[Feature] Federate autonomous GovOPlaN installations with governed exchange #41

New Issue

2026-08-05T16:21:20+02:00

zemion commented

2026-08-05 16:21:20 +02:00

Outcome

Two autonomous GovOPlaN installations can exchange a bounded object or command while retaining independent policy, authorization, retention, keys, evidence, and the right to pause or revoke the relationship.

Scope

Peer discovery and explicit administrator-approved pairing with independent trust anchors.
Signed, replay-protected exchange envelopes with stable external references, schema/profile versions, purpose, classification, provenance, and expiry.
Object profiles for identity/function references, Postbox messages/receipts, records transfers, workflow handoffs, configuration packages, and governed data products.
Inbox/outbox state machines with idempotency, quarantine, reconciliation, correction, and human intervention.
Local policy mapping, minimization, current authorization, retention, legal hold, and audit at both peers.
Compatibility negotiation, key rotation/revocation, degraded operation, export/import evidence, and deletion/correction semantics.

First proof

Deliver one function-addressed Postbox message between two test installations, acknowledge it once, reconcile an injected unknown outcome, revoke the peer, and retain independently verifiable evidence on both sides. No shared database, tenant, administrator, or implicit transitive trust is allowed.

Acceptance criteria

The first exchange profile and conformance fixture are versioned and documented.
Duplicate, reordered, expired, unsigned, unauthorized, and incompatible envelopes fail safely.
Each peer can explain what was sent, accepted, rejected, corrected, retained, and revoked.
The link can be disabled without disabling either installation or corrupting accepted local state.

Architecture: docs/FEDERATED_GOVOPLAN_ARCHITECTURE.md.

## Outcome Two autonomous GovOPlaN installations can exchange a bounded object or command while retaining independent policy, authorization, retention, keys, evidence, and the right to pause or revoke the relationship. ## Scope - Peer discovery and explicit administrator-approved pairing with independent trust anchors. - Signed, replay-protected exchange envelopes with stable external references, schema/profile versions, purpose, classification, provenance, and expiry. - Object profiles for identity/function references, Postbox messages/receipts, records transfers, workflow handoffs, configuration packages, and governed data products. - Inbox/outbox state machines with idempotency, quarantine, reconciliation, correction, and human intervention. - Local policy mapping, minimization, current authorization, retention, legal hold, and audit at both peers. - Compatibility negotiation, key rotation/revocation, degraded operation, export/import evidence, and deletion/correction semantics. ## First proof Deliver one function-addressed Postbox message between two test installations, acknowledge it once, reconcile an injected unknown outcome, revoke the peer, and retain independently verifiable evidence on both sides. No shared database, tenant, administrator, or implicit transitive trust is allowed. ## Acceptance criteria - The first exchange profile and conformance fixture are versioned and documented. - Duplicate, reordered, expired, unsigned, unauthorized, and incompatible envelopes fail safely. - Each peer can explain what was sent, accepted, rejected, corrected, retained, and revoked. - The link can be disabled without disabling either installation or corrupting accepted local state. Architecture: `docs/FEDERATED_GOVOPLAN_ARCHITECTURE.md`.