govoplan/docs/evidence/snapshots/CAPABILITY_AND_INFRASTRUCTURE_FIT.generated.md

GovOPlaN Capability and IT-Infrastructure Fit Assessment

Generated from capability-fit-current.json. Edit and validate the machine-readable assessment, then regenerate this file; do not maintain conclusions independently in Markdown.

This is an evidence-based fit assessment, not a production approval or security certification. Repository or manifest existence alone never counts as an implemented capability. Unknown target requirements remain explicitly not_assessed.

Assessment record

Field	Value
Assessment ID	campaign-reference-2026-07-22
Schema version	govoplan.fit-assessment/0.2.0
Assessed on	2026-07-22
Scope	Campaign-centric internal pilot and small-production candidate
Release	stable-catalog-202607220843 (tagged_release)
Meta commit	5447299289a1
Deployment profile	production-like-dev · partial
Configuration packages	none: environment-profile basis only
Canonical input SHA-256	5a23f17c5289c5a89d2e92445f2c8b2eef54e3753f1392ebf300aff5508f0bfe

Controlled status vocabulary

Status	Meaning
verified	Implemented and directly exercised by evidence appropriate to the stated scope.
available_unconfigured	Implemented with supporting evidence, but not configured and exercised in the target.
partial	A useful subset exists, but a material part of the requirement is missing or unproved.
scaffold	Contracts or structure exist, but the end-to-end capability is not usable.
external_system	The deployment or another system must supply the capability.
planned	Only a concept, backlog item, or design direction exists.
not_fit	Evidence shows that the assessed composition cannot meet the requirement.
not_assessed	The requirement or target environment is not sufficiently known.

Scope and reference journeys

Reference journeys:

• Internal operator authors, validates, builds, queues, sends and reconciles an email Campaign with managed attachments
• Operator inspects delivery and audit evidence

Explicitly postponed:

• Workflow and workflow-driven user stories

Facts

• The assessment is pinned to signed stable catalog sequence 202607220843 and the exact module commits listed below.
• The Campaign authoring, validation, build, mock-delivery, managed-file, local-access, and local-audit paths have direct test or contract evidence.
• The production-like development profile runs PostgreSQL and Redis in containers while application processes use editable source trees.
• No installed-target, external-provider, reference-readiness, recovery, or production-approval evidence bundle is attached to this assessment.

Decisions

• Use Campaign as the first reference journey and flagship pilot scenario.
• Keep Workflow and workflow-driven user stories planned and explicitly postponed for this assessment.
• Use local GovOPlaN accounts for the bounded pilot; do not claim federated identity support.
• Do not approve small production until installed-artifact, target mail, monitoring, backup/restore, and recovery proof checks pass.

Assumptions

• The pilot can use local accounts and one internal tenant or office.
• A dedicated non-production SMTP/IMAP account and safe recipients are available.
• Pilot load fits one API and one worker until measured otherwise.
• Durable local storage is acceptable for the pilot.

Unresolved decisions

• What are the target organization's data classes, legal bases, retention and external-disclosure rules?
• Which identity, mail, file, address and monitoring systems are mandatory?
• What are Campaign volume, concurrency, growth, availability, RPO and RTO?
• Who owns each external runtime component and operational control?
• Which accessibility, security, support and procurement constraints are mandatory?

Pinned release and composition

Release reproducible: yes.

Release notes:

• The live stable catalog has a valid Ed25519 signature trusted through release-key-1.
• Core v0.1.13 and Campaign v0.1.10 are tagged and package-integrated; this is not target-environment or production approval.
• The absence of a configuration package is pinned explicitly as an environment-profile-only basis; this remains a promotion gap.

