release: publish stable product destinations

docs/architecture/PRODUCT_EXPERIENCE_AND_MODULE_BOUNDARIES.md

@@ -72,7 +72,7 @@ Each WebUI module should be able to announce:
 The contract references surfaces. It does not permit Core or a product package
 to import their implementation.
 
-The first versioned `product_surfaces` slice is now implemented in Core. It
+The versioned `product_surfaces` slice is implemented in Core. It
 binds a stable product identity and entry path to one or more owner routes,
 View surfaces, presentations, capabilities, search sources, help contexts and
 documentation topics. It also carries standard unavailable/degraded
@@ -80,8 +80,22 @@ explanations and migration aliases. Mail and Postbox contribute the first
 shared identity, `communication.messages`: `/messages` and the migration alias
 `/inbox` select the first currently authorized, View-visible owner while the
 underlying `/mail` and `/postbox` deep links, custody and permissions remain
-unchanged. Alias resolution emits a bounded client telemetry event before the
-redirect.
+unchanged. Tasks, Calendar and Files contribute the corresponding single-owner
+identities:
+
+| Product identity | Stable destination | Compatible owner route |
+| --- | --- | --- |
+| Work | `/work` | `/tasks` |
+| Calendar | `/agenda` | `/calendar` |
+| Messages | `/messages` (`/inbox` alias) | `/mail`, `/postbox` |
+| Files | `/documents` | `/files` |
+
+Core replaces those owner entries in the ordinary rail with the stable product
+destinations. A collapsed **All available tools** catalogue retains every
+authorized technical owner route independently of View focus; unauthorized
+entries are never disclosed. The original deep links remain valid, and all
+contributing owner paths keep the corresponding product entry active. Alias
+resolution emits a bounded client telemetry event before the redirect.
 
 Core's `ProductAvailabilityState` is the shared presentation primitive for
 authorization, Policy, configuration, disabled, missing-capability, offline and
@@ -105,10 +119,11 @@ People and Responsibility. They are configurable system/tenant defaults and
 Views projections, not hard-coded repository groups. Empty areas disappear;
 single-destination areas may link directly; familiar tools may remain pinned.
 
-The complete permission-derived module rail remains available as **All
-available tools**. Its ability to scroll is useful and is not itself the
-product defect. The defect is requiring people to infer a task or outcome from
-repository topology.
+The complete permission-derived module rail is available as the collapsed
+**All available tools** escape. It is deliberately independent of the active
+View while still enforcing authorization. Its ability to scroll is useful and
+is not itself the product defect. The defect is requiring people to infer a
+task or outcome from repository topology.
 
 Task-local Work, Calendar, Messages and Files tools may be contributed to the
 optional `govoplan-quick-access` rail. Messages composes Mail, Postbox and
@@ -125,6 +140,12 @@ sections, commands, widgets, and fields. A view must not grant a permission or
 change data semantics. Policy can force, allow, or prohibit a surface at system,
 tenant, group, or user scope.
 
+Core browser conformance exercises the German Anwohnerparkausweis reference
+context with Work, Calendar, Messages and Files entries, verifies that package
+owner labels are absent from the primary rail, expands the technical catalogue,
+and runs WCAG 2 A/AA checks over the result. Unit permutations cover two-owner,
+one-owner, unauthorized-owner and focused-View compositions.
+
 ## Error And Provenance Language
 
 Normal errors answer:

docs/architecture/QUICK_ACCESS_AND_PRODUCT_AREAS.md

@@ -39,16 +39,24 @@ The first production-shaped slice is implemented:
   order and optional labels. Scoped Views therefore configure product
   presentation for system, tenant, group, user and Workflow contexts;
 - the expanded left rail groups classified destinations while retaining
-  Dashboard and every authorized unclassified destination under More tools.
+  Dashboard and every authorized unclassified destination under More tools;
+- Core promotes Work (`/work`), Calendar (`/agenda`), Messages (`/messages`)
+  and Files (`/documents`) into stable primary destinations and collapses the
+  compatible owner routes under **All available tools**;
+- **All available tools** is permission-derived but independent of the active
+  View, providing a deliberate escape without granting access or discarding
+  the original `/tasks`, `/calendar`, `/mail`, `/postbox` and `/files` links.
 
