{ "$schema": "./capability-fit.schema.json", "schema_version": "0.2.0", "assessment_id": "campaign-reference-2026-07-22", "assessed_at": "2026-07-22", "scope": { "title": "Campaign-centric internal pilot and small-production candidate", "reference_journeys": [ "Internal operator authors, validates, builds, queues, sends and reconciles an email Campaign with managed attachments", "Operator inspects delivery and audit evidence" ], "postponed": [ "Workflow and workflow-driven user stories" ] }, "facts": [ "The assessment is pinned to signed stable catalog sequence 202607220843 and the exact module commits listed below.", "The Campaign authoring, validation, build, mock-delivery, managed-file, local-access, and local-audit paths have direct test or contract evidence.", "The production-like development profile runs PostgreSQL and Redis in containers while application processes use editable source trees.", "No installed-target, external-provider, reference-readiness, recovery, or production-approval evidence bundle is attached to this assessment." ], "decisions": [ "Use Campaign as the first reference journey and flagship pilot scenario.", "Keep Workflow and workflow-driven user stories planned and explicitly postponed for this assessment.", "Use local GovOPlaN accounts for the bounded pilot; do not claim federated identity support.", "Do not approve small production until installed-artifact, target mail, monitoring, backup/restore, and recovery proof checks pass." ], "release": { "kind": "tagged_release", "ref": "stable-catalog-202607220843", "meta_commit": "5447299289a1", "reproducible": true, "configuration_packages": [ "none: environment-profile basis only" ], "notes": [ "The live stable catalog has a valid Ed25519 signature trusted through release-key-1.", "Core v0.1.13 and Campaign v0.1.10 are tagged and package-integrated; this is not target-environment or production approval.", "The absence of a configuration package is pinned explicitly as an environment-profile-only basis; this remains a promotion gap." ] }, "composition": [ { "module_id": "core", "repository": "govoplan-core", "commit": "d487726f4d2c", "manifest_version": "0.1.13", "enabled": true, "dirty": false, "role": "API, registry, migrations, sessions, kernel contracts and shared WebUI" }, { "module_id": "tenancy", "repository": "govoplan-tenancy", "commit": "efbec827616b", "manifest_version": "0.1.8", "enabled": true, "dirty": false, "role": "Tenant context and lifecycle" }, { "module_id": "organizations", "repository": "govoplan-organizations", "commit": "39c081c4fb8f", "manifest_version": "0.1.8", "enabled": true, "dirty": false, "role": "Organization model" }, { "module_id": "identity", "repository": "govoplan-identity", "commit": "7a1710af896f", "manifest_version": "0.1.8", "enabled": true, "dirty": false, "role": "Normalized internal identity directory" }, { "module_id": "access", "repository": "govoplan-access", "commit": "f1d64d247e12", "manifest_version": "0.1.11", "enabled": true, "dirty": false, "role": "Local authentication, sessions, API keys and RBAC" }, { "module_id": "admin", "repository": "govoplan-admin", "commit": "11ecf362a36d", "manifest_version": "0.1.8", "enabled": true, "dirty": false, "role": "Administration surfaces" }, { "module_id": "dashboard", "repository": "govoplan-dashboard", "commit": "4b960ad37f0d", "manifest_version": "0.1.8", "enabled": true, "dirty": false, "role": "Module-aware home surface" }, { "module_id": "policy", "repository": "govoplan-policy", "commit": "1063622d311a", "manifest_version": "0.1.9", "enabled": true, "dirty": false, "role": "Policy explanation and configuration boundary" }, { "module_id": "audit", "repository": "govoplan-audit", "commit": "d3d2c60d7dc1", "manifest_version": "0.1.8", "enabled": true, "dirty": false, "role": "Database audit records and retrying audit outbox" }, { "module_id": "campaigns", "repository": "govoplan-campaign", "commit": "735e874bd03c", "manifest_version": "0.1.10", "enabled": true, "dirty": false, "role": "Campaign authoring, build, delivery control and reporting" }, { "module_id": "files", "repository": "govoplan-files", "commit": "2b34f6e30578", "manifest_version": "0.1.9", "enabled": true, "dirty": false, "role": "Managed files and Campaign attachments" }, { "module_id": "mail", "repository": "govoplan-mail", "commit": "3e2302909022", "manifest_version": "0.1.10", "enabled": true, "dirty": false, "role": "SMTP and IMAP profiles and transports" }, { "module_id": "calendar", "repository": "govoplan-calendar", "commit": "9bcf41bb1fbb", "manifest_version": "0.1.8", "enabled": true, "dirty": false, "role": "Optional calendar outside the Campaign pilot minimum" }, { "module_id": "docs", "repository": "govoplan-docs", "commit": "be52b716caed", "manifest_version": "0.1.10", "enabled": true, "dirty": false, "role": "Configured-system