feat: protect postbox message content

2026-08-02 03:40:57 +02:00
parent 7d310d5c33
commit 8f8d259a76
12 changed files with 611 additions and 29 deletions
@@ -92,10 +92,12 @@ an independently readable copy in the next frozen function Postbox. The
 `govoplan.postbox.dispatch_routes` periodic Core worker drains due routes when
 Celery beat and a worker consuming the `postbox` queue are enabled.

-The persistence model reserves ciphertext manifests, wrapped keys, key epochs,
-expiry, and withdrawal state. The active profile remains `plaintext_v1`; the
-module does not claim end-to-end encryption until the history, recovery, and
-handover policy choices in the security issues are resolved.
+Postboxes support `plaintext_v1` and an optional `server_envelope_v1` profile.
+The latter stores message bodies as ciphertext through the Encryption
+capability and fails closed on reads if that capability or key is unavailable.
+Subjects, participants, routing, attachment references, and lifecycle metadata
+remain observable. Existing externally produced ciphertext references remain
+supported, but neither path is described as end-to-end encryption.

 Run focused checks with: