Add governed encryption administration

tests/test_encryption.py

@@ -377,6 +377,79 @@ class EncryptionTests(unittest.TestCase):
         self.assertEqual(2, second.approvals)
         self.assertFalse(second.provenance["key_material_released"])
 
+    def test_operator_queries_are_bounded_tenant_scoped_and_secret_free(self) -> None:
+        self.create_vault()
+        self.service.register_envelope(
+            self.session,
+            self.principal,
+            request=ProtectionRegistrationRequest(
+                envelope=self.envelope("files", "operator-query"),
+                idempotency_key="register-operator-query",
+                policy_decision_ref="policy:protect",
+            ),
+        )
+        migration = self.service.request_migration(
+            self.session,
+            self.principal,
+            request=ProtectionMigrationRequest(
+                tenant_id="tenant-1",
+                envelope_id="envelope-operator-query",
+                target_provider_id="test",
+                target_vault_id="vault-1",
+                target_key_version=1,
+                target_algorithm_suite="AES-256-GCM",
+                mode="destroy",
+                policy_decision_ref="policy:destroy",
+                assurance_evidence_ref="assurance:destroy",
+                idempotency_key="migration-operator-query",
+            ),
+        )
+        recovery = self.service.request_recovery(
+            self.session,
+            self.principal,
+            request=RecoveryRequest(
+                tenant_id="tenant-1",
+                vault_id="vault-1",
+                reason="operator query fixture",
+                requested_scope="vault-status",
+                policy_decision_ref="policy:recovery",
+                assurance_evidence_ref="assurance:requester",
+                idempotency_key="recovery-operator-query",
+                expires_at=utcnow() + timedelta(hours=1),
+            ),
+        )
+
+        vaults = self.service.list_vaults(
+            self.session, self.principal, tenant_id="tenant-1", limit=1000
+        )
+        envelopes = self.service.list_envelopes(
+            self.session, self.principal, tenant_id="tenant-1", limit=1000
+        )
+        migrations = self.service.list_migrations(
+            self.session, self.principal, tenant_id="tenant-1", limit=1000
+        )
+        recoveries = self.service.list_recoveries(
+            self.session, self.principal, tenant_id="tenant-1", limit=1000
+        )
+
+        self.assertEqual(["vault-1"], [item.vault_id for item in vaults])
+        self.assertEqual(
+            ["envelope-operator-query"],
+            [item.envelope_id for item in envelopes],
+        )
+        self.assertEqual(migration.migration_id, migrations[0].migration_id)
+        self.assertEqual(recovery.recovery_id, recoveries[0].recovery_id)
+        self.assertEqual("operator query fixture", recoveries[0].reason)
+        self.assertFalse(hasattr(vaults[0], "provider_key_ref"))
+        self.assertFalse(hasattr(envelopes[0], "wrapped_key_refs"))
+        self.assertFalse(hasattr(envelopes[0], "ciphertext_ref"))
+        with self.assertRaisesRegex(EncryptionError, "Cross-tenant"):
+            self.service.list_vaults(
+                self.session,
+                Principal("account-1", "tenant-2"),
+                tenant_id="tenant-1",
+            )
+
     def test_contract_rejects_secret_bearing_envelope_metadata(self) -> None:
         with self.assertRaisesRegex(ValueError, "secret material"):
             replace(

tests/test_manifest.py

@@ -16,7 +16,7 @@ from govoplan_encryption.backend.local_provider import LOCAL_PROVIDER_ID
 
 
 class EncryptionManifestTests(unittest.TestCase):
-    def test_manifest_exposes_headless_governed_capabilities(self) -> None:
+    def test_manifest_exposes_governed_capabilities_and_operator_ui(self) -> None:
         manifest = get_manifest()
 
         self.assertEqual("encryption", manifest.id)
@@ -35,7 +35,21 @@ class EncryptionManifestTests(unittest.TestCase):
         )
         self.assertIsNotNone(manifest.route_factory)
         self.assertIsNotNone(manifest.migration_spec)
-        self.assertIsNone(manifest.frontend)
+        self.assertIsNotNone(manifest.frontend)
+        self.assertEqual("@govoplan/encryption-webui", manifest.frontend.package_name)
+        self.assertEqual(
+            {
+                "encryption.admin.operations",
+                "encryption.admin.vaults",
+                "encryption.admin.migrations",
+                "encryption.admin.recovery",
+            },
+            {surface.id for surface in manifest.frontend.view_surfaces},
+        )
+        self.assertIn(
+            "encryption.administration",
+            {topic.id for topic in manifest.documentation},
+        )
         self.assertEqual("vertical_slice", manifest.architecture.maturity)