documentation" }, { "module_id": "ops", "repository": "govoplan-ops", "commit": "341773a4ff8a", "manifest_version": "0.1.8", "enabled": true, "dirty": false, "role": "Readiness and deployment-profile visibility" }, { "module_id": "addresses", "repository": "govoplan-addresses", "commit": "93dddbb8c52a", "manifest_version": "0.1.9", "enabled": false, "dirty": false, "role": "Optional reusable recipient sources and CardDAV" } ], "deployment_profile": { "id": "production-like-dev", "status": "partial", "description": "PostgreSQL and Redis run in containers while API, WebUI, worker and scheduler run from editable source trees.", "evidence": [ { "kind": "configuration", "scope": "current_workspace", "locator": "govoplan/dev/production-like/docker-compose.yml" }, { "kind": "documentation", "scope": "documented_model", "locator": "govoplan/dev/production-like/README.md" } ] }, "scenarios": [ { "id": "campaign-pilot", "label": "Controlled Campaign pilot", "status": "partial", "recommendation": "Proceed with a bounded internal pilot after its provider, privacy, workload, and recovery proof checks are assigned and passed.", "composition": [ "core", "tenancy", "organizations", "identity", "access", "admin", "dashboard", "policy", "audit", "campaigns", "files", "mail", "docs", "ops" ], "topology": [ "One supervised GovOPlaN API process and one immutable built WebUI behind deployment-owned TLS termination", "One PostgreSQL database and a durable single-node or shared managed-file path", "One persistent private Redis broker and one supervised Celery worker when asynchronous delivery is enabled", "One dedicated non-production SMTP/IMAP account with a restricted safe-recipient policy", "External health checks, centralized logs, protected secret injection, and coordinated backup storage" ], "conditions": [ "Use one internal tenant or office and controlled operators.", "Keep recipient volume non-critical until measured.", "Enable Addresses only when reusable recipient lists or CardDAV are explicitly in scope.", "Do not enable or claim Workflow from this assessment." ] }, { "id": "small-production-candidate", "label": "Small-production candidate", "status": "partial", "recommendation": "Do not approve production until every listed operational gate has target evidence and the residual risks have named owners.", "composition": [ "core", "tenancy", "organizations", "identity", "access", "admin", "dashboard", "policy", "audit", "campaigns", "files", "mail", "docs", "ops" ], "topology": [ "Immutable separately supervised WebUI, API, and worker artifacts behind monitored reverse-proxy TLS", "Dedicated or managed PostgreSQL with measured coordinated backup and isolated restore", "Persistent authenticated Redis with queue-age, queue-depth, and worker-health alerts", "Durable shared or S3-compatible object storage with versioning, lifecycle, and restore evidence", "Target-native secret management, centralized monitoring/logging/audit export, and an exercised incident and disaster-recovery procedure" ], "conditions": [ "Pin and promote a configuration package instead of relying on an environment-only basis.", "Pass installed-release, target SMTP/IMAP, accessibility, privacy, security, operations, and recovery evidence gates.", "Agree availability, RPO, RTO, retention, support, and procurement requirements.", "Run only one scheduler unless distributed leadership or locking is proved." ] } ], "functional_context": { "required_modules": [ "core", "tenancy", "organizations", "identity", "access", "admin", "dashboard", "policy", "audit", "campaigns", "files", "mail", "docs", "ops" ], "optional_modules": [ "addresses" ], "external_systems": [ "Deployment-owned reverse proxy and TLS certificate lifecycle", "Target SMTP/IMAP service and its DNS, certificate, throttling, bounce, and reply policies", "Target-native secret store, monitoring/logging platform, backup storage, and incident-response process" ], "missing_contracts": [ "End-to-end federated identity provider and lifecycle contract", "Target monitoring, alert delivery, and central audit/SIEM acceptance contract", "Production configuration-package promotion and approval evidence" ], "policy_decisions": [ "Recipient allow-list, permitted sender, attachment, retention, and external-disclosure policy", "Identity, MFA, break-glass, service-account, and joiner/mover/leaver policy", "Availability, RPO, RTO, support, procurement, and residual-risk ownership" ], "manual_workarounds": [ "Use controlled local accounts while federation remains outside the verified slice", "Use one supervised scheduler where periodic work is unavoidable", "Keep provider reconciliation and production promotion under explicit operator review" ], "blockers": [ "No promoted configuration package is pinned", "No installed-target or target SMTP/IMAP proof is attached", "No coherent target backup/restore