Module	Repository and commit	Manifest version	Enabled	Role
core	govoplan-core @ d487726f4d2c	0.1.13	yes	API, registry, migrations, sessions, kernel contracts and shared WebUI
tenancy	govoplan-tenancy @ efbec827616b	0.1.8	yes	Tenant context and lifecycle
organizations	govoplan-organizations @ 39c081c4fb8f	0.1.8	yes	Organization model
identity	govoplan-identity @ 7a1710af896f	0.1.8	yes	Normalized internal identity directory
access	govoplan-access @ f1d64d247e12	0.1.11	yes	Local authentication, sessions, API keys and RBAC
admin	govoplan-admin @ 11ecf362a36d	0.1.8	yes	Administration surfaces
dashboard	govoplan-dashboard @ 4b960ad37f0d	0.1.8	yes	Module-aware home surface
policy	govoplan-policy @ 1063622d311a	0.1.9	yes	Policy explanation and configuration boundary
audit	govoplan-audit @ d3d2c60d7dc1	0.1.8	yes	Database audit records and retrying audit outbox
campaigns	govoplan-campaign @ 735e874bd03c	0.1.10	yes	Campaign authoring, build, delivery control and reporting
files	govoplan-files @ 2b34f6e30578	0.1.9	yes	Managed files and Campaign attachments
mail	govoplan-mail @ 3e2302909022	0.1.10	yes	SMTP and IMAP profiles and transports
calendar	govoplan-calendar @ 9bcf41bb1fbb	0.1.8	yes	Optional calendar outside the Campaign pilot minimum
docs	govoplan-docs @ be52b716caed	0.1.10	yes	Configured-system documentation
ops	govoplan-ops @ 341773a4ff8a	0.1.8	yes	Readiness and deployment-profile visibility
addresses	govoplan-addresses @ 93dddbb8c52a	0.1.9	no	Optional reusable recipient sources and CardDAV

Deployment profile

Status: partial

PostgreSQL and Redis run in containers while API, WebUI, worker and scheduler run from editable source trees.

Evidence:

• configuration/current_workspace: govoplan/dev/production-like/docker-compose.yml
• documentation/documented_model: govoplan/dev/production-like/README.md

Recommended scenarios

Controlled Campaign pilot

Status: partial

Proceed with a bounded internal pilot after its provider, privacy, workload, and recovery proof checks are assigned and passed.

Composition: core, tenancy, organizations, identity, access, admin, dashboard, policy, audit, campaigns, files, mail, docs, ops.

Topology:

• One supervised GovOPlaN API process and one immutable built WebUI behind deployment-owned TLS termination
• One PostgreSQL database and a durable single-node or shared managed-file path
• One persistent private Redis broker and one supervised Celery worker when asynchronous delivery is enabled
• One dedicated non-production SMTP/IMAP account with a restricted safe-recipient policy
• External health checks, centralized logs, protected secret injection, and coordinated backup storage

Conditions:

• Use one internal tenant or office and controlled operators.
• Keep recipient volume non-critical until measured.
• Enable Addresses only when reusable recipient lists or CardDAV are explicitly in scope.
• Do not enable or claim Workflow from this assessment.

Small-production candidate

Status: partial

Do not approve production until every listed operational gate has target evidence and the residual risks have named owners.

Composition: core, tenancy, organizations, identity, access, admin, dashboard, policy, audit, campaigns, files, mail, docs, ops.

Topology:

• Immutable separately supervised WebUI, API, and worker artifacts behind monitored reverse-proxy TLS
• Dedicated or managed PostgreSQL with measured coordinated backup and isolated restore
• Persistent authenticated Redis with queue-age, queue-depth, and worker-health alerts
• Durable shared or S3-compatible object storage with versioning, lifecycle, and restore evidence
• Target-native secret management, centralized monitoring/logging/audit export, and an exercised incident and disaster-recovery procedure

Conditions:

• Pin and promote a configuration package instead of relying on an environment-only basis.
• Pass installed-release, target SMTP/IMAP, accessibility, privacy, security, operations, and recovery evidence gates.
• Agree availability, RPO, RTO, retention, support, and procurement requirements.
• Run only one scheduler unless distributed leadership or locking is proved.

