feat: scaffold encryption capability boundaries

docs/ENCRYPTION_BOUNDARY.md

@@ -0,0 +1,50 @@
+# Encryption Boundary
+
+## Purpose
+
+`govoplan-encryption` is an optional cryptographic service module. It supplies
+key and content-protection capabilities to modules that choose to use them. It
+does not own feature data, normal authorization, retention, or business
+ownership.
+
+## Initial Invariants
+
+1. Resource ownership and cryptographic key custody are independent.
+2. Administrative ownership recovery does not grant encryption keys.
+3. Key recovery is a separate, high-assurance, auditable ceremony.
+4. Every ciphertext carries a stable protection profile, key version, algorithm
+   suite, and authenticated context reference.
+5. Rotation and rewrapping are resumable and idempotent.
+6. Protected content cannot silently fall back to plaintext.
+7. Provider loss, disabled modules, unavailable devices, and recovery delay are
+   visible states, not generic read failures.
+8. Disabling or uninstalling is blocked while unresolved protected content
+   remains.
+
+## Planned Capability Families
+
+- **Key vault:** create and resolve key hierarchies without exposing raw key
+  material to feature modules.
+- **Content protection:** authenticated envelope encryption and decryption for
+  authorized feature-owned payloads.
+- **E2EE profiles:** recipient/device key envelopes where the server cannot
+  decrypt normal content.
+- **Rotation:** rewrap keys and migrate algorithm suites with bounded progress
+  and evidence.
+- **Recovery ceremony:** quorum, delay, recent authentication, custody evidence,
+  and explicit scope.
+- **Disable preflight:** inventory protection references and produce a blocking
+  migration plan.
+
+## Decisions Deferred Until Threat Modeling
+
+- cryptographic libraries and external KMS/HSM providers
+- server-managed versus client-managed profile suites
+- per-object, per-vault, and per-recipient data-key granularity
+- device enrollment and revocation protocol
+- external-recipient key discovery and trust
+- recovery quorum defaults for each assurance profile
+- ciphertext portability and offline export format
+
+These decisions require explicit threat models and interoperability fixtures.
+They must not be inferred from ordinary resource-ownership workflows.