1.9 KiB
GovOPlaN Encryption
Repository type: module (platform).
govoplan-encryption is the optional provider-neutral boundary for governed key
vaults, versioned content-protection envelopes, key lifecycle operations,
recovery ceremonies, and disable/uninstall assurance.
Implemented
- opaque provider capability contracts; raw key material never crosses them;
- tenant/scope-bound vault and key-version metadata;
- idempotent provision, rotation, revocation, destruction scheduling, and outcome-unknown reconciliation;
- versioned ciphertext envelopes with authenticated-context and migration provenance;
- resumable, evidence-backed rewrap, re-encryption, decrypt, export, and destroy state transitions;
- recent high-assurance, distinct-custodian quorum recovery authorization;
- typed APIs, audit-safe events, Alembic migration, and uninstall blocking;
- Files and Postbox boundary fixtures.
Deliberately Not Bundled
The module contains no cipher implementation, raw key store, development master key, KMS/HSM driver, client E2EE protocol, or provider credentials. A deployment must install a separately reviewed provider capability. Until a concrete profile passes conformance, backup/restore, key-loss, interoperability, and security review, GovOPlaN must not claim that content is encrypted or end-to-end encrypted.
Feature modules continue to own content, authorization, retention, and resource ownership. Access approval, resource ownership, Identity Trust, and key custody are separate decisions.
See docs/ENCRYPTION_BOUNDARY.md for the threat model, profile consequences, algorithms, recovery, and disable semantics.
Verification
cd /mnt/DATA/git/govoplan-encryption
PYTHONPATH=src:/mnt/DATA/git/govoplan-core/src \
/mnt/DATA/git/govoplan/.venv/bin/python -m unittest discover -s tests