Agreed deployment boundary
This issue is now the Core safety contract behind the installation/update journey in GovOPlaN/govoplan #13 and…
Partial product decision and policy briefing
A function-bound Postbox belongs to the function/unit context, not to the individual incumbent. Obtaining the effective function therefore grants…
Decision briefing
Recommended production boundary:
- The in-app notification is the canonical durable record and always works without Mail.
- Email is a secondary delivery attempt submitted…
Decision briefing and recommended baseline
Group ownership should use policy-driven acceptance assurance rather than one hard-coded rule:
- Default: one currently authorized group manager…
The generic workflow and policy briefing is recorded in govoplan-core#276. Campaign should consume that contract rather than implement local transfer semantics. Recommended default is one…
Product decision: intentionally postponed
This redesign remains important, but the current envelope -> server -> reusable credential hierarchy and inheritance model is not accepted as final…
Product decision: governance model accepted
Concrete organization hierarchies are tenant-owned. The system owns versioned organization-model templates, not one mutable live hierarchy inherited…
Product decision: initial scope accepted
Implement first-class access explanations for:
campaign_version, identified by the persistent version UUID;campaign_delivery_job,…
Product decision: accepted
The initial contract is now fixed:
- No matching attachment rule means no attachment is expected. This state must never warn or block merely because the message has…
Focused verification is complete in bdc161e. The auditable delivery capability, durable hierarchy routes, producer isolation, current-holder access, and route/read/ack summaries are covered by…
Completed in bdc161e. Inbox and administration behavior now presents explicit withdrawn, expired, and inaccessible linked-message states, suppresses unavailable content, prevents invalid…
Completed in Postbox bdc161e, Campaign cd223cb, and Core 9b88ae3. Producer-scoped receipt summaries expose current-holder readability, read/ack evidence, hierarchy routes, withdrawal, and…