# GovOPlaN Encryption Codex Guide

## Scope

This repository owns optional cryptographic platform capabilities: vaults, key
hierarchies, content-protection profiles, E2EE recipient and device keys,
rotation, recovery ceremonies, and disable/uninstall assurance.

## Boundaries

- Core owns neutral capability contracts and module discovery.
- Feature modules own plaintext semantics, authorization, retention, and normal
  resource ownership.
- This module may protect feature-owned payloads but must not become their
  business-data store.
- Never add placeholder, home-grown, or unauthenticated cryptography.
- A disable or uninstall operation must prove that every protection reference
  was decrypted, rewrapped, explicitly exported, or cryptographically deleted.
- Ownership recovery and cryptographic key recovery are separate processes.

Use Gitea issues as the canonical backlog and state log.