Sloth-ninja puts firm deletion on a proper governance footing

This fork treats deletion as a controlled legal-data lifecycle, not a button that merely hides records.

compliancemulti-tenant

Sloth-ninja has added firm-level deletion controls designed for multi-tenant legal work, including a retention period before data is permanently purged and options for administrators to restore a deleted firm or bring its deletion forward.

The important safeguard is broader than the deletion screen itself: documents marked for deletion are also excluded from chat and document-based context. In practice, a supposedly deleted matter should not remain discoverable through a neighbouring feature.

The work also sets out a deletion policy and cleanup paths for associated data. It is a cohesive governance package, so any team considering it should assess it alongside its own retention duties and data model rather than cherry-picking individual controls.

So what Legal teams handling multiple clients should care because defensible deletion requires both retention controls and confidence that removed material cannot quietly reappear in search or chat.

View this fork on GitHub →

Spotted something wrong? Or know the PR text has fresher detail than the writeup above?

Commits in this thread

6 commits from Sloth-ninja/JessicaOSS, oldest first. Source extracted verbatim from the harvested git log.

SHA	Subject	Author	Date
`f9dd9eb7`	WS8 F/G bundled migration: firm models + deletion governance	sloth-ninja	2026-07-27	↗ GitHub
commit body Owner-authorised 27/07/2026 (allowlist entry added by the owner). Additive, defaulted columns only - zero behaviour change until PR F/G code lands: - organisations: allow_member_model_prefs (default false), model_config jsonb, retention_days (default 30) - deleted_at/deleted_by tombstones + pending-purge partial indexes on projects, documents, chats, tabular_reviews, workflows (document_versions precedent) - deletion_audit_logs: append-only org-scoped audit trail, RLS enabled, browser-role grants revoked schema.sql mirrored; BUILD_LOG records the gate decisions (account deletion blocked for org members in v1, retention 1-365 admin-editable, one audit row per bulk action). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
`51891a1d`	Merge pull request #44 from Sloth-ninja/firm-models-deletion-migration	Ezana.H	2026-07-27	↗ GitHub
WS8 F/G bundled migration: firm models + deletion governance
`c2ff42da`	WS8 PR G: deletion governance (firm tombstones, retention, purge, admin restore/expedite)	sloth-ninja	2026-07-27	↗ GitHub
commit body Firm members' destructive deletes become reversible tombstones held for the firm's retention window then hard-purged; orgless self-hosters keep today's immediate hard delete. Rides migration 20260727_01 (#44) - no new migration, all code 42703/42P01-tolerant. New lib/deletionGovernance.ts seam: tombstone-vs-hard-delete decision (fail-SAFE to tombstone on org-lookup error, the deliberate inversion of PR B's fail-open), predicate-encoded tombstones, read exclusion post-filtering the owner-frozen overview RPCs, a per-org retention purge sweep (boot + 6h), admin pending-deletions/restore/expedite + retention clamp, and best-effort deletion_audit_logs. Frontend: firm-settings Retention + Pending deletions surfaces, honest member delete copy, member account-deletion block. Spec in docs/DELETION_GOVERNANCE_SPEC.md. Backend tsc clean, vitest 326 passed (48 new + 17 admin). Frontend tsc clean, eslint 0 errors on changed files. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
`44168e86`	WS8 PR G review fix: exclude tombstoned docs from chat/tabular doc-context	sloth-ninja	2026-07-27	↗ GitHub
commit body Independent review should-fix: buildDocContext reloaded a tombstoned single document still referenced by a chat's message files / prior doc events, leaving a deleted document readable AND editable (read_document/edit_document) via chat. Now intersects resolved ids against getTombstonedIds (42703-tolerant) at every doc-context entry point: buildDocContext (assistant chat), buildProjectDocContext (project chat, defensive), and filterAccessibleDocumentIds (single choke point for tabular create/update/generate/regenerate extraction). New chatTools.docContext.test.ts (exclusion + 42703 degradation). Nits: .limit(1000) on the purge + pending-deletions scans; overlapping-sweep double-count comment. Backend tsc clean, vitest 328 passed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
`1f4b9e6b`	Merge remote-tracking branch 'origin/main' into ws8-deletion-governance	sloth-ninja	2026-07-28	↗ GitHub
commit body # Conflicts: # CLAUDE.md # backend/src/lib/organisations.test.ts # backend/src/lib/organisations.ts # backend/src/middleware/auth.policy.test.ts # backend/src/routes/admin.ts # backend/src/routes/user.serialize.test.ts # docs/BUILD_LOG.md # frontend/src/app/(pages)/admin/firm-settings/page.tsx # frontend/src/app/lib/mikeApi.ts
`77f1e331`	Merge pull request #46 from Sloth-ninja/ws8-deletion-governance	Ezana.H	2026-07-28	↗ GitHub
WS8 PR G: deletion governance (firm tombstones, retention, purge, admin restore/expedite)

Capture this thread into my fork

Download a single Markdown prompt that tells Claude how to port every commit above into your working tree — adapting paths and structure to match your repo. Run it via claude -p < capture-thread-1001.md from inside the repo you want the changes in.

⬇ Download capture-thread-1001.md