feat: implement institutional governance and recovery architecture

2026-08-01 17:46:53 +02:00
parent 3c658fa32d
commit d78b13f9d3
45 changed files with 4388 additions and 262 deletions
@@ -0,0 +1,41 @@
+# Governed Data and Assurance Product Package
+
+This package composes Datasources, Dataflow, Reporting, Search, Risk
+Compliance, Policy, Audit, and Access. Connectors may acquire external data,
+but Datasources owns the governed catalogue and immutable snapshots; Dataflow
+owns transformation definitions and runs; Reporting owns measures and
+presentation; Risk Compliance owns controls, findings, and effectiveness
+review.
+
+## Reference journey
+
+1. Register a typed datasource with source authority, purpose, classification,
+   owner, freshness, and correction policy.
+2. Acquire or upload an immutable source state.
+3. execute a versioned flow and retain intermediate materializations and
+   provenance;
+4. publish a report or decision input against exact source and flow revisions;
+5. link obligation, governed object, risk, control, evidence, finding,
+   corrective measure, and effectiveness review; and
+6. search current authorized objects while preserving ownership and access
+   rechecks.
+
+## Reference-readiness gates
+
+The artifact remains a `product` package. Promotion to `reference` requires:
+
+- a target-tested monthly-data and sanctions-screening fixture with expected
+  outputs and complete provenance;
+- database/object-storage backup and restore plus interrupted-run recovery;
+- security evidence for datasource credentials, staged data, intermediate
+  states, search documents, and assurance references;
+- operator runbooks for stale sources, failed runs, index rebuilds, and graph
+  reconciliation;
+- accessibility evidence for the catalogue, graph editors, result inspection,
+  reports, and assurance graph;
+- privacy evidence for minimization, purpose, retention, field visibility, and
+  aggregate disclosure; and
+- version-pinned user and administrator documentation.
+
+Optional Connectors, Files, Notifications, and Workflow Engine integrations
+must remain capability-based and absence-safe.
@@ -0,0 +1,34 @@
+{
+  "package_id": "product.governed-data-assurance",
+  "name": "Governed Data and Assurance",
+  "version": "0.1.0",
+  "package_class": "product",
+  "description": "Compose governed sources, transformations, reports, search, controls and assurance evidence through stable contracts.",
+  "publisher": "GovOPlaN",
+  "category": "data-governance",
+  "license": "AGPL-3.0-or-later",
+  "required_modules": [
+    {"module_id": "access"},
+    {"module_id": "audit"},
+    {"module_id": "dataflow"},
+    {"module_id": "datasources"},
+    {"module_id": "policy"},
+    {"module_id": "reporting"},
+    {"module_id": "risk_compliance"},
+    {"module_id": "search"}
+  ],
+  "optional_modules": [
+    {"module_id": "connectors"},
+    {"module_id": "files"},
+    {"module_id": "notifications"},
+    {"module_id": "workflow_engine"}
+  ],
+  "evidence": [
+    {
+      "kind": "documentation",
+      "reference": "packages/product/governed-data-assurance/README.md",
+      "summary": "Defines the package boundary, provenance chain, and reference-readiness gates."
+    }
+  ],
+  "tags": ["datasources", "dataflow", "reporting", "assurance"]
+}