feat: scaffold encryption capability boundaries

README.md

@@ -0,0 +1,53 @@
+# GovOPlaN Encryption
+
+<!-- govoplan-repository-type:start -->
+**Repository type:** module (platform).
+<!-- govoplan-repository-type:end -->
+
+`govoplan-encryption` is the optional platform boundary for managed key vaults,
+content encryption, end-to-end encryption profiles, key rotation, recovery, and
+cryptographic deletion assurance.
+
+The module is deliberately scaffolded before cryptographic implementation. It
+announces stable integration surfaces and policy boundaries without presenting
+placeholder cryptography as production-ready protection.
+
+## Boundary
+
+The module will own:
+
+- vault and key hierarchy metadata
+- envelope-key wrapping and rotation workflows
+- content-protection profiles, including E2EE profiles
+- device and recipient key registration
+- recovery ceremonies, assurance evidence, and key custody
+- disable and uninstall preflight for protected content
+
+Feature modules continue to own their content, authorization, retention, and
+normal ownership records. They integrate through optional encryption
+capabilities and store only stable protection references and ciphertext.
+
+## Disable Rule
+
+Disabling or uninstalling this module must never make protected content silently
+unreadable. Every protected object must first be decrypted, rewrapped to another
+available provider, exported with explicit key custody, or deliberately
+destroyed under an authorized cryptographic-deletion process. The eventual
+uninstall guard will block while unresolved protection references remain.
+
+See [docs/ENCRYPTION_BOUNDARY.md](docs/ENCRYPTION_BOUNDARY.md) for the initial
+threat, ownership, recovery, and lifecycle decisions.
+
+## Current State
+
+The repository currently contains a discoverable manifest, permission and role
+metadata, versioned interface announcements, documentation, and focused tests.
+It has no routes, persistence, WebUI, key generation, or encryption runtime yet.
+
+## Verification
+
+```bash
+cd /mnt/DATA/git/govoplan-encryption
+PYTHONPATH=src:/mnt/DATA/git/govoplan-core/src \
+  /mnt/DATA/git/govoplan/.venv/bin/python -m unittest discover -s tests
+```