govoplan-encryption/AGENTS.md

GovOPlaN Encryption Codex Guide

Documentation Contract

• Treat documentation as part of every behavior change. Update this module's manifest-driven DocumentationTopic contributions for affected user and administrator behavior.
• Keep feature content here; govoplan-docs projects it without importing Encryption internals.
• Maintain a static user/admin baseline and run /mnt/DATA/git/govoplan/tools/checks/check-manifest-shapes.py after behavior or manifest changes.

Scope

This repository owns optional cryptographic platform capabilities: vaults, key hierarchies, content-protection profiles, E2EE recipient and device keys, rotation, recovery ceremonies, and disable/uninstall assurance.

Boundaries

• Core owns neutral capability contracts and module discovery.
• Feature modules own plaintext semantics, authorization, retention, and normal resource ownership.
• This module may protect feature-owned payloads but must not become their business-data store.
• Never add placeholder, home-grown, or unauthenticated cryptography.
• A disable or uninstall operation must prove that every protection reference was decrypted, rewrapped, explicitly exported, or cryptographically deleted.
• Ownership recovery and cryptographic key recovery are separate processes.

Use Gitea issues as the canonical backlog and state log.