# GovOPlaN Encryption

<!-- govoplan-repository-type:start -->
**Repository type:** module (platform).
<!-- govoplan-repository-type:end -->

`govoplan-encryption` is the optional provider-neutral boundary for governed key
vaults, versioned content-protection envelopes, key lifecycle operations,
recovery ceremonies, and disable/uninstall assurance.

## Implemented

- opaque provider capability contracts; raw key material never crosses them;
- tenant/scope-bound vault and key-version metadata;
- idempotent provision, rotation, revocation, destruction scheduling, and
  outcome-unknown reconciliation;
- versioned ciphertext envelopes with authenticated-context and migration
  provenance;
- resumable, evidence-backed rewrap, re-encryption, decrypt, export, and destroy
  state transitions;
- recent high-assurance, distinct-custodian quorum recovery authorization;
- typed APIs, audit-safe events, Alembic migration, and uninstall blocking;
- Files and Postbox boundary fixtures.

## Deliberately Not Bundled

The module contains no cipher implementation, raw key store, development master
key, KMS/HSM driver, client E2EE protocol, or provider credentials. A deployment
must install a separately reviewed provider capability. Until a concrete profile
passes conformance, backup/restore, key-loss, interoperability, and security
review, GovOPlaN must not claim that content is encrypted or end-to-end
encrypted.

Feature modules continue to own content, authorization, retention, and resource
ownership. Access approval, resource ownership, Identity Trust, and key custody
are separate decisions.

See [docs/ENCRYPTION_BOUNDARY.md](docs/ENCRYPTION_BOUNDARY.md) for the threat
model, profile consequences, algorithms, recovery, and disable semantics.

## Verification

```bash
cd /mnt/DATA/git/govoplan-encryption
PYTHONPATH=src:/mnt/DATA/git/govoplan-core/src \
  /mnt/DATA/git/govoplan/.venv/bin/python -m unittest discover -s tests
```