feat(identity-trust): add governed DSAR coverage

src/govoplan_identity_trust/backend/manifest.py

@@ -26,6 +26,10 @@ from govoplan_core.core.modules import (
 from govoplan_core.core.provider_governance import declared_module_architecture
 from govoplan_core.db.base import Base
 from govoplan_identity_trust.backend.db import models
+from govoplan_identity_trust.backend.dsar_provider import (
+    IDENTITY_TRUST_DSAR_CAPABILITY,
+    IdentityTrustDsarProvider,
+)
 from govoplan_identity_trust.backend.service import SqlIdentityTrustService
 
 
@@ -64,6 +68,10 @@ def _service(_context: ModuleContext) -> SqlIdentityTrustService:
     return SqlIdentityTrustService()
 
 
+def _dsar_provider(_context: ModuleContext) -> IdentityTrustDsarProvider:
+    return IdentityTrustDsarProvider()
+
+
 manifest = ModuleManifest(
     id=MODULE_ID,
     name=MODULE_NAME,
@@ -72,6 +80,10 @@ manifest = ModuleManifest(
     provides_interfaces=(
         ModuleInterfaceProvider(name="identity_trust.directory", version="1.0.0"),
         ModuleInterfaceProvider(name="identity_trust.assurance", version="1.0.0"),
+        ModuleInterfaceProvider(
+            name=IDENTITY_TRUST_DSAR_CAPABILITY,
+            version="0.1.0",
+        ),
     ),
     permissions=(
         _permission(
@@ -165,6 +177,7 @@ manifest = ModuleManifest(
     capability_factories={
         CAPABILITY_IDENTITY_TRUST_DIRECTORY: _service,
         CAPABILITY_IDENTITY_TRUST_ASSURANCE: _service,
+        IDENTITY_TRUST_DSAR_CAPABILITY: _dsar_provider,
     },
     capability_documentation={
         CAPABILITY_IDENTITY_TRUST_DIRECTORY: CapabilityDocumentation(
@@ -177,6 +190,14 @@ manifest = ModuleManifest(
             summary="Verifies bounded, recent assurance evidence for high-risk cryptographic operations.",
             contract_version="1.0.0",
         ),
+        IDENTITY_TRUST_DSAR_CAPABILITY: CapabilityDocumentation(
+            label="Identity Trust data-subject request provider",
+            summary=(
+                "Exports bounded device-key and assurance records while keeping "
+                "cryptographic history under governed retention and review."
+            ),
+            contract_version="0.1.0",
+        ),
     },
     migration_spec=MigrationSpec(
         module_id=MODULE_ID,
@@ -202,6 +223,47 @@ manifest = ModuleManifest(
         ),
     ),
     documentation=(
+        DocumentationTopic(
+            id="identity-trust.data-subject-requests",
+            title="Identity Trust data-subject requests",
+            summary=(
+                "Export tenant-scoped device trust, assurance, epoch, and key-access "
+                "evidence without private or operational key material."
+            ),
+            body=(
+                "Identity Trust correlates exact account and identity identifiers in "
+                "the active tenant and can narrow results to an exact device or key. "
+                "The access package includes bounded public-key registration fields, "
+                "assurance state, matching key epochs, and key-access decisions. It "
+                "never exports private JWK parameters, request digests, idempotency "
+                "keys, or arbitrary provenance payloads. Device-key revocation requires "
+                "manual review of recovery, active encrypted resources, and the current "
+                "epoch. Assurance, epoch, and access-decision records remain immutable "
+                "security evidence."
+            ),
+            layer="configured",
+            documentation_types=("admin", "user"),
+            audience=("user", "administrator", "security_officer", "auditor"),
+            related_modules=("core", "access", "encryption", "postbox"),
+            metadata={
+                "help_contexts": [
+                    "identity_trust.settings.devices",
+                    "identity_trust.admin.trust",
+                    "privacy.data-subject-requests",
+                ],
+                "consequence_classes": {
+                    "export_trust_state": (
+                        "Returns bounded public trust and assurance evidence only."
+                    ),
+                    "review_device_revocation": (
+                        "Requires recovery and encrypted-resource impact review."
+                    ),
+                    "retain_security_evidence": (
+                        "Preserves epoch, assurance, and access-decision history."
+                    ),
+                },
+            },
+        ),
         DocumentationTopic(
             id="identity-trust.device-keys",
             title="Device keys and key epochs",