54 lines
2.0 KiB
Markdown
54 lines
2.0 KiB
Markdown
# GovOPlaN Encryption
|
|
|
|
<!-- govoplan-repository-type:start -->
|
|
**Repository type:** module (platform).
|
|
<!-- govoplan-repository-type:end -->
|
|
|
|
`govoplan-encryption` is the optional platform boundary for managed key vaults,
|
|
content encryption, end-to-end encryption profiles, key rotation, recovery, and
|
|
cryptographic deletion assurance.
|
|
|
|
The module is deliberately scaffolded before cryptographic implementation. It
|
|
announces stable integration surfaces and policy boundaries without presenting
|
|
placeholder cryptography as production-ready protection.
|
|
|
|
## Boundary
|
|
|
|
The module will own:
|
|
|
|
- vault and key hierarchy metadata
|
|
- envelope-key wrapping and rotation workflows
|
|
- content-protection profiles, including E2EE profiles
|
|
- device and recipient key registration
|
|
- recovery ceremonies, assurance evidence, and key custody
|
|
- disable and uninstall preflight for protected content
|
|
|
|
Feature modules continue to own their content, authorization, retention, and
|
|
normal ownership records. They integrate through optional encryption
|
|
capabilities and store only stable protection references and ciphertext.
|
|
|
|
## Disable Rule
|
|
|
|
Disabling or uninstalling this module must never make protected content silently
|
|
unreadable. Every protected object must first be decrypted, rewrapped to another
|
|
available provider, exported with explicit key custody, or deliberately
|
|
destroyed under an authorized cryptographic-deletion process. The eventual
|
|
uninstall guard will block while unresolved protection references remain.
|
|
|
|
See [docs/ENCRYPTION_BOUNDARY.md](docs/ENCRYPTION_BOUNDARY.md) for the initial
|
|
threat, ownership, recovery, and lifecycle decisions.
|
|
|
|
## Current State
|
|
|
|
The repository currently contains a discoverable manifest, permission and role
|
|
metadata, versioned interface announcements, documentation, and focused tests.
|
|
It has no routes, persistence, WebUI, key generation, or encryption runtime yet.
|
|
|
|
## Verification
|
|
|
|
```bash
|
|
cd /mnt/DATA/git/govoplan-encryption
|
|
PYTHONPATH=src:/mnt/DATA/git/govoplan-core/src \
|
|
/mnt/DATA/git/govoplan/.venv/bin/python -m unittest discover -s tests
|
|
```
|