feat(connectors): add governed DSAR coverage

src/govoplan_connectors/backend/manifest.py

@@ -13,6 +13,7 @@ from govoplan_core.core.module_guards import (
 from govoplan_core.core.datasources import CAPABILITY_DATASOURCE_ORIGINS
 from govoplan_core.core.feeds import CAPABILITY_CONNECTORS_FEEDS
 from govoplan_core.core.modules import (
+    CapabilityDocumentation,
     DocumentationTopic,
     FrontendModule,
     MigrationSpec,
@@ -48,6 +49,10 @@ from govoplan_connectors.backend.db.models import (
     ConnectorSimulationRun,
     ConnectorTabularSource,
 )
+from govoplan_connectors.backend.dsar_provider import (
+    CONNECTORS_DSAR_CAPABILITY,
+    ConnectorsDsarProvider,
+)
 from govoplan_connectors.backend.sanctions_sources import (
     SANCTIONS_READ_SCOPE,
     SANCTIONS_REFRESH_SCOPE,
@@ -202,7 +207,12 @@ EXTERNAL_PROVIDERS = (
         objects=(
             ProviderObjectDeclaration(
                 object_type="sanctions_source_snapshot",
-                field_groups=("source_identity", "raw_evidence", "entries", "acquisition_health"),
+                field_groups=(
+                    "source_identity",
+                    "raw_evidence",
+                    "entries",
+                    "acquisition_health",
+                ),
                 authority_modes=("external_authoritative", "external_mirror"),
                 default_authority_mode="external_mirror",
             ),
@@ -337,6 +347,10 @@ def _feed_provider(_context) -> ConnectorFeedProvider:
     return ConnectorFeedProvider()
 
 
+def _dsar_provider(_context) -> ConnectorsDsarProvider:
+    return ConnectorsDsarProvider()
+
+
 def _tenant_summary(session, tenant_id: str) -> dict[str, int]:
     return {
         "connector_definitions": (
@@ -418,6 +432,7 @@ manifest = ModuleManifest(
             name="connectors.runtime_contract",
             version=CONNECTOR_RUNTIME_INTERFACE_VERSION,
         ),
+        ModuleInterfaceProvider(name=CONNECTORS_DSAR_CAPABILITY, version="0.1.0"),
     ),
     permissions=PERMISSIONS,
     role_templates=ROLE_TEMPLATES,
@@ -449,6 +464,17 @@ manifest = ModuleManifest(
         CAPABILITY_DATASOURCE_ORIGINS: _datasource_origin_provider,
         CAPABILITY_CONNECTORS_SANCTIONS_SNAPSHOTS: (_sanctions_snapshot_provider),
         CAPABILITY_CONNECTORS_FEEDS: _feed_provider,
+        CONNECTORS_DSAR_CAPABILITY: _dsar_provider,
+    },
+    capability_documentation={
+        CONNECTORS_DSAR_CAPABILITY: CapabilityDocumentation(
+            label="Connector data-subject request provider",
+            summary=(
+                "Exports minimized operator attribution without connector secrets, "
+                "external payloads, or transport evidence."
+            ),
+            contract_version="0.1.0",
+        ),
     },
     tenant_summary_providers=(_tenant_summary,),
     architecture=ARCHITECTURE,
@@ -498,6 +524,46 @@ manifest = ModuleManifest(
         ),
     ),
     documentation=(
+        DocumentationTopic(
+            id="connectors.data-subject-requests",
+            title="Connector data-subject requests",
+            summary=(
+                "Export accountable connector activity without disclosing credentials "
+                "or external data."
+            ),
+            body=(
+                "Connectors correlates only an exact tenant account identifier and can "
+                "narrow an already verified search to one source, acquisition, "
+                "definition, configuration, or simulation. The export identifies the "
+                "subject's configuration, acquisition, simulation, and review activity "
+                "using bounded lifecycle metadata. It never includes credential or "
+                "endpoint references, source rows, external responses, request payloads, "
+                "mapping and configuration documents, diagnostics, provenance, hashes, "
+                "or transport evidence. Connector attribution remains immutable "
+                "governance and external-operation evidence and is retained rather than "
+                "automatically erased. Email or object identifiers without a verified "
+                "account identifier do not establish a match."
+            ),
+            layer="configured",
+            documentation_types=("admin", "user"),
+            audience=("user", "operator", "module_admin", "auditor"),
+            related_modules=("core", "access", "audit", "policy"),
+            order=37,
+            metadata={
+                "help_contexts": ["privacy.data-subject-requests"],
+                "consequence_classes": {
+                    "export_operator_attribution": (
+                        "Returns minimized connector activity for the exact account."
+                    ),
+                    "exclude_connector_secrets": (
+                        "Never returns credentials, endpoints, external rows, or evidence payloads."
+                    ),
+                    "retain_connector_evidence": (
+                        "Preserves configuration and external-operation accountability."
+                    ),
+                },
+            },
+        ),
         DocumentationTopic(
             id="connectors.governed-configuration",
             title="Govern connector definitions and simulations",