# Encryption Boundary

## Purpose

`govoplan-encryption` is an optional cryptographic service module. It supplies
key and content-protection capabilities to modules that choose to use them. It
does not own feature data, normal authorization, retention, or business
ownership.

## Initial Invariants

1. Resource ownership and cryptographic key custody are independent.
2. Administrative ownership recovery does not grant encryption keys.
3. Key recovery is a separate, high-assurance, auditable ceremony.
4. Every ciphertext carries a stable protection profile, key version, algorithm
   suite, and authenticated context reference.
5. Rotation and rewrapping are resumable and idempotent.
6. Protected content cannot silently fall back to plaintext.
7. Provider loss, disabled modules, unavailable devices, and recovery delay are
   visible states, not generic read failures.
8. Disabling or uninstalling is blocked while unresolved protected content
   remains.

## Planned Capability Families

- **Key vault:** create and resolve key hierarchies without exposing raw key
  material to feature modules.
- **Content protection:** authenticated envelope encryption and decryption for
  authorized feature-owned payloads.
- **E2EE profiles:** recipient/device key envelopes where the server cannot
  decrypt normal content.
- **Rotation:** rewrap keys and migrate algorithm suites with bounded progress
  and evidence.
- **Recovery ceremony:** quorum, delay, recent authentication, custody evidence,
  and explicit scope.
- **Disable preflight:** inventory protection references and produce a blocking
  migration plan.

## Decisions Deferred Until Threat Modeling

- cryptographic libraries and external KMS/HSM providers
- server-managed versus client-managed profile suites
- per-object, per-vault, and per-recipient data-key granularity
- device enrollment and revocation protocol
- external-recipient key discovery and trust
- recovery quorum defaults for each assurance profile
- ciphertext portability and offline export format

These decisions require explicit threat models and interoperability fixtures.
They must not be inferred from ordinary resource-ownership workflows.