diff --git a/docs/CONNECTED_GOVERNANCE_PLATFORM_ROADMAP.md b/docs/CONNECTED_GOVERNANCE_PLATFORM_ROADMAP.md index ea65474..6d9fdcc 100644 --- a/docs/CONNECTED_GOVERNANCE_PLATFORM_ROADMAP.md +++ b/docs/CONNECTED_GOVERNANCE_PLATFORM_ROADMAP.md @@ -870,11 +870,17 @@ can be tested. acting context through their owned contracts. 3. Postbox accepts one durable message and attachment references and returns a delivery receipt; Campaign or another sender retains only typed references. -4. An authorized function holder or delegate discovers and handles the message. -5. Vacancy, ambiguity, expiry, or unavailable dependencies create visible safe - states rather than an implicit personal fallback. -6. Reassignment changes future access without moving or rewriting the message; - delivery, access, and correction evidence remains connected. +4. The Postbox remains addressable with zero, one, or several incumbents. During + vacancy it retains the delivery and visibly waits for a holder rather than + falling back to a personal account. +5. An authorized function holder or time-bounded delegate receives a + device-bound grant for the policy-selected key epochs and handles the + message in an explicit represented-function context. +6. Hand-over, revocation, or delegation expiry rotates/withdraws future key + access without claiming to erase plaintext already obtained. Content is + corrected or superseded by a linked version, never silently substituted. +7. Delivery, vacancy, assignment, key access, delegation, action, and correction + evidence remains connected and distinguishes multiple incumbents. ### Story J: from specialist-system context to reproducible document @@ -892,17 +898,25 @@ can be tested. ### Story K: from operational sources to trusted institutional indicator -1. A governed catalog declares source owner, purpose, classification, schema, - extraction mode, reporting-date semantics, freshness, and credentials. +1. A governed catalog declares read-only HIS and CampusOnline source owners, + purpose, classification, schema, extraction mode, freshness, and credentials + for the internal student-statistics subject area. 2. An ingestion run stages a snapshot or watermark and records schema drift, validation findings, quarantine, and replay evidence. -3. Versioned transformations map official keys, organizational hierarchies, - time dimensions, and measures into a documented analytical data product. -4. Reporting serves policy-aware aggregates and permitted drill-down with the - calculation and lineage visible. -5. Scheduled outputs, APIs, templates, or open-data handoffs use the same +3. The product records reference date separately from extraction, acceptance, + and freeze dates: for example, a `1 September` state accepted on + `12 December` becomes the pinned semester snapshot. Corrections supersede it + visibly rather than rewriting it. +4. In a graphical typed data-flow editor, versioned source, validation, mapping, + transformation, aggregation, and data-product nodes map official keys, + organizational hierarchies, time dimensions, and measures. The graph is + acyclic, previewable, testable, and carries lineage and pinned versions. +5. Reporting serves the internal student-statistics product with policy-aware + aggregates and permitted drill-down. A list report can become a governed + source for a downstream template-backed publishable report. +6. Scheduled outputs, APIs, templates, or open-data handoffs use the same product version rather than reimplementing the calculation. -6. Package promotion reproduces the accepted report in development, test, and +7. Package promotion reproduces the accepted reports in development, test, and production; corrections create new evidence rather than rewriting history. ### Story L: from generated artifact to approved collaborative record @@ -1216,16 +1230,19 @@ user-story implementation remains paused. examples as the first pinned reference product. 2. **Function-bound Postbox.** Implement Postbox and the Organizations–Identity–IDM–Access responsibility path; add Campaign delivery - to a function in an organizational unit and prove reassignment, delegation, - vacancy, retention, and audit behavior. + to a function in an organizational unit and prove vacancy, multiple + incumbents, reassignment, time-bounded delegation, key-epoch access, + retention, and audit behavior without personal ownership fallback. 3. **Templates, Reports, and deep launch.** Build one data-backed document and one report through curated source contracts; open the task safely from a mock and then target HIS-style producer; preserve reproducible input, definition, output, and return-reference evidence. -4. **Governed university BI path.