govoplan-encryption is the optional platform boundary for managed key vaults, content encryption, end-to-end encryption profiles, key rotation, recovery, and cryptographic deletion assurance.

The module is deliberately scaffolded before cryptographic implementation. It announces stable integration surfaces and policy boundaries without presenting placeholder cryptography as production-ready protection.

Boundary

The module will own:

vault and key hierarchy metadata
envelope-key wrapping and rotation workflows
content-protection profiles, including E2EE profiles
device and recipient key registration
recovery ceremonies, assurance evidence, and key custody
disable and uninstall preflight for protected content

Feature modules continue to own their content, authorization, retention, and normal ownership records. They integrate through optional encryption capabilities and store only stable protection references and ciphertext.

Disable Rule

Disabling or uninstalling this module must never make protected content silently unreadable. Every protected object must first be decrypted, rewrapped to another available provider, exported with explicit key custody, or deliberately destroyed under an authorized cryptographic-deletion process. The eventual uninstall guard will block while unresolved protection references remain.

See docs/ENCRYPTION_BOUNDARY.md for the initial threat, ownership, recovery, and lifecycle decisions.

Current State

The repository currently contains a discoverable manifest, permission and role metadata, versioned interface announcements, documentation, and focused tests. It has no routes, persistence, WebUI, key generation, or encryption runtime yet.

Verification

cd /mnt/DATA/git/govoplan-encryption
PYTHONPATH=src:/mnt/DATA/git/govoplan-core/src \
  /mnt/DATA/git/govoplan/.venv/bin/python -m unittest discover -s tests