feat: protect postbox message content

src/govoplan_postbox/backend/manifest.py

@@ -7,6 +7,7 @@ from govoplan_core.core.access import (
     CAPABILITY_AUTH_PRINCIPAL_RESOLVER,
 )
 from govoplan_core.core.identity import CAPABILITY_IDENTITY_DIRECTORY
+from govoplan_core.core.encryption import CAPABILITY_ENCRYPTION_CONTENT_CIPHER
 from govoplan_core.core.idm import (
     CAPABILITY_IDM_DIRECTORY,
     CAPABILITY_IDM_FUNCTION_ASSIGNMENTS,
@@ -212,6 +213,7 @@ manifest = ModuleManifest(
         "access",
         "audit",
         "campaigns",
+        "encryption",
         "files",
         "mail",
         "notifications",
@@ -257,6 +259,12 @@ manifest = ModuleManifest(
             version_max_exclusive="0.2.0",
             optional=True,
         ),
+        ModuleInterfaceRequirement(
+            name=CAPABILITY_ENCRYPTION_CONTENT_CIPHER,
+            version_min="1.0.0",
+            version_max_exclusive="2.0.0",
+            optional=True,
+        ),
     ),
     permissions=PERMISSIONS,
     role_templates=ROLE_TEMPLATES,
@@ -368,9 +376,11 @@ manifest = ModuleManifest(
                 "permission with effective IDM assignment context. Templates "
                 "can lazily materialize unit-specific addresses, while exact "
                 "postboxes cover exceptional responsibilities. The first "
-                "implementation persists plaintext but reserves explicit "
-                "ciphertext, signed-manifest, and key-epoch fields; it does not "
-                "claim end-to-end encryption until a trusted policy profile is selected."
+                "Plaintext Postboxes remain available without Encryption. A "
+                "server-envelope profile stores message bodies as ciphertext and "
+                "uses the optional Encryption capability for authorized reads. "
+                "External ciphertext profiles retain producer-managed references "
+                "and keys; neither profile is described as end-to-end encryption."
             ),
             layer="available",
             documentation_types=("admin", "user"),
@@ -392,7 +402,11 @@ manifest = ModuleManifest(
         maturity="vertical_slice",
         documentation_ref="docs/POSTBOX_CONCEPT.md",
         test_ref="tests/test_service.py",
-        known_limits=("End-to-end encryption and target deployment recovery profiles are intentionally not claimed.",),
+        known_limits=(
+            "Subjects, routing metadata, participants, and attachment references remain plaintext metadata.",
+            "Server-envelope protection is server-decryptable and is not end-to-end encryption.",
+            "External ciphertext profiles require a separately governed producer and client key-custody profile.",
+        ),
         owned_concepts=("postbox", "postbox address", "postbox message", "delivery receipt", "access event"),
         non_owned_concepts=("identity", "function assignment", "campaign", "cryptographic key custody"),
         recovery_docs=("docs/POSTBOX_CONCEPT.md",),