Functional matrix context

Required modules

• core
• tenancy
• organizations
• identity
• access
• admin
• dashboard
• policy
• audit
• campaigns
• files
• mail
• docs
• ops

Optional modules

• addresses

External systems and connectors

• Deployment-owned reverse proxy and TLS certificate lifecycle
• Target SMTP/IMAP service and its DNS, certificate, throttling, bounce, and reply policies
• Target-native secret store, monitoring/logging platform, backup storage, and incident-response process

Missing contracts

• End-to-end federated identity provider and lifecycle contract
• Target monitoring, alert delivery, and central audit/SIEM acceptance contract
• Production configuration-package promotion and approval evidence

Policy decisions

• Recipient allow-list, permitted sender, attachment, retention, and external-disclosure policy
• Identity, MFA, break-glass, service-account, and joiner/mover/leaver policy
• Availability, RPO, RTO, support, procurement, and residual-risk ownership

Manual workarounds

• Use controlled local accounts while federation remains outside the verified slice
• Use one supervised scheduler where periodic work is unavoidable
• Keep provider reconciliation and production promotion under explicit operator review

Blockers

• No promoted configuration package is pinned
• No installed-target or target SMTP/IMAP proof is attached
• No coherent target backup/restore or disaster-recovery drill with measured RPO/RTO is attached
• No target privacy, security, accessibility, operations, or production-approval evidence is attached

Assessment questionnaire

Every required area remains visible even when its target answer is unknown.

Area	Question	State	Answer	Evidence
Scope Outcomes	Which journey is assessed?	answered	An internal operator authors, validates, builds, queues, sends and reconciles a Campaign with managed attachments.	—
Scope Outcomes	Is Workflow in scope?	answered	No; Workflow is planned and explicitly postponed.	—
Scope Outcomes	Which users, roles, tenants, organization units, and delegated functions participate?	assumed	One internal tenant or office with controlled Campaign operators; detailed organization and delegation shape remains target-specific.	—
Scope Outcomes	What constitutes pilot success and production acceptance?	answered	Pilot success requires the bounded Campaign journey and proof checks; production additionally requires installed-artifact, provider, privacy, security, operations, recovery, and approval evidence.	—
Data Policy	Which data classes and legal bases apply?	not_assessed	—	—
Data Policy	What retention, deletion, archive and legal-hold rules apply?	not_assessed	—	—
Data Policy	Which privacy, security, residency, minimization, access, and external-disclosure constraints apply?	not_assessed	—	—
Identity Integrations	May the pilot use local GovOPlaN accounts?	assumed	Yes; federation is outside the verified composition.	—
Identity Integrations	Which target SMTP/IMAP service and policy apply?	not_assessed	—	—
Identity Integrations	Which identity protocols, MFA, joiner/mover/leaver, service-account, and break-glass rules are mandatory?	not_assessed	—	—
Identity Integrations	Which connector protocols, versions, directions, authentication, certificate, rate-limit, egress, and degraded-mode requirements apply?	not_assessed	—	—
Workload Growth	What are Campaign frequency, recipients per Campaign, send window, import size and attachment volume?	not_assessed	—	—
Workload Growth	What are tenant, named-user, active-user, concurrent-user, and peak-request assumptions?	not_assessed	—	—
Workload Growth	What are tenant, user, concurrency, file, database, queue and audit growth assumptions?	not_assessed	—	—
Workload Growth	What connector traffic, scheduled-job, batch, queue-depth, queue-age, and external-rate-limit peaks apply?	not_assessed	—	—
Availability Operations	What availability, RPO and RTO are required?	not_assessed	—	—
Availability Operations	Who operates database, queue, storage, TLS, secrets, monitoring, backup and incident response?	not_assessed	—	—
Availability Operations	Which hosting, network-zone, egress, proxy, DNS, NTP, certificate-authority, residency, or disconnected-operation constraints apply?	not_assessed	—	—
Procurement Decisions	Which licensing, accessibility, security, certification, support and procurement conditions are mandatory?	not_assessed	—	—

Functional capability matrix

Requirement	Status	Evidence	Conditions and gaps	Recommendation and proof
platform.composition Compose enabled backend and WebUI modules without hard optional-module dependencies.	verified	test/committed_source: govoplan-core/tests/test_module_system.py; contract/current_workspace: govoplan/tools/checks/check-contracts.py (43 modules, 33 providers, 19 requirements, no issues)	Condition: Package integration is verified; repeat checks on the installed target composition.; Gap: No target deployment acceptance is recorded.; Risk: A reproducible module graph can still be installed or configured incorrectly.	Use the signed stable catalog and verify the minimal Campaign composition after installation. Proof: Run contract, migration, API and WebUI module-permutation gates on the installed release.
access.local Provide tenant-scoped local accounts, sessions, API keys and RBAC.	verified	test/committed_source: govoplan-access/tests/test_auth_dependencies.py; test/committed_source: govoplan-core/tests/test_api_smoke.py#cookie-session-csrf	Condition: Pilot accepts local accounts.; Gap: MFA and federated lifecycle are not part of this conclusion.; Risk: Manual account lifecycle may not satisfy production identity policy.	Use controlled local pilot accounts and define break-glass/bootstrap rules. Proof: Exercise joiner, role change, suspension and protected-owner recovery.
campaign.journey Author, validate, build, queue, send, reconcile and report a Campaign with frozen execution evidence.	verified	test/committed_source: govoplan-core/tests/test_api_smoke.py#campaign-create-validate-build-mock-send; test/committed_source: govoplan-campaign/tests (Campaign v0.1.10 is exactly the catalog-selected tagged source); configuration/committed_source: https://govoplan.add-ideas.de/catalogs/v1/channels/stable.json#sequence-202607220843 (Core v0.1.13 and Campaign v0.1.10 have matching catalogued Python and WebUI refs)	Condition: This verifies implementation paths, not target-provider delivery.; Gap: Usability and target-provider acceptance remain separate.; Risk: Package integration does not prove provider behavior or production operations.	Use the catalogued Campaign release for usability and target-provider acceptance. Proof: Run the complete journey with safe data and the target-like mail service.
files.managed_attachments Store and resolve managed Campaign attachments on durable storage.	verified	test/current_workspace: govoplan-files/tests (14 tests passed); test/current_workspace: govoplan-campaign/tests/test_attachment_building.py	Condition: Deployment provides a durable storage root.; Gap: Target backup and restore are not verified.; Risk: Node-local storage prevents safe independent API scaling.	Use durable local storage for the pilot and assess object/shared storage before scaling. Proof: Back up and restore files together with database references.
mail.smtp_imap Send Campaign mail through SMTP and optionally append sent messages through IMAP.	available_unconfigured	test/current_workspace: govoplan-mail/tests (22 tests passed); documentation/documented_model: govoplan-campaign/docs/CAMPAIGN_DELIVERY_RUNBOOK.md	Condition: Use a dedicated non-production service account and safe recipients.; Gap: No target provider, TLS chain, throttling or bounce/reply process was exercised.; Risk: Ambiguous provider outcomes can cause duplicate-send risk if reconciled incorrectly.	Run target-like interoperability and failure drills before production use. Proof: Prove SMTP acceptance, IMAP append, throttling and outcome reconciliation.
addresses.recipient_sources Select reusable address lists as Campaign recipient sources.	available_unconfigured	test/current_workspace: govoplan-addresses/tests (14 tests passed)	Condition: Enable the Addresses module explicitly.; Gap: Addresses is disabled in the pinned root profile.; Risk: Recipient governance may differ between source data and frozen Campaign evidence.	Enable only when reusable lists are a pilot requirement. Proof: Build a Campaign from a source list and verify immutable recipient provenance.
audit.local Retain tenant/system audit evidence and retry governed audit events.	verified	test/current_workspace: govoplan-audit/tests (5 tests passed)	Condition: Conclusion covers local database evidence only.; Gap: No central sink, retention enforcement or tamper-evident archive is verified.; Risk: Local audit evidence may not satisfy organizational records or SIEM requirements.	Define retention and export requirements before production approval. Proof: Exercise privileged-event review, retention and any required external export.
identity.federation Integrate external LDAP/AD, OIDC/SAML or SCIM identity infrastructure.	scaffold	documentation/documented_model: govoplan-idm/README.md	Gap: No end-to-end provider connector or federated login is verified.; Risk: Federation-dependent organizations cannot use the current pilot composition without extra implementation.	Use local pilot accounts or assess and implement the selected provider path. Proof: Run provider metadata, login/provisioning, deprovisioning and failure tests.
compliance.export_control Screen persons and organizations against embargo/sanctions lists with review evidence.	planned	issue/documented_model: #12	Gap: No provider, list provenance, match policy, review flow or legal evidence exists.; Risk: The current composition must not be represented as performing export-control screening.	Keep outside pilot claims until the user story is implemented and legally validated. Proof: Validate list ingestion, versioning, matching, false-positive review and audit evidence.
workflow Orchestrate the journey through Workflow.	planned	observation/documented_model: Assessment scope (Explicitly postponed)	Gap: Workflow is outside this assessment.; Risk: Including it would overstate the assessed composition.	Do not enable or claim Workflow for this reference pilot. Proof: Reassess in a later Workflow-focused composition.

