feat(reporting): add governed DSAR coverage

src/govoplan_reporting/backend/manifest.py

@@ -51,6 +51,10 @@ from govoplan_reporting.backend.contracts import (
     CAPABILITY_REPORTING_SCHEDULER,
 )
 from govoplan_reporting.backend.db import models as reporting_models
+from govoplan_reporting.backend.dsar_provider import (
+    REPORTING_DSAR_CAPABILITY,
+    ReportingDsarProvider,
+)
 from govoplan_reporting.backend.definitions import (
     ADMIN_SCOPE,
     READ_SCOPE,
@@ -199,6 +203,11 @@ def _retention(context: ModuleContext):
     return ReportingRetentionService()
 
 
+def _dsar_provider(context: ModuleContext) -> ReportingDsarProvider:
+    del context
+    return ReportingDsarProvider()
+
+
 def _tenant_summary(session, tenant_id: str) -> dict[str, int]:
     definitions = (
         session.query(reporting_models.ReportingDefinitionRevision)
@@ -315,7 +324,11 @@ manifest = ModuleManifest(
                 label="i18n:govoplan-core.product_area.data_assurance",
                 icon="database-zap",
                 description="i18n:govoplan-core.product_area.data_assurance_description",
-                surface_ids=("reporting.navigation", "reporting.workspace", "reporting.compatibility"),
+                surface_ids=(
+                    "reporting.navigation",
+                    "reporting.workspace",
+                    "reporting.compatibility",
+                ),
                 order=60,
             ),
         ),
@@ -357,6 +370,7 @@ manifest = ModuleManifest(
             name=CAPABILITY_REPORTING_PUBLICATION_MAIL, version="1.0.0"
         ),
         ModuleInterfaceProvider(name=CAPABILITY_REPORTING_RETENTION, version="1.0.0"),
+        ModuleInterfaceProvider(name=REPORTING_DSAR_CAPABILITY, version="0.1.0"),
     ),
     requires_interfaces=(
         ModuleInterfaceRequirement(
@@ -392,6 +406,7 @@ manifest = ModuleManifest(
         CAPABILITY_REPORTING_PUBLICATION_FILES: _files_publication,
         CAPABILITY_REPORTING_PUBLICATION_MAIL: _mail_publication,
         CAPABILITY_REPORTING_RETENTION: _retention,
+        REPORTING_DSAR_CAPABILITY: _dsar_provider,
     },
     capability_documentation={
         CAPABILITY_REPORTING_REGISTRY: CapabilityDocumentation(
@@ -431,6 +446,13 @@ manifest = ModuleManifest(
             documentation_types=("admin",),
             audience=("privacy_officer", "operator", "system_admin"),
         ),
+        REPORTING_DSAR_CAPABILITY: CapabilityDocumentation(
+            label="Reporting data-subject request provider",
+            summary="Finds subject-owned Reporting state and minimizes derived report copies.",
+            contract_version="0.1.0",
+            documentation_types=("admin", "user"),
+            audience=("privacy_officer", "operator", "user"),
+        ),
     },
     search_sources=(
         SearchSourceProviderRegistration(
@@ -488,6 +510,34 @@ manifest = ModuleManifest(
     ),
     tenant_summary_providers=(_tenant_summary,),
     documentation=(
+        DocumentationTopic(
+            id="reporting.data-subject-requests",
+            title="Reporting data-subject requests",
+            summary="Review personal workspace state and derived report copies without confusing them with source-owned facts.",
+            body=(
+                "Reporting matches exact tenant-scoped artifact references and account, identity, or membership ownership and attribution. Access output is deliberately minimized: report rows, parameters, filters, delivery targets, source payloads, diagnostics, provenance bodies, and hashes are not copied into the DSAR result. Source modules remain responsible for finding and correcting subject facts; Reporting cannot safely infer a person by scanning arbitrary aggregate output. "
+                "Private saved views and short-lived drill contexts can be deleted, subject grants can be revoked, and explicitly identified retained execution or publication detail can be minimized idempotently while hashes remain. Shared views, definitions, schedules, quality/import evidence, and staff attribution require authorized review or retention. Correct the source before rerunning a report or republishing an output."
+            ),
+            layer="configured",
+            documentation_types=("admin", "user"),
+            audience=("user", "operator", "module_admin", "auditor"),
+            related_modules=("core", "datasources", "dataflow", "policy"),
+            metadata={
+                "kind": "reference",
+                "help_contexts": [
+                    "reporting.data-subject-requests",
+                    "reporting.workspace",
+                ],
+            },
+            links=(
+                DocumentationLink(
+                    label="Reporting governance and retention",
+                    href="govoplan-reporting/README.md",
+                    kind="repository",
+                ),
+            ),
+            order=9,
+        ),
         DocumentationTopic(
             id="reporting.governed-bi",
             title="Governed reporting and semantic BI",