govoplan/docs/INTERFACE_SURFACE_INVENTORY.md

GovOPlaN Interface Surface Inventory And Rollout

This is the initial evidence inventory for the product-wide interface pattern language. It records code contributions, not an assertion that every listed surface is complete, enabled in a deployment, usable, or compliant.

The applicable design contract is INTERFACE_PATTERN_LANGUAGE.md.

Snapshot And Method

The source-derived inventory command is documented in PLATFORM_CONTROL_PLANE.md. It produces machine-readable field, label, translation, route, API-reference, and module manifest evidence. This hand-maintained document remains the reviewed product interpretation and rollout ledger; generated evidence does not replace it.

Snapshot refreshed: 2026-08-03.

The generated snapshot contains 65 module manifests, 35 WebUI-contributing repositories, 40 statically declared module routes, 1,156 UI fields, and 836 backend endpoints. All backend endpoints are classified and no stale endpoint declarations were found. The 234 endpoints without a static WebUI reference are kept visible as review evidence; they may intentionally serve workers, public clients, connectors, or external integrations.

Evidence was read from tracked Git HEAD in the local GovOPlaN checkouts:

• core routes and fallback behavior in govoplan-core/webui/src/App.tsx
• every present govoplan-*/webui/src/module.ts
• the matching backend src/*/backend/manifest.py
• named UI capabilities and contribution identifiers in each module.ts
• Campaign nested routes in its tracked CampaignWorkspace.tsx and SectionSidebar.tsx

Tracked commits are used as the integrated baseline. Dirty worktree changes are not treated as delivered behavior. The former Campaign recipient-editor and preview WIP is integrated in tracked commits; completed work is no longer described as a local exception.

Runtime visibility remains conditional on the module being packaged and enabled, server metadata, installed optional capabilities, the authenticated actor, tenant context, route permission guards, and inner-surface permission checks. A route in this inventory therefore means "the code contributes this route when its module is active", not "every user sees it".

Inventory states:

• Contributed: a route or named UI capability exists in tracked source.
• Metadata gap: frontend runtime source contributes a route but the backend manifest does not describe the same route/navigation surface.
• Unreviewed: the surface has not yet completed the pattern, state, accessibility, privacy, and consequence audit. This is the default unless an issue supplies verification evidence.
• Pilot: the surface is in the Campaign-first rollout.

Core Shell Surfaces

Surface	Owner and code evidence	Audience/access evidence	Primary task and target archetype	Audit / rollout
Public landing and login	govoplan-core PublicLandingPage; rendered while no authenticated principal exists	Unauthenticated; maintenance and backend-reachability context are shell inputs	Understand the service and authenticate; public entry	Unreviewed; later public-entry audit
Session/bootstrap state	govoplan-core App.tsx and AppShell	All browser sessions during bootstrap	Understand that session/platform state is loading; state contract	Unreviewed; core shell
/ authenticated redirect	govoplan-core chooses the first visible navigation destination	Authenticated; result depends on visible nav contributions	Enter the actor's first accessible service area; navigation behavior, not a content page	Unreviewed; focused-view/default-route work must preserve this fallback
/dashboard fallback	govoplan-core DashboardPage only when the Dashboard module is absent	Authenticated; no route-specific scope in core	Cross-module starting point; dashboard	Unreviewed; compare with module dashboard before shared changes
/settings	govoplan-core SettingsPage	Authenticated; contributed sections and integrations filter internally	Profile, UI/workspace preference, local connection, and user-scoped integration settings; configuration	Core-owned pattern migration complete in Core #225, commit fa32cca
Shell chrome	AppShell, Titlebar, IconRail, BreadcrumbBar, HelpMenu, language menu, unsaved-change provider	Public/authenticated variants; nav filtered later	Tenant/actor context, global navigation, help, language, session and maintenance state	Unreviewed; platform-owned prerequisite for focused views

Direct Module Route Contributions

The access column summarizes only the route-level declaration in module.ts. Inner APIs and controls may impose additional checks. Public and compatibility routes are called out explicitly because they do not have the same manifest semantics as authenticated navigation routes.

