govoplan/docs/evidence/snapshots/INTERFACE_SURFACE_INVENTORY.md

GovOPlaN Interface Surface Inventory And Rollout

Pinned snapshot: This inventory records the source-derived state reviewed on 2026-08-03. It is retained as evidence, not maintained as the current rollout ledger. Generate a new inventory and use Gitea issues for current implementation state.

This is the initial evidence inventory for the product-wide interface pattern language. It records code contributions, not an assertion that every listed surface is complete, enabled in a deployment, usable, or compliant.

The applicable design contract is INTERFACE_PATTERN_LANGUAGE.md.

Snapshot And Method

The source-derived inventory command is documented in PLATFORM_CONTROL_PLANE.md. It produces machine-readable field, label, translation, route, API-reference, and module manifest evidence. This hand-maintained document is the reviewed interpretation of that snapshot; generated evidence does not retroactively change it.

Snapshot refreshed: 2026-08-03.

The generated snapshot contains 65 module manifests, 35 WebUI-contributing repositories, 40 statically declared module routes, 1,156 UI fields, and 836 backend endpoints. All backend endpoints are classified and no stale endpoint declarations were found. The 234 endpoints without a static WebUI reference are kept visible as review evidence; they may intentionally serve workers, public clients, connectors, or external integrations.

Evidence was read from tracked Git HEAD in the local GovOPlaN checkouts:

• core routes and fallback behavior in govoplan-core/webui/src/App.tsx
• every present govoplan-*/webui/src/module.ts
• the matching backend src/*/backend/manifest.py
• named UI capabilities and contribution identifiers in each module.ts
• Campaign nested routes in its tracked CampaignWorkspace.tsx and SectionSidebar.tsx

Tracked commits are used as the integrated baseline. Dirty worktree changes are not treated as delivered behavior. The former Campaign recipient-editor and preview WIP is integrated in tracked commits; completed work is no longer described as a local exception.

Runtime visibility remains conditional on the module being packaged and enabled, server metadata, installed optional capabilities, the authenticated actor, tenant context, route permission guards, and inner-surface permission checks. A route in this inventory therefore means "the code contributes this route when its module is active", not "every user sees it".

Inventory states:

• Contributed: a route or named UI capability exists in tracked source.
• Metadata gap: frontend runtime source contributes a route but the backend manifest does not describe the same route/navigation surface.
• Unreviewed: the surface has not yet completed the pattern, state, accessibility, privacy, and consequence audit. This is the default unless an issue supplies verification evidence.
• Pilot: the surface is in the Campaign-first rollout.

Core Shell Surfaces

Surface	Owner and code evidence	Audience/access evidence	Primary task and target archetype	Audit / rollout
Public landing and login	govoplan-core PublicLandingPage; rendered while no authenticated principal exists	Unauthenticated; maintenance and backend-reachability context are shell inputs	Understand the service and authenticate; public entry	Core shell contract complete under Core #227: semantic entry/login, uniform reachable/offline/maintenance feedback, keyboard focus, responsive layout and privacy-safe pre-authentication state
Session/bootstrap state	govoplan-core App.tsx and AppShell	All browser sessions during bootstrap	Understand that session/platform state is loading; state contract	Core shell contract complete: loading, unreachable, maintenance, authentication-required and module-load failure states use shared status/alert boundaries without erasing the shell
/ authenticated redirect	govoplan-core chooses the first visible navigation destination	Authenticated; result depends on visible nav contributions	Enter the actor's first accessible service area; navigation behavior, not a content page	Core route/module-permutation contract complete; permission, module, View and fallback filtering precede navigation and do not execute a domain action
/dashboard fallback	govoplan-core DashboardPage only when the Dashboard module is absent	Authenticated; no route-specific scope in core	Cross-module starting point; dashboard	Core fallback and Dashboard module permutations complete; fallback remains usable without the optional Dashboard module
/settings	govoplan-core SettingsPage	Authenticated; contributed sections and integrations filter internally	Profile, UI/workspace preference, local connection, and user-scoped integration settings; configuration	Core-owned pattern migration complete in Core #225, commit fa32cca
Shell chrome	AppShell, Titlebar, IconRail, BreadcrumbBar, HelpMenu, language menu, unsaved-change provider	Public/authenticated variants; nav filtered later	Tenant/actor context, global navigation, help, language, session and maintenance state	Core shell contract complete under Core #227/#225 and Views #2: semantic global controls, scroll-safe rail, visible maintenance state, guarded navigation, configured Docs fallback, optional Search, responsive/theme/i18n checks and module permutations

Direct Module Route Contributions

The access column summarizes only the route-level declaration in module.ts. Inner APIs and controls may impose additional checks. Public and compatibility routes are called out explicitly because they do not have the same manifest semantics as authenticated navigation routes.