Infrastructure matrix

Requirement	Status	Evidence	Conditions and gaps	Recommendation and proof
runtime.web_api Serve matching WebUI and API artifacts with health endpoints.	verified	test/committed_source: govoplan-core/tests/test_module_system.py; route/committed_source: govoplan-core/src/govoplan_core/server/fastapi.py#/health	Condition: Materialize the matching catalogued artifacts in the target.; Gap: No production image or service bundle is supplied by the profile.; Risk: Editable source processes are unsuitable as a production artifact.	Install matching catalogued WebUI/API refs and supervise them as immutable artifacts. Proof: Deploy the built artifacts and run health/module-route checks.
runtime.worker Run durable asynchronous Campaign jobs.	available_unconfigured	configuration/current_workspace: govoplan/tools/launch/launch-production-like-dev.sh	Condition: Redis and a supervised worker are required when Celery is enabled.; Gap: Target heartbeat, restart and queue-age alerting are not proved.; Risk: Queued work can stall silently without monitoring.	Start one worker for the pilot and split queues only after measurement. Proof: Interrupt and restart a worker while preserving job/reconciliation safety.
runtime.scheduler Run periodic recovery and cleanup safely.	partial	test/committed_source: govoplan-calendar/tests/test_outbox.py (Committed and pushed after the catalogued Calendar v0.1.8 tag)	Condition: Calendar outbox and recovery work is remote-integrated source but not stable-package-integrated.; Gap: No distributed leader election or target supervision is established.; Risk: Multiple schedulers can duplicate periodic dispatch without locking.	Omit from the Campaign-only pilot or run one supervised instance. Proof: Prove missed-schedule recovery and single-leader behavior.
data.postgresql Persist application state in PostgreSQL with explicit migrations.	verified	configuration/committed_source: govoplan/dev/postgres; test/committed_source: govoplan/tools/checks/postgres-integration-check.py	Condition: Target database remains deployment-owned.; Gap: HA, patching, WAL policy and capacity are not assessed.; Risk: A single unprotected database is a system-wide failure point.	Use managed or dedicated PostgreSQL with explicit migration and backup controls. Proof: Run migrations and restore a target-like database.
queue.redis Provide the Celery broker and queue persistence.	available_unconfigured	configuration/current_workspace: govoplan/dev/production-like/docker-compose.yml#redis	Gap: Authentication, TLS, eviction, HA and queue-loss policy are not assessed.; Risk: Broker loss or eviction can delay work even when database business state survives.	Configure private persistent Redis and monitor queue age/depth. Proof: Exercise broker interruption and worker recovery.
storage.local Persist managed files on a durable single-node/shared path.	verified	contract/committed_source: govoplan-files/src/govoplan_files/backend/storage/backends.py	Condition: Path is durable, private, writable and backed up.; Gap: Node-local storage cannot support independent API replicas.; Risk: Files can be lost or become inconsistent with database state.	Use for a bounded pilot only with coordinated backup. Proof: Restore files and verify all database references.
storage.object Use S3-compatible storage for independently scalable file persistence.	partial	test/current_workspace: govoplan-files/tests/test_connector_providers.py	Gap: No chosen target service or storage-backend interoperability drill.; Risk: Provider semantics, CA or lifecycle mismatch can break file access/retention.	Select and exercise the target object store before horizontal scaling. Proof: Upload, retrieve, version, back up and restore representative objects.
edge.proxy_tls Terminate HTTPS and enforce proxy/security policy.	external_system	route/committed_source: govoplan-ops/src/govoplan_ops/backend/api/v1/routes.py#deployment-security	Gap: No proxy, certificates, renewal, header or request-limit configuration is shipped here.; Risk: Incorrect proxy/cookie/CORS configuration can expose sessions or block legitimate use.	Supply and monitor the edge through the target platform. Proof: Run external TLS/header/cookie/CORS and upload-limit tests.
