Implement governed encryption lifecycle

README.md

@@ -4,45 +4,39 @@
 **Repository type:** module (platform).
 <!-- govoplan-repository-type:end -->
 
-`govoplan-encryption` is the optional platform boundary for managed key vaults,
-content encryption, end-to-end encryption profiles, key rotation, recovery, and
-cryptographic deletion assurance.
+`govoplan-encryption` is the optional provider-neutral boundary for governed key
+vaults, versioned content-protection envelopes, key lifecycle operations,
+recovery ceremonies, and disable/uninstall assurance.
 
-The module is deliberately scaffolded before cryptographic implementation. It
-announces stable integration surfaces and policy boundaries without presenting
-placeholder cryptography as production-ready protection.
+## Implemented
 
-## Boundary
+- opaque provider capability contracts; raw key material never crosses them;
+- tenant/scope-bound vault and key-version metadata;
+- idempotent provision, rotation, revocation, destruction scheduling, and
+  outcome-unknown reconciliation;
+- versioned ciphertext envelopes with authenticated-context and migration
+  provenance;
+- resumable, evidence-backed rewrap, re-encryption, decrypt, export, and destroy
+  state transitions;
+- recent high-assurance, distinct-custodian quorum recovery authorization;
+- typed APIs, audit-safe events, Alembic migration, and uninstall blocking;
+- Files and Postbox boundary fixtures.
 
-The module will own:
+## Deliberately Not Bundled
 
-- vault and key hierarchy metadata
-- envelope-key wrapping and rotation workflows
-- content-protection profiles, including E2EE profiles
-- device and recipient key registration
-- recovery ceremonies, assurance evidence, and key custody
-- disable and uninstall preflight for protected content
+The module contains no cipher implementation, raw key store, development master
+key, KMS/HSM driver, client E2EE protocol, or provider credentials. A deployment
+must install a separately reviewed provider capability. Until a concrete profile
+passes conformance, backup/restore, key-loss, interoperability, and security
+review, GovOPlaN must not claim that content is encrypted or end-to-end
+encrypted.
 
-Feature modules continue to own their content, authorization, retention, and
-normal ownership records. They integrate through optional encryption
-capabilities and store only stable protection references and ciphertext.
+Feature modules continue to own content, authorization, retention, and resource
+ownership. Access approval, resource ownership, Identity Trust, and key custody
+are separate decisions.
 
-## Disable Rule
-
-Disabling or uninstalling this module must never make protected content silently
-unreadable. Every protected object must first be decrypted, rewrapped to another
-available provider, exported with explicit key custody, or deliberately
-destroyed under an authorized cryptographic-deletion process. The eventual
-uninstall guard will block while unresolved protection references remain.
-
-See [docs/ENCRYPTION_BOUNDARY.md](docs/ENCRYPTION_BOUNDARY.md) for the initial
-threat, ownership, recovery, and lifecycle decisions.
-
-## Current State
-
-The repository currently contains a discoverable manifest, permission and role
-metadata, versioned interface announcements, documentation, and focused tests.
-It has no routes, persistence, WebUI, key generation, or encryption runtime yet.
+See [docs/ENCRYPTION_BOUNDARY.md](docs/ENCRYPTION_BOUNDARY.md) for the threat
+model, profile consequences, algorithms, recovery, and disable semantics.
 
 ## Verification