, and scores are not persisted; reassess before adding a migration-owned store. |
@@ -80,6 +81,7 @@ persistent subject-data store. Adding a migration invalidates that explanation.
 | `wiki` | `govoplan-wiki` | Migration-owned | Provider | Provider `privacy.dsar.wiki` is registered and documented. |
 | `workflow` | `govoplan-workflow` | No module migration | Reviewed no-store rationale | Presentation-only module: Workflow edits and projects Workflow Engine state; Workflow Engine owns persistence and DSAR coverage. |
 | `workflow_engine` | `govoplan-workflow-engine` | Migration-owned | Provider | Provider `privacy.dsar.workflow_engine` is registered and documented. |
+| `xrechnung` | `govoplan-xrechnung` | No module migration | Reviewed no-store rationale | Stateless validation-contract module: XRechnung persists no invoice, report, diagnostic, or handoff; the invoking Files, Procurement, or Payments workflow remains the subject-data owner. Reassess before adding a validation store. |
 
 Provider search, export minimization, retention, and erasure behavior remains
 documented and tested by each owning module. This matrix verifies adoption and

packages/govoplan-meta/pyproject.toml

@@ -14,7 +14,7 @@ dependencies = [
   "govoplan-tenancy==0.1.18",
   "govoplan-organizations==0.1.18",
   "govoplan-identity==0.1.18",
-  "govoplan-idm==0.1.20",
+  "govoplan-idm==0.1.21",
   "govoplan-access==0.1.20",
   "govoplan-admin==0.1.19",
   "govoplan-policy==0.1.20",
@@ -44,6 +44,7 @@ full = [
   "govoplan-datasources==0.1.21",
   "govoplan-decisions==0.1.19",
   "govoplan-dist-lists==0.1.18",
+  "govoplan-dms==0.1.19",
   "govoplan-encryption==0.1.18",
   "govoplan-evaluation==0.1.19",
   "govoplan-facilities==0.1.19",
@@ -83,6 +84,7 @@ full = [
   "govoplan-wiki==0.1.20",
   "govoplan-workflow==0.1.21",
   "govoplan-workflow-engine==0.1.19",
+  "govoplan-xrechnung==0.1.19",
 ]
 
 [project.urls]

requirements-release.txt

@@ -4,7 +4,7 @@
 govoplan-tenancy @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-tenancy.git@v0.1.18
 govoplan-organizations @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-organizations.git@v0.1.18
 govoplan-identity @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-identity.git@v0.1.18
-govoplan-idm @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-idm.git@v0.1.20
+govoplan-idm @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-idm.git@v0.1.21
 govoplan-access @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-access.git@v0.1.20
 govoplan-admin @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-admin.git@v0.1.19
 govoplan-policy @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-policy.git@v0.1.20

tests/test_package_set_dispatch.py

@@ -22,11 +22,14 @@ class PackageSetDispatchTests(unittest.TestCase):
     def test_meta_package_resolves_to_exact_tagged_repository_targets(self) -> None:
         targets = MODULE.package_targets()
 
-        self.assertEqual(66, len(targets))
-        self.assertEqual(66, len({target.distribution for target in targets}))
+        self.assertEqual(71, len(targets))
+        self.assertEqual(71, len({target.distribution for target in targets}))
         by_name = {target.distribution: target for target in targets}
-        self.assertEqual("v0.1.14", by_name["govoplan-core"].tag)
-        self.assertEqual("v0.1.8", by_name["govoplan-access"].tag)
+        self.assertEqual("v0.1.37", by_name["govoplan-core"].tag)
+        self.assertEqual("v0.1.20", by_name["govoplan-access"].tag)
+        self.assertEqual("v0.1.19", by_name["govoplan-dms"].tag)
+        self.assertEqual("v0.1.21", by_name["govoplan-idm"].tag)
+        self.assertEqual("v0.1.19", by_name["govoplan-xrechnung"].tag)
         self.assertTrue(by_name["govoplan-core"].tag_exists)
         self.assertTrue(by_name["govoplan-access"].has_webui)
         self.assertEqual(

tools/checks/dsar-coverage-exemptions.json

@@ -4,6 +4,7 @@
   "certificates": "Contract-only module: certificate issuance and revocation persistence are not implemented; reassess before adding a migration-owned store.",
   "consultation": "Contract-only module: consultation submissions and evaluation persistence are not implemented; reassess before adding a migration-owned store.",
   "contracts": "Contract-only module: contract, amendment, and obligation persistence are not implemented; reassess before adding a migration-owned store.",
+  "dms": "Stateless integration-preview module: DMS retains no document, person, credential, or provider-response store; Files and Records remain the subject-data owners. Reassess before persisting a target binding, plan, receipt, or diagnostic.",
   "evaluation": "Contract-only module: evaluation runs, responses, and scores are not persisted; reassess before adding a migration-owned store.",
   "facilities": "Contract-only module: facility and maintenance persistence are not implemented; reassess before adding a migration-owned store.",
   "grants": "Contract-only module: grant applications, awards, and monitoring are not persisted; reassess before adding a migration-owned store.",
@@ -18,5 +19,6 @@
   "soap": "Transport-only module: SOAP binds explicitly published operations and owns no domain or subject-data store.",
   "tenancy": "Orchestration module: tenant lifecycle and settings use Core-owned storage; Access covers account and membership subject data.",
   "transparency": "Contract-only module: requests, disclosure reviews, and publications are not persisted; reassess before adding a migration-owned store.",
-  "workflow": "Presentation-only module: Workflow edits and projects Workflow Engine state; Workflow Engine owns persistence and DSAR coverage."
+  "workflow": "Presentation-only module: Workflow edits and projects Workflow Engine state; Workflow Engine owns persistence and DSAR coverage.",
+  "xrechnung": "Stateless validation-contract module: XRechnung persists no invoice, report, diagnostic, or handoff; the invoking Files, Procurement, or Payments workflow remains the subject-data owner. Reassess before adding a validation store."
 }