Service discovery -> Case intake -> Party and representation -> Mandate
resolution -> approval/deliberation -> formal Decision -> observed delivery
effect -> record and review references

The maintained concrete scenario is a German resident parking permit (Anwohnerparkausweis). Its versioned fixture is tests/fixtures/resident_parking_permit_journey.json. It pins the service, exact Form revision, resident inputs, digital and assisted channels, Case type, human review handoff, formal outcome, Postbox delivery channel, and Records filing/retention target. Generic permit wording is no longer acceptance evidence for this package.

The package is now executable rather than metadata-only. Its Access fragments create the bounded resident-permit clerk role, collect only the tenant-local responsibility group key and name, create that group, and bind the role. The Forms-owned fragment carries a digest-bound German-reference application schema and imports it as a tenant-local draft with source provenance. Reapplying the same source digest is a no-op; replacing an unrelated local definition remains blocked unless the reviewed package explicitly selects a new revision. Normal Forms review and publication are still required before the definition can serve new applications. The Workflow Engine-owned fragment materializes and activates the tenant review baseline, resolves the chosen responsibility group into each human handoff, and preserves the evidence, decision, and EUR 30 payment-review steps as a replay-safe contributed definition.

Services, Cases, Payments, Tasks, and the optional delivery and Records modules already execute the pinned journey through their runtime contracts, but their reusable configuration fragments are not yet claimed by this package. Until those module-owned configuration providers are added, the package preflight deliberately distinguishes the installed runtime composition from the Access, Forms, and Workflow configurations it can currently materialize.

An installed Forms and Forms Runtime pair adds an alternative governed entry path before case/workflow handoff:

Service discovery -> exact Form revision -> validated draft/submission
                  -> receipt and handoff evidence -> Case or Workflow owner

The assisted path now creates an authenticated, resumable session against that same exact Form revision. It records channel, affected and represented parties, authority, purpose, notice, responsible function, language, accessibility support, and field provenance. Submission fails closed until an immutable read-back outcome matches the current revision, values, attachments, and signatures. Saving a correction therefore requires a fresh confirmation rather than silently reusing old evidence.

Services, Cases, Parties, Mandates, Committee, and Decisions retain immutable provider-owned revisions for the parts they own. Portal, Cases, and Committee consume capabilities for cross-module semantics only. The package does not grant cross-module table access and can omit optional presentation, work, deliberation, delivery, or records modules while retaining explicit references to externally performed steps.

When Records is present, Forms Runtime, Cases, and Decisions expose exact, digest-bound source snapshots for explicit filing. The source module rechecks current access, Records chooses the destination and preserves chronology, and the filed reference never becomes an editable copy. When Search is present, the same three owners contribute rebuildable metadata-only projections. Form values, evidence payloads, Decision reasoning, operative results, and conditions are excluded; every candidate is authorized again before it is shown.

When Tasks is present, explicit work and source-owned Workflow handoffs appear in one resumable inbox with typed account, group, role, function, or assignment responsibility. Workflow Engine retains process state and completion commands; Tasks retains only explicit tasks and the aggregation surface.

Security And Recovery

Every provider is tenant-bound. Missing or conflicting authority fails closed. Protected Decision content has a separate permission. Writes are replay-safe and OCC-guarded. Database restore is the semantic-state recovery unit; file and communication effects remain governed by their owning providers and are linked through requested/observed effect, evidence, and audit references. Search is a derived recovery unit and can be rebuilt from authoritative module state.

The executable fixture in tests/test_institutional_governance_journey.py proves SQL-backed Service, Case, Party, Mandate, Committee meeting/agendum/vote/minute, and Decision state. tests/test_institutional_service_journey.py separately proves exact Portal Form launch, persisted submission provenance, idempotent replay, resumable assisted intake with enforced read-back evidence, and a durable Workflow handoff that remains visible through Tasks after the database session is reopened and disappears only after the Workflow Engine records completion. Core's production-component browser conformance suite additionally executes the German self-service and assisted Anwohnerparkausweis paths at desktop and mobile widths. It proves native keyboard order, accessible names and landmarks, WCAG 2.1 A/AA automation, responsive geometry, first-draft persistence, and mixed per-field person/document/system provenance. Physical screen-reader spot checks remain target-environment release evidence. Module-level Records source tests prove exact Form submission, Case revision, and Decision revision filing. Target-environment browser accessibility, production identity and delivery, a named archive profile, and recovery evidence are still required before this product package may claim reference_ready maturity.

The generic package orchestrator stops at the first provider apply or health blocker. Access and Forms may commit in separate provider transactions, so the operator must retain the reviewed pre-apply database snapshot until verification is complete. The Admin result reports no-op, snapshot-required, or partial-apply recovery state and never describes this as atomic cross-module undo. Exported fragments carry source/module/operator/scope provenance; supplied values and credentials are not serialized into that provenance.