Routes	Owner	Route-level access	Primary archetype	Migration issue
/admin	Access	Any declared administration/read scope	Administration/configuration host	Access pattern migration complete in Access #19, commit 1409dbf; shared host contract complete in Core #225
/address-book	Addresses	addresses:contact:read	Governed source directory, contact/list detail, external-provider operation, governance facts, and reversible correction	Addresses pattern migration complete in Addresses #23, commit f9a7185
/approvals	Approvals	approvals:workspace:read	Work queue/guided decision	Approvals pattern migration complete in Approvals #3, commit 24e9559
/calendar	Calendar	calendar:event:read	Full-height calendar workspace with filterable collection/agenda sidebar, continuous and bounded date views, guarded VEVENT and source editors, synchronized-source status, durable outbox recovery, and destructive remote-move evidence	Calendar pattern migration complete in Calendar #22, commit d7fd944
/campaigns, /campaigns/:campaignId/*, /campaigns/queue, /campaigns/reports	Campaign	Campaign read/report/control scopes	List-detail, guided review, monitoring, reporting	Campaign pattern pilot complete in Campaign #74; bounded product features such as watched-folder policy remain independently tracked
/operator	Campaign	Campaign read plus queue/control scope	Compatibility redirect to /campaigns/queue	Campaign #74 complete; redirect remains declared for saved links and is retired under the compatibility policy rather than through the UI migration
/cases, /cases/:caseId	Cases	cases:case:read	Governed case directory and detail workspace with guarded OCC lifecycle editor, provider-owned references, immutable timeline/history, and confirmed object-access editor	Cases pattern migration complete in Cases #4, commit 43b4cc8
/committee	Committee	committee:workspace:read	Governed workspace	Committee pattern migration complete in Committee #2, commit e64af30
/dashboard	Dashboard	No route-specific scope	View-specific personal workspace with module/permission-filtered widget library, guarded four-column composition, nested widget settings, server/browser fallback, and optimistic layout persistence	Dashboard pattern migration complete in Dashboard #3, commit da3947f
/dataflow	Dataflow	Pipeline read/admin	Governed library, guarded graph/constrained-SQL definition editor, typed node inspector, bounded intermediate preview, automation triggers, and durable run/deployment evidence	Dataflow pattern migration complete in Dataflow #20, commit 109ddcd
/datasources	Datasources	Catalogue read/source admin	Governed catalogue, staging preflight, optional-origin directory, authority editor, and immutable evidence	Datasources pattern migration complete in Datasources #7, commit 6406ce7
/distribution-lists	Distribution Lists	List read/write/admin	Governed directory, immutable-revision editor, expansion preview, and evidence register	Distribution Lists pattern migration complete in Distribution Lists #8, commit 6cdd804
/docs	Docs	Documentation or settings read	Documentation/reference	Configured-system workflow/reference/pattern help complete in Docs #15, commit abe2f78
/files	Files	files:file:read	Directory/explorer	Files pattern migration complete in Files #42, commit d8ae506
/forms	Forms	forms:definition:read	Definition library/editor	Forms pattern migration complete in Forms #4, commit e505536
/forms-runtime, /forms-runtime/:instanceId	Forms Runtime	Participate or workspace read	Guided form execution	Forms Runtime pattern migration complete in Forms Runtime #5, commit 07dd35b
/idm	IDM	Assignment, function-change, relationship, or organization scopes	Directory/governed change	IDM pattern migration complete in IDM #12, commit d864317
/mail, /mail/bounces	Mail	Mailbox or bounce read/manage	Directory/explorer, operational evidence	Mail pattern migration complete in Mail #20, commit 7844d9c
/notifications	Notifications	notifications:notification:read	Inbox/list-detail with guarded recipient state, confirmed local cancellation/dispatch, and sanitized delivery evidence	Notifications pattern migration complete in Notifications #4, commit ad6a31f
/ops	Ops	Operations or settings read	Monitoring/evidence with contextual run, drain, readiness-blocker, and recovery guidance	Ops pattern migration complete in Ops #4, commit 2b32643
/organizations	Organizations	Model/unit/function or settings read	Directory/hierarchy editor	Organizations pattern migration complete in Organizations #7, commit 97acfcb
/portal	Portal	portal:service:read	Explained service directory and governed handoff	Portal pattern migration complete in Portal #2; durable evidence in govoplan-portal/docs/INTERFACE_PATTERN_MIGRATION.md
/postbox	Postbox	postbox:postbox:read	Inbox/list-detail	Postbox pattern migration complete in Postbox #26, commit a97eb3b
/projects	Projects	projects:project:read	Revisioned list-detail/project workspace	Projects pattern migration complete in Projects #2; durable evidence in govoplan-projects/docs/INTERFACE_PATTERN_MIGRATION.md
/reporting, /reports	Reporting	reporting:definition:read	Governed report catalogue, analytical workspace and evidence	Reporting pattern migration complete in Reporting #8; durable evidence in govoplan-reporting/docs/INTERFACE_PATTERN_MIGRATION.md
/risk-compliance	Risk Compliance	Workspace or sanctions read	Immutable source evidence, version-pinned screening, list-detail review, and revisioned assurance graph with explicit blockers and consequences	Risk Compliance pattern migration complete in Risk Compliance #8, commit 24d80a6
/scheduling	Scheduling	scheduling:schedule:read	List-detail/guided decision	Scheduling pattern migration complete in Scheduling #8, commit c17cbda
/scheduling/public/:requestId/:token	Scheduling	Public signed token	Public participation	Scheduling #8 complete in c17cbda
/search	Search	search:result:read	Keyboard-first global/context overlay and full results fallback	Search pattern migration complete in Search #4; durable evidence in govoplan-search/docs/INTERFACE_PATTERN_MIGRATION.md
/templates	Templates	Template read/write/publish/render/admin	Governed library, immutable-revision editor, compatibility preview, and render evidence	Templates pattern migration complete in Templates #5, commit 72fafa2
/tickets	Tickets	tickets:ticket:read	Governed operational queue/detail workspace with distinct report, triage, assignment, resolution, comment, reference and removal boundaries	Tickets vertical slice and pattern migration complete in Tickets #1, release v0.1.20
/voting	Voting	voting:ballot:read	Governed ballot workspace	Voting pattern migration complete in Voting #1, commit 2625990
/wiki	Wiki	wiki:page:read	Governed space-tree/page workspace with draft editing, immutable revision comparison, publication, comments, typed references and archival	Native Wiki vertical slice and pattern migration implemented in Wiki #1, release v0.1.20
/workflow	Workflow	Definition read or instance admin	Native BPMN editor, governed revision actions and execution evidence	Workflow pattern migration complete in Workflow #15; durable evidence in govoplan-workflow/docs/INTERFACE_PATTERN_MIGRATION.md

