# GovOPlaN Identity Trust

<!-- govoplan-repository-type:start -->
**Repository type:** module (platform).
<!-- govoplan-repository-type:end -->

`govoplan-identity-trust` owns public device keys, key epochs, bounded
authentication-assurance evidence, and auditable key-access trust decisions.
It deliberately does not own login sessions, resource authorization, private
keys, encryption, or plaintext.

The backend exposes `identity_trust.directory` and
`identity_trust.assurance`. Access or Policy must approve resource access
first; Identity Trust then verifies the acting account, active public device
key, current subject epoch, and assurance evidence. Encryption providers may
consume that decision to rewrap a key, but no key material is returned by this
module.

The WebUI contributes two optional surfaces:

- **Settings > Device trust** lets an account inspect active/revoked public
  device keys, revoke a current key with its expected revision, and inspect
  assurance level, provider, device binding, expiry, and provenance.
- **Administration > Identity trust** lets an authorized security officer use
  an Access-backed account selector when Access is available, inspect the same
  bounded projections, rotate subject epochs with an upstream Access decision,
  and review immutable key-access decisions. Explicit account references remain
  usable when the optional Access directory is absent.

Revocation and rotation are not retroactive: neither can recall plaintext,
exports, or key material already obtained by an endpoint. Stale revisions fail
closed and must be reloaded. The API and UI expose public JWK metadata only;
private JWK parameters are rejected by the capability contract.

Focused verification:

```bash
PYTHONPATH=src:/mnt/DATA/git/govoplan-core/src \
  /mnt/DATA/git/govoplan/.venv/bin/python -m unittest discover -s tests
```