# GovOPlaN Encryption Codex Guide

## Documentation Contract

- Treat documentation as part of every behavior change. Update this module's manifest-driven `DocumentationTopic` contributions for affected user and administrator behavior.
- Keep feature content here; `govoplan-docs` projects it without importing Encryption internals.
- Maintain a static user/admin baseline and run `/mnt/DATA/git/govoplan/tools/checks/check-manifest-shapes.py` after behavior or manifest changes.

## Scope

This repository owns optional cryptographic platform capabilities: vaults, key
hierarchies, content-protection profiles, E2EE recipient and device keys,
rotation, recovery ceremonies, and disable/uninstall assurance.

## Boundaries

- Core owns neutral capability contracts and module discovery.
- Feature modules own plaintext semantics, authorization, retention, and normal
  resource ownership.
- This module may protect feature-owned payloads but must not become their
  business-data store.
- Never add placeholder, home-grown, or unauthenticated cryptography.
- A disable or uninstall operation must prove that every protection reference
  was decrypted, rewrapped, explicitly exported, or cryptographically deleted.
- Ownership recovery and cryptographic key recovery are separate processes.

Use Gitea issues as the canonical backlog and state log.