** Starting from that concrete source, add one - scheduled staging, quality, transformation, semantic-product, lineage, and - policy-aware reporting path. Package it for repeatable promotion between - development, test, and production before generalizing dataflow. +4. **Governed university BI path.** Start with read-only HIS/CampusOnline data + and an internal student-statistics product. Add scheduled staging, explicit + reference/freeze states, quality, a graphical typed transformation and + aggregation flow, semantic-product lineage, list-report chaining, and a + template-backed publishable report. Package it for repeatable promotion + before generalizing dataflow. 5. **Collaborative document lifecycle.** Add DMS versions, review/approval, provider-neutral editing sessions, one collaborative editor, conflict and recovery behavior, and Records handoff over Files-backed content. @@ -1252,15 +1269,16 @@ them; they do not block the product vision today. system, and which conflict/failure behavior is acceptable? - Which default participant privacy profiles should ship for scheduling, consultation, committee, and public participation? -- What assurance, signature, federation, and E2EE levels are required for the - first trusted postbox deployment? -- Which external IDM source and conflict, disable, delegation, and vacancy - policy should prove delivery to organizational responsibility? +- Which history window, device assurance, organizational recovery/quorum, + rotation strength, signature, and federation profile is required for the + first trusted E2EE Postbox deployment? +- Which external IDM source and conflict/disable policy should prove function + assignment and time-bounded delegation for organizational responsibility? - Which HIS or other specialist system should be the first deep-launch producer, and which callback/reference behavior can it support? -- Which bounded university dataset, reporting date semantics, official keys, - accepted calculation, privacy profile, and drill-down level should define the - first analytical data product? +- Which exact HIS/CampusOnline interfaces, student-statistics fields and + official keys, accepted calculation, freeze/correction policy, privacy + profile, and drill-down level should define the first analytical data product? - After the first source-to-report proof, do repeated source/dataflow contracts justify separate `govoplan-datasources` and `govoplan-dataflow` modules? - Which collaborative editor should be the first target, and should its first diff --git a/docs/REFERENCE_JOURNEY_PROGRAM.md b/docs/REFERENCE_JOURNEY_PROGRAM.md index b3bb086..ebf9730 100644 --- a/docs/REFERENCE_JOURNEY_PROGRAM.md +++ b/docs/REFERENCE_JOURNEY_PROGRAM.md @@ -183,6 +183,15 @@ repeatable. - Campaign consumes a generic delivery-target capability. It may target an email recipient or a function-bound Postbox without importing either module's internals. +- A Postbox exists independently of its current holders. Vacancy, one + incumbent, several incumbents, and time-bounded delegation are valid states; + none turns the Postbox into a personal account. +- The E2EE target uses per-content keys and function/postbox key epochs. + Assignment grants device-bound access to policy-selected history, while + hand-over, revocation, and delegation expiry rotate or withdraw future key + access without claiming to erase plaintext already obtained. +- Content and signed manifests are immutable. Correction or replacement is a + linked new object/version, never silent substitution. ### Implementation slices @@ -195,18 +204,23 @@ repeatable. 3. Complete the Organizations–Identity–IDM–Access function-assignment and delegation path, including provenance and compatibility migration from legacy projections. -4. Add Campaign delivery to a function-bound Postbox, file attachment +4. Define the E2EE key-grant/epoch profile for vacancy, multiple incumbents, + hand-over, history access, time-bounded delegation, recovery, and audit. +5. Add Campaign delivery to a function-bound Postbox, file attachment references, optional external-mail bridge, and notification attention signals through capabilities. -5. Document reassignment, delegation, vacancy, expired assignment, unavailable +6. Document reassignment, delegation, vacancy, expired assignment, unavailable optional module, retention, and future E2EE limitations honestly. ### Gate A campaign message can be delivered once to a function-bound Postbox; an authorized holder can act in an explicit context; a reassignment changes future -access without moving or rewriting the message; vacancy and ambiguous context -fail visibly; delivery, access, and later corrections remain auditable. +access without moving or rewriting the message. A vacant Postbox remains +addressable, retains the delivery, and visibly reports that no holder can +decrypt or act until