or disaster-recovery drill with measured RPO/RTO is attached", "No target privacy, security, accessibility, operations, or production-approval evidence is attached" ] }, "questionnaire": { "scope_outcomes": [ { "id": "outcome.reference_journey", "question": "Which journey is assessed?", "state": "answered", "answer": "An internal operator authors, validates, builds, queues, sends and reconciles a Campaign with managed attachments.", "evidence": [] }, { "id": "outcome.workflow", "question": "Is Workflow in scope?", "state": "answered", "answer": "No; Workflow is planned and explicitly postponed.", "evidence": [] }, { "id": "scope.users_tenants_organizations", "question": "Which users, roles, tenants, organization units, and delegated functions participate?", "state": "assumed", "answer": "One internal tenant or office with controlled Campaign operators; detailed organization and delegation shape remains target-specific.", "evidence": [] }, { "id": "outcome.acceptance", "question": "What constitutes pilot success and production acceptance?", "state": "answered", "answer": "Pilot success requires the bounded Campaign journey and proof checks; production additionally requires installed-artifact, provider, privacy, security, operations, recovery, and approval evidence.", "evidence": [] } ], "data_policy": [ { "id": "data.classification", "question": "Which data classes and legal bases apply?", "state": "not_assessed", "answer": null, "evidence": [] }, { "id": "data.retention", "question": "What retention, deletion, archive and legal-hold rules apply?", "state": "not_assessed", "answer": null, "evidence": [] }, { "id": "data.privacy_security_disclosure", "question": "Which privacy, security, residency, minimization, access, and external-disclosure constraints apply?", "state": "not_assessed", "answer": null, "evidence": [] } ], "identity_integrations": [ { "id": "identity.pilot", "question": "May the pilot use local GovOPlaN accounts?", "state": "assumed", "answer": "Yes; federation is outside the verified composition.", "evidence": [] }, { "id": "integration.mail", "question": "Which target SMTP/IMAP service and policy apply?", "state": "not_assessed", "answer": null, "evidence": [] }, { "id": "identity.protocols_lifecycle", "question": "Which identity protocols, MFA, joiner/mover/leaver, service-account, and break-glass rules are mandatory?", "state": "not_assessed", "answer": null, "evidence": [] }, { "id": "integration.protocols_network", "question": "Which connector protocols, versions, directions, authentication, certificate, rate-limit, egress, and degraded-mode requirements apply?", "state": "not_assessed", "answer": null, "evidence": [] } ], "workload_growth": [ { "id": "workload.campaign_volume_peaks", "question": "What are Campaign frequency, recipients per Campaign, send window, import size and attachment volume?", "state": "not_assessed", "answer": null, "evidence": [] }, { "id": "workload.tenants_users_concurrency", "question": "What are tenant, named-user, active-user, concurrent-user, and peak-request assumptions?", "state": "not_assessed", "answer": null, "evidence": [] }, { "id": "workload.files_jobs_audit_growth_retention", "question": "What are tenant, user, concurrency, file, database, queue and audit growth assumptions?", "state": "not_assessed", "answer": null, "evidence": [] }, { "id": "workload.connector_traffic_batches", "question": "What connector traffic, scheduled-job, batch, queue-depth, queue-age, and external-rate-limit peaks apply?", "state": "not_assessed", "answer": null, "evidence": [] } ], "availability_operations": [ { "id": "availability.rto_rpo", "question": "What availability, RPO and RTO are required?", "state": "not_assessed", "answer": null, "evidence": [] }, { "id": "operations.ownership", "question": "Who operates database, queue, storage, TLS, secrets, monitoring, backup and incident response?", "state": "not_assessed", "answer": null, "evidence": [] }, { "id": "hosting.network_constraints", "question": "Which hosting, network-zone, egress, proxy, DNS, NTP, certificate-authority, residency, or disconnected-operation constraints apply?", "state": "not_assessed", "answer": null, "evidence": [] } ], "procurement_decisions": [ { "id": "procurement.constraints", "question": "Which licensing, accessibility, security, certification, support and procurement conditions are mandatory?", "state": "not_assessed", "answer": null, "evidence": [] } ] }, "capabilities": [ { "id": "platform.composition", "requirement": "Compose enabled backend and WebUI modules without hard optional-module dependencies.", "status": "verified", "evidence": [ { "kind": "test", "scope": "committed_source", "locator": "govoplan-core/tests/test_module_system.py" }, { "kind": "contract", "scope": "current_workspace", "locator": "govoplan/tools/checks/check-contracts.py", "note": "43 