# Governed Service To Decision

This product package composes independently owned institutional semantics into
one reconstructable administrative journey:

```text
Service discovery -> Case intake -> Party and representation -> Mandate
resolution -> approval/deliberation -> formal Decision -> observed delivery
effect -> record and review references
```

The maintained concrete scenario is a German resident parking permit
(`Anwohnerparkausweis`). Its versioned fixture is
`tests/fixtures/resident_parking_permit_journey.json`. It pins the service,
exact Form revision, resident inputs, digital and assisted channels, Case type,
human review handoff, formal outcome, Postbox delivery channel, and Records
filing/retention target. Generic permit wording is no longer acceptance
evidence for this package.

An installed Forms and Forms Runtime pair adds an alternative governed entry
path before case/workflow handoff:

```text
Service discovery -> exact Form revision -> validated draft/submission
                  -> receipt and handoff evidence -> Case or Workflow owner
```

The assisted path now creates an authenticated, resumable session against that
same exact Form revision. It records channel, affected and represented parties,
authority, purpose, notice, responsible function, language, accessibility
support, and field provenance. Submission fails closed until an immutable
read-back outcome matches the current revision, values, attachments, and
signatures. Saving a correction therefore requires a fresh confirmation rather
than silently reusing old evidence.

Services, Cases, Parties, Mandates, Committee, and Decisions retain immutable
provider-owned revisions for the parts they own. Portal, Cases, and Committee
consume capabilities for cross-module semantics only. The package does not
grant cross-module table access and can omit optional presentation, work,
deliberation, delivery, or records modules while retaining explicit references
to externally performed steps.

When Records is present, Forms Runtime, Cases, and Decisions expose exact,
digest-bound source snapshots for explicit filing. The source module rechecks
current access, Records chooses the destination and preserves chronology, and
the filed reference never becomes an editable copy. When Search is present,
the same three owners contribute rebuildable metadata-only projections. Form
values, evidence payloads, Decision reasoning, operative results, and
conditions are excluded; every candidate is authorized again before it is
shown.

When Tasks is present, explicit work and source-owned Workflow handoffs appear
in one resumable inbox with typed account, group, role, function, or assignment
responsibility. Workflow Engine retains process state and completion commands;
Tasks retains only explicit tasks and the aggregation surface.

## Security And Recovery

Every provider is tenant-bound. Missing or conflicting authority fails closed.
Protected Decision content has a separate permission. Writes are replay-safe
and OCC-guarded. Database restore is the semantic-state recovery unit; file and
communication effects remain governed by their owning providers and are linked
through requested/observed effect, evidence, and audit references. Search is a
derived recovery unit and can be rebuilt from authoritative module state.

The executable fixture in
`tests/test_institutional_governance_journey.py` proves SQL-backed Service,
Case, Party, Mandate, Committee meeting/agendum/vote/minute, and Decision state.
`tests/test_institutional_service_journey.py` separately proves exact Portal
Form launch, persisted submission provenance, idempotent replay, resumable
assisted intake with enforced read-back evidence, and a durable Workflow handoff
that remains visible through Tasks after the database session is reopened and
disappears only after the Workflow Engine records completion.
Module-level Records source tests prove exact Form submission, Case revision,
and Decision revision filing. Target-environment browser accessibility,
production identity and delivery, a named archive profile, and recovery evidence
are still required before this product package may claim `reference_ready`
maturity.