feat: add verifiable audit evidence bundles

src/govoplan_audit/backend/manifest.py

@@ -10,11 +10,12 @@ from govoplan_core.core.access import (
     CAPABILITY_AUTH_PRINCIPAL_RESOLVER,
 )
 from govoplan_core.core.module_guards import drop_table_retirement_provider, persistent_table_uninstall_guard
-from govoplan_core.core.modules import DocumentationTopic, FrontendModule, MigrationSpec, ModuleContext, ModuleManifest
+from govoplan_core.core.modules import DocumentationCondition, DocumentationTopic, FrontendModule, MigrationSpec, ModuleContext, ModuleManifest
 from govoplan_core.core.provider_governance import declared_module_architecture
 from govoplan_core.core.events import CAPABILITY_PLATFORM_EVENT_OUTBOX
 from govoplan_core.core.views import ViewSurface
 from govoplan_core.db.base import Base
+from govoplan_audit.backend.permissions import AUDIT_PERMISSIONS, AUDIT_ROLE_TEMPLATES
 
 
 def _route_factory(context: ModuleContext):
@@ -54,6 +55,8 @@ manifest = ModuleManifest(
     id="audit",
     name="Audit",
     version="0.1.18",
+    permissions=AUDIT_PERMISSIONS,
+    role_templates=AUDIT_ROLE_TEMPLATES,
     required_capabilities=(CAPABILITY_AUTH_PRINCIPAL_RESOLVER, CAPABILITY_AUTH_PERMISSION_EVALUATOR),
     route_factory=_route_factory,
     documentation=(
@@ -91,6 +94,32 @@ manifest = ModuleManifest(
                 ],
             },
         ),
+        DocumentationTopic(
+            id="audit.evidence-bundles",
+            title="Export and independently verify audit evidence",
+            summary="Authorized auditors can export bounded, redacted evidence bundles with canonical hashes and optional trusted signatures.",
+            body="Tenant exports require audit:evidence:export and remain tenant-scoped; system or all-scope exports require audit:system_evidence:export. Each bundle contains versioned audit-record DTOs, trace and policy/source provenance, external module evidence references, redaction declarations, and canonical hashes, but never raw messages, recipient lists, secrets, credentials, or file contents. Generation and download are audited. Use govoplan-audit-verify with optional trusted Ed25519 public keys and external evidence files to distinguish valid, incomplete, unverifiable, unsupported, and tampered evidence without database access. Modules contribute external references through serialized Core EvidenceReference-compatible facts or the export request; they do not import Audit internals.",
+            documentation_types=("user", "admin"),
+            audience=("auditor", "security_officer", "operator"),
+            conditions=(
+                DocumentationCondition(required_scopes=("audit:evidence:export",)),
+                DocumentationCondition(required_scopes=("audit:system_evidence:export",)),
+            ),
+            related_modules=("policy", "files"),
+            metadata={
+                "kind": "workflow",
+                "help_contexts": [
+                    "audit.evidence.export",
+                    "audit.evidence.verify",
+                    "audit.evidence.signing",
+                ],
+                "verification": [
+                    "Confirm the requested record scope is complete and bounded before export.",
+                    "Verify canonical hashes offline and supply trusted keys or referenced evidence when required.",
+                    "Treat missing external evidence, unverifiable references, and hash mismatches as distinct outcomes.",
+                ],
+            },
+        ),
     ),
     frontend=FrontendModule(
         module_id="audit",
@@ -108,6 +137,7 @@ manifest = ModuleManifest(
         ),
         retirement_supported=True,
         retirement_provider=drop_table_retirement_provider(
+            audit_models.AuditEvidenceBundle,
             audit_models.AuditLog,
             audit_models.AuditOutboxDelivery,
             audit_models.AuditOutboxEvent,
@@ -117,6 +147,7 @@ manifest = ModuleManifest(
     ),
     uninstall_guard_providers=(
         persistent_table_uninstall_guard(
+            audit_models.AuditEvidenceBundle,
             audit_models.AuditLog,
             audit_models.AuditOutboxDelivery,
             audit_models.AuditOutboxEvent,
@@ -134,12 +165,12 @@ manifest = ModuleManifest(
         maturity="vertical_slice",
         documentation_ref="docs/AUDIT_TRACE_CONTEXT.md",
         test_ref="tests/test_audit_module_contract.py",
-        known_limits=("Cross-deployment archival and evidentiary export profiles are not yet reference-ready.",),
-        owned_concepts=("audit record", "audit retention", "transactional event outbox"),
+        known_limits=("Cross-deployment long-term archive transfer remains deployment-specific.",),
+        owned_concepts=("audit record", "audit retention", "audit evidence bundle", "transactional event outbox"),
         non_owned_concepts=("domain record", "policy decision", "external effect"),
         recovery_docs=("README.md",),
-        security_docs=("docs/AUDIT_TRACE_CONTEXT.md",),
-        operations_docs=("README.md",),
+        security_docs=("docs/AUDIT_TRACE_CONTEXT.md", "docs/EVIDENCE_BUNDLES.md"),
+        operations_docs=("README.md", "docs/EVIDENCE_BUNDLES.md"),
     ),
 )