feat(identity): add governed DSAR coverage

src/govoplan_identity/backend/manifest.py

@@ -6,10 +6,12 @@ from govoplan_core.core.access import CAPABILITY_AUTH_PERMISSION_EVALUATOR, CAPA
 from govoplan_core.core.identity import CAPABILITY_IDENTITY_DIRECTORY, CAPABILITY_IDENTITY_SEARCH
 from govoplan_core.core.module_guards import persistent_table_uninstall_guard
 from govoplan_core.core.modules import (
+    CapabilityDocumentation,
     DocumentationTopic,
     FrontendModule,
     MigrationSpec,
     ModuleContext,
+    ModuleInterfaceProvider,
     ModuleManifest,
     PermissionDefinition,
     RoleTemplate,
@@ -18,6 +20,10 @@ from govoplan_core.core.modules import (
 from govoplan_core.core.provider_governance import declared_module_architecture
 from govoplan_core.db.base import Base
 from govoplan_identity.backend.db import models as identity_models  # noqa: F401 - populate metadata
+from govoplan_identity.backend.dsar_provider import (
+    IDENTITY_DSAR_CAPABILITY,
+    IdentityDsarProvider,
+)
 
 
 def _permission(
@@ -90,6 +96,11 @@ def _identity_directory(context: ModuleContext) -> object:
     return SqlIdentityDirectory()
 
 
+def _dsar_provider(context: ModuleContext) -> IdentityDsarProvider:
+    del context
+    return IdentityDsarProvider()
+
+
 manifest = ModuleManifest(
     id="identity",
     name="Identity",
@@ -98,6 +109,9 @@ manifest = ModuleManifest(
     permissions=PERMISSIONS,
     role_templates=ROLE_TEMPLATES,
     route_factory=_route_factory,
+    provides_interfaces=(
+        ModuleInterfaceProvider(name=IDENTITY_DSAR_CAPABILITY, version="0.1.0"),
+    ),
     frontend=FrontendModule(
         module_id="identity",
         package_name="@govoplan/identity-webui",
@@ -135,8 +149,54 @@ manifest = ModuleManifest(
     capability_factories={
         CAPABILITY_IDENTITY_DIRECTORY: _identity_directory,
         CAPABILITY_IDENTITY_SEARCH: _identity_directory,
+        IDENTITY_DSAR_CAPABILITY: _dsar_provider,
+    },
+    capability_documentation={
+        IDENTITY_DSAR_CAPABILITY: CapabilityDocumentation(
+            label="Identity data-subject request provider",
+            summary=(
+                "Exports a corroborated system identity and matching account link "
+                "without automatically mutating cross-tenant identity state."
+            ),
+            contract_version="0.1.0",
+        ),
     },
     documentation=(
+        DocumentationTopic(
+            id="identity.data-subject-requests",
+            title="Identity data-subject requests",
+            summary=(
+                "Export a canonical identity only after its exact identity and "
+                "account-link identifiers corroborate each other."
+            ),
+            body=(
+                "Identity records are system-scoped rather than tenant-owned. The "
+                "data-subject provider therefore requires an exact identity identifier "
+                "and either its exact linked account or account-link identifier before "
+                "returning display, external-subject, lifecycle, and matching-link data. "
+                "Other links and arbitrary identity settings are excluded. A tenant "
+                "request cannot automatically deactivate the identity or remove the "
+                "link because either action can affect authentication and memberships "
+                "outside that tenant. Erasure is recorded as a manual review requiring "
+                "Identity, Access, tenancy, and retention owners."
+            ),
+            layer="configured",
+            documentation_types=("admin", "user"),
+            audience=("user", "system_admin", "identity_admin", "auditor"),
+            related_modules=("core", "access", "tenancy"),
+            order=23,
+            metadata={
+                "help_contexts": ["privacy.data-subject-requests"],
+                "consequence_classes": {
+                    "corroborated_export": (
+                        "Discloses one matching identity/account-link pair only."
+                    ),
+                    "manual_erasure_review": (
+                        "Prevents a tenant request from changing system-wide identity state."
+                    ),
+                },
+            },
+        ),
         DocumentationTopic(
             id="identity.model",
             title="Identity directory",