Final Module Closure Evidence

The final five module-owned work packages complete the 2026-08-03 rollout snapshot. Their module documents are the durable detailed inventories; the table below records the cross-product closure evidence.

Owner	Dominant archetype and consequential boundary	Focused evidence
Workflow	Definition list-detail plus specialized native BPMN editor; save/activate/archive/delete/reset and instance transitions remain revisioned, confirmed, and Engine-owned	Shared dialogs/status/alerts/help, dirty-navigation guard, keyboard palette insertion, edge inspector alternative, responsive/reduced-motion contract, TypeScript and focused structure test
Search	Focus-contained global/context overlay plus URL-stable full results; filters only narrow permission-aware source results	F3/Ctrl/Cmd+K, listbox keyboard navigation, provider-partial diagnostics, shared controls/help, narrow layout and focused overlay/interface tests
Reporting	Three-region governed analytical workspace; runs, schedules, exports and publications retain purpose, permission, source and policy provenance	Shared grid/dialog/status/help, keyboard-explainable Run blockers, responsive task order, provider/semantic backend tests and focused interface test
Projects	Revisioned list-detail planning workspace; visibility and saves are ACL/OCC-governed and retain a change reason	Shared dialog/status/help/field labels, save errors attached to the editor, semantic list controls, responsive/focus contract and focused interface test
Portal	Explained service directory and exact-revision provider handoff; Portal never owns the launched case/form/workflow effect	Shared status/alert/toggle/help/blocker controls, stable disabled Open action with actor/action/destination, guarded navigation, responsive layout and focused interface test

Future WebUI modules and newly added routes are not grandfathered by this snapshot. They must meet the same surface definition of done in their owning feature issue and pass the source/runtime inventory gates; they do not reopen this finite migration program unless the pattern contract itself changes.

Manifest And Runtime Route Alignment

Backend route metadata lets operators, Docs, release tooling, and remote bundle loading reason about the configured interface without executing module UI code. module.ts remains the executable local route/render source. Missing metadata is recorded here as an evidence gap; this inventory does not infer whether each gap is intentional.

The generated comparison is aligned for all authenticated canonical routes. Two deliberate exceptions remain visible:

• Campaign contributes /operator as a compatibility redirect for saved View projections; its canonical and manifest-declared destination is /campaigns/queue.
• Scheduling contributes /scheduling/public/:requestId/:token through the separate publicRoutes contract. Authenticated manifest routes intentionally do not describe public signed-token entry points yet.

Admin, Audit, Policy, Tenancy, and Views contribute composed administration or settings surfaces rather than direct routes. Their migration issues are Admin #8, Audit #8, Policy #11, Tenancy #6, and Views #2.

Release evidence must continue to run the generated inventory and manifest shape checks so new executable routes, public routes, aliases, and composed surfaces cannot silently diverge from their declared metadata.

Composed Surfaces And Extension Points

These surfaces are active only when the host and contributing modules are enabled and the actor passes the declared filters.