modules, 33 providers, 19 requirements, no issues" } ], "conditions": [ "Package integration is verified; repeat checks on the installed target composition." ], "gaps": [ "No target deployment acceptance is recorded." ], "risks": [ "A reproducible module graph can still be installed or configured incorrectly." ], "recommendation": "Use the signed stable catalog and verify the minimal Campaign composition after installation.", "proof_check": "Run contract, migration, API and WebUI module-permutation gates on the installed release." }, { "id": "access.local", "requirement": "Provide tenant-scoped local accounts, sessions, API keys and RBAC.", "status": "verified", "evidence": [ { "kind": "test", "scope": "committed_source", "locator": "govoplan-access/tests/test_auth_dependencies.py" }, { "kind": "test", "scope": "committed_source", "locator": "govoplan-core/tests/test_api_smoke.py#cookie-session-csrf" } ], "conditions": [ "Pilot accepts local accounts." ], "gaps": [ "MFA and federated lifecycle are not part of this conclusion." ], "risks": [ "Manual account lifecycle may not satisfy production identity policy." ], "recommendation": "Use controlled local pilot accounts and define break-glass/bootstrap rules.", "proof_check": "Exercise joiner, role change, suspension and protected-owner recovery." }, { "id": "campaign.journey", "requirement": "Author, validate, build, queue, send, reconcile and report a Campaign with frozen execution evidence.", "status": "verified", "evidence": [ { "kind": "test", "scope": "committed_source", "locator": "govoplan-core/tests/test_api_smoke.py#campaign-create-validate-build-mock-send" }, { "kind": "test", "scope": "committed_source", "locator": "govoplan-campaign/tests", "note": "Campaign v0.1.10 is exactly the catalog-selected tagged source" }, { "kind": "configuration", "scope": "committed_source", "locator": "https://govoplan.add-ideas.de/catalogs/v1/channels/stable.json#sequence-202607220843", "note": "Core v0.1.13 and Campaign v0.1.10 have matching catalogued Python and WebUI refs" } ], "conditions": [ "This verifies implementation paths, not target-provider delivery." ], "gaps": [ "Usability and target-provider acceptance remain separate." ], "risks": [ "Package integration does not prove provider behavior or production operations." ], "recommendation": "Use the catalogued Campaign release for usability and target-provider acceptance.", "proof_check": "Run the complete journey with safe data and the target-like mail service." }, { "id": "files.managed_attachments", "requirement": "Store and resolve managed Campaign attachments on durable storage.", "status": "verified", "evidence": [ { "kind": "test", "scope": "current_workspace", "locator": "govoplan-files/tests", "note": "14 tests passed" }, { "kind": "test", "scope": "current_workspace", "locator": "govoplan-campaign/tests/test_attachment_building.py" } ], "conditions": [ "Deployment provides a durable storage root." ], "gaps": [ "Target backup and restore are not verified." ], "risks": [ "Node-local storage prevents safe independent API scaling." ], "recommendation": "Use durable local storage for the pilot and assess object/shared storage before scaling.", "proof_check": "Back up and restore files together with database references." }, { "id": "mail.smtp_imap", "requirement": "Send Campaign mail through SMTP and optionally append sent messages through IMAP.", "status": "available_unconfigured", "evidence": [ { "kind": "test", "scope": "current_workspace", "locator": "govoplan-mail/tests", "note": "22 tests passed" }, { "kind": "documentation", "scope": "documented_model", "locator": "govoplan-campaign/docs/CAMPAIGN_DELIVERY_RUNBOOK.md" } ], "conditions": [ "Use a dedicated non-production service account and safe recipients." ], "gaps": [ "No target provider, TLS chain, throttling or bounce/reply process was exercised." ], "risks": [ "Ambiguous provider outcomes can cause duplicate-send risk if reconciled incorrectly." ], "recommendation": "Run target-like interoperability and failure drills before production use.", "proof_check": "Prove SMTP acceptance, IMAP append, throttling and outcome reconciliation." }, { "id": "addresses.recipient_sources", "requirement": "Select reusable address lists as Campaign recipient sources.", "status": "available_unconfigured", "evidence": [ { "kind": "test", "scope": "current_workspace", "locator": "govoplan-addresses/tests", "note": "14 tests passed" } ], "conditions": [ "Enable the Addresses module explicitly." ], "gaps": [ "Addresses is disabled in the pinned root profile." ], "risks": [ "Recipient governance may differ between source data and frozen Campaign evidence." ], "recommendation": "Enable only when reusable lists are a pilot requirement.", "proof_check": "Build a Campaign from a source list and verify immutable recipient