Routes	Owner	Route-level access	Primary archetype	Migration issue
/admin	Access	Any declared administration/read scope	Administration/configuration host	Access pattern migration complete in Access #19, commit 1409dbf; shared host contract complete in Core #225
/address-book	Addresses	addresses:contact:read	Directory/list-detail	Addresses #23
/approvals	Approvals	approvals:workspace:read	Work queue/guided decision	Approvals pattern migration complete in Approvals #3, commit 24e9559
/calendar	Calendar	calendar:event:read	Calendar/list-detail	Calendar #22
/campaigns, /campaigns/:campaignId/*, /campaigns/queue, /campaigns/reports, /templates	Campaign	Campaign read/report/control scopes; template route has no route guard	List-detail, guided review, monitoring, reporting	Campaign #74
/operator	Campaign	Campaign read plus queue/control scope	Compatibility redirect to /campaigns/queue	Campaign #74; retire under the compatibility policy
/cases, /cases/:caseId	Cases	cases:case:read	List-detail/case workspace	Cases #4
/committee	Committee	committee:workspace:read	Governed workspace	Committee pattern migration complete in Committee #2, commit e64af30
/dashboard	Dashboard	No route-specific scope	Dashboard	Dashboard #3
/dataflow	Dataflow	Pipeline read/admin	Graph editor/execution evidence	Dataflow #20
/datasources	Datasources	Catalogue read/source admin	Directory/configuration	Datasources #7
/distribution-lists	Distribution Lists	List read/write/admin	Governed directory, immutable-revision editor, expansion preview, and evidence register	Distribution Lists pattern migration complete in Distribution Lists #8, commit 6cdd804
/docs	Docs	Documentation or settings read	Documentation/reference	Docs #15
/files	Files	files:file:read	Directory/explorer	Files pattern migration complete in Files #42, commit d8ae506
/forms	Forms	forms:definition:read	Definition library/editor	Forms pattern migration complete in Forms #4, commit e505536
/forms-runtime, /forms-runtime/:instanceId	Forms Runtime	Participate or workspace read	Guided form execution	Forms Runtime pattern migration complete in Forms Runtime #5, commit 07dd35b
/idm	IDM	Assignment, function-change, relationship, or organization scopes	Directory/governed change	IDM pattern migration complete in IDM #12, commit d864317
/mail, /mail/bounces	Mail	Mailbox or bounce read/manage	Directory/explorer, operational evidence	Mail pattern migration complete in Mail #20, commit 7844d9c
/notifications	Notifications	notifications:notification:read	Inbox/list-detail	Notifications #4
/ops	Ops	Operations or settings read	Monitoring/evidence	Ops #4
/organizations	Organizations	Model/unit/function or settings read	Directory/hierarchy editor	Organizations pattern migration complete in Organizations #7, commit 97acfcb
/portal	Portal	portal:service:read	Service portal	Portal #2
/postbox	Postbox	postbox:postbox:read	Inbox/list-detail	Postbox pattern migration complete in Postbox #26, commit a97eb3b
/projects	Projects	projects:project:read	List-detail/project workspace	Projects #2
/reporting, /reports	Reporting	reporting:definition:read	Reporting/definition library	Reporting #8
/risk-compliance	Risk Compliance	Workspace or sanctions read	Governed work queue/evidence	Risk Compliance #8
/scheduling	Scheduling	scheduling:schedule:read	List-detail/guided decision	Scheduling pattern migration complete in Scheduling #8, commit c17cbda
/scheduling/public/:requestId/:token	Scheduling	Public signed token	Public participation	Scheduling #8 complete in c17cbda
/search	Search	search:result:read	Search overlay/results	Search #4
/templates	Templates	Template read/write/publish/render/admin	Governed library, immutable-revision editor, compatibility preview, and render evidence	Templates pattern migration complete in Templates #5, commit 72fafa2
/voting	Voting	voting:ballot:read	Governed ballot workspace	Voting pattern migration complete in Voting #1, commit 2625990
/workflow	Workflow	Definition read or instance admin	Graph editor/execution evidence	Workflow #15

Manifest And Runtime Route Alignment

Backend route metadata lets operators, Docs, release tooling, and remote bundle loading reason about the configured interface without executing module UI code. module.ts remains the executable local route/render source. Missing metadata is recorded here as an evidence gap; this inventory does not infer whether each gap is intentional.

The generated comparison is aligned for all authenticated canonical routes. Two deliberate exceptions remain visible:

• Campaign contributes /operator as a compatibility redirect for saved View projections; its canonical and manifest-declared destination is /campaigns/queue.
• Scheduling contributes /scheduling/public/:requestId/:token through the separate publicRoutes contract. Authenticated manifest routes intentionally do not describe public signed-token entry points yet.