Host surface	Contributor and evidence	Contributed regions/actions	Pattern implication	Audit
/admin	Access host (AdminPage)	System tenants/users/roles, tenant users/groups/roles/API keys/settings, function-role mappings, user/group mail and file connector scopes	One stable admin information architecture must contain both host-owned and contributed sections	Pattern migration, contextual help, explained permission/protection states, optional-module blockers, localization, and focused evidence complete in Access #19 (1409dbf); Core #225 shared host contract complete
/admin	govoplan-admin admin.sections	Overview; system settings; configuration changes; configuration packages; role/group templates; module management	Configuration, guided operations, review/preflight, consequence	Pattern migration, contextual help, explained permission/protection/applicability states, guarded consequential actions, localization, and focused evidence complete in Admin #8 (d428f33)
/admin	govoplan-tenancy admin.sections	System tenant registry and active-tenant settings	Administration directory, effective configuration, lifecycle consequence	Pattern migration, contextual help, explained permission/lifecycle/system-policy states, dirty-state guards, localization, and focused evidence complete in Tenancy #6 (e76fe16)
/admin	govoplan-audit admin.sections	System audit; tenant audit	Evidence/provenance and reporting	Pattern migration, localized evidence projection, contextual help, and focused tests complete in Audit #8 (6d3fcc1)
/admin	govoplan-files admin.sections and files.connectors	System and tenant file connections plus scoped connector managers used by Access	Adaptive configuration, discovery/test, policy and credentials	Pattern migration, contextual help, blocker explanations and focused evidence complete in Files #42 (d8ae506)
/admin	govoplan-organizations admin.sections	Tenant organization settings	Configuration/list-detail	Pattern migration, tenant-owned provenance, contextual help, guarded settings/editor drafts, explained permission states, localization and focused evidence complete in Organizations #7 (97acfcb)
/admin	govoplan-policy admin.sections	System, tenant, group, and user retention	Effective value, source/provenance, consequential configuration	Pattern migration complete in Policy #11 (f964ed7) with Core editor contract fa32cca
/admin and /settings	govoplan-mail mail.profiles	System/tenant/group/user mail profile and policy managers	Same server/credential/policy grammar as file connectors	Pattern migration, contextual help, policy/target/permission blockers and focused evidence complete in Mail #20 (7844d9c; shared test-reason contract Core 2d0551a)
/settings	Core host	Profile; interface; workspace; local connection	Personal configuration with adaptive forms and immediate feedback	Pattern migration complete in Core #225 (fa32cca)
/settings	Files and Mail named capabilities	User-scoped file connections and mail profiles/policy	Optional integration regions disappear cleanly when capability absent	Files #42, Mail #20 and Core #225 complete
/admin and /settings	govoplan-views admin.sections, settings.sections, and views.runtime	System/tenant definition and assignment editors, personal/group editors, global selector	Versioned presentation projection with inheritance, lockout safeguards, optional directory targets, and no authorization effect	Pattern migration, contextual help, localized selector/editor, guarded drafts, explained inherited/permission/capability states, and focused evidence complete in Views #2 (c125f33)
/settings	govoplan-notifications settings.sections	Notification preferences	Personal configuration	Pattern migration, contextual help, permission/target explanation, typed toggles and focused evidence complete in Notifications #4 (ad6a31f)
/dashboard	Dashboard host and dashboard.widgets	Installed-modules widget; Ops health widget when Ops contributes it	Widget ordering, staleness, permissions, destination behavior	Pattern migration, view-aware composition, keyboard/drag alternatives, responsive packing, module filtering and focused evidence complete in Dashboard #3 (da3947f)
/organizations	IDM organizations.functionActions	Action leading to assignment view filtered by IDM scopes	Cross-module context action through explicit capability	IDM pattern migration complete in IDM #12 (d864317)
Campaign attachments/import	Files files.fileExplorer	Folder tree, managed chooser, file listing/pattern resolution/sharing	Optional domain composition without sibling-private imports	Campaign #74 pilot complete; watched-folder and duplicate-attachment product policy remain independent Campaign #60/#61 features
Campaign review/send	Mail runtime mail.devMailbox	Mock-mail verification when backend advertises runtime capability	Optional review stage with unavailable/optional states	Explicit intervention and review-progress vocabulary delivered in Campaign #63; send modes/progress delivered in #62/#79

Other named capability exports (files.connectors, organizations.functionPicker, and mail profile validation) are contracts consumed inside the composed surfaces above; they are not independent routes.

Core Configuration Surface Map

Core #225 now supplies and verifies the platform-owned configuration contract. The durable Core inventory is govoplan-core/docs/INTERFACE_PATTERN_MIGRATION.md.

Surface / code evidence	Primary task	Target pattern	Material consequence/state	Completion evidence
/settings (SettingsPage)	Change personal profile, interface/workspace preferences, or local development connection	Two-zone typed settings workspace	Changes are user-scoped; save and test actions distinguish clean, busy, and active states	Contextual help, unsaved guard, typed controls and keyboard-explainable disabled actions in Core fa32cca
Reusable credentials (CredentialEnvelopeManager)	Compare and configure scoped reusable authentication material	Repeated administration plus adaptive create/edit	Secret values are write-only; permission and missing-owner states block mutation explicitly; deletion can break dependent connections	Actionable blocker, stable row actions, typed references, unsaved guard and shared destructive confirmation
Retention (RetentionPolicyManagement)	Inspect effective retention and narrow permitted local values	Effective-policy editor	Parent locks, source paths and write authority control whether sensitive evidence can be retained	Typed narrowing controls, source-path help, lock/target/permission blockers and clean/loading/save reasons
Shared configuration primitives	Compose module-owned settings without sibling-private imports	Platform behavior contract	Consequence, focus, help, async, confirmation and permission semantics remain consistent	Core component suites, 121 module-system tests and full-product type/build/bundle gates

No primary Core configuration flow requires raw JSON. Expert JSON remains limited to diagnostics, interchange, conflict evidence, or read-only inspection.

