Implement identity trust module

README.md

@@ -1,5 +1,24 @@
-# govoplan-identity-trust
+# GovOPlaN Identity Trust
 
 <!-- govoplan-repository-type:start -->
 **Repository type:** module (platform).
 <!-- govoplan-repository-type:end -->
+
+`govoplan-identity-trust` owns public device keys, key epochs, bounded
+authentication-assurance evidence, and auditable key-access trust decisions.
+It deliberately does not own login sessions, resource authorization, private
+keys, encryption, or plaintext.
+
+The headless module exposes `identity_trust.directory` and
+`identity_trust.assurance`. Access or Policy must approve resource access
+first; Identity Trust then verifies the acting account, active public device
+key, current subject epoch, and assurance evidence. Encryption providers may
+consume that decision to rewrap a key, but no key material is returned by this
+module.
+
+Focused verification:
+
+```bash
+PYTHONPATH=src:/mnt/DATA/git/govoplan-core/src \
+  /mnt/DATA/git/govoplan/.venv/bin/python -m unittest discover -s tests
+```