Implement retention, quotas, garbage collection, and cryptographic deletion #90

Merged

lost-rob0t merged 5 commits from agent/issue-31-retention-deletion into main

2026-08-30 03:27:14 +00:00

lost-rob0t commented

2026-08-30 03:25:18 +00:00

(Migrated from github.com)

Closes #31.

RAGE transaction for retention, quotas, garbage collection, and cryptographic deletion.

Starting main: 74fb629 (merge of #89).

Completed and verified slices:

bounded, content-free retention planner: closed typed rules (age, watermark with low target, record cap, application/workspace context overrides), keyset-paged catalog access with new stats()/page_ready() storage primitives, decrypt-on-demand context evaluation only inside the disputed age window with a strict fail-closed budget, dry-run plans that touch nothing;
retention sweep engine: plan + idempotent canonical deletes, sanitized retention_sweep audit events (counts, bytes, outcome only), audit failure propagates after durable deletion;
purge-all: canonical deletion of every record, semantic index invalidated, activity snapshot emptied, active record key destroyed (health verified not-ready), sanitized purge_all audit; idempotent; dry-run supported;
garbage collection: storage recovery + semantic-index pruning + surviving-record activity rebuild; every step recomputes from canonical state, so interrupted runs resume by re-running; sanitized garbage_collection audit;
documentation: docs/retention.md.

Acceptance evidence (exact head 233f1caf2e126550ae2f8788448c3fe39650fd58):

expired records removed from every derived structure (index membership, activity membership, and storage absence asserted);
quota pressure deletes only per configured policy, always audited; no eviction without pressure (oldest-first order asserted);
interrupted GC resumes safely (idempotency tests; storage recovery completes interrupted deletes);
purge-all leaves no decryptable capture records using active key material (envelopes removed + key destruction asserted).

CI on final head: all 4 jobs green. Canonical ./scripts/check: 906 tests passed (unit 786, security 61, integration 53, contract 6), 8 failure modes verified, Bandit clean, detect-secrets clean, ruff clean, strict Pyright clean. RAGE log: rage/issue-31-retention-deletion.org.

Closes #31. RAGE transaction for retention, quotas, garbage collection, and cryptographic deletion. Starting main: `74fb629` (merge of #89). Completed and verified slices: - bounded, content-free retention planner: closed typed rules (age, watermark with low target, record cap, application/workspace context overrides), keyset-paged catalog access with new `stats()`/`page_ready()` storage primitives, decrypt-on-demand context evaluation only inside the disputed age window with a strict fail-closed budget, dry-run plans that touch nothing; - retention sweep engine: plan + idempotent canonical deletes, sanitized `retention_sweep` audit events (counts, bytes, outcome only), audit failure propagates after durable deletion; - purge-all: canonical deletion of every record, semantic index invalidated, activity snapshot emptied, active record key destroyed (health verified not-ready), sanitized `purge_all` audit; idempotent; dry-run supported; - garbage collection: storage recovery + semantic-index pruning + surviving-record activity rebuild; every step recomputes from canonical state, so interrupted runs resume by re-running; sanitized `garbage_collection` audit; - documentation: `docs/retention.md`. Acceptance evidence (exact head `233f1caf2e126550ae2f8788448c3fe39650fd58`): - expired records removed from every derived structure (index membership, activity membership, and storage absence asserted); - quota pressure deletes only per configured policy, always audited; no eviction without pressure (oldest-first order asserted); - interrupted GC resumes safely (idempotency tests; storage recovery completes interrupted deletes); - purge-all leaves no decryptable capture records using active key material (envelopes removed + key destruction asserted). CI on final head: all 4 jobs green. Canonical `./scripts/check`: 906 tests passed (unit 786, security 61, integration 53, contract 6), 8 failure modes verified, Bandit clean, detect-secrets clean, ruff clean, strict Pyright clean. RAGE log: `rage/issue-31-retention-deletion.org`.