Evidence lifecycle, retention, deletion, legal hold, redaction, and audit receipts are explicit contracts for operator reads and actions.
Milestone 4.P.3 — Privacy, Retention, Deletion & Audit Governance
Status: In progress — deletion foundations are present; lifecycle and safe-rendering residuals remain. Outcome: Evidence is useful without crossing the no-prompt/no-completion boundary, and reads/actions expose retention, hold, redaction, deletion, and audit state honestly. Track: Track P — Operator Readiness, Evidence & Control Plane Dependencies: 4.P.1; 4.P.2 Estimated effort: 3 weeks Gate: G4 governance
Contracts and current foundations
The privacy governance migration defines capture policies, metadata-only defaults, legal holds, an org-deletion saga, per-store receipts, audit append/verifier behavior, encrypted object-store writes, and asynchronous redaction. Deployed stores are configured explicitly; omitted stores may be not_applicable, while unreachable configured stores fail closed. Soft-deleted organizations still require explicit evidence and session-event deletion.
Audit records include actor, org_id, purpose, assurance, policy result, action, and receipt references. Privileged raw/export/deletion access remains server-authorized and step-up protected.
Residuals
ClickHouse TTL is storage hygiene rather than a deletion SLA and may age rows during an active hold; broker/result and backup erasure, crypto twin parity, and a retention scheduler/API remain open follow-ups. Full safe rendering, hostile-content handling, and DOM sanitization are Track D/P6 dependencies. Usage and billing ledgers are a documented non-erasable carve-out until their lifecycle contract changes.
Verification gate
Prove cross-store deletion receipts, hold blocking, tombstone behavior, redaction labels, audit verification, and post-deletion reads across two tenants. P6 adds hostile-content and redaction browser checks; D2–D6 must display residual states rather than hide them.
Rollout and rollback
Trigger: incomplete receipt, hold bypass, unsafe rendering, or deletion/read mismatch. Reversal: block destructive actions, retain legal holds and audit history, and return to metadata-only reads. Verify: rerun store receipts, hold tests, hostile-content checks, and tenant-negative reads.
Findings addressed
F4-004, F4-006, F4-008, F4-019, F4-020, F4-024.
Exit checklist
- Lifecycle DTOs expose retention, hold, redaction, deletion, tombstone, and receipt state.
- Cross-store deletion and legal-hold receipts are evidenced for deployed stores.
- Retention scheduler/API and ClickHouse hold/TTL residuals are owned and labeled.
- Safe-rendering and hostile-content evidence is attached through P6/Track D.
- D2–D6 use explicit lifecycle states and never infer deletion or completeness.
Last updated on