Policy Surface Map

Policy #11 verifies the four composed retention sections. The durable module-level inventory is govoplan-policy/docs/INTERFACE_PATTERN_MIGRATION.md.

Surface / code evidence	Primary task	Target pattern	Material consequence/state	Completion evidence
System retention	Set the instance ceiling and run retention	Effective-policy editor plus destructive operation	An applied run can irreversibly redact/delete retained content; dry-run and applied evidence remain distinct	Core source-path/lock contract, permission and busy reasons, shared confirmation, typed/filterable outcome grid and audit-oriented wording
Tenant retention	Narrow the inherited system ceiling	Effective-policy editor	Tenant policy cannot silently loosen its parent	Core typed controls, effective path and parent-lock explanation
Group and user retention	Select an authorized target and narrow inherited policy	Targeted effective-policy editor	Selection exposes only bounded account/group labels; no retained content is returned	Delta-backed target loading, retry, missing-target blocker and responsive shared admin composition

Automated evidence for Policy f964ed7 comprises 50 backend/manifest tests, the Policy interface structural gate, 65 manifest-shape checks, and the full-product TypeScript/Vite build with structural localization, theme and bundle-budget gates. Policy uses no sibling-private imports.

Files Surface Map

Files #42 classifies and verifies the complete Files-owned route and composition boundary. The durable module-level inventory is govoplan-files/docs/INTERFACE_PATTERN_MIGRATION.md.

Surface / code evidence	Primary task	Target pattern	Material consequence/state	Completion evidence
/files (FilesPage)	Browse spaces/folders and repeatedly act on current content	Full-height directory/explorer	Navigation is low consequence; upload, synchronize, move, copy and share are medium; delete is high	Stable two-pane composition, contextual help, selection/permission/state-specific disabled reasons, shared confirmation and responsive collapse
Upload/archive, transfer, rename and connector-import dialogs	Supply, validate and review one bounded change	Adaptive create/edit or guided import	Writes managed content and may resolve conflicts or import untrusted bytes	Shared dialogs/drop zone, bounded archive preflight, conflict review, explicit confirmation and no browser-native confirmation
Share/access explanation	Inspect or change who can use a resource	Review/decision	Grants can disclose content; delete/revoke changes access	Shared access explanation, action components and destructive confirmation; backend redaction remains authoritative
File connector tree and connection/credential dialogs	Compare and configure external endpoints and reusable credentials	Administration plus adaptive create/edit	Endpoint, secret and capability changes can enable remote access	Shared connection tree/forms/advanced panel, endpoint discovery and login test, unsaved-change guard, read-only deployment provenance and actionable disabled reasons
Connector policy card	Narrow effective connector use	Effective-policy editor	Inherited deny/allow rules affect lower scopes	Typed selectors, deny-precedence warning, effective sources, contextual admin help and permission blocker
files.widget.spaces	See available spaces and enter Files	Dashboard widget	Space/provider names remain permission-filtered	Shared loading, alert and status components; bounded configuration and refresh
files.fileExplorer capability	Select a governed managed snapshot for another module	Directory chooser	Exact file/version becomes another module's governed input	Capability-only composition, no sibling-private import, stable chooser/confirmation and exact snapshot evidence

Automated evidence for commit d8ae506 comprises 104 Files backend tests, three focused Files WebUI structure tests, the full-product TypeScript/Vite build, structural localization audit, theme contract and bundle budget. Shared Dialog and disabled-tooltip behavior provide focus entry/return and keyboard-reachable explanations; responsive source order is guarded at 1050 px and 760 px. Secrets are not returned to the WebUI, and JSON remains only an advanced provider-compatibility escape hatch rather than the primary editor.

Mail Surface Map

Mail #20 classifies and verifies the complete Mail-owned route and composition boundary. The durable module-level inventory is govoplan-mail/docs/INTERFACE_PATTERN_MIGRATION.md.

