Record resident permit browser evidence

docs/architecture/PRODUCT_EXPERIENCE_AND_MODULE_BOUNDARIES.md

@@ -72,6 +72,23 @@ Each WebUI module should be able to announce:
 The contract references surfaces. It does not permit Core or a product package
 to import their implementation.
 
+The first versioned `product_surfaces` slice is now implemented in Core. It
+binds a stable product identity and entry path to one or more owner routes,
+View surfaces, presentations, capabilities, search sources, help contexts and
+documentation topics. It also carries standard unavailable/degraded
+explanations and migration aliases. Mail and Postbox contribute the first
+shared identity, `communication.messages`: `/messages` and the migration alias
+`/inbox` select the first currently authorized, View-visible owner while the
+underlying `/mail` and `/postbox` deep links, custody and permissions remain
+unchanged. Alias resolution emits a bounded client telemetry event before the
+redirect.
+
+Core's `ProductAvailabilityState` is the shared presentation primitive for
+authorization, Policy, configuration, disabled, missing-capability, offline and
+provider-degraded states. Product language is primary; exact module,
+capability, provider and correlation provenance is available only in an
+expandable technical section.
+
 ## Navigation Model
 
 The default shell should prioritize:
@@ -132,9 +149,9 @@ first rail slice.
 
 ### Slice 1: inventory and aliases
 
-- classify every route, navigation item, widget, setting, search object, and
+- continue classifying every route, navigation item, widget, setting, search object, and
   help context by product area and object type;
-- add product aliases without removing existing deep links;
+- extend the implemented product-surface aliases without removing existing deep links;
 - flag raw module IDs in ordinary-user labels and errors.
 
 ### Slice 2: work-first shell

packages/govoplan-meta/pyproject.toml

@@ -4,13 +4,13 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "govoplan"
-version = "0.1.39"
+version = "0.1.41"
 description = "Developer convenience package for a versioned GovOPlaN composition"
 readme = "README.md"
 requires-python = ">=3.12"
 license = { text = "AGPL-3.0-or-later" }
 dependencies = [
-  "govoplan-core[server]==0.1.39",
+  "govoplan-core[server]==0.1.41",
   "govoplan-tenancy==0.1.20",
   "govoplan-organizations==0.1.20",
   "govoplan-identity==0.1.20",
@@ -21,7 +21,7 @@ dependencies = [
   "govoplan-audit==0.1.20",
   "govoplan-dashboard==0.1.20",
   "govoplan-files==0.1.23",
-  "govoplan-mail==0.1.24",
+  "govoplan-mail==0.1.25",
   "govoplan-campaign==0.1.27",
   "govoplan-calendar==0.1.22",
   "govoplan-docs==0.1.22",
@@ -51,7 +51,7 @@ full = [
   "govoplan-facilities==0.1.20",
   "govoplan-fit-connect==0.1.20",
   "govoplan-forms==0.1.22",
-  "govoplan-forms-runtime==0.1.19",
+  "govoplan-forms-runtime==0.1.20",
   "govoplan-grants==0.1.20",
   "govoplan-helpdesk==0.1.21",
   "govoplan-identity-trust==0.1.20",
@@ -64,7 +64,7 @@ full = [
   "govoplan-permits==0.1.20",
   "govoplan-poll==0.1.20",
   "govoplan-portal==0.1.21",
-  "govoplan-postbox==0.1.21",
+  "govoplan-postbox==0.1.22",
   "govoplan-procurement==0.1.20",
   "govoplan-projects==0.1.19",
   "govoplan-quick-access==0.1.20",

packages/product/service-to-decision/README.md

@@ -91,6 +91,12 @@ Form launch, persisted submission provenance, idempotent replay, resumable
 assisted intake with enforced read-back evidence, and a durable Workflow handoff
 that remains visible through Tasks after the database session is reopened and
 disappears only after the Workflow Engine records completion.
+Core's production-component browser conformance suite additionally executes the
+German self-service and assisted Anwohnerparkausweis paths at desktop and mobile
+widths. It proves native keyboard order, accessible names and landmarks, WCAG
+2.1 A/AA automation, responsive geometry, first-draft persistence, and mixed
+per-field person/document/system provenance. Physical screen-reader spot checks
+remain target-environment release evidence.
 Module-level Records source tests prove exact Form submission, Case revision,
 and Decision revision filing. Target-environment browser accessibility,
 production identity and delivery, a named archive profile, and recovery evidence

requirements-release.txt

@@ -11,7 +11,7 @@ govoplan-policy @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-policy.git@v0
 govoplan-audit @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-audit.git@v0.1.20
 govoplan-dashboard @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-dashboard.git@v0.1.20
 govoplan-files @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-files.git@v0.1.23
-govoplan-mail @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-mail.git@v0.1.24
+govoplan-mail @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-mail.git@v0.1.25
 govoplan-campaign @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-campaign.git@v0.1.27
 govoplan-calendar @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-calendar.git@v0.1.22
 govoplan-docs @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-docs.git@v0.1.22

tests/fixtures/resident_parking_permit_journey.json

@@ -85,13 +85,15 @@
       "The configured applicant email issues a short-lived, hash-only status link through Notifications and exposes only the bounded status timeline.",
       "An idempotent replay returns the same persisted submission.",
       "The human review handoff survives a database-session restart and remains visible in Tasks until completion.",
+      "The production self-service and assisted WebUI paths preserve keyboard order, accessible names, WCAG 2.1 A/AA automation, and responsive geometry at desktop and mobile widths.",
+      "The assisted operator can assign independent source, confidence, and governed declaring-party, document, or system references to every populated field before immutable read-back.",
       "The formal decision retains party, mandate, legal-basis, evidence, delivery, review, and exact revision references.",
       "The Case-bound payment handoff creates a replay-safe obligation and accepts a full manual receipt only with exact amount, currency, transaction reference, and immutable evidence.",
       "Forms Runtime, Cases, and Decisions can expose exact snapshots for explicit eAkte filing."
     ],
     "manual_or_target": [
-      "Complete the digital journey with keyboard and screen reader at desktop and mobile widths.",
-      "Complete the assisted operator journey with keyboard and screen reader at desktop and mobile widths.",
+      "Perform physical screen-reader spot checks for the digital journey at desktop and mobile widths.",
+      "Perform physical screen-reader spot checks for the assisted operator journey at desktop and mobile widths.",
       "Open, resend, expire, and revoke the applicant status link with keyboard and screen reader at desktop and mobile widths.",
       "Verify the configured Postbox or external delivery provider, including unknown outcome and reconciliation.",
       "Restore the pinned composition and reconstruct the exact form, case, decision, delivery evidence, and eAkte chronology.",

tests/test_institutional_service_journey.py

@@ -287,7 +287,10 @@ class InstitutionalServiceJourneyTests(unittest.TestCase):
         self.assertEqual("de-DE", JOURNEY["locale"])
         self.assertEqual("email_link", JOURNEY["status_access"]["mode"])
         self.assertEqual("manual", JOURNEY["payment"]["mode"])
-        self.assertEqual(8, len(JOURNEY["acceptance"]["automated"]))
+        automated = JOURNEY["acceptance"]["automated"]
+        self.assertEqual(10, len(automated))
+        self.assertTrue(any("desktop and mobile" in item for item in automated))
+        self.assertTrue(any("independent source" in item for item in automated))
         self.assertEqual(6, len(JOURNEY["acceptance"]["manual_or_target"]))
 
     def test_portal_launches_exact_form_revision_and_persists_submission(self) -> None: