govoplan/packages/product/service-to-decision/README.md

Governed Service To Decision

This product package composes independently owned institutional semantics into one reconstructable administrative journey:

Service discovery -> Case intake -> Party and representation -> Mandate
resolution -> approval/deliberation -> formal Decision -> observed delivery
effect -> record and review references

An installed Forms and Forms Runtime pair adds an alternative governed entry path before case/workflow handoff:

Service discovery -> exact Form revision -> validated draft/submission
                  -> receipt and handoff evidence -> Case or Workflow owner

Services, Cases, Parties, Mandates, Committee, and Decisions retain immutable provider-owned revisions for the parts they own. Portal, Cases, and Committee consume capabilities for cross-module semantics only. The package does not grant cross-module table access and can omit optional presentation, work, deliberation, delivery, or records modules while retaining explicit references to externally performed steps.

When Records is present, Forms Runtime, Cases, and Decisions expose exact, digest-bound source snapshots for explicit filing. The source module rechecks current access, Records chooses the destination and preserves chronology, and the filed reference never becomes an editable copy. When Search is present, the same three owners contribute rebuildable metadata-only projections. Form values, evidence payloads, Decision reasoning, operative results, and conditions are excluded; every candidate is authorized again before it is shown.

When Tasks is present, explicit work and source-owned Workflow handoffs appear in one resumable inbox with typed account, group, role, function, or assignment responsibility. Workflow Engine retains process state and completion commands; Tasks retains only explicit tasks and the aggregation surface.

Security And Recovery

Every provider is tenant-bound. Missing or conflicting authority fails closed. Protected Decision content has a separate permission. Writes are replay-safe and OCC-guarded. Database restore is the semantic-state recovery unit; file and communication effects remain governed by their owning providers and are linked through requested/observed effect, evidence, and audit references. Search is a derived recovery unit and can be rebuilt from authoritative module state.

The executable fixture in tests/test_institutional_governance_journey.py proves SQL-backed Service, Case, Party, Mandate, Committee meeting/agendum/vote/minute, and Decision state. tests/test_institutional_service_journey.py separately proves exact Portal Form launch, persisted submission provenance, idempotent replay, and a durable Workflow handoff that remains visible through Tasks after the database session is reopened and disappears only after the Workflow Engine records completion. Module-level Records source tests prove exact Form submission, Case revision, and Decision revision filing. Target-environment browser accessibility, production identity and delivery, a named archive profile, and recovery evidence are still required before this product package may claim reference_ready maturity.