provenance." }, { "id": "audit.local", "requirement": "Retain tenant/system audit evidence and retry governed audit events.", "status": "verified", "evidence": [ { "kind": "test", "scope": "current_workspace", "locator": "govoplan-audit/tests", "note": "5 tests passed" } ], "conditions": [ "Conclusion covers local database evidence only." ], "gaps": [ "No central sink, retention enforcement or tamper-evident archive is verified." ], "risks": [ "Local audit evidence may not satisfy organizational records or SIEM requirements." ], "recommendation": "Define retention and export requirements before production approval.", "proof_check": "Exercise privileged-event review, retention and any required external export." }, { "id": "identity.federation", "requirement": "Integrate external LDAP/AD, OIDC/SAML or SCIM identity infrastructure.", "status": "scaffold", "evidence": [ { "kind": "documentation", "scope": "documented_model", "locator": "govoplan-idm/README.md" } ], "conditions": [], "gaps": [ "No end-to-end provider connector or federated login is verified." ], "risks": [ "Federation-dependent organizations cannot use the current pilot composition without extra implementation." ], "recommendation": "Use local pilot accounts or assess and implement the selected provider path.", "proof_check": "Run provider metadata, login/provisioning, deprovisioning and failure tests." }, { "id": "compliance.export_control", "requirement": "Screen persons and organizations against embargo/sanctions lists with review evidence.", "status": "planned", "evidence": [ { "kind": "issue", "scope": "documented_model", "locator": "https://git.add-ideas.de/GovOPlaN/govoplan/issues/12" } ], "conditions": [], "gaps": [ "No provider, list provenance, match policy, review flow or legal evidence exists." ], "risks": [ "The current composition must not be represented as performing export-control screening." ], "recommendation": "Keep outside pilot claims until the user story is implemented and legally validated.", "proof_check": "Validate list ingestion, versioning, matching, false-positive review and audit evidence." }, { "id": "workflow", "requirement": "Orchestrate the journey through Workflow.", "status": "planned", "evidence": [ { "kind": "observation", "scope": "documented_model", "locator": "Assessment scope", "note": "Explicitly postponed" } ], "conditions": [], "gaps": [ "Workflow is outside this assessment." ], "risks": [ "Including it would overstate the assessed composition." ], "recommendation": "Do not enable or claim Workflow for this reference pilot.", "proof_check": "Reassess in a later Workflow-focused composition." } ], "infrastructure": [ { "id": "runtime.web_api", "requirement": "Serve matching WebUI and API artifacts with health endpoints.", "status": "verified", "evidence": [ { "kind": "test", "scope": "committed_source", "locator": "govoplan-core/tests/test_module_system.py" }, { "kind": "route", "scope": "committed_source", "locator": "govoplan-core/src/govoplan_core/server/fastapi.py#/health" } ], "conditions": [ "Materialize the matching catalogued artifacts in the target." ], "gaps": [ "No production image or service bundle is supplied by the profile." ], "risks": [ "Editable source processes are unsuitable as a production artifact." ], "recommendation": "Install matching catalogued WebUI/API refs and supervise them as immutable artifacts.", "proof_check": "Deploy the built artifacts and run health/module-route checks." }, { "id": "runtime.worker", "requirement": "Run durable asynchronous Campaign jobs.", "status": "available_unconfigured", "evidence": [ { "kind": "configuration", "scope": "current_workspace", "locator": "govoplan/tools/launch/launch-production-like-dev.sh" } ], "conditions": [ "Redis and a supervised worker are required when Celery is enabled." ], "gaps": [ "Target heartbeat, restart and queue-age alerting are not proved." ], "risks": [ "Queued work can stall silently without monitoring." ], "recommendation": "Start one worker for the pilot and split queues only after measurement.", "proof_check": "Interrupt and restart a worker while preserving job/reconciliation safety." }, { "id": "runtime.scheduler", "requirement": "Run periodic recovery and cleanup safely.", "status": "partial", "evidence": [ { "kind": "test", "scope": "committed_source", "locator": "govoplan-calendar/tests/test_outbox.py", "note": "Committed and pushed after the catalogued Calendar v0.1.8 tag" } ], "conditions": [ "Calendar outbox and recovery work is remote-integrated source but not stable-package-integrated." ], "gaps": [ "No distributed leader election or target supervision is established." ], "risks": [ "Multiple schedulers can duplicate periodic dispatch without locking." ], "recommendation": "Omit from the Campaign-only pilot or run one supervised instance.", "proof_check": "Prove missed-schedule recovery