security.secret_store Inject and rotate master, database, mail and connector secrets.	external_system	configuration/committed_source: govoplan/.env.example	Gap: No target secret manager or rotation drill is selected.; Risk: Loss of the master key makes encrypted credentials unavailable; leakage compromises connectors.	Use target-native secret injection and document rotation/recovery. Proof: Rotate a non-production credential and recover from a protected backup.
identity.access Authenticate users and enforce tenant-scoped authorization through the selected identity mode.	verified	test/committed_source: govoplan-access/tests/test_auth_dependencies.py; test/committed_source: govoplan-core/tests/test_api_smoke.py#cookie-session-csrf	Condition: The bounded pilot accepts local GovOPlaN accounts.; Gap: Target MFA, federation, provisioning, and joiner/mover/leaver requirements are not assessed.; Risk: A local-only identity topology may not satisfy institutional production policy.	Use controlled local pilot accounts and assess the mandatory production identity topology separately. Proof: Exercise login, role change, account suspension, protected bootstrap, and break-glass recovery in the target.
connectors.mail Reach the selected SMTP/IMAP and other external connector endpoints under explicit network and provider policy.	available_unconfigured	test/current_workspace: govoplan-mail/tests (Protocol adapters have direct tests; no target provider was exercised); documentation/documented_model: govoplan-campaign/docs/CAMPAIGN_DELIVERY_RUNBOOK.md	Condition: The deployment supplies DNS, egress, proxy, CA trust, scoped service accounts, and provider limits.; Gap: No target endpoint, TLS chain, throttling, sender policy, bounce/reply path, or disclosure agreement is assessed.; Risk: Provider rejection, delay, or ambiguous outcomes can affect delivery and evidence completeness.	Use a dedicated safe provider account for the pilot and require target interoperability evidence before production. Proof: Exercise target-like SMTP acceptance, IMAP append, throttling, outage, retry, and reconciliation through the approved network path.
operations.monitoring Detect API, database, worker, queue, storage and delivery degradation.	partial	route/committed_source: govoplan-ops/src/govoplan_ops/backend/api/v1/routes.py#/ops/readiness; contract/committed_source: govoplan-core/src/govoplan_core/server/fastapi.py#slow-request-logging	Gap: No metrics exporter, log collector, dashboards, alert routes or SLO is verified.; Risk: Failures and queue backlog can remain unnoticed.	Integrate external monitoring before small production. Proof: Trigger each readiness/delivery failure and verify an actionable alert.
operations.audit Retain, monitor, review, and where required export security and business audit evidence.	partial	test/current_workspace: govoplan-audit/tests (Local audit persistence and retry behavior are exercised)	Condition: Local database audit evidence is part of coordinated backup and access review.; Gap: Target retention enforcement, tamper-evident export, SIEM integration, alerting, and privileged review are not verified.; Risk: Local evidence alone may not meet institutional security, records, or incident-response requirements.	Define the target audit retention, export, monitoring, and review controls before production approval. Proof: Exercise privileged-event review, retention, export failure/retry, and target SIEM or archive ingestion.
operations.backup_restore Back up and restore database, files, configuration and keys as a coherent service.	partial	documentation/documented_model: govoplan-core/docs/DEPLOYMENT_OPERATOR_GUIDE.md; issue/documented_model: GovOPlaN/govoplan-core#29	Gap: No target full-service restore drill or measured RPO/RTO exists.; Risk: Partial restore can produce missing files, unusable secrets or inconsistent evidence.	Treat Core #29 and a target restore drill as a production gate. Proof: Restore the whole service into an isolated environment and measure it.
operations.disaster_recovery Recover the service after site or dependency loss within agreed RPO/RTO.	not_assessed	absence/current_workspace: No target DR plan or exercise evidence supplied	Gap: RPO/RTO, off-site copies, recovery order, failover, communications and exercise schedule are unknown.; Risk: Service and evidence may be unrecoverable after a major incident.	Define and exercise DR before any availability commitment. Proof: Run a documented end-to-end recovery exercise.

