release: align governed tenant erasure

docs/evidence/snapshots/DSAR_PROVIDER_COVERAGE.generated.md

@@ -6,8 +6,8 @@ Every other active module requires a reviewed explanation of why it owns no
 persistent subject-data store. Adding a migration invalidates that explanation.
 
 - Active modules: 72
-- Registered and documented DSAR providers: 48
-- Reviewed no-store rationales: 24
+- Registered and documented DSAR providers: 49
+- Reviewed no-store rationales: 23
 - Unexplained coverage gaps: 0
 
 | Module | Repository | Persistence | Coverage | Rationale |
@@ -75,7 +75,7 @@ persistent subject-data store. Adding a migration invalidates that explanation.
 | `soap` | `govoplan-soap` | No module migration | Reviewed no-store rationale | Transport-only module: SOAP binds explicitly published operations and owns no domain or subject-data store. |
 | `tasks` | `govoplan-tasks` | Migration-owned | Provider | Provider `privacy.dsar.tasks` is registered and documented. |
 | `templates` | `govoplan-templates` | Migration-owned | Provider | Provider `privacy.dsar.templates` is registered and documented. |
-| `tenancy` | `govoplan-tenancy` | No module migration | Reviewed no-store rationale | Orchestration module: tenant lifecycle and settings use Core-owned storage; Access covers account and membership subject data. |
+| `tenancy` | `govoplan-tenancy` | Migration-owned | Provider | Provider `privacy.dsar.tenancy` is registered and documented. |
 | `tickets` | `govoplan-tickets` | Migration-owned | Provider | Provider `privacy.dsar.tickets` is registered and documented. |
 | `transparency` | `govoplan-transparency` | No module migration | Reviewed no-store rationale | Contract-only module: requests, disclosure reviews, and publications are not persisted; reassess before adding a migration-owned store. |
 | `views` | `govoplan-views` | Migration-owned | Provider | Provider `privacy.dsar.views` is registered and documented. |

packages/govoplan-meta/pyproject.toml

@@ -4,18 +4,18 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "govoplan"
-version = "0.1.42"
+version = "0.1.43"
 description = "Developer convenience package for a versioned GovOPlaN composition"
 readme = "README.md"
 requires-python = ">=3.12"
 license = { text = "AGPL-3.0-or-later" }
 dependencies = [
-  "govoplan-core[server]==0.1.42",
-  "govoplan-tenancy==0.1.20",
+  "govoplan-core[server]==0.1.43",
+  "govoplan-tenancy==0.1.21",
   "govoplan-organizations==0.1.20",
   "govoplan-identity==0.1.20",
   "govoplan-idm==0.1.24",
-  "govoplan-access==0.1.23",
+  "govoplan-access==0.1.24",
   "govoplan-admin==0.1.22",
   "govoplan-policy==0.1.22",
   "govoplan-audit==0.1.20",

requirements-release.txt

@@ -1,11 +1,11 @@
 # Whole-product release install from immutable, independently versioned module tags.
 # Only add a module after its referenced tag has been published.
 ../govoplan-core[server]
-govoplan-tenancy @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-tenancy.git@v0.1.20
+govoplan-tenancy @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-tenancy.git@v0.1.21
 govoplan-organizations @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-organizations.git@v0.1.20
 govoplan-identity @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-identity.git@v0.1.20
 govoplan-idm @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-idm.git@v0.1.24
-govoplan-access @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-access.git@v0.1.23
+govoplan-access @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-access.git@v0.1.24
 govoplan-admin @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-admin.git@v0.1.22
 govoplan-policy @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-policy.git@v0.1.22
 govoplan-audit @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-audit.git@v0.1.20

