107 lines
5.9 KiB
Markdown
107 lines
5.9 KiB
Markdown
# Governed Service To Decision
|
|
|
|
This product package composes independently owned institutional semantics into
|
|
one reconstructable administrative journey:
|
|
|
|
```text
|
|
Service discovery -> Case intake -> Party and representation -> Mandate
|
|
resolution -> approval/deliberation -> formal Decision -> observed delivery
|
|
effect -> record and review references
|
|
```
|
|
|
|
The maintained concrete scenario is a German resident parking permit
|
|
(`Anwohnerparkausweis`). Its versioned fixture is
|
|
`tests/fixtures/resident_parking_permit_journey.json`. It pins the service,
|
|
exact Form revision, resident inputs, digital and assisted channels, Case type,
|
|
human review handoff, formal outcome, Postbox delivery channel, and Records
|
|
filing/retention target. Generic permit wording is no longer acceptance
|
|
evidence for this package.
|
|
|
|
The package is now executable rather than metadata-only. Its Access fragments
|
|
create the bounded resident-permit clerk role, collect only the tenant-local
|
|
responsibility group key and name, create that group, and bind the role. The
|
|
Forms-owned fragment carries a digest-bound German-reference application schema
|
|
and imports it as a tenant-local draft with source provenance. Reapplying the
|
|
same source digest is a no-op; replacing an unrelated local definition remains
|
|
blocked unless the reviewed package explicitly selects a new revision. Normal
|
|
Forms review and publication are still required before the definition can serve
|
|
new applications. The Workflow Engine-owned fragment materializes and activates
|
|
the tenant review baseline, resolves the chosen responsibility group into each
|
|
human handoff, and preserves the evidence, decision, and EUR 30 payment-review
|
|
steps as a replay-safe contributed definition.
|
|
|
|
Services, Cases, Payments, Tasks, and the optional delivery and Records modules
|
|
already execute the pinned journey through their runtime
|
|
contracts, but their reusable configuration fragments are not yet claimed by
|
|
this package. Until those module-owned configuration providers are added, the
|
|
package preflight deliberately distinguishes the installed runtime composition
|
|
from the Access, Forms, and Workflow configurations it can currently materialize.
|
|
|
|
An installed Forms and Forms Runtime pair adds an alternative governed entry
|
|
path before case/workflow handoff:
|
|
|
|
```text
|
|
Service discovery -> exact Form revision -> validated draft/submission
|
|
-> receipt and handoff evidence -> Case or Workflow owner
|
|
```
|
|
|
|
The assisted path now creates an authenticated, resumable session against that
|
|
same exact Form revision. It records channel, affected and represented parties,
|
|
authority, purpose, notice, responsible function, language, accessibility
|
|
support, and field provenance. Submission fails closed until an immutable
|
|
read-back outcome matches the current revision, values, attachments, and
|
|
signatures. Saving a correction therefore requires a fresh confirmation rather
|
|
than silently reusing old evidence.
|
|
|
|
Services, Cases, Parties, Mandates, Committee, and Decisions retain immutable
|
|
provider-owned revisions for the parts they own. Portal, Cases, and Committee
|
|
consume capabilities for cross-module semantics only. The package does not
|
|
grant cross-module table access and can omit optional presentation, work,
|
|
deliberation, delivery, or records modules while retaining explicit references
|
|
to externally performed steps.
|
|
|
|
When Records is present, Forms Runtime, Cases, and Decisions expose exact,
|
|
digest-bound source snapshots for explicit filing. The source module rechecks
|
|
current access, Records chooses the destination and preserves chronology, and
|
|
the filed reference never becomes an editable copy. When Search is present,
|
|
the same three owners contribute rebuildable metadata-only projections. Form
|
|
values, evidence payloads, Decision reasoning, operative results, and
|
|
conditions are excluded; every candidate is authorized again before it is
|
|
shown.
|
|
|
|
When Tasks is present, explicit work and source-owned Workflow handoffs appear
|
|
in one resumable inbox with typed account, group, role, function, or assignment
|
|
responsibility. Workflow Engine retains process state and completion commands;
|
|
Tasks retains only explicit tasks and the aggregation surface.
|
|
|
|
## Security And Recovery
|
|
|
|
Every provider is tenant-bound. Missing or conflicting authority fails closed.
|
|
Protected Decision content has a separate permission. Writes are replay-safe
|
|
and OCC-guarded. Database restore is the semantic-state recovery unit; file and
|
|
communication effects remain governed by their owning providers and are linked
|
|
through requested/observed effect, evidence, and audit references. Search is a
|
|
derived recovery unit and can be rebuilt from authoritative module state.
|
|
|
|
The executable fixture in
|
|
`tests/test_institutional_governance_journey.py` proves SQL-backed Service,
|
|
Case, Party, Mandate, Committee meeting/agendum/vote/minute, and Decision state.
|
|
`tests/test_institutional_service_journey.py` separately proves exact Portal
|
|
Form launch, persisted submission provenance, idempotent replay, resumable
|
|
assisted intake with enforced read-back evidence, and a durable Workflow handoff
|
|
that remains visible through Tasks after the database session is reopened and
|
|
disappears only after the Workflow Engine records completion.
|
|
Module-level Records source tests prove exact Form submission, Case revision,
|
|
and Decision revision filing. Target-environment browser accessibility,
|
|
production identity and delivery, a named archive profile, and recovery evidence
|
|
are still required before this product package may claim `reference_ready`
|
|
maturity.
|
|
|
|
The generic package orchestrator stops at the first provider apply or health
|
|
blocker. Access and Forms may commit in separate provider transactions, so the
|
|
operator must retain the reviewed pre-apply database snapshot until verification
|
|
is complete. The Admin result reports no-op, snapshot-required, or partial-apply
|
|
recovery state and never describes this as atomic cross-module undo. Exported
|
|
fragments carry source/module/operator/scope provenance; supplied values and
|
|
credentials are not serialized into that provenance.
|