and single-leader behavior." }, { "id": "data.postgresql", "requirement": "Persist application state in PostgreSQL with explicit migrations.", "status": "verified", "evidence": [ { "kind": "configuration", "scope": "committed_source", "locator": "govoplan/dev/postgres" }, { "kind": "test", "scope": "committed_source", "locator": "govoplan/tools/checks/postgres-integration-check.py" } ], "conditions": [ "Target database remains deployment-owned." ], "gaps": [ "HA, patching, WAL policy and capacity are not assessed." ], "risks": [ "A single unprotected database is a system-wide failure point." ], "recommendation": "Use managed or dedicated PostgreSQL with explicit migration and backup controls.", "proof_check": "Run migrations and restore a target-like database." }, { "id": "queue.redis", "requirement": "Provide the Celery broker and queue persistence.", "status": "available_unconfigured", "evidence": [ { "kind": "configuration", "scope": "current_workspace", "locator": "govoplan/dev/production-like/docker-compose.yml#redis" } ], "conditions": [], "gaps": [ "Authentication, TLS, eviction, HA and queue-loss policy are not assessed." ], "risks": [ "Broker loss or eviction can delay work even when database business state survives." ], "recommendation": "Configure private persistent Redis and monitor queue age/depth.", "proof_check": "Exercise broker interruption and worker recovery." }, { "id": "storage.local", "requirement": "Persist managed files on a durable single-node/shared path.", "status": "verified", "evidence": [ { "kind": "contract", "scope": "committed_source", "locator": "govoplan-files/src/govoplan_files/backend/storage/backends.py" } ], "conditions": [ "Path is durable, private, writable and backed up." ], "gaps": [ "Node-local storage cannot support independent API replicas." ], "risks": [ "Files can be lost or become inconsistent with database state." ], "recommendation": "Use for a bounded pilot only with coordinated backup.", "proof_check": "Restore files and verify all database references." }, { "id": "storage.object", "requirement": "Use S3-compatible storage for independently scalable file persistence.", "status": "partial", "evidence": [ { "kind": "test", "scope": "current_workspace", "locator": "govoplan-files/tests/test_connector_providers.py" } ], "conditions": [], "gaps": [ "No chosen target service or storage-backend interoperability drill." ], "risks": [ "Provider semantics, CA or lifecycle mismatch can break file access/retention." ], "recommendation": "Select and exercise the target object store before horizontal scaling.", "proof_check": "Upload, retrieve, version, back up and restore representative objects." }, { "id": "edge.proxy_tls", "requirement": "Terminate HTTPS and enforce proxy/security policy.", "status": "external_system", "evidence": [ { "kind": "route", "scope": "committed_source", "locator": "govoplan-ops/src/govoplan_ops/backend/api/v1/routes.py#deployment-security" } ], "conditions": [], "gaps": [ "No proxy, certificates, renewal, header or request-limit configuration is shipped here." ], "risks": [ "Incorrect proxy/cookie/CORS configuration can expose sessions or block legitimate use." ], "recommendation": "Supply and monitor the edge through the target platform.", "proof_check": "Run external TLS/header/cookie/CORS and upload-limit tests." }, { "id": "security.secret_store", "requirement": "Inject and rotate master, database, mail and connector secrets.", "status": "external_system", "evidence": [ { "kind": "configuration", "scope": "committed_source", "locator": "govoplan/.env.example" } ], "conditions": [], "gaps": [ "No target secret manager or rotation drill is selected." ], "risks": [ "Loss of the master key makes encrypted credentials unavailable; leakage compromises connectors." ], "recommendation": "Use target-native secret injection and document rotation/recovery.", "proof_check": "Rotate a non-production credential and recover from a protected backup." }, { "id": "identity.access", "requirement": "Authenticate users and enforce tenant-scoped authorization through the selected identity mode.", "status": "verified", "evidence": [ { "kind": "test", "scope": "committed_source", "locator": "govoplan-access/tests/test_auth_dependencies.py" }, { "kind": "test", "scope": "committed_source", "locator": "govoplan-core/tests/test_api_smoke.py#cookie-session-csrf" } ], "conditions": [ "The bounded pilot accepts local GovOPlaN accounts." ], "gaps": [ "Target MFA, federation, provisioning, and joiner/mover/leaver requirements are not assessed." ], "risks": [ "A local-only identity topology may not satisfy institutional production policy." ], "recommendation": "Use controlled local pilot accounts and assess the mandatory production identity topology separately.", "proof_check": "Exercise login, role change, account suspension, protected