-The baseline classification is now manifest-declared for every ordinary
-user-facing module and enforced by the workspace manifest check. A separately
+The baseline classification and the four initial stable destinations are now
+manifest-declared. The area classification covers every ordinary user-facing
+module and is enforced by the workspace manifest check. A separately
 versioned launch-context contract carries bounded active-object, acting,
 temporal, View and return references into full-page Quick Access fallbacks;
 Cases publishes the first active-object reference. The remaining rollout is to
 add useful bounded tools and active-object publishers only where a maintained
-journey benefits, and to extend browser evidence to a pinned reference
-composition. Authorized global and technical routes remain visible through
+journey benefits. The pinned German Anwohnerparkausweis browser composition
+verifies stable product labels, technical escape, keyboard access and WCAG
+conformance. Authorized global and technical routes remain visible through
 their dedicated shell entry or **All available tools**.
 
 ## Quick Access Boundary
@@ -166,9 +174,10 @@ areas, and users may personalize them within Policy ceilings. An empty area is
 omitted. An area with one destination may open it directly. A multi-destination
 area provides a useful work/recent/action surface rather than another menu.
 
-Familiar product nouns such as Calendar, Mail or Files may remain directly
-pinned. The objective is not to hide every module name; it is to prevent
-repository topology from determining a person's workflow.
+Familiar product nouns such as Calendar or Files remain direct product
+destinations. The objective is not to hide every implementation name from
+administrators; it is to prevent repository topology from determining a
+person's workflow.
 
 The initial module classification is deliberately outcome-oriented:
 

docs/evidence/snapshots/DSAR_PROVIDER_COVERAGE.generated.md

@@ -6,8 +6,8 @@ Every other active module requires a reviewed explanation of why it owns no
 persistent subject-data store. Adding a migration invalidates that explanation.
 
 - Active modules: 72
-- Registered and documented DSAR providers: 48
-- Reviewed no-store rationales: 24
+- Registered and documented DSAR providers: 49
+- Reviewed no-store rationales: 23
 - Unexplained coverage gaps: 0
 
 | Module | Repository | Persistence | Coverage | Rationale |
@@ -75,7 +75,7 @@ persistent subject-data store. Adding a migration invalidates that explanation.
 | `soap` | `govoplan-soap` | No module migration | Reviewed no-store rationale | Transport-only module: SOAP binds explicitly published operations and owns no domain or subject-data store. |
 | `tasks` | `govoplan-tasks` | Migration-owned | Provider | Provider `privacy.dsar.tasks` is registered and documented. |
 | `templates` | `govoplan-templates` | Migration-owned | Provider | Provider `privacy.dsar.templates` is registered and documented. |
-| `tenancy` | `govoplan-tenancy` | No module migration | Reviewed no-store rationale | Orchestration module: tenant lifecycle and settings use Core-owned storage; Access covers account and membership subject data. |
+| `tenancy` | `govoplan-tenancy` | Migration-owned | Provider | Provider `privacy.dsar.tenancy` is registered and documented. |
 | `tickets` | `govoplan-tickets` | Migration-owned | Provider | Provider `privacy.dsar.tickets` is registered and documented. |
 | `transparency` | `govoplan-transparency` | No module migration | Reviewed no-store rationale | Contract-only module: requests, disclosure reviews, and publications are not persisted; reassess before adding a migration-owned store. |
 | `views` | `govoplan-views` | Migration-owned | Provider | Provider `privacy.dsar.views` is registered and documented. |