Admin, Audit, Policy, Tenancy, and Views contribute composed administration or settings surfaces rather than direct routes. Their migration issues are Admin #8, Audit #8, Policy #11, Tenancy #6, and Views #2.

Release evidence must continue to run the generated inventory and manifest shape checks so new executable routes, public routes, aliases, and composed surfaces cannot silently diverge from their declared metadata.

Composed Surfaces And Extension Points

These surfaces are active only when the host and contributing modules are enabled and the actor passes the declared filters.

Host surface	Contributor and evidence	Contributed regions/actions	Pattern implication	Audit
/admin	Access host (AdminPage)	System tenants/users/roles, tenant users/groups/roles/API keys/settings, function-role mappings, user/group mail and file connector scopes	One stable admin information architecture must contain both host-owned and contributed sections	Pattern migration, contextual help, explained permission/protection states, optional-module blockers, localization, and focused evidence complete in Access #19 (1409dbf); Core #225 shared host contract complete
/admin	govoplan-admin admin.sections	Overview; system settings; configuration changes; configuration packages; role/group templates; module management	Configuration, guided operations, review/preflight, consequence	Pattern migration, contextual help, explained permission/protection/applicability states, guarded consequential actions, localization, and focused evidence complete in Admin #8 (d428f33)
/admin	govoplan-tenancy admin.sections	System tenant registry and active-tenant settings	Administration directory, effective configuration, lifecycle consequence	Pattern migration, contextual help, explained permission/lifecycle/system-policy states, dirty-state guards, localization, and focused evidence complete in Tenancy #6 (e76fe16)
/admin	govoplan-audit admin.sections	System audit; tenant audit	Evidence/provenance and reporting	Pattern migration, localized evidence projection, contextual help, and focused tests complete in Audit #8 (6d3fcc1)
/admin	govoplan-files admin.sections and files.connectors	System and tenant file connections plus scoped connector managers used by Access	Adaptive configuration, discovery/test, policy and credentials	Pattern migration, contextual help, blocker explanations and focused evidence complete in Files #42 (d8ae506)
/admin	govoplan-organizations admin.sections	Tenant organization settings	Configuration/list-detail	Pattern migration, tenant-owned provenance, contextual help, guarded settings/editor drafts, explained permission states, localization and focused evidence complete in Organizations #7 (97acfcb)
/admin	govoplan-policy admin.sections	System, tenant, group, and user retention	Effective value, source/provenance, consequential configuration	Pattern migration complete in Policy #11 (f964ed7) with Core editor contract fa32cca
/admin and /settings	govoplan-mail mail.profiles	System/tenant/group/user mail profile and policy managers	Same server/credential/policy grammar as file connectors	Pattern migration, contextual help, policy/target/permission blockers and focused evidence complete in Mail #20 (7844d9c; shared test-reason contract Core 2d0551a)
/settings	Core host	Profile; interface; workspace; local connection	Personal configuration with adaptive forms and immediate feedback	Pattern migration complete in Core #225 (fa32cca)
/settings	Files and Mail named capabilities	User-scoped file connections and mail profiles/policy	Optional integration regions disappear cleanly when capability absent	Files #42, Mail #20 and Core #225 complete
/admin and /settings	govoplan-views admin.sections, settings.sections, and views.runtime	System/tenant definition and assignment editors, personal/group editors, global selector	Versioned presentation projection with inheritance, lockout safeguards, optional directory targets, and no authorization effect	Pattern migration, contextual help, localized selector/editor, guarded drafts, explained inherited/permission/capability states, and focused evidence complete in Views #2 (c125f33)
/settings	govoplan-notifications settings.sections	Notification preferences	Personal configuration	Unreviewed
/dashboard	Dashboard host and dashboard.widgets	Installed-modules widget; Ops health widget when Ops contributes it	Widget ordering, staleness, permissions, destination behavior	Unreviewed
/organizations	IDM organizations.functionActions	Action leading to assignment view filtered by IDM scopes	Cross-module context action through explicit capability	IDM pattern migration complete in IDM #12 (d864317)
Campaign attachments/import	Files files.fileExplorer	Folder tree, managed chooser, file listing/pattern resolution/sharing	Optional domain composition without sibling-private imports	Pilot audit under Campaign #74
Campaign review/send	Mail runtime mail.devMailbox	Mock-mail verification when backend advertises runtime capability	Optional review stage with unavailable/optional states	Explicit intervention and review-progress vocabulary delivered in Campaign #63; send modes/progress delivered in #62/#79

Other named capability exports (files.connectors, organizations.functionPicker, and mail profile validation) are contracts consumed inside the composed surfaces above; they are not independent routes.

