[P1] Implement retention, quotas, garbage collection, and cryptographic deletion #31

New issue

Closed

opened 2026-07-18 00:02:51 +00:00 by lost-rob0t · 0 comments

lost-rob0t commented

2026-07-18 00:02:51 +00:00

(Migrated from github.com)

Goal

Bound the amount and lifetime of retained personal activity data.

Requirements

Retention policies by age, total size, application, workspace, and record type.
Storage high/low watermarks and predictable eviction order.
Scheduled garbage collection for blobs, indexes, summaries, and tombstones.
Cryptographic deletion where per-record or per-period data keys make it practical.
Manual purge-all operation that invalidates indexes and cached summaries.
Dry-run reporting without exposing captured text.

Acceptance criteria

Expired records are removed from every derived structure.
Quota pressure cannot delete outside the configured policy silently.
Interrupted garbage collection resumes safely.
Purge-all leaves no decryptable capture records using the active key material.

Depends on

## Goal Bound the amount and lifetime of retained personal activity data. ## Requirements - Retention policies by age, total size, application, workspace, and record type. - Storage high/low watermarks and predictable eviction order. - Scheduled garbage collection for blobs, indexes, summaries, and tombstones. - Cryptographic deletion where per-record or per-period data keys make it practical. - Manual purge-all operation that invalidates indexes and cached summaries. - Dry-run reporting without exposing captured text. ## Acceptance criteria - Expired records are removed from every derived structure. - Quota pressure cannot delete outside the configured policy silently. - Interrupted garbage collection resumes safely. - Purge-all leaves no decryptable capture records using the active key material. ## Depends on - #10 - #11 - #30