WS8 PR G: deletion governance (firm tombstones, retention, purge, admin restore/expedite)
Firm members' destructive deletes become reversible tombstones held for the firm's retention window then hard-purged; orgless self-hosters keep today's immediate hard delete. Rides migration 20260727_01 (#44) - no new migration, all code 42703/42P01-tolerant. New lib/deletionGovernance.ts seam: tombstone-vs-hard-delete decision (fail-SAFE to tombstone on org-lookup error, the deliberate inversion of PR B's fail-open), predicate-encoded tombstones, read exclusion post-filtering the owner-frozen overview RPCs, a per-org retention purge sweep (boot + 6h), admin pending-deletions/restore/expedite + retention clamp, and best-effort deletion_audit_logs. Frontend: firm-settings Retention + Pending deletions surfaces, honest member delete copy, member account-deletion block. Spec in docs/DELETION_GOVERNANCE_SPEC.md. Backend tsc clean, vitest 326 passed (48 new + 17 admin). Frontend tsc clean, eslint 0 errors on changed files. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
| Repository | Sloth-ninja/JessicaOSS |
|---|---|
| Author | sloth-ninja <ezanahaddis@gmail.com> |
| Authored | |
| Parents | 51891a1d |
| Stats | 27 files changed , +3201 , -45 |
| Part of | WS8: firm deletion governance and retention controls |
Capture this commit into my fork
Download a Markdown prompt that tells Claude how to port this
exact commit into your working tree. Run it via
claude -p < capture-commit-c2ff42da.md
from inside the repo you want the change in.