Core Configuration Surface Map

Core #225 now supplies and verifies the platform-owned configuration contract. The durable Core inventory is govoplan-core/docs/INTERFACE_PATTERN_MIGRATION.md.

Surface / code evidence	Primary task	Target pattern	Material consequence/state	Completion evidence
/settings (SettingsPage)	Change personal profile, interface/workspace preferences, or local development connection	Two-zone typed settings workspace	Changes are user-scoped; save and test actions distinguish clean, busy, and active states	Contextual help, unsaved guard, typed controls and keyboard-explainable disabled actions in Core fa32cca
Reusable credentials (CredentialEnvelopeManager)	Compare and configure scoped reusable authentication material	Repeated administration plus adaptive create/edit	Secret values are write-only; permission and missing-owner states block mutation explicitly; deletion can break dependent connections	Actionable blocker, stable row actions, typed references, unsaved guard and shared destructive confirmation
Retention (RetentionPolicyManagement)	Inspect effective retention and narrow permitted local values	Effective-policy editor	Parent locks, source paths and write authority control whether sensitive evidence can be retained	Typed narrowing controls, source-path help, lock/target/permission blockers and clean/loading/save reasons
Shared configuration primitives	Compose module-owned settings without sibling-private imports	Platform behavior contract	Consequence, focus, help, async, confirmation and permission semantics remain consistent	Core component suites, 121 module-system tests and full-product type/build/bundle gates

No primary Core configuration flow requires raw JSON. Expert JSON remains limited to diagnostics, interchange, conflict evidence, or read-only inspection.

Policy Surface Map

Policy #11 verifies the four composed retention sections. The durable module-level inventory is govoplan-policy/docs/INTERFACE_PATTERN_MIGRATION.md.

Surface / code evidence	Primary task	Target pattern	Material consequence/state	Completion evidence
System retention	Set the instance ceiling and run retention	Effective-policy editor plus destructive operation	An applied run can irreversibly redact/delete retained content; dry-run and applied evidence remain distinct	Core source-path/lock contract, permission and busy reasons, shared confirmation, typed/filterable outcome grid and audit-oriented wording
Tenant retention	Narrow the inherited system ceiling	Effective-policy editor	Tenant policy cannot silently loosen its parent	Core typed controls, effective path and parent-lock explanation
Group and user retention	Select an authorized target and narrow inherited policy	Targeted effective-policy editor	Selection exposes only bounded account/group labels; no retained content is returned	Delta-backed target loading, retry, missing-target blocker and responsive shared admin composition

Automated evidence for Policy f964ed7 comprises 50 backend/manifest tests, the Policy interface structural gate, 65 manifest-shape checks, and the full-product TypeScript/Vite build with structural localization, theme and bundle-budget gates. Policy uses no sibling-private imports.

Files Surface Map

Files #42 classifies and verifies the complete Files-owned route and composition boundary. The durable module-level inventory is govoplan-files/docs/INTERFACE_PATTERN_MIGRATION.md.

Surface / code evidence	Primary task	Target pattern	Material consequence/state	Completion evidence
/files (FilesPage)	Browse spaces/folders and repeatedly act on current content	Full-height directory/explorer	Navigation is low consequence; upload, synchronize, move, copy and share are medium; delete is high	Stable two-pane composition, contextual help, selection/permission/state-specific disabled reasons, shared confirmation and responsive collapse
Upload/archive, transfer, rename and connector-import dialogs	Supply, validate and review one bounded change	Adaptive create/edit or guided import	Writes managed content and may resolve conflicts or import untrusted bytes	Shared dialogs/drop zone, bounded archive preflight, conflict review, explicit confirmation and no browser-native confirmation
Share/access explanation	Inspect or change who can use a resource	Review/decision	Grants can disclose content; delete/revoke changes access	Shared access explanation, action components and destructive confirmation; backend redaction remains authoritative
File connector tree and connection/credential dialogs	Compare and configure external endpoints and reusable credentials	Administration plus adaptive create/edit	Endpoint, secret and capability changes can enable remote access	Shared connection tree/forms/advanced panel, endpoint discovery and login test, unsaved-change guard, read-only deployment provenance and actionable disabled reasons
Connector policy card	Narrow effective connector use	Effective-policy editor	Inherited deny/allow rules affect lower scopes	Typed selectors, deny-precedence warning, effective sources, contextual admin help and permission blocker
files.widget.spaces	See available spaces and enter Files	Dashboard widget	Space/provider names remain permission-filtered	Shared loading, alert and status components; bounded configuration and refresh
files.fileExplorer capability	Select a governed managed snapshot for another module	Directory chooser	Exact file/version becomes another module's governed input	Capability-only composition, no sibling-private import, stable chooser/confirmation and exact snapshot evidence

