feat(encryption): add governed DSAR coverage

src/govoplan_encryption/backend/manifest.py

@@ -32,6 +32,10 @@ from govoplan_core.core.modules import (
 from govoplan_core.core.provider_governance import declared_module_architecture
 from govoplan_core.db.base import Base
 from govoplan_encryption.backend.db import models
+from govoplan_encryption.backend.dsar_provider import (
+    ENCRYPTION_DSAR_CAPABILITY,
+    EncryptionDsarProvider,
+)
 from govoplan_encryption.backend.local_provider import (
     LOCAL_PROVIDER_ID,
     LocalAesGcmProvider,
@@ -88,6 +92,10 @@ def _local_provider(context: ModuleContext) -> LocalAesGcmProvider:
     return LocalAesGcmProvider(getattr(context.settings, "master_key_b64", None))
 
 
+def _dsar_provider(_context: ModuleContext) -> EncryptionDsarProvider:
+    return EncryptionDsarProvider()
+
+
 def _disable_guard(
     session: object | None,
     _module_id: str,
@@ -188,6 +196,7 @@ manifest = ModuleManifest(
             name=CAPABILITY_ENCRYPTION_DISABLE_PREFLIGHT,
             version="1.0.0",
         ),
+        ModuleInterfaceProvider(name=ENCRYPTION_DSAR_CAPABILITY, version="0.1.0"),
     ),
     permissions=PERMISSIONS,
     role_templates=ROLE_TEMPLATES,
@@ -235,6 +244,7 @@ manifest = ModuleManifest(
         CAPABILITY_ENCRYPTION_CONTENT_CIPHER: _service,
         CAPABILITY_ENCRYPTION_RECOVERY: _service,
         CAPABILITY_ENCRYPTION_DISABLE_PREFLIGHT: _service,
+        ENCRYPTION_DSAR_CAPABILITY: _dsar_provider,
         f"{CAPABILITY_ENCRYPTION_KEY_MATERIAL_PROVIDER_PREFIX}{LOCAL_PROVIDER_ID}": _local_provider,
         f"{CAPABILITY_ENCRYPTION_CONTENT_CIPHER_PROVIDER_PREFIX}{LOCAL_PROVIDER_ID}": _local_provider,
     },
@@ -281,6 +291,14 @@ manifest = ModuleManifest(
             ),
             contract_version="1.0.0",
         ),
+        ENCRYPTION_DSAR_CAPABILITY: CapabilityDocumentation(
+            label="Encryption data-subject request provider",
+            summary=(
+                "Exports minimized cryptographic custody attribution without key "
+                "material, ciphertext references, or protected evidence."
+            ),
+            contract_version="0.1.0",
+        ),
     },
     migration_spec=MigrationSpec(
         module_id=MODULE_ID,
@@ -322,6 +340,50 @@ manifest = ModuleManifest(
         ),
     ),
     documentation=(
+        DocumentationTopic(
+            id="encryption.data-subject-requests",
+            title="Encryption data-subject requests",
+            summary=(
+                "Export cryptographic custody participation without exposing protected "
+                "content or key material."
+            ),
+            body=(
+                "Encryption correlates only an exact tenant account identifier and can "
+                "narrow an already verified search to a vault, key operation, envelope, "
+                "migration, or recovery ceremony. The export reports minimized vault "
+                "administration, key-operation requests, protection registrations, "
+                "migrations, and recovery participation. It never returns provider or "
+                "public key references, wrapped keys, nonces, ciphertext locations, "
+                "resource identifiers, digests, request payloads, assurance and policy "
+                "references, recovery reasons, idempotency keys, or provenance. Feature "
+                "modules remain responsible for exporting the plaintext semantics of "
+                "their own protected resources. Cryptographic lifecycle and custody "
+                "attribution remains immutable security evidence and is retained rather "
+                "than automatically erased."
+            ),
+            layer="configured",
+            documentation_types=("admin", "user"),
+            audience=("user", "administrator", "security_officer", "auditor"),
+            related_modules=("core", "identity_trust", "audit", "policy"),
+            order=95,
+            metadata={
+                "help_contexts": [
+                    "encryption.admin.operations",
+                    "privacy.data-subject-requests",
+                ],
+                "consequence_classes": {
+                    "export_custody_attribution": (
+                        "Returns minimized lifecycle activity for the exact account."
+                    ),
+                    "exclude_cryptographic_secrets": (
+                        "Never returns key material, ciphertext references, nonces, or protected evidence."
+                    ),
+                    "retain_cryptographic_evidence": (
+                        "Preserves immutable custody and recovery accountability."
+                    ),
+                },
+            },
+        ),
         DocumentationTopic(
             id="encryption.boundary",
             title="Encryption and key-custody boundary",