Add governed encryption administration

src/govoplan_encryption/backend/manifest.py

@@ -19,6 +19,7 @@ from govoplan_core.core.modules import (
     CapabilityDocumentation,
     DocumentationLink,
     DocumentationTopic,
+    FrontendModule,
     MigrationSpec,
     ModuleContext,
     ModuleInterfaceProvider,
@@ -26,6 +27,7 @@ from govoplan_core.core.modules import (
     ModuleUninstallGuardResult,
     PermissionDefinition,
     RoleTemplate,
+    ViewSurface,
 )
 from govoplan_core.core.provider_governance import declared_module_architecture
 from govoplan_core.db.base import Base
@@ -190,6 +192,43 @@ manifest = ModuleManifest(
     permissions=PERMISSIONS,
     role_templates=ROLE_TEMPLATES,
     route_factory=_router,
+    frontend=FrontendModule(
+        module_id=MODULE_ID,
+        package_name="@govoplan/encryption-webui",
+        view_surfaces=(
+            ViewSurface(
+                id="encryption.admin.operations",
+                module_id=MODULE_ID,
+                kind="section",
+                label="Encryption administration",
+                order=10,
+            ),
+            ViewSurface(
+                id="encryption.admin.vaults",
+                module_id=MODULE_ID,
+                kind="section",
+                label="Key vaults",
+                parent_id="encryption.admin.operations",
+                order=20,
+            ),
+            ViewSurface(
+                id="encryption.admin.migrations",
+                module_id=MODULE_ID,
+                kind="section",
+                label="Protection migrations",
+                parent_id="encryption.admin.operations",
+                order=30,
+            ),
+            ViewSurface(
+                id="encryption.admin.recovery",
+                module_id=MODULE_ID,
+                kind="section",
+                label="Recovery ceremonies",
+                parent_id="encryption.admin.operations",
+                order=40,
+            ),
+        ),
+    ),
     capability_factories={
         CAPABILITY_ENCRYPTION_KEY_VAULT: _service,
         CAPABILITY_ENCRYPTION_CONTENT_PROTECTION: _service,
@@ -319,6 +358,50 @@ manifest = ModuleManifest(
                 ),
             ),
         ),
+        DocumentationTopic(
+            id="encryption.administration",
+            title="Administer encryption operations",
+            summary=(
+                "Inspect safe vault and envelope metadata, govern key lifecycle, "
+                "coordinate migrations, and verify disable readiness."
+            ),
+            body=(
+                "Encryption administration exposes bounded tenant metadata but "
+                "never provider key references, wrapped keys, ciphertext locations, "
+                "or plaintext. Rotation creates a new current version while existing "
+                "envelopes remain version-bound. Revocation and destruction cannot "
+                "recall material already obtained and can make content unavailable. "
+                "Migrations remain two-phase: the owning module performs the durable "
+                "content operation and records evidence before success. Disable "
+                "preflight blocks until every envelope has a terminal disposition."
+            ),
+            layer="available",
+            documentation_types=("admin",),
+            audience=("administrator", "security_officer", "auditor"),
+            related_modules=OPTIONAL_DEPENDENCIES,
+            order=110,
+        ),
+        DocumentationTopic(
+            id="encryption.recovery",
+            title="Run an encryption recovery ceremony",
+            summary=(
+                "Request and decide time-bounded recovery with high assurance and "
+                "a distinct-custodian quorum."
+            ),
+            body=(
+                "A recovery requester supplies policy and recent high-assurance "
+                "evidence and cannot approve the same ceremony. Each custodian can "
+                "decide once; a rejection terminates the request and approvals must "
+                "reach the vault quorum before expiry. Approval authorizes a later "
+                "provider operation. It does not release key material, transfer "
+                "resource ownership, or prove that recovery execution succeeded."
+            ),
+            layer="available",
+            documentation_types=("admin", "user"),
+            audience=("administrator", "security_officer", "auditor"),
+            related_modules=("identity_trust", "access", "audit", "policy"),
+            order=120,
+        ),
     ),
     architecture=declared_module_architecture(
         layer="institutional_foundation",