Automated evidence for commit d8ae506 comprises 104 Files backend tests, three focused Files WebUI structure tests, the full-product TypeScript/Vite build, structural localization audit, theme contract and bundle budget. Shared Dialog and disabled-tooltip behavior provide focus entry/return and keyboard-reachable explanations; responsive source order is guarded at 1050 px and 760 px. Secrets are not returned to the WebUI, and JSON remains only an advanced provider-compatibility escape hatch rather than the primary editor.

Mail Surface Map

Mail #20 classifies and verifies the complete Mail-owned route and composition boundary. The durable module-level inventory is govoplan-mail/docs/INTERFACE_PATTERN_MIGRATION.md.

Surface / code evidence	Primary task	Target pattern	Material consequence/state	Completion evidence
/mail (MailboxPage)	Browse an authorized provider mailbox without changing it	Full-height directory/explorer	Message metadata and content are private; every provider read is bounded and non-mutating	Stable three-pane composition, contextual help, explicit no-profile blocker, refresh reasons, keyboard rows, paging and responsive collapse
Mail profile tree and profile/server/credential dialogs	Compare and configure reusable transport identities	Administration plus guided/adaptive create/edit	Endpoint and credential changes can enable external effects	Shared connection tree/dialog/stage rail/forms, focused hierarchy editors, unsaved guard, connection tests, permission/target blockers and disabled-save reasons
Mail policy card	Narrow profile visibility, lower-scope definitions and transport/address patterns	Effective-policy editor	Inherited allow/deny rules affect delivery and lower scopes	Typed selectors and controls, effective source path, lock/read-only blocker, dirty-save state and contextual admin help
/mail/bounces watcher table	Configure and explicitly scan bounded IMAP evidence sources	Operational administration	Provider access changes durable source cursors and evidence	Shared grid/status/loading/alerts, actionable no-profile and busy states, field help and stable row actions
/mail/bounces observations and watcher removal	Review sanitized delivery outcomes or stop future scans	Evidence/reporting plus destructive confirmation	Recipient diagnostics are sensitive; watcher removal retains existing evidence	Bounded sanitized rows and shared confirmation with retained-evidence consequence
mail.profiles and reference-selector capabilities	Select/validate Mail-owned transport from another module	Governed capability composition	A selected identity can perform external effects	Stable references, Mail-owned authorization/secret resolution, no sibling-private imports and clean optional absence

Automated evidence for Mail commit 7844d9c and Core commit 2d0551a comprises 114 Mail backend tests, Mail's focused UI/model/structure suite, the Core shared mail-component suite, 65 manifest-shape checks and the full-product TypeScript/Vite build with structural localization, theme and bundle-budget gates. Shared Dialog and disabled-tooltip behavior provides focus containment, return and keyboard-reachable explanations. Responsive source order is guarded at 1250 px, 900 px and 760 px. Passwords remain write-only, mailbox responses are bounded, and bounce evidence excludes raw provider messages.

Campaign Pilot Surface Map

Campaign is detailed first because it exercises almost every archetype. The recipient-data editor is now consolidated into the recipients section on remote main; Campaign #67 records the accepted and verified integration boundary.

Campaign already consumes core primitives including ModuleSubnav, Card, PageTitle, Button, LoadingFrame, DismissibleAlert, FormField, StatusBadge, MetricCard, DataGrid, TableActionGroup, Dialog, ConfirmDialog, FileDropZone, MessageDisplayPanel, policy components, access/module capabilities, and unsaved-navigation guards. Reuse alone does not prove that the composition or states satisfy the pattern.