tools/checks/dsar-coverage-exemptions.json

@@ -19,7 +19,6 @@
   "resources": "Contract-only module: resource catalog and allocation persistence are not implemented; reassess before adding a migration-owned store.",
   "rest": "Transport-only module: REST binds explicitly published functions and owns no domain or subject-data store.",
   "soap": "Transport-only module: SOAP binds explicitly published operations and owns no domain or subject-data store.",
-  "tenancy": "Orchestration module: tenant lifecycle and settings use Core-owned storage; Access covers account and membership subject data.",
   "transparency": "Contract-only module: requests, disclosure reviews, and publications are not persisted; reassess before adding a migration-owned store.",
   "workflow": "Presentation-only module: Workflow edits and projects Workflow Engine state; Workflow Engine owns persistence and DSAR coverage.",
   "xrechnung": "Stateless validation-contract module: XRechnung persists no invoice, report, diagnostic, or handoff; the invoking Files, Procurement, or Payments workflow remains the subject-data owner. Reassess before adding a validation store."

tools/inventory/endpoint-surface-declarations.json

@@ -2007,6 +2007,20 @@
       "rationale": "Published integration, interoperability, public-participant, or health endpoint.",
       "repository": "govoplan-soap"
     },
+    {
+      "category": "intentionally_headless",
+      "method": "GET",
+      "path": "/admin/tenant-erasure-policy",
+      "rationale": "Tenant-erasure policy is a consequential operator API with recent-authentication and dedicated-permission gates.",
+      "repository": "govoplan-tenancy"
+    },
+    {
+      "category": "intentionally_headless",
+      "method": "PATCH",
+      "path": "/admin/tenant-erasure-policy",
+      "rationale": "Tenant-erasure policy is a consequential operator API with recent-authentication and dedicated-permission gates.",
+      "repository": "govoplan-tenancy"
+    },
     {
       "category": "intentionally_headless",
       "method": "GET",
@@ -2014,6 +2028,48 @@
       "rationale": "Tenant deletion preflight is an administrative safety API consumed before a destructive workflow.",
       "repository": "govoplan-tenancy"
     },
+    {
+      "category": "intentionally_headless",
+      "method": "POST",
+      "path": "/admin/tenants/{}/erasure-operations",
+      "rationale": "Tenant erasure is an audited, provider-driven operator workflow whose API exposes the complete review and recovery evidence.",
+      "repository": "govoplan-tenancy"
+    },
+    {
+      "category": "intentionally_headless",
+      "method": "GET",
+      "path": "/admin/tenants/{}/erasure-operations/{}",
+      "rationale": "Tenant erasure is an audited, provider-driven operator workflow whose API exposes the complete review and recovery evidence.",
+      "repository": "govoplan-tenancy"
+    },
+    {
+      "category": "intentionally_headless",
+      "method": "POST",
+      "path": "/admin/tenants/{}/erasure-operations/{}/approve",
+      "rationale": "Tenant-erasure approval requires typed confirmation, recent authentication, and a distinct authorized account.",
+      "repository": "govoplan-tenancy"
+    },
+    {
+      "category": "intentionally_headless",
+      "method": "POST",
+      "path": "/admin/tenants/{}/erasure-operations/{}/cancel",
+      "rationale": "Tenant-erasure cancellation is a recovery control available only before destructive work starts.",
+      "repository": "govoplan-tenancy"
+    },
+    {
+      "category": "intentionally_headless",
+      "method": "POST",
+      "path": "/admin/tenants/{}/erasure-operations/{}/execute",
+      "rationale": "Tenant-erasure execution is a consequential operator API with provider checkpoints and fail-closed reconciliation.",
+      "repository": "govoplan-tenancy"
+    },
+    {
+      "category": "intentionally_headless",
+      "method": "POST",
+      "path": "/admin/tenants/{}/erasure-operations/{}/reconcile",
+      "rationale": "Tenant-erasure reconciliation resumes idempotent provider steps after pending or outcome-unknown effects.",
+      "repository": "govoplan-tenancy"
+    },
     {
       "category": "compatibility",
       "method": "POST",