feat(search): add governed DSAR coverage

src/govoplan_search/backend/manifest.py

@@ -11,6 +11,7 @@ from govoplan_core.core.module_guards import (
     persistent_table_uninstall_guard,
 )
 from govoplan_core.core.modules import (
+    CapabilityDocumentation,
     DocumentationLink,
     DocumentationTopic,
     FrontendModule,
@@ -30,6 +31,10 @@ from govoplan_core.core.search import (
 from govoplan_core.core.views import ViewSurface
 from govoplan_core.db.base import Base
 from govoplan_search.backend.db import models as search_models
+from govoplan_search.backend.dsar_provider import (
+    SEARCH_DSAR_CAPABILITY,
+    SearchDsarProvider,
+)
 
 
 MODULE_ID = "search"
@@ -101,6 +106,11 @@ def _router(_context: ModuleContext):
     return router
 
 
+def _dsar_provider(context: ModuleContext) -> SearchDsarProvider:
+    del context
+    return SearchDsarProvider()
+
+
 manifest = ModuleManifest(
     id=MODULE_ID,
     name=MODULE_NAME,
@@ -122,6 +132,7 @@ manifest = ModuleManifest(
         ModuleInterfaceProvider(name="search.provider", version="1.0.0"),
         ModuleInterfaceProvider(name="search.index_writer", version="1.1.0"),
         ModuleInterfaceProvider(name="search.source", version="1.0.0"),
+        ModuleInterfaceProvider(name=SEARCH_DSAR_CAPABILITY, version="0.1.0"),
     ),
     permissions=PERMISSIONS,
     role_templates=ROLE_TEMPLATES,
@@ -189,6 +200,14 @@ manifest = ModuleManifest(
     ),
     capability_factories={
         CAPABILITY_SEARCH_INDEX_WRITER: _service,
+        SEARCH_DSAR_CAPABILITY: _dsar_provider,
+    },
+    capability_documentation={
+        SEARCH_DSAR_CAPABILITY: CapabilityDocumentation(
+            label="Search data-subject request provider",
+            summary="Finds and purges derived index copies while preserving source authority.",
+            contract_version="0.1.0",
+        ),
     },
     search_providers=(
         SearchProviderRegistration(
@@ -198,6 +217,34 @@ manifest = ModuleManifest(
         ),
     ),
     documentation=(
+        DocumentationTopic(
+            id="search.data-subject-requests",
+            title="Derived Search data-subject requests",
+            summary="Remove derived index copies without treating Search as the authoritative data owner.",
+            body=(
+                "Search correlates explicit index/change identifiers and provider-owned source references inside the exact tenant. Account, identity, and membership selectors expose only minimized ACL projections and never imply ownership of the indexed source object. Indexed title, summary, body, search text, URL, keywords, metadata, external-reference payloads, ACL token values, hashes, cursors, queued documents, and errors are excluded. "
+                "Derived document and queued-change rows may be deleted idempotently. ACL-only matches require source-authority review. Source correction or erasure must happen in the owner module before Search is rebuilt; otherwise the source can legitimately republish the derived entry."
+            ),
+            layer="configured",
+            documentation_types=("admin", "user"),
+            audience=("user", "operator", "module_admin", "auditor"),
+            related_modules=("core", "access"),
+            metadata={
+                "kind": "reference",
+                "help_contexts": [
+                    "search.data-subject-requests",
+                    "search.admin.index",
+                ],
+            },
+            links=(
+                DocumentationLink(
+                    label="Search index lifecycle",
+                    href="govoplan-search/README.md",
+                    kind="repository",
+                ),
+            ),
+            order=11,
+        ),
         DocumentationTopic(
             id="search.global-and-contextual",
             title="Global and contextual search",