packages/govoplan-meta/pyproject.toml

@@ -4,26 +4,26 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "govoplan"
-version = "0.1.42"
+version = "0.1.44"
 description = "Developer convenience package for a versioned GovOPlaN composition"
 readme = "README.md"
 requires-python = ">=3.12"
 license = { text = "AGPL-3.0-or-later" }
 dependencies = [
-  "govoplan-core[server]==0.1.42",
-  "govoplan-tenancy==0.1.20",
+  "govoplan-core[server]==0.1.44",
+  "govoplan-tenancy==0.1.21",
   "govoplan-organizations==0.1.20",
   "govoplan-identity==0.1.20",
   "govoplan-idm==0.1.24",
-  "govoplan-access==0.1.23",
+  "govoplan-access==0.1.24",
   "govoplan-admin==0.1.22",
   "govoplan-policy==0.1.22",
   "govoplan-audit==0.1.20",
   "govoplan-dashboard==0.1.20",
-  "govoplan-files==0.1.24",
+  "govoplan-files==0.1.25",
   "govoplan-mail==0.1.26",
   "govoplan-campaign==0.1.27",
-  "govoplan-calendar==0.1.22",
+  "govoplan-calendar==0.1.23",
   "govoplan-docs==0.1.22",
   "govoplan-ops==0.1.21",
 ]
@@ -77,7 +77,7 @@ full = [
   "govoplan-search==0.1.19",
   "govoplan-services==0.1.19",
   "govoplan-soap==0.1.19",
-  "govoplan-tasks==0.1.21",
+  "govoplan-tasks==0.1.22",
   "govoplan-templates==0.1.21",
   "govoplan-tickets==0.1.22",
   "govoplan-transparency==0.1.20",

requirements-release.txt

@@ -1,18 +1,18 @@
 # Whole-product release install from immutable, independently versioned module tags.
 # Only add a module after its referenced tag has been published.
 ../govoplan-core[server]
-govoplan-tenancy @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-tenancy.git@v0.1.20
+govoplan-tenancy @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-tenancy.git@v0.1.21
 govoplan-organizations @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-organizations.git@v0.1.20
 govoplan-identity @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-identity.git@v0.1.20
 govoplan-idm @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-idm.git@v0.1.24
-govoplan-access @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-access.git@v0.1.23
+govoplan-access @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-access.git@v0.1.24
 govoplan-admin @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-admin.git@v0.1.22
 govoplan-policy @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-policy.git@v0.1.22
 govoplan-audit @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-audit.git@v0.1.20
 govoplan-dashboard @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-dashboard.git@v0.1.20
-govoplan-files @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-files.git@v0.1.24
+govoplan-files @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-files.git@v0.1.25
 govoplan-mail @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-mail.git@v0.1.26
 govoplan-campaign @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-campaign.git@v0.1.27
-govoplan-calendar @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-calendar.git@v0.1.22
+govoplan-calendar @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-calendar.git@v0.1.23
 govoplan-docs @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-docs.git@v0.1.22
 govoplan-ops @ git+ssh://git@git.add-ideas.de/GovOPlaN/govoplan-ops.git@v0.1.21

tests/test_package_registry_release.py

@@ -70,7 +70,7 @@ class PackageRegistryReleaseTests(unittest.TestCase):
         by_name = {item["name"]: item for item in selected}
         self.assertIn("govoplan-core", by_name)
         self.assertIn("govoplan-records", by_name)
-        self.assertEqual("0.1.21", by_name["govoplan-tasks"]["version"])
+        self.assertEqual("0.1.22", by_name["govoplan-tasks"]["version"])
 
         payload = PACKAGE_SET.generate_package_set(
             core_version=core_version,

