Sloth-ninja gives firm member deletion a safety net

Accidentally removing a solicitor no longer has to mean permanent loss of their work.

securityworkflow

For organisation-based firms, deleted member records now enter a reversible holding state, with who deleted them and when recorded. They stay out of normal views and cannot surface in document chat or review context, but administrators can still recover them before the retention window expires.

Pending-deletion review lets administrators restore a record or remove it permanently.
Configurable retention gives each firm one to 365 days before removal.
MFA-protected controls add a check before recovery, early removal, or policy changes.
Organisation-free self-hosted installations retain immediate deletion.

The cautious part is well judged: if the system cannot confirm an organisation's status because of a database error, it preserves the record rather than risk destroying it.

So what Firm legal-ops teams and pilot partners should care if accidental account removal could otherwise erase valuable matter context.

View this fork on GitHub →

Spotted something wrong? Or know the PR text has fresher detail than the writeup above?

Commits in this thread

3 commits from Sloth-ninja/JessicaOSS, oldest first. Source extracted verbatim from the harvested git log.

SHA	Subject	Author	Date
`c2ff42da`	WS8 PR G: deletion governance (firm tombstones, retention, purge, admin restore/expedite)	sloth-ninja	2026-07-27	↗ GitHub
commit body Firm members' destructive deletes become reversible tombstones held for the firm's retention window then hard-purged; orgless self-hosters keep today's immediate hard delete. Rides migration 20260727_01 (#44) - no new migration, all code 42703/42P01-tolerant. New lib/deletionGovernance.ts seam: tombstone-vs-hard-delete decision (fail-SAFE to tombstone on org-lookup error, the deliberate inversion of PR B's fail-open), predicate-encoded tombstones, read exclusion post-filtering the owner-frozen overview RPCs, a per-org retention purge sweep (boot + 6h), admin pending-deletions/restore/expedite + retention clamp, and best-effort deletion_audit_logs. Frontend: firm-settings Retention + Pending deletions surfaces, honest member delete copy, member account-deletion block. Spec in docs/DELETION_GOVERNANCE_SPEC.md. Backend tsc clean, vitest 326 passed (48 new + 17 admin). Frontend tsc clean, eslint 0 errors on changed files. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
`44168e86`	WS8 PR G review fix: exclude tombstoned docs from chat/tabular doc-context	sloth-ninja	2026-07-27	↗ GitHub
commit body Independent review should-fix: buildDocContext reloaded a tombstoned single document still referenced by a chat's message files / prior doc events, leaving a deleted document readable AND editable (read_document/edit_document) via chat. Now intersects resolved ids against getTombstonedIds (42703-tolerant) at every doc-context entry point: buildDocContext (assistant chat), buildProjectDocContext (project chat, defensive), and filterAccessibleDocumentIds (single choke point for tabular create/update/generate/regenerate extraction). New chatTools.docContext.test.ts (exclusion + 42703 degradation). Nits: .limit(1000) on the purge + pending-deletions scans; overlapping-sweep double-count comment. Backend tsc clean, vitest 328 passed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
`1f4b9e6b`	Merge remote-tracking branch 'origin/main' into ws8-deletion-governance	sloth-ninja	2026-07-28	↗ GitHub
commit body # Conflicts: # CLAUDE.md # backend/src/lib/organisations.test.ts # backend/src/lib/organisations.ts # backend/src/middleware/auth.policy.test.ts # backend/src/routes/admin.ts # backend/src/routes/user.serialize.test.ts # docs/BUILD_LOG.md # frontend/src/app/(pages)/admin/firm-settings/page.tsx # frontend/src/app/lib/mikeApi.ts

Capture this thread into my fork

Download a single Markdown prompt that tells Claude how to port every commit above into your working tree — adapting paths and structure to match your repo. Run it via claude -p < capture-thread-1140.md from inside the repo you want the changes in.

⬇ Download capture-thread-1140.md