Kaukus

Ship the Rust-backed voting replacement with agreed current-production feature parity and minimal safe deployment plumbing. Rust owns new voting runs; Rails retains authorization, voting-right source data, encrypted content and the surrounding UI. Keep the work deliberately bounded: restore actively used parity, preserve historical access with the simplest safe read-only or migration approach, prevent lifecycle regressions, configure database/secrets/connectivity/backups, validate in staging, and cut over. Do not turn this into a broader voting redesign, observability program, distributed-systems framework or unrelated Rails-to-Rust migration.

Prepare, rehearse, and deploy the Murmur transcription control plane and autoscaled Scaleway GPU workers for production use. Cover application reliability, infrastructure and networking, image delivery, secrets, persistence and recovery, observability, operational runbooks, and a controlled first workload.

Build an independent Rust/PostgreSQL identity platform, separately from the ZITADEL-compatible port, at /home/mathias/work/identity-platform. Use a feature-oriented modular monolith with Axum/SQLx, typed Maud views, Vite/Stimulus/custom CSS and self-hosted icons. Authoritative relational state, explicit migrations, curated transactional history and outbox; security reads must not depend on replay or asynchronous projections. Start with one shared Kaukus identity realm, reusable accounts, customer/operator organizations and independent project access/roles. Identity administration is Kaukus-internal; customers continue managing users through Kaukus, with a provisioning API to be built later. Keep business-specific meeting/voting/support permissions in Kaukus. Prove reuse through feature slices before adding generic abstractions or crate splits. No near-term production cutover; leave running ZITADEL unchanged and use only fresh synthetic fixtures.

Build a production-grade Rust replacement for the ZITADEL deployment based on production branch `feat/nb-translations` at commit `4877cddfba02c3fed166a35e19927360dd8467fe`. Reuse the existing PostgreSQL database in place without a schema or data migration, expose the OIDC and v2 API subset required by moeteadm, and replace the JavaScript-heavy login/admin applications with localized Askama server rendering in English (`en`), Norwegian Bokmål (`nb`), and Danish (`da`). Use Stimulus only for progressive enhancement and browser-only capabilities such as WebAuthn. Delivery uses a rehearsed hard cutover with secure rollback; it is not an MVP or disposable prototype.

Implement durable, retryable and idempotent delivery of voting-engine broadcasts, notifications and integration effects. Committed commands must recover from process or enqueue failure without resubmission; rolled-back commands must emit no effects. Include operational visibility and a safe production cutover. Source: [Implement voting-engine outbox delivery](https://task.matda.me/tasks/tsk_zdaraph9uw). Complete the project tasks to finish this work. Implementation details, dependencies, acceptance criteria and questions are in the individual tasks.