jobtrackingapp/docs/verification/sec-009-account-lifecycle.md

SEC-009 account export and deletion lifecycle

Updated: 2026-08-15

Status: IN PROGRESS. Generated-output ownership is now explicit. Readable export and the disabled deletion lifecycle remain to be implemented.

Owner inventory boundary

The authoritative inventory must include Identity-safe account/profile fields and roles; companies, opportunities, applications and all workspace children; correspondence/events/attachments; Career Profile and versions/children; CV variants/versions/artifacts/extraction runs; AI notes/interactions/operations/notifications; email drafts/send metadata; provider connection metadata; rules; sessions/trusted-device metadata; and owned files. It must exclude password/security hashes, TOTP/recovery/token hashes, OAuth tokens, IMAP passwords, data-protection keys and global settings.

Checkpoint 1 — owner-scoped generated files

• AppPaths.GetOwnerStorageKey provides one opaque SHA-256 owner directory key.
• CV PDF exports now write under CvExports/<owner-key>/<yyyyMMdd>/<uuid>.pdf. The friendly renderer filename remains the download name, while the stored UUID prevents collisions and unsafe path influence.
• Daily exports now write under exports/<owner-key>/daily_export_<yyyyMMdd>.json with the existing atomic temporary-file move.
• The PDF exporter receives the authenticated/public-variant owner explicitly from every controller, including anonymous public download after slug ownership resolution.
• Retention prunes both legacy top-level date directories and new owner/date directories. Unknown folders remain untouched.

No existing generated file is moved or guessed. Legacy shared-date outputs stay a separately reviewed rollout concern because they cannot be attributed safely.

Verification

• Focused CV/export/controller/background tests: 77/77.
• Full backend: 647/647.
• Backend build: pass, zero warnings/errors.
• git diff --check: pass aside from line-ending notices.

Remaining repository work

1. Implement one owner inventory used by both readable ZIP export and deletion.
2. Add manifest/checksums/warnings and include safely owned binary files without exposing storage paths.
3. Add the additive deletion state/request/file schema and disabled coordinator.
4. Add pending-account authentication/mutation gates, session/queue cancellation, provider cleanup and idempotent file quarantine/database purge.
5. Add separate tombstone storage/replay and settings/admin UX while keeping production activation disabled.

Production retention, legal hold and restored-backup decisions remain recorded in BLOCKERS.md.