bootstrap, and break-glass recovery in the target." }, { "id": "connectors.mail", "requirement": "Reach the selected SMTP/IMAP and other external connector endpoints under explicit network and provider policy.", "status": "available_unconfigured", "evidence": [ { "kind": "test", "scope": "current_workspace", "locator": "govoplan-mail/tests", "note": "Protocol adapters have direct tests; no target provider was exercised" }, { "kind": "documentation", "scope": "documented_model", "locator": "govoplan-campaign/docs/CAMPAIGN_DELIVERY_RUNBOOK.md" } ], "conditions": [ "The deployment supplies DNS, egress, proxy, CA trust, scoped service accounts, and provider limits." ], "gaps": [ "No target endpoint, TLS chain, throttling, sender policy, bounce/reply path, or disclosure agreement is assessed." ], "risks": [ "Provider rejection, delay, or ambiguous outcomes can affect delivery and evidence completeness." ], "recommendation": "Use a dedicated safe provider account for the pilot and require target interoperability evidence before production.", "proof_check": "Exercise target-like SMTP acceptance, IMAP append, throttling, outage, retry, and reconciliation through the approved network path." }, { "id": "operations.monitoring", "requirement": "Detect API, database, worker, queue, storage and delivery degradation.", "status": "partial", "evidence": [ { "kind": "route", "scope": "committed_source", "locator": "govoplan-ops/src/govoplan_ops/backend/api/v1/routes.py#/ops/readiness" }, { "kind": "contract", "scope": "committed_source", "locator": "govoplan-core/src/govoplan_core/server/fastapi.py#slow-request-logging" } ], "conditions": [], "gaps": [ "No metrics exporter, log collector, dashboards, alert routes or SLO is verified." ], "risks": [ "Failures and queue backlog can remain unnoticed." ], "recommendation": "Integrate external monitoring before small production.", "proof_check": "Trigger each readiness/delivery failure and verify an actionable alert." }, { "id": "operations.audit", "requirement": "Retain, monitor, review, and where required export security and business audit evidence.", "status": "partial", "evidence": [ { "kind": "test", "scope": "current_workspace", "locator": "govoplan-audit/tests", "note": "Local audit persistence and retry behavior are exercised" } ], "conditions": [ "Local database audit evidence is part of coordinated backup and access review." ], "gaps": [ "Target retention enforcement, tamper-evident export, SIEM integration, alerting, and privileged review are not verified." ], "risks": [ "Local evidence alone may not meet institutional security, records, or incident-response requirements." ], "recommendation": "Define the target audit retention, export, monitoring, and review controls before production approval.", "proof_check": "Exercise privileged-event review, retention, export failure/retry, and target SIEM or archive ingestion." }, { "id": "operations.backup_restore", "requirement": "Back up and restore database, files, configuration and keys as a coherent service.", "status": "partial", "evidence": [ { "kind": "documentation", "scope": "documented_model", "locator": "govoplan-core/docs/DEPLOYMENT_OPERATOR_GUIDE.md" }, { "kind": "issue", "scope": "documented_model", "locator": "https://git.add-ideas.de/GovOPlaN/govoplan-core/issues/29" } ], "conditions": [], "gaps": [ "No target full-service restore drill or measured RPO/RTO exists." ], "risks": [ "Partial restore can produce missing files, unusable secrets or inconsistent evidence." ], "recommendation": "Treat Core #29 and a target restore drill as a production gate.", "proof_check": "Restore the whole service into an isolated environment and measure it." }, { "id": "operations.disaster_recovery", "requirement": "Recover the service after site or dependency loss within agreed RPO/RTO.", "status": "not_assessed", "evidence": [ { "kind": "absence", "scope": "current_workspace", "locator": "No target DR plan or exercise evidence supplied" } ], "conditions": [], "gaps": [ "RPO/RTO, off-site copies, recovery order, failover, communications and exercise schedule are unknown." ], "risks": [ "Service and evidence may be unrecoverable after a major incident." ], "recommendation": "Define and exercise DR before any availability commitment.", "proof_check": "Run a documented end-to-end recovery exercise." } ], "data_flows": [ { "id": "browser.api", "from": "User browser", "to": "Reverse proxy and GovOPlaN WebUI/API", "data": [ "Session and CSRF cookies", "Campaign content", "Recipient personal data", "Managed files" ], "trust_boundary": "Client/public to application", "controls": [ "HTTPS", "Exact CORS origins", "Secure cookies", "Tenant and RBAC enforcement", "Request limits" ] }, { "id": "api.database", "from": "GovOPlaN API and workers", "to": "PostgreSQL", "data": [ "Tenant and identity records", "Campaign