feat(approvals): add governed DSAR coverage

src/govoplan_approvals/backend/manifest.py

@@ -31,6 +31,10 @@ from govoplan_core.core.tasks import WorkItemProviderRegistration
 from govoplan_core.core.views import ViewSurface
 from govoplan_core.db.base import Base
 from govoplan_approvals.backend.db import models as approval_models
+from govoplan_approvals.backend.dsar_provider import (
+    APPROVALS_DSAR_CAPABILITY,
+    ApprovalsDsarProvider,
+)
 from govoplan_approvals.backend.service import SqlApprovalRequests
 
 
@@ -75,6 +79,10 @@ def _requests(_context: ModuleContext) -> SqlApprovalRequests:
     return SqlApprovalRequests()
 
 
+def _dsar_provider(_context: ModuleContext) -> ApprovalsDsarProvider:
+    return ApprovalsDsarProvider()
+
+
 def _work_items(_context: ModuleContext):
     from govoplan_approvals.backend.work_items import ApprovalWorkItemProvider
 
@@ -106,6 +114,7 @@ manifest = ModuleManifest(
     ),
     provides_interfaces=(
         ModuleInterfaceProvider(name=CAPABILITY_APPROVAL_REQUESTS, version="0.1.0"),
+        ModuleInterfaceProvider(name=APPROVALS_DSAR_CAPABILITY, version="0.1.0"),
     ),
     permissions=(
         _permission(
@@ -214,13 +223,24 @@ manifest = ModuleManifest(
             ),
         ),
     ),
-    capability_factories={CAPABILITY_APPROVAL_REQUESTS: _requests},
+    capability_factories={
+        CAPABILITY_APPROVAL_REQUESTS: _requests,
+        APPROVALS_DSAR_CAPABILITY: _dsar_provider,
+    },
     capability_documentation={
         CAPABILITY_APPROVAL_REQUESTS: CapabilityDocumentation(
             label="Governed approval requests",
             summary="Freezes exact subject approval chains and resolves auditable sequential decisions.",
             contract_version="0.1.0",
-        )
+        ),
+        APPROVALS_DSAR_CAPABILITY: CapabilityDocumentation(
+            label="Approvals data-subject request provider",
+            summary=(
+                "Exports personal decision participation and minimized actor "
+                "attribution without exposing immutable approval internals."
+            ),
+            contract_version="0.1.0",
+        ),
     },
     work_item_providers=(
         WorkItemProviderRegistration(
@@ -256,6 +276,47 @@ manifest = ModuleManifest(
     ),
     tenant_summary_providers=(_tenant_summary,),
     documentation=(
+        DocumentationTopic(
+            id="approvals.data-subject-requests",
+            title="Approval data-subject requests",
+            summary=(
+                "Export a subject's approval decisions and minimized lifecycle "
+                "attribution without disclosing unrelated chain content."
+            ),
+            body=(
+                "Approvals correlates exact account, membership, identity, or explicit "
+                "actor identifiers inside the active tenant. An optional request "
+                "identifier only narrows an already verified actor search and never "
+                "discloses a request by itself. Authored decisions include their bounded "
+                "reason, step, outcome, delegation reference, and actor activities. "
+                "Request, lifecycle, and template activity is minimized to attribution "
+                "and stable context. Approval payloads, authority provenance, signature "
+                "objects, hashes, idempotency keys, and replay state are excluded. "
+                "Decision-reason erasure requires manual legal and chain-integrity "
+                "review; all other attribution remains immutable evidence."
+            ),
+            layer="configured",
+            documentation_types=("admin", "user"),
+            audience=("user", "operator", "module_admin", "auditor"),
+            related_modules=("core", "access", "workflow_engine", "audit"),
+            metadata={
+                "help_contexts": [
+                    "approvals.workspace",
+                    "privacy.data-subject-requests",
+                ],
+                "consequence_classes": {
+                    "export_decision_participation": (
+                        "Returns bounded subject-authored decision evidence."
+                    ),
+                    "review_reason_erasure": (
+                        "Requires legal and approval-chain integrity review."
+                    ),
+                    "retain_attribution": (
+                        "Preserves minimized immutable lifecycle evidence."
+                    ),
+                },
+            },
+        ),
         DocumentationTopic(
             id="approvals.module-boundary",
             title="Governed approval chains",