Surface / code evidence	Primary task	Target pattern	Material consequence/state	Completion evidence
/mail (MailboxPage)	Browse an authorized provider mailbox without changing it	Full-height directory/explorer	Message metadata and content are private; every provider read is bounded and non-mutating	Stable three-pane composition, contextual help, explicit no-profile blocker, refresh reasons, keyboard rows, paging and responsive collapse
Mail profile tree and profile/server/credential dialogs	Compare and configure reusable transport identities	Administration plus guided/adaptive create/edit	Endpoint and credential changes can enable external effects	Shared connection tree/dialog/stage rail/forms, focused hierarchy editors, unsaved guard, connection tests, permission/target blockers and disabled-save reasons
Mail policy card	Narrow profile visibility, lower-scope definitions and transport/address patterns	Effective-policy editor	Inherited allow/deny rules affect delivery and lower scopes	Typed selectors and controls, effective source path, lock/read-only blocker, dirty-save state and contextual admin help
/mail/bounces watcher table	Configure and explicitly scan bounded IMAP evidence sources	Operational administration	Provider access changes durable source cursors and evidence	Shared grid/status/loading/alerts, actionable no-profile and busy states, field help and stable row actions
/mail/bounces observations and watcher removal	Review sanitized delivery outcomes or stop future scans	Evidence/reporting plus destructive confirmation	Recipient diagnostics are sensitive; watcher removal retains existing evidence	Bounded sanitized rows and shared confirmation with retained-evidence consequence
mail.profiles and reference-selector capabilities	Select/validate Mail-owned transport from another module	Governed capability composition	A selected identity can perform external effects	Stable references, Mail-owned authorization/secret resolution, no sibling-private imports and clean optional absence

Automated evidence for Mail commit 7844d9c and Core commit 2d0551a comprises 114 Mail backend tests, Mail's focused UI/model/structure suite, the Core shared mail-component suite, 65 manifest-shape checks and the full-product TypeScript/Vite build with structural localization, theme and bundle-budget gates. Shared Dialog and disabled-tooltip behavior provides focus containment, return and keyboard-reachable explanations. Responsive source order is guarded at 1250 px, 900 px and 760 px. Passwords remain write-only, mailbox responses are bounded, and bounce evidence excludes raw provider messages.

Campaign Pilot Surface Map

Campaign is detailed first because it exercises almost every archetype. The recipient-data editor is now consolidated into the recipients section on remote main; Campaign #67 records the accepted and verified integration boundary.

Campaign already consumes core primitives including ModuleSubnav, Card, PageTitle, Button, LoadingFrame, DismissibleAlert, FormField, StatusBadge, MetricCard, DataGrid, TableActionGroup, Dialog, ConfirmDialog, FileDropZone, MessageDisplayPanel, policy components, access/module capabilities, and unsaved-navigation guards. Reuse alone does not prove that the composition or states satisfy the pattern.

Surface / code evidence	Primary task	Target pattern	Material consequence/state	Known issue / rollout
Campaign list (CampaignListPage)	Find, compare, create, open	List-detail entry	Campaign lifecycle/status and creation	#74 and guided entry #35 complete
Overview (CampaignOverviewPage)	Understand/edit campaign identity, version, access, lifecycle	Object overview plus adaptive edit	Lock/archive/delete/access changes expose consequence, reversibility, owner/access and lifecycle evidence	#74 complete; lifecycle policy is independently extended in Campaign #26
Fields (CampaignFieldsPage)	Define recipient/template field schema	Structured editor	Schema changes can invalidate recipient/template data	#74 complete
Attachments/files (AttachmentsDataPage, AttachmentRulesOverlay)	Select sources and attachment/ZIP rules	Directory chooser plus adaptive rule editor	Missing or mismatched files affect built messages	#74 and attachment-detail #59 complete
Recipients (RecipientDataPage)	Select/import/map/edit recipients, address fields and per-recipient values/files	Import/mapping plus list-detail editor	Personal data, validation, bulk activation, file links	Consolidated editor #67, guided entry #35 and #74 audit complete; independent bulk action #68 remains product scope
Template (TemplateDataPage, placeholder/expression dialogs)	Author subject/body and preview substitutions	Adaptive editor plus stable preview	Generated communication content and unresolved expressions	#74 and stable overlay #73 complete
Mail settings (MailSettingsPage settings view)	Select/configure campaign mail transport	Adaptive configuration	Credentials, SMTP/IMAP destinations, test outcomes	#74 and Core #225 shared mail pattern complete; final credential hierarchy remains Mail #10
Campaign settings (GlobalSettingsPage settings view)	Configure campaign behavior	Adaptive configuration	Can alter validation/build/send behavior	#74 complete
Mail policy (MailSettingsPage policy view)	Inspect/override effective mail policy	Effective policy/provenance editor	Inheritance and locks affect allowed delivery	#74 and Core #225 effective-policy pattern complete
Campaign policy (GlobalSettingsPage policy view)	Inspect/override campaign policy	Effective policy/provenance editor	Inheritance, actor authority, and blocked edits	#74 and Core #225 effective-policy pattern complete
Review/send (ReviewSendPage)	Validate, build, mock-test, confirm/send, inspect results	Guided review/decision plus durable progress	External communication, bounded synchronous execution, persisted queue mode, partial effects, retries, evidence	Interventions #63, send/progress #62/#79 and #74 wording/accessibility audit complete
Message and attachment detail overlays	Inspect one built/mock message and its attachment links	Stable detail/review dialog	Personal data, exact outbound content, reviewed state	Delivered and verified in #59 and #73
Campaign report (CampaignReportPage)	Filter and inspect delivery outcomes	Reporting/list-detail	Partial, failed, explicitly excluded/skipped, SMTP/IMAP outcomes and retries	Server-owned filtering and counts delivered in #65 with the full-result DataGrid contract from Core #263; excluded semantics in #66
Audit (CampaignAuditPage)	Reach campaign evidence/history	Explained provenance handoff	Campaign emits platform evidence; Audit owns reading, retention and bundles	#74 complete as an explicit Audit handoff; object-scoped projection may follow Audit #3 without a sibling-private import
JSON (CampaignJsonView)	Inspect/download expert representation	Advanced diagnostics/reference	Full authorized configuration may contain personal data but no inline transport secrets	#74 privacy audit complete with explicit sensitivity warning and campaign-read boundary
Create wizard (CreateWizard)	Seed a campaign through basics, sender, fields, recipients, template, attachments, review, send	Guided setup	Current steps mix creation and later consequential delivery; completion semantics need audit	Guided first campaign #35
Review/send wizard routes	Focus the canonical review or send stage	Guided review	Thin wrappers render the same ReviewSendPage with a stable initial stage; no parallel workflow state exists	#74 inventory decision complete
Operator queue (OperatorQueuePage)	Monitor jobs and intervene	Monitoring/work queue	Campaign/version/job identity, historical active-version discovery, fixed action positions, authority-aware disabled states, exact non-overlapping queue counts, server-paged jobs, bounded refresh, retry/queue/reconcile per version, campaign-wide pause/resume/cancel, and leave/return progress	Durable controls #78 and #74 wording/accessibility audit complete
Aggregate reports (AggregateReportsPage)	Compare cross-campaign delivery outcomes	Privacy-preserving aggregate reporting	Tenant/campaign ACL, deployment/tenant small-cell policy, complementary and overlapping-cell suppression, explicit denominator, and no recipient detail/diagnostics/export/drill-down	Separate aggregate-reader surface delivered in #80; not parity with the permission-gated per-campaign detail report

