WS8 PR G: deletion governance (firm tombstones, retention, purge, admin restore/expedite)

↗ view on GitHub · sloth-ninja · 2026-07-27 · c2ff42da

Firm members' destructive deletes become reversible tombstones held for the
firm's retention window then hard-purged; orgless self-hosters keep today's
immediate hard delete. Rides migration 20260727_01 (#44) - no new migration,
all code 42703/42P01-tolerant. New lib/deletionGovernance.ts seam:
tombstone-vs-hard-delete decision (fail-SAFE to tombstone on org-lookup error,
the deliberate inversion of PR B's fail-open), predicate-encoded tombstones,
read exclusion post-filtering the owner-frozen overview RPCs, a per-org
retention purge sweep (boot + 6h), admin pending-deletions/restore/expedite +
retention clamp, and best-effort deletion_audit_logs. Frontend: firm-settings
Retention + Pending deletions surfaces, honest member delete copy, member
account-deletion block. Spec in docs/DELETION_GOVERNANCE_SPEC.md.

Backend tsc clean, vitest 326 passed (48 new + 17 admin). Frontend tsc clean,
eslint 0 errors on changed files.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Repository Sloth-ninja/JessicaOSS
Author sloth-ninja <ezanahaddis@gmail.com>
Authored
Parents 51891a1d
Stats 27 files changed , +3201 , -45
Part of WS8: firm deletion governance and retention controls

Capture this commit into my fork

Download a Markdown prompt that tells Claude how to port this exact commit into your working tree. Run it via claude -p < capture-commit-c2ff42da.md from inside the repo you want the change in.

⬇ Download capture-commit-c2ff42da.md