Data flows and trust boundaries

Flow	From → to	Data	Trust boundary	Controls
browser.api	User browser → Reverse proxy and GovOPlaN WebUI/API	Session and CSRF cookies; Campaign content; Recipient personal data; Managed files	Client/public to application	HTTPS; Exact CORS origins; Secure cookies; Tenant and RBAC enforcement; Request limits
api.database	GovOPlaN API and workers → PostgreSQL	Tenant and identity records; Campaign drafts, snapshots and jobs; Connector metadata; Audit evidence	Application to primary state store	Dedicated database identity; Private or encrypted transport; Migrations; Backup and retention
api.queue.worker	GovOPlaN API → Redis and Celery worker	Job identifiers; Queue routing and retry metadata	Request plane to asynchronous processing plane	Private authenticated broker; Bounded payloads; Idempotent claims; Queue monitoring
worker.mail	GovOPlaN Campaign worker → External SMTP and IMAP services	Recipient addresses; Message bodies; Attachments; Sent-message copy	GovOPlaN to external communication provider	Scoped service account; TLS and CA policy; Sender and recipient policy; Rate limits; Outcome reconciliation
worker.connectors	GovOPlaN connector worker → External address, file, object or calendar service	Addresses; Files and provenance; Calendar resources	GovOPlaN to organizational/external content systems	Explicit sync direction; Scoped credentials; Endpoint allow-list; Provenance; Conflict and reconciliation policy

Risks and residual risks

Risk	Impact	Treatment	Owner	Residual risk
risk.reproducibility The signed package selection is reproducible but has not been accepted as an installed target composition.	Installation or configuration drift can still produce uncertain deployed behavior.	Materialize the signed catalog in an isolated target and run installed-artifact acceptance gates.	unassigned	Module and environment differences still require release-environment verification.
risk.delivery_provider Target SMTP/IMAP behavior and failure modes are unproved.	Failed, delayed or duplicate communication and incomplete evidence.	Run target-like interoperability, throttling and uncertainty drills.	unassigned	External provider outages and ambiguous outcomes remain operational risks.
risk.recovery Backup/restore and disaster recovery are not demonstrated across all state and keys.	Irrecoverable or inconsistent service after loss.	Complete Core #29 and an isolated full-service restore/DR exercise.	unassigned	Recovery time and data loss remain bounded by the selected external infrastructure.

Recommendations

• Proceed only with a controlled internal Campaign pilot after the bounded proof checks pass.
• Use the minimal composition and enable Addresses only for an explicit reusable-recipient journey.
• Do not claim Workflow, export-control screening, identity federation or production DR as implemented.
• Treat installed-release acceptance, target mail proof, monitoring and a coherent restore drill as production gates.

Proof-of-concept and promotion checks

1. Materialize the signed catalog into an isolated installation and rerun contract, migration and module-permutation gates against the installed artifacts.
2. Collect the isolated installation with the bounded installed-composition evidence contract; require exact enabled package/module versions, complete RECORD verification and immutable provenance anchored to this assessment.
3. Run a safe target-like Campaign through SMTP acceptance, IMAP append, reporting and audit.
4. Drill worker, Redis and ambiguous-delivery failures without duplicate sends.
5. Restore PostgreSQL, managed files, configuration and encrypted credentials and measure RPO/RTO.
6. Validate proxy/TLS, cookies/CORS, account bootstrap, secret redaction, monitoring and alert delivery.
7. Measure representative Campaign/file/queue/database load and external throttling.
8. Require separately issued, expiring and independently scope-authorized evidence before marking target environment, external provider or production approval proof as checked.

Generation contract

This report is deterministic output from the schema-validated JSON companion. The generator rejects duplicate JSON keys, schema drift, secret-bearing field names, stale checked-in output, and oversized inputs. A new assessment or release changes the canonical input hash and requires review of the affected evidence and conclusions through the release-aware reassessment tool.