cesnimda/jobtrackingapp
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix(account): close deletion cache gap
CI and Deploy / test (pull_request) Successful in 5m22s
Details
CI and Deploy / deploy (pull_request) Has been skipped
Details

Browse Source 
Require authenticated sidecar cache purge before a deletion can complete and keep failures retryable. Mount tombstones outside restored application data while leaving deletion disabled by default.
This commit is contained in:
cesnimda
2026-08-15 19:40:07 +02:00
parent c0e190d5b5
commit 7185491a05
14 changed files with 134 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
BLOCKERS.md
+2 -2
View File
@@ -38,9 +38,9 @@ Updated: 2026-08-15
## Account deletion retention and restore policy
- **Blocked:** Enabling SEC-009 self-service deletion in production and declaring backup erasure complete.
- **Why:** The readable export and idempotent live-data deletion coordinator are implemented at `842e793` behind an explicit disabled gate. Repository code cannot truthfully choose legal retention periods, backup expiry, provider obligations or the tombstone lifetime needed to prevent restoration from resurrecting an erased account. Production inventory also confirms current backups are database-only and no protected tombstone volume exists yet.
- **Why:** The readable export and idempotent live-data deletion coordinator are implemented behind an explicit disabled gate. Repository code cannot truthfully choose legal retention periods, backup expiry, provider obligations or the tombstone lifetime needed to prevent restoration from resurrecting an erased account. Production inventory confirms current backups are database-only and no protected tombstone volume is deployed yet; the release branch now defines the separate volume and retryable authenticated sidecar-cache purge.
- **Required:** Decide retention periods for operational backups, audit/security records and deletion tombstones; identify any legal hold/export obligations; approve the restore behavior for deleted identities.
- **Recommended:** Keep production self-service and admin deletion disabled. Decide retention, mount the tombstone store outside restored application data, build a complete DB/files/keys backup set, then use a disposable account to prove provider/cache cleanup and restored-backup tombstone replay before staged activation.
- **Recommended:** Keep production self-service and admin deletion disabled. Decide retention, deploy/protect the configured tombstone volume, build a complete DB/files/keys backup set, then use a disposable account to prove remote-provider cleanup, sidecar purge across restart and restored-backup tombstone replay before staged activation.
## Legacy job/application column cutover