Surface / code evidence	Primary task	Target pattern	Material consequence/state	Known issue / rollout
Campaign list (CampaignListPage)	Find, compare, create, open	List-detail entry	Campaign lifecycle/status and creation	Audit in #74; guided entry #35
Overview (CampaignOverviewPage)	Understand/edit campaign identity, version, access, lifecycle	Object overview plus adaptive edit	Lock/archive/delete/access changes need real consequence and reversibility wording	#74 remaining audit
Fields (CampaignFieldsPage)	Define recipient/template field schema	Structured editor	Schema changes can invalidate recipient/template data	#74 audit
Attachments/files (AttachmentsDataPage, AttachmentRulesOverlay)	Select sources and attachment/ZIP rules	Directory chooser plus adaptive rule editor	Missing or mismatched files affect built messages	#74; attachment-detail #59
Recipients (RecipientDataPage)	Select/import/map/edit recipients, address fields and per-recipient values/files	Import/mapping plus list-detail editor	Personal data, validation, bulk activation, file links	Consolidated editor delivered in #67; #74 remaining audit and guided entry #35
Template (TemplateDataPage, placeholder/expression dialogs)	Author subject/body and preview substitutions	Adaptive editor plus stable preview	Generated communication content and unresolved expressions	#74; stable overlay #73
Mail settings (MailSettingsPage settings view)	Select/configure campaign mail transport	Adaptive configuration	Credentials, SMTP/IMAP destinations, test outcomes	#74; align with Core #225 mail pattern
Campaign settings (GlobalSettingsPage settings view)	Configure campaign behavior	Adaptive configuration	Can alter validation/build/send behavior	#74 audit
Mail policy (MailSettingsPage policy view)	Inspect/override effective mail policy	Effective policy/provenance editor	Inheritance and locks affect allowed delivery	#74; Core #225 policy pattern
Campaign policy (GlobalSettingsPage policy view)	Inspect/override campaign policy	Effective policy/provenance editor	Inheritance, actor authority, and blocked edits	#74; Core #225 policy pattern
Review/send (ReviewSendPage)	Validate, build, mock-test, confirm/send, inspect results	Guided review/decision plus durable progress	External communication, bounded synchronous execution, persisted queue mode, partial effects, retries, evidence	Blocking/non-blocking interventions and reviewed/remaining evidence delivered in #63; bounded synchronous and explicit/persisted queued modes delivered in #62 and #79; #74 audit remains
Message and attachment detail overlays	Inspect one built/mock message and its attachment links	Stable detail/review dialog	Personal data, exact outbound content, reviewed state	Delivered and verified in #59 and #73
Campaign report (CampaignReportPage)	Filter and inspect delivery outcomes	Reporting/list-detail	Partial, failed, explicitly excluded/skipped, SMTP/IMAP outcomes and retries	Server-owned filtering and counts delivered in #65 with the full-result DataGrid contract from Core #263; excluded semantics in #66
Audit (CampaignAuditPage)	Inspect campaign evidence/history	Provenance timeline/report	Actor/action/effect trace	#74 audit
JSON (CampaignJsonView)	Inspect expert representation	Advanced diagnostics/reference	Raw data may contain personal/configuration values; not a primary editor	#74 privacy/redaction audit
Create wizard (CreateWizard)	Seed a campaign through basics, sender, fields, recipients, template, attachments, review, send	Guided setup	Current steps mix creation and later consequential delivery; completion semantics need audit	Guided first campaign #35
Review/send wizard routes	Alternate guided review/send shells	Guided review	Tracked routes exist; implementation relationship to ReviewSendPage must be established, not guessed	#74 inventory decision
Operator queue (OperatorQueuePage)	Monitor jobs and intervene	Monitoring/work queue	Campaign/version/job identity, historical active-version discovery, fixed action positions, authority-aware disabled states, exact non-overlapping queue counts, server-paged jobs, bounded refresh, retry/queue/reconcile per version, campaign-wide pause/resume/cancel, and leave/return progress	Durable operator controls delivered in #78; #74 wording/accessibility audit remains
Aggregate reports (AggregateReportsPage)	Compare cross-campaign delivery outcomes	Privacy-preserving aggregate reporting	Tenant/campaign ACL, deployment/tenant small-cell policy, complementary and overlapping-cell suppression, explicit denominator, and no recipient detail/diagnostics/export/drill-down	Separate aggregate-reader surface delivered in #80; not parity with the permission-gated per-campaign detail report
Templates route (TemplatesPage)	Browse template records	Directory/list-detail	Template availability and later generated outputs	#74 audit; verify missing route guard intent

The five review stages currently named in code are Validate and inspect, Build and review, Mock send and verify, Confirm and send, and Delivery results. Campaign #63 owns the intervention and status vocabulary; Workflow is not required to define or implement it.

