feat: initialize governed postbox module

README.md

@@ -18,7 +18,7 @@ This repository owns:
   normalized Identity, IDM, Organizations, and Core/Access contracts
 - API routes for postbox directory, messages, access checks, and administration
 - optional integration capabilities for campaign, files, portal, notification, and mail-facing workflows
-- future WebUI package `@govoplan/postbox-webui`
+- inbox and tenant administration WebUI package `@govoplan/postbox-webui`
 
 Core owns auth, tenants, RBAC evaluation, database/session primitives, module
 discovery, migrations, CSRF/API helpers, and shell layout. Identity owns
@@ -72,3 +72,24 @@ Frontend package:
 ```
 
 Platform RBAC, module capability contracts, and governance rules are documented in `govoplan-core/docs/`.
+
+## Current implementation
+
+The first usable slice includes immutable template revisions, stable lazy
+addresses, exact function-bound Postboxes, current IDM assignment access
+decisions, vacancy status, idempotent producer delivery, source-preserving
+message and attachment references, personal read/acknowledgement receipts,
+unified inbox projections, access evidence, an inbox route, and tenant
+administration.
+
+The persistence model reserves ciphertext manifests, wrapped keys, key epochs,
+expiry, and withdrawal state. The active profile remains `plaintext_v1`; the
+module does not claim end-to-end encryption until the history, recovery, and
+handover policy choices in the security issues are resolved.
+
+Run focused checks with:
+
+```bash
+/mnt/DATA/git/govoplan/.venv/bin/python -m unittest discover -s tests
+cd webui && npm run test:ui-structure
+```