The five review stages currently named in code are Validate and inspect, Build and review, Mock send and verify, Confirm and send, and Delivery results. Campaign #63 owns the intervention and status vocabulary; Workflow is not required to define or implement it.

Repositories Without A WebUI Package

The generated manifest snapshot reports no WebUI package for:

govoplan-assets, govoplan-booking, govoplan-certificates, govoplan-connectors, govoplan-consultation, govoplan-contracts, govoplan-decisions, govoplan-encryption, govoplan-evaluation, govoplan-facilities, govoplan-grants, govoplan-helpdesk, govoplan-identity, govoplan-identity-trust, govoplan-inspections, govoplan-learning, govoplan-mandates, govoplan-parties, govoplan-permits, govoplan-poll, govoplan-procurement, govoplan-records, govoplan-resources, govoplan-rest, govoplan-services, govoplan-soap, govoplan-transparency, and govoplan-workflow-engine.

Tenancy does provide composed administration surfaces despite having no direct route. This section is only negative package evidence; connector-only, capability-only, runtime-only, and backend-only modules may intentionally remain headless. A new WebUI should be created only for a concrete user task, not to make every module symmetrical.

Rollout Matrix

Order	Scope	Current evidence	Target	Owner / issue	Verification gate	Status
0	Product grammar and route inventory	Doctrine, ledger, layout rules, module contract, current route sources	One reconciled pattern language and evidence inventory	Meta #11	Reviewed route/component inventory, module documents, manifest shapes and focused contracts	Complete 2026-08-03
1	Campaign baseline integration	Recipient-editor WIP and tracker state have been reconciled with remote main	Integrated, testable baseline before migration claims	Campaign #67 and tracker cleanup	Backend and focused WebUI suites; issue evidence	Complete 2026-07-22
2	Campaign previews/details	Stable shared dialog with bounded scrolling and fixed responsive preview workspace	Stable header/body/footer, accessible long-content detail	Campaign #59 and #73	Review-preview and overlay structure tests	Complete 2026-07-22
3	Campaign review/interventions	Five domain-owned stages use central blocker and guided-review primitives; validation/build warnings name action, actor, and destination; hard blockers, individual review, and group review remain distinct; reviewed/remaining counts survive reload through build-bound review evidence	Clear stages, outcomes, blockers, next actor/action, reviewed evidence	Campaign #63	reviewProgress state tests, shared-component structure contract, TypeScript build, configured-system help topic, and Campaign documentation tests	Complete 2026-08-03 (d635f3a; Core primitives and contextual help b823a22)
4	Campaign send/progress	A hard deployment ceiling bounds synchronous delivery; the selected synchronous, worker-queue, or database-queue mode is explicit and persisted; progress and recovery survive navigation; immediate-send response and audit evidence are allowlisted	Pre-send mode/consequence plus durable leave/return progress, retry and reconciliation without recipient/provider leakage	Campaign #62 and #79	Boundary/concurrency/preflight, async selection, persisted mode, sanitized response/audit, partial/failure/retry and reload/return tests	Complete 2026-07-22 (7e16603, 60efd1c, 62a6879, b0282eb, f095a3e)
5	Campaign report filtering	Core DataGrid distinguishes client/full-result from server-owned queries; Campaign applies filter/sort/count before pagination and synchronizes count shortcuts with the grid query	One shared server-owned status/list/filter/count model	Campaign #65 and Core #263	DataGrid contract/build tests plus exact shortcut/query/filter/count and large-result behavior	Complete 2026-07-22 (e6062fe, cece71d, aa4ec66, 4eb651c)
6	Campaign operator recovery	A durable campaign/version queue page exposes historical work, exact non-overlapping state counts, persisted mode, permission-safe controls, server-paged job evidence, bounded refresh and active-state recovery	Fixed-position actions, disabled explanations, leave/return state, version-scoped retry/queue/reconcile and explicit campaign-wide pause/resume/cancel	Campaign #78	Queue model/structure, historical-version, permission, paging, recovery-control, stale-response and delta tests	Complete 2026-07-22 (21f3014, 99d44ee, 735e874)
7	Campaign aggregate reports	A separate aggregate-reader projection and UI expose only policy-suppressed business totals with a stable status domain	Explicit denominator and exclusions, deployment floor plus tenant-strengthened small-cell threshold, complementary and overlapping-cell suppression, no detail/export/diagnostics	Campaign #80	Aggregate query, cross-metric suppression, route/role/ACL, stable filter and UI structure tests	Complete 2026-07-22 (06125cc, fc36aee, 8ee87b7, ac3329c, 1225802)
8	Campaign excluded outcomes	Excluded build rows become explicit skipped transport outcomes and remain protected from queue/cancel/retry ambiguity	One durable source-to-job-to-report meaning with guarded historical normalization	Campaign #66	Builder/persistence, migration, query/count, queue-control and report-explanation tests	Complete 2026-07-22 (7229fb8)
9	Guided first campaign	Eight-stage creation flow persists current step/draft and hands off to ordinary review/delivery preparation	Task-oriented entry that hands off clearly to normal editing/review	Campaign #35	First-run flow, resume/back, partial validation, immutable-history and optional-module behavior, no implicit send	Complete 2026-07-30
10	Prove/extract generic primitives	Shared consequence, focus, help, blocker, unsaved-change, confirmation, connection-tree and effective-policy contracts now have Core and multiple module consumers	Keep Core behavior-only and leave domain composition in owning modules	Core #225 plus bounded follow-ups	Core behavior/accessibility tests and module-permutation tests	Complete 2026-08-03 (fa32cca; Files d8ae506; Mail 7844d9c)
11	Configured-system pattern help	Role/config-aware workflow, reference, pattern, and system topics are projected by Docs; shared route, field, blocker, and action links resolve to configured Docs or the hosted fallback	Stable configured-system guidance without feature-to-Docs imports	Docs #15	Docs suite, shared component tests, Campaign review tests, 46 module permutations, full-product bundle budget	Complete 2026-08-03 (Docs abe2f78; Core b823a22; Campaign d635f3a)
12	Admin/configuration family	Core host/settings/credential/retention contracts, shared primitives, module lifecycle, Files, Mail, Policy, Access, Admin, Tenancy, Views, and Organizations are integrated and verified	Continue the same consequence/provenance grammar only through bounded module-owned migrations	Core #225 and module children	Per-surface state/accessibility/consequence evidence	Core #225 complete fa32cca; Access 1409dbf; Files d8ae506; Mail 7844d9c; Policy f964ed7; Admin d428f33; Tenancy e76fe16; Views c125f33; Organizations 97acfcb
13	Remaining module surfaces	33 bounded module-owned issues cover every WebUI contributor not already tracked by Campaign #74 or completed Docs #15	Per-module audit and migration, ordered by user task and consequence rather than a bulk rewrite	Issues linked in the direct-route and composed-surface sections	Module-focused tests, manifest shapes, contextual Docs, and applicable definition-of-done gates	Complete: prior 28 recorded commits plus Workflow #15, Search #4, Reporting #8, Projects #2 and Portal #2 verified 2026-08-03
14	Manifest/runtime alignment	Authenticated canonical routes align; public signed-token and compatibility routes are explicit exceptions	Stable declarations reconcile with source and any effective runtime module combination	Meta #25	Strict duplicate/stale/undeclared declaration CI, per-module digests, and authorized read-only runtime inventory	Complete 2026-08-04

Workflow remains outside this rollout matrix because it has its own runtime and editor workstream, not because it is postponed. Focused views can be specified, manually selected, and tested through core composition contracts today. Workflow steps may activate those views through the same contract without changing the proven surface patterns.

Inventory Maintenance

When a route, nav item, named UI capability, host section, or Campaign workspace surface changes:

1. Update the owner, evidence, task, archetype, and consequence here.
2. Link the implementation issue and verification evidence.
3. Keep "unreviewed" until state, permission/privacy, consequence/provenance, accessibility, responsive, theme, i18n, and applicable async behavior have been checked.
4. Re-scan both module.ts and the backend manifest; do not infer one from the other.
5. Recreate the inventory from a clean release lockfile before using it as release evidence.