assignment; multiple incumbents and delegates receive +independent key/access evidence. Delivery, key access, and later corrections +remain auditable. ## Stage 3: Templates, reports, data sources, and deep launches @@ -314,26 +328,51 @@ evidence, policy, and correction across independently installable modules. cost/resource limits, retention, backup/restore, promotion between systems, and reproducible release recipes. +### Selected first subject-area direction + +- Start with read-only HIS and CampusOnline source profiles and produce the + institution's internal student-statistics data product plus reports derived + from it. +- Model reference/effective date separately from extraction, validation, and + freeze dates. For example, a semester state may describe `1 September`, be + accepted and frozen on `12 December`, and remain the reproducible source for + that semester's official statistics. Later corrections create a superseding + version; they never rewrite the frozen state silently. +- Make a graphical, typed data-flow editor the primary analyst surface. Nodes + represent governed sources/snapshots, validation, mapping, transformation, + aggregation, a list report/data product, template rendering, and publication. + The graph is versioned, testable, previewable, acyclic, and shows schema, + lineage, quality findings, policy, and pinned upstream versions. +- A list report may become a governed source for another flow. This enables + `source + transformations/aggregation -> list report/data product -> template + -> publishable report` without copying the calculation or losing lineage. + ### Implementation slices -1. Select one bounded, read-only university dataset and one decision-relevant - report; define its legal/policy basis, source owner, official keys, time - semantics, and acceptance calculation. +1. Bound the first HIS/CampusOnline student-statistics dataset and internal + report; define its legal/policy basis, source owners, official keys, + reference/freeze semantics, privacy level, and acceptance calculation. 2. Generalize the Stage 3 source profile into catalog, ingestion-run, staged dataset, validation, transformation, lineage, and data-product contracts. -3. Implement one scheduled incremental load with quarantine/replay and a fully - transparent transformation into an aggregate product. -4. Serve the product through Reporting with policy-aware aggregate and +3. Implement one scheduled load and explicit frozen-state lifecycle with + quarantine/replay and a fully transparent transformation into the internal + student-statistics product. +4. Implement the first graphical typed flow editor over those proven nodes, + including version/diff, validation, preview, cycle prevention, and pinned + upstream product versions. +5. Serve the product through Reporting with policy-aware aggregate and drill-down behavior; export reproducible evidence and calculation metadata. -5. Package mappings, transformations, validations, reports, documentation, and +6. Chain one list report as a source into a template-backed publishable report. +7. Package mappings, transformations, validations, reports, documentation, and tests so they can be promoted from development to test to production. ### Gate -One university data product can be rebuilt from a declared source snapshot or -watermark, passes explicit quality tests, explains every measure and mapping, -enforces disclosure policy, survives schema/freshness failures visibly, and -produces the same accepted report across promoted environments. +One internal student-statistics product can be rebuilt from declared HIS and/or +CampusOnline snapshots, preserves its reference and freeze dates, passes +explicit quality tests, explains every measure and mapping, enforces disclosure +policy, survives schema/freshness failures visibly, and produces the same +accepted list and template-backed report across promoted environments. ## Stage 5: Collaborative document editing @@ -400,9 +439,11 @@ that first needs them: - first target SMTP/IMAP, file/directory, identity, and deployment profile; - first external IDM source and identity conflict/disable policy; -- first trusted Postbox assurance/E2EE profile and external-mail bridge; +- first trusted Postbox assurance/recovery/history-access profile and + external-mail bridge; - first HIS or other launch producer and callback/reference contract; -- first university dataset, report, reporting date semantics, and permitted +- exact HIS/CampusOnline source endpoints, student-statistics keys and accepted + calculation, freeze/correction policy, privacy profile, and permitted drill-down level; - whether repeated data-source and dataflow contracts justify separate `govoplan-datasources` and `govoplan-dataflow` modules after the Stage 3 proof;