drafts, snapshots and jobs", "Connector metadata", "Audit evidence" ], "trust_boundary": "Application to primary state store", "controls": [ "Dedicated database identity", "Private or encrypted transport", "Migrations", "Backup and retention" ] }, { "id": "api.queue.worker", "from": "GovOPlaN API", "to": "Redis and Celery worker", "data": [ "Job identifiers", "Queue routing and retry metadata" ], "trust_boundary": "Request plane to asynchronous processing plane", "controls": [ "Private authenticated broker", "Bounded payloads", "Idempotent claims", "Queue monitoring" ] }, { "id": "worker.mail", "from": "GovOPlaN Campaign worker", "to": "External SMTP and IMAP services", "data": [ "Recipient addresses", "Message bodies", "Attachments", "Sent-message copy" ], "trust_boundary": "GovOPlaN to external communication provider", "controls": [ "Scoped service account", "TLS and CA policy", "Sender and recipient policy", "Rate limits", "Outcome reconciliation" ] }, { "id": "worker.connectors", "from": "GovOPlaN connector worker", "to": "External address, file, object or calendar service", "data": [ "Addresses", "Files and provenance", "Calendar resources" ], "trust_boundary": "GovOPlaN to organizational/external content systems", "controls": [ "Explicit sync direction", "Scoped credentials", "Endpoint allow-list", "Provenance", "Conflict and reconciliation policy" ] } ], "assumptions": [ "The pilot can use local accounts and one internal tenant or office.", "A dedicated non-production SMTP/IMAP account and safe recipients are available.", "Pilot load fits one API and one worker until measured otherwise.", "Durable local storage is acceptable for the pilot." ], "open_questions": [ "What are the target organization's data classes, legal bases, retention and external-disclosure rules?", "Which identity, mail, file, address and monitoring systems are mandatory?", "What are Campaign volume, concurrency, growth, availability, RPO and RTO?", "Who owns each external runtime component and operational control?", "Which accessibility, security, support and procurement constraints are mandatory?" ], "risks": [ { "id": "risk.reproducibility", "statement": "The signed package selection is reproducible but has not been accepted as an installed target composition.", "impact": "Installation or configuration drift can still produce uncertain deployed behavior.", "treatment": "Materialize the signed catalog in an isolated target and run installed-artifact acceptance gates.", "owner": null, "residual_risk": "Module and environment differences still require release-environment verification." }, { "id": "risk.delivery_provider", "statement": "Target SMTP/IMAP behavior and failure modes are unproved.", "impact": "Failed, delayed or duplicate communication and incomplete evidence.", "treatment": "Run target-like interoperability, throttling and uncertainty drills.", "owner": null, "residual_risk": "External provider outages and ambiguous outcomes remain operational risks." }, { "id": "risk.recovery", "statement": "Backup/restore and disaster recovery are not demonstrated across all state and keys.", "impact": "Irrecoverable or inconsistent service after loss.", "treatment": "Complete Core #29 and an isolated full-service restore/DR exercise.", "owner": null, "residual_risk": "Recovery time and data loss remain bounded by the selected external infrastructure." } ], "recommendations": [ "Proceed only with a controlled internal Campaign pilot after the bounded proof checks pass.", "Use the minimal composition and enable Addresses only for an explicit reusable-recipient journey.", "Do not claim Workflow, export-control screening, identity federation or production DR as implemented.", "Treat installed-release acceptance, target mail proof, monitoring and a coherent restore drill as production gates." ], "proof_checks": [ "Materialize the signed catalog into an isolated installation and rerun contract, migration and module-permutation gates against the installed artifacts.", "Collect the isolated installation with the bounded installed-composition evidence contract; require exact enabled package/module versions, complete RECORD verification and immutable provenance anchored to this assessment.", "Run a safe target-like Campaign through SMTP acceptance, IMAP append, reporting and audit.", "Drill worker, Redis and ambiguous-delivery failures without duplicate sends.", "Restore PostgreSQL, managed files, configuration and encrypted credentials and measure RPO/RTO.", "Validate proxy/TLS, cookies/CORS, account bootstrap, secret redaction, monitoring and alert delivery.", "Measure representative Campaign/file/queue/database load and external throttling.", "Require separately issued, expiring and independently scope-authorized evidence before marking target environment, external provider or production approval proof as checked." ] }