Repositories Without A WebUI Package

The generated manifest snapshot reports no WebUI package for:

govoplan-assets, govoplan-booking, govoplan-certificates, govoplan-connectors, govoplan-consultation, govoplan-contracts, govoplan-decisions, govoplan-encryption, govoplan-evaluation, govoplan-facilities, govoplan-grants, govoplan-helpdesk, govoplan-identity, govoplan-identity-trust, govoplan-inspections, govoplan-learning, govoplan-mandates, govoplan-parties, govoplan-permits, govoplan-poll, govoplan-procurement, govoplan-records, govoplan-resources, govoplan-rest, govoplan-services, govoplan-soap, govoplan-tickets, govoplan-transparency, govoplan-wiki, and govoplan-workflow-engine.

Tenancy does provide composed administration surfaces despite having no direct route. This section is only negative package evidence; connector-only, capability-only, runtime-only, and backend-only modules may intentionally remain headless. A new WebUI should be created only for a concrete user task, not to make every module symmetrical.

Rollout Matrix

Order	Scope	Current evidence	Target	Owner / issue	Verification gate	Status
0	Product grammar and route inventory	Doctrine, ledger, layout rules, module contract, current route sources	One reconciled pattern language and evidence inventory	Meta #11	Docs links/diff checks; issue/wiki sync after integration	Initial slice in this document
1	Campaign baseline integration	Recipient-editor WIP and tracker state have been reconciled with remote main	Integrated, testable baseline before migration claims	Campaign #67 and tracker cleanup	Backend and focused WebUI suites; issue evidence	Complete 2026-07-22
2	Campaign previews/details	Stable shared dialog with bounded scrolling and fixed responsive preview workspace	Stable header/body/footer, accessible long-content detail	Campaign #59 and #73	Review-preview and overlay structure tests	Complete 2026-07-22
3	Campaign review/interventions	Five domain-owned stages use central blocker and guided-review primitives; validation/build warnings name action, actor, and destination; hard blockers, individual review, and group review remain distinct; reviewed/remaining counts survive reload through build-bound review evidence	Clear stages, outcomes, blockers, next actor/action, reviewed evidence	Campaign #63	reviewProgress state tests, shared-component structure contract, TypeScript build, configured-system help topic, and Campaign documentation tests	Complete 2026-08-03 (d635f3a; Core primitives and contextual help b823a22)
4	Campaign send/progress	A hard deployment ceiling bounds synchronous delivery; the selected synchronous, worker-queue, or database-queue mode is explicit and persisted; progress and recovery survive navigation; immediate-send response and audit evidence are allowlisted	Pre-send mode/consequence plus durable leave/return progress, retry and reconciliation without recipient/provider leakage	Campaign #62 and #79	Boundary/concurrency/preflight, async selection, persisted mode, sanitized response/audit, partial/failure/retry and reload/return tests	Complete 2026-07-22 (7e16603, 60efd1c, 62a6879, b0282eb, f095a3e)
5	Campaign report filtering	Core DataGrid distinguishes client/full-result from server-owned queries; Campaign applies filter/sort/count before pagination and synchronizes count shortcuts with the grid query	One shared server-owned status/list/filter/count model	Campaign #65 and Core #263	DataGrid contract/build tests plus exact shortcut/query/filter/count and large-result behavior	Complete 2026-07-22 (e6062fe, cece71d, aa4ec66, 4eb651c)
6	Campaign operator recovery	A durable campaign/version queue page exposes historical work, exact non-overlapping state counts, persisted mode, permission-safe controls, server-paged job evidence, bounded refresh and active-state recovery	Fixed-position actions, disabled explanations, leave/return state, version-scoped retry/queue/reconcile and explicit campaign-wide pause/resume/cancel	Campaign #78	Queue model/structure, historical-version, permission, paging, recovery-control, stale-response and delta tests	Complete 2026-07-22 (21f3014, 99d44ee, 735e874)
