govoplan-identity-trust owns public device keys, key epochs, bounded authentication-assurance evidence, and auditable key-access trust decisions. It deliberately does not own login sessions, resource authorization, private keys, encryption, or plaintext.

The backend exposes identity_trust.directory and identity_trust.assurance. Access or Policy must approve resource access first; Identity Trust then verifies the acting account, active public device key, current subject epoch, and assurance evidence. Encryption providers may consume that decision to rewrap a key, but no key material is returned by this module.

The WebUI contributes two optional surfaces:

Settings > Device trust lets an account inspect active/revoked public device keys, revoke a current key with its expected revision, and inspect assurance level, provider, device binding, expiry, and provenance.
Administration > Identity trust lets an authorized security officer use an Access-backed account selector when Access is available, inspect the same bounded projections, rotate subject epochs with an upstream Access decision, and review immutable key-access decisions. Explicit account references remain usable when the optional Access directory is absent.

Revocation and rotation are not retroactive: neither can recall plaintext, exports, or key material already obtained by an endpoint. Stale revisions fail closed and must be reloaded. The API and UI expose public JWK metadata only; private JWK parameters are rejected by the capability contract.

Focused verification:

PYTHONPATH=src:/mnt/DATA/git/govoplan-core/src \
  /mnt/DATA/git/govoplan/.venv/bin/python -m unittest discover -s tests

Git-source WebUI package

The repository root exposes @govoplan/identity-trust-webui for Git-tagged release dependencies. It mirrors the owning webui/package.json version, public TypeScript/CSS exports and peer requirements, with entry paths under webui/src. Consumers provide the shared Core/React peers; the facade runs no development or install scripts. The source archive contains webui/src, this README and any repository license file. Run module development checks from webui/; Python installation remains governed by pyproject.toml.

Das Repository stellt @govoplan/identity-trust-webui am Wurzelpfad für versionierte Git-Abhängigkeiten bereit. Version, öffentliche TypeScript-/CSS-Exporte und Peer-Anforderungen entsprechen webui/package.json; die Einstiegspfade liegen unter webui/src. Gemeinsame Core-/React-Peers stellt die einbindende Anwendung bereit. Die Fassade führt keine Entwicklungs- oder Installationsskripte aus. Entwicklungsprüfungen bleiben in webui/, die Python-Installation weiterhin in pyproject.toml definiert.