Implement timeline inspection and selective deletion #89

Merged

lost-rob0t merged 36 commits from agent/issue-30-timeline-deletion into main

2026-08-30 02:47:32 +00:00

lost-rob0t commented

2026-08-23 02:36:02 +00:00

(Migrated from github.com)

Closes #30.

RAGE transaction for timeline inspection and selective deletion.

Starting main: 44917323d8649c56bb8d7948315eca78d0eadc81.

Completed and verified slices:

encrypted semantic-index selective removal;
canonical post-decrypt visibility recheck preventing deleted records from escaping concurrent retrieval;
owner-only durable deletion journal and forward-only recovery coordinator;
canonical storage deletion followed by semantic/activity derived-state reconciliation;
stale .deletion-intent.json.tmp crash recovery;
surviving-record activity rebuild adapter (bounded enumeration of the snapshot window, decrypt-on-demand, concurrent-deletion skips, candidate-overflow fail-closed, memory-only plaintext);
typed deletion-scope service: closed scopes (record IDs / opaque activity-cluster ID / application within mandatory explicit bounds / bounded time range), bounded decrypt-on-demand resolution, fail-closed on overflow, empty, unknown, or conflicting scopes;
typed timeline/filter/preview service: bounded newest-first listing with application filter, redacted metadata + provenance + policy revision + finding counts + opaque cluster IDs, decrypt-on-demand text/screenshot previews that are never cached or persisted;
authenticated IPC exposure: preview-record (query capability) and delete-records (dedicated IpcCapability.DELETE) commands, extended typed payload, exact-single-scope validation, daemon-side TimelineDeletionHandler with fixed sanitized reason codes and fail-closed audit semantics;
CLI surface over the authenticated IPC only: timeline [--application], preview, delete with one explicit scope;
sanitized destructive audit events (deletion_request: closed scope class, count, outcome, correlation ID only; IPC audit gained the closed delete capability flag);
journal permission and symlink abuse coverage (12 adversarial cases: symlinked root/file/temp, wrong modes, foreign owner, oversized, tampered, non-regular files; decoy targets never followed);
documentation: docs/timeline.md plus docs/cli.md and docs/ipc.md updates.

Notable defect found and fixed during the transaction: EncryptedSemanticIndex.remove raised on an uninitialized index, which would have wedged deletion recovery forever for users without a semantic index; removal is now a vacuous no-op there (regression-tested).

Test evidence (exact final head 0ddbcebb9edff59606029f15cd51b614fa220229):

CI run on final head: all 4 jobs green (ubuntu-22.04, ubuntu-24.04, canonical gate, failure propagation).
Canonical ./scripts/check: 887 tests passed (unit 771, security 61, integration 49, contract 6), 8 failure modes verified, repository policy checks passed, Bandit clean, detect-secrets clean.
Strict Pyright: 0 errors. Ruff format/check: clean.
Key RED→GREEN evidence recorded per slice in rage/issue-30-timeline-selective-deletion.org, including a genuine Bandit-caught production defect (assert-based narrowing replaced with fail-closed checks) and the semantic-index wedge defect.
Integration proof: authenticated socket round trip (timeline → preview → delete → post-deletion timeline → audit assertions) over the real transport with real SQLite encrypted storage; deleted records cannot reappear in listing or storage.

No later issue is consumed by this transaction (retention/purge-all/secure-erase remain in #31; UI in #36).

Closes #30. RAGE transaction for timeline inspection and selective deletion. Starting main: `44917323d8649c56bb8d7948315eca78d0eadc81`. Completed and verified slices: - encrypted semantic-index selective removal; - canonical post-decrypt visibility recheck preventing deleted records from escaping concurrent retrieval; - owner-only durable deletion journal and forward-only recovery coordinator; - canonical storage deletion followed by semantic/activity derived-state reconciliation; - stale `.deletion-intent.json.tmp` crash recovery; - surviving-record activity rebuild adapter (bounded enumeration of the snapshot window, decrypt-on-demand, concurrent-deletion skips, candidate-overflow fail-closed, memory-only plaintext); - typed deletion-scope service: closed scopes (record IDs / opaque activity-cluster ID / application within mandatory explicit bounds / bounded time range), bounded decrypt-on-demand resolution, fail-closed on overflow, empty, unknown, or conflicting scopes; - typed timeline/filter/preview service: bounded newest-first listing with application filter, redacted metadata + provenance + policy revision + finding counts + opaque cluster IDs, decrypt-on-demand text/screenshot previews that are never cached or persisted; - authenticated IPC exposure: `preview-record` (query capability) and `delete-records` (dedicated `IpcCapability.DELETE`) commands, extended typed payload, exact-single-scope validation, daemon-side `TimelineDeletionHandler` with fixed sanitized reason codes and fail-closed audit semantics; - CLI surface over the authenticated IPC only: `timeline [--application]`, `preview`, `delete` with one explicit scope; - sanitized destructive audit events (`deletion_request`: closed scope class, count, outcome, correlation ID only; IPC audit gained the closed `delete` capability flag); - journal permission and symlink abuse coverage (12 adversarial cases: symlinked root/file/temp, wrong modes, foreign owner, oversized, tampered, non-regular files; decoy targets never followed); - documentation: `docs/timeline.md` plus `docs/cli.md` and `docs/ipc.md` updates. Notable defect found and fixed during the transaction: `EncryptedSemanticIndex.remove` raised on an uninitialized index, which would have wedged deletion recovery forever for users without a semantic index; removal is now a vacuous no-op there (regression-tested). Test evidence (exact final head `0ddbcebb9edff59606029f15cd51b614fa220229`): - CI run on final head: all 4 jobs green (ubuntu-22.04, ubuntu-24.04, canonical gate, failure propagation). - Canonical `./scripts/check`: 887 tests passed (unit 771, security 61, integration 49, contract 6), 8 failure modes verified, repository policy checks passed, Bandit clean, detect-secrets clean. - Strict Pyright: 0 errors. Ruff format/check: clean. - Key RED→GREEN evidence recorded per slice in `rage/issue-30-timeline-selective-deletion.org`, including a genuine Bandit-caught production defect (assert-based narrowing replaced with fail-closed checks) and the semantic-index wedge defect. - Integration proof: authenticated socket round trip (timeline → preview → delete → post-deletion timeline → audit assertions) over the real transport with real SQLite encrypted storage; deleted records cannot reappear in listing or storage. No later issue is consumed by this transaction (retention/purge-all/secure-erase remain in #31; UI in #36).