7	Campaign aggregate reports	A separate aggregate-reader projection and UI expose only policy-suppressed business totals with a stable status domain	Explicit denominator and exclusions, deployment floor plus tenant-strengthened small-cell threshold, complementary and overlapping-cell suppression, no detail/export/diagnostics	Campaign #80	Aggregate query, cross-metric suppression, route/role/ACL, stable filter and UI structure tests	Complete 2026-07-22 (06125cc, fc36aee, 8ee87b7, ac3329c, 1225802)
8	Campaign excluded outcomes	Excluded build rows become explicit skipped transport outcomes and remain protected from queue/cancel/retry ambiguity	One durable source-to-job-to-report meaning with guarded historical normalization	Campaign #66	Builder/persistence, migration, query/count, queue-control and report-explanation tests	Complete 2026-07-22 (7229fb8)
9	Guided first campaign	Existing wizard routes and ordinary workspace overlap	Task-oriented entry that hands off clearly to normal editing/review	Campaign #35	First-run flow, resume/back, validation, optional modules, no implicit send	P1 after core pilot patterns stabilize
10	Prove/extract generic primitives	Shared consequence, focus, help, blocker, unsaved-change, confirmation, connection-tree and effective-policy contracts now have Core and multiple module consumers	Keep Core behavior-only and leave domain composition in owning modules	Core #225 plus bounded follow-ups	Core behavior/accessibility tests and module-permutation tests	Complete 2026-08-03 (fa32cca; Files d8ae506; Mail 7844d9c)
11	Configured-system pattern help	Role/config-aware workflow, reference, pattern, and system topics are projected by Docs; shared route, field, blocker, and action links resolve to configured Docs or the hosted fallback	Stable configured-system guidance without feature-to-Docs imports	Docs #15	Docs suite, shared component tests, Campaign review tests, 46 module permutations, full-product bundle budget	Complete 2026-08-03 (Docs abe2f78; Core b823a22; Campaign d635f3a)
12	Admin/configuration family	Core host/settings/credential/retention contracts, shared primitives, module lifecycle, Files, Mail, Policy, Access, Admin, Tenancy, Views, and Organizations are integrated and verified	Continue the same consequence/provenance grammar only through bounded module-owned migrations	Core #225 and module children	Per-surface state/accessibility/consequence evidence	Core #225 complete fa32cca; Access 1409dbf; Files d8ae506; Mail 7844d9c; Policy f964ed7; Admin d428f33; Tenancy e76fe16; Views c125f33; Organizations 97acfcb
13	Remaining module surfaces	33 bounded module-owned issues cover every WebUI contributor not already tracked by Campaign #74 or completed Docs #15	Per-module audit and migration, ordered by user task and consequence rather than a bulk rewrite	Issues linked in the direct-route and composed-surface sections	Module-focused tests, manifest shapes, contextual Docs, and applicable definition-of-done gates	Scheduling c17cbda, Audit 6d3fcc1, Access 1409dbf, Files d8ae506, Mail 7844d9c, Policy f964ed7, Admin d428f33, Tenancy e76fe16, Views c125f33, Organizations 97acfcb, Postbox a97eb3b, IDM d864317, Committee e64af30, Approvals 24e9559, Forms Runtime 07dd35b, Forms e505536, Voting 2625990, Distribution Lists 6cdd804, and Templates 72fafa2 complete
14	Manifest/runtime alignment	Several executable routes are absent from manifest metadata	Declared alignment or explicit validated exception	Core contract issue to create	Automated manifest/module route check and configured Docs verification	Discovery follow-up

Workflow remains outside this rollout matrix because it has its own runtime and editor workstream, not because it is postponed. Focused views can be specified, manually selected, and tested through core composition contracts today. Workflow steps may activate those views through the same contract without changing the proven surface patterns.

Inventory Maintenance

When a route, nav item, named UI capability, host section, or Campaign workspace surface changes:

1. Update the owner, evidence, task, archetype, and consequence here.
2. Link the implementation issue and verification evidence.
3. Keep "unreviewed" until state, permission/privacy, consequence/provenance, accessibility, responsive, theme, i18n, and applicable async behavior have been checked.
4. Re-scan both module.ts and the backend manifest; do not infer one from the other.
5. Recreate the inventory from a clean release lockfile before using it as release evidence.