feat: add governed local content encryption provider

README.md

@@ -20,16 +20,25 @@ recovery ceremonies, and disable/uninstall assurance.
   state transitions;
 - recent high-assurance, distinct-custodian quorum recovery authorization;
 - typed APIs, audit-safe events, Alembic migration, and uninstall blocking;
-- Files and Postbox boundary fixtures.
+- a bundled `local_aesgcm` server-envelope provider using AES-256-GCM and
+  SQL-persisted wrapped vault/content keys;
+- owner-facing content protect/open/rewrap and two-phase re-encryption
+  operations that never export key material;
+- Files and Postbox encrypted-content adapters and fail-closed fixtures.
 
-## Deliberately Not Bundled
+## Provider Boundary
 
-The module contains no cipher implementation, raw key store, development master
-key, KMS/HSM driver, client E2EE protocol, or provider credentials. A deployment
-must install a separately reviewed provider capability. Until a concrete profile
-passes conformance, backup/restore, key-loss, interoperability, and security
-review, GovOPlaN must not claim that content is encrypted or end-to-end
-encrypted.
+The bundled provider derives a deployment wrapping key from `MASTER_KEY_B64` and
+keeps vault and per-content keys wrapped in shared SQL state. It provides real
+authenticated encryption at rest, but the application server can decrypt and
+therefore this is not E2EE, an HSM/KMS assurance claim, or independent
+certification. Production backup and restore must preserve the database,
+ciphertext storage, and exact deployment key as separate governed assets.
+
+No client E2EE protocol, tenant KMS/HSM driver, provider credentials, or formal
+certification profile is bundled. Those remain provider-specific work and must
+pass conformance, backup/restore, key-loss, interoperability, and security review
+before a stronger product claim is made.
 
 Feature modules continue to own content, authorization, retention, and resource
 ownership. Access approval, resource ownership, Identity Trust, and key custody