tools/checks/dsar-coverage-exemptions.json

@@ -19,7 +19,6 @@
   "resources": "Contract-only module: resource catalog and allocation persistence are not implemented; reassess before adding a migration-owned store.",
   "rest": "Transport-only module: REST binds explicitly published functions and owns no domain or subject-data store.",
   "soap": "Transport-only module: SOAP binds explicitly published operations and owns no domain or subject-data store.",
-  "tenancy": "Orchestration module: tenant lifecycle and settings use Core-owned storage; Access covers account and membership subject data.",
   "transparency": "Contract-only module: requests, disclosure reviews, and publications are not persisted; reassess before adding a migration-owned store.",
   "workflow": "Presentation-only module: Workflow edits and projects Workflow Engine state; Workflow Engine owns persistence and DSAR coverage.",
   "xrechnung": "Stateless validation-contract module: XRechnung persists no invoice, report, diagnostic, or handoff; the invoking Files, Procurement, or Payments workflow remains the subject-data owner. Reassess before adding a validation store."

tools/inventory/endpoint-surface-declarations.json

@@ -2007,6 +2007,20 @@
       "rationale": "Published integration, interoperability, public-participant, or health endpoint.",
       "repository": "govoplan-soap"
     },
+    {
+      "category": "intentionally_headless",
+      "method": "GET",
+      "path": "/admin/tenant-erasure-policy",
+      "rationale": "Tenant-erasure policy is a consequential operator API with recent-authentication and dedicated-permission gates.",
+      "repository": "govoplan-tenancy"
+    },
+    {
+      "category": "intentionally_headless",
+      "method": "PATCH",
+      "path": "/admin/tenant-erasure-policy",
+      "rationale": "Tenant-erasure policy is a consequential operator API with recent-authentication and dedicated-permission gates.",
+      "repository": "govoplan-tenancy"
+    },
     {
       "category": "intentionally_headless",
       "method": "GET",
@@ -2014,6 +2028,48 @@
       "rationale": "Tenant deletion preflight is an administrative safety API consumed before a destructive workflow.",
       "repository": "govoplan-tenancy"
     },
+    {
+      "category": "intentionally_headless",
+      "method": "POST",
+      "path": "/admin/tenants/{}/erasure-operations",
+      "rationale": "Tenant erasure is an audited, provider-driven operator workflow whose API exposes the complete review and recovery evidence.",
+      "repository": "govoplan-tenancy"
+    },
+    {
+      "category": "intentionally_headless",
+      "method": "GET",
+      "path": "/admin/tenants/{}/erasure-operations/{}",
+      "rationale": "Tenant erasure is an audited, provider-driven operator workflow whose API exposes the complete review and recovery evidence.",
+      "repository": "govoplan-tenancy"
+    },
+    {
+      "category": "intentionally_headless",
+      "method": "POST",
+      "path": "/admin/tenants/{}/erasure-operations/{}/approve",
+      "rationale": "Tenant-erasure approval requires typed confirmation, recent authentication, and a distinct authorized account.",
+      "repository": "govoplan-tenancy"
+    },
+    {
+      "category": "intentionally_headless",
+      "method": "POST",
+      "path": "/admin/tenants/{}/erasure-operations/{}/cancel",
+      "rationale": "Tenant-erasure cancellation is a recovery control available only before destructive work starts.",
+      "repository": "govoplan-tenancy"
+    },
+    {
+      "category": "intentionally_headless",
+      "method": "POST",
+      "path": "/admin/tenants/{}/erasure-operations/{}/execute",
+      "rationale": "Tenant-erasure execution is a consequential operator API with provider checkpoints and fail-closed reconciliation.",
+      "repository": "govoplan-tenancy"
+    },
+    {
+      "category": "intentionally_headless",
+      "method": "POST",
+      "path": "/admin/tenants/{}/erasure-operations/{}/reconcile",
+      "rationale": "Tenant-erasure reconciliation resumes idempotent provider steps after pending or outcome-unknown effects.",
+      "repository": "govoplan-tenancy"
+    },
     {
       "category": "compatibility",
       "method": "POST",