Legal Document Versioning & Signing

Legal documents are platform-scoped and versioned per (type, language). Each LegalDocument carries a SHA-256 content-hash so any byte-level change requires a new version, and a superseded_by link to its successor. Publishing a new version through POST /legal/documents (platform-admin only) automatically sets superseded_by on the previously active version for the same (type, language) pair, so the active version is unambiguous and historical versions remain queryable. The public GET /legal/documents?type=&lang= reads the active version; GET /legal/documents/history (admin) lists every version sorted by effective_date descending.

Acceptance is recorded in a separate, tenant-scoped, append-only collection. LegalDocumentAcceptance is one immutable row per (tenant, type, version) capturing IP, user-agent, a copy of the content-hash at signing time and signing metadata. Today the platform supports clickwrap acceptance through POST /tenants/{id}/legal/{doc_type}/sign-clickwrap — a checkbox flow that records the contextual proof. DocuSign eSignature REST integration plus BankID QR collect-flow are stubbed in the codebase and return 501 until provider credentials land in Azure Key Vault; HMAC-SHA256 webhook validation is designed in. PDF generation via WeasyPrint for both unsigned drafts and signed documents (with signature attestation rendered into the footer) is on the same pending track.

The onboarding integration is what closes the loop. GET /tenants/{id}/legal/pending?lang= returns every document where the tenant either has no acceptance or where the active version requires re-acceptance because of a supersede event with material changes. The is_fully_accepted() service helper returns true exactly when the pending list is empty; the planned onboarding-guard wires this into POST /tenants so a new tenant cannot complete signup without a full acceptance set on file. Contracts will gain a legal_document_acceptances list of PydanticObjectIds linking the contract to the specific document versions accepted at execution, so a future dispute can reconstruct exactly what the parties agreed to and when.