Repository navigation
Files Changed: bound receipt evidence and retention lifecycle #1089
Description
Important
Problem — A durable receipt table without preflight capacity limits or bounded sidecar evidence can silently lose provenance or retain arbitrary private data.
Approach — Add deterministic root-budget reservation and a host-local evidence sidecar referenced only after atomic evidence publication.
Scope — in: receipt/metadata/evidence budgets, metadata-only overflow, sidecar atomicity, orphan cleanup, root deletion, retention · out: external-diff compatibility and UI queries.
Assumptions — The operation, receipt, and assessment storage slice is merged.
Acceptance Criteria
- Preflight rejects known local work exceeding receipt or metadata capacity before storage or filesystem work.
- Evidence above its evidence-byte budget yields a metadata-only receipt rather than an untracked write.
- Evidence is atomically stored before its committed receipt reference; interrupted storage leaves only removable orphans.
- Root deletion and terminal retention remove receipt rows and sidecar evidence idempotently.
Testing Decisions
Extend the prior storage suite with deterministic budget boundaries, interrupted-write cleanup, evidence overflow, root deletion, and repeated cleanup.
Key Decisions
The injected root budget has max_receipts, max_metadata_bytes, max_evidence_bytes, and retention_ms. Evidence never resides in the session database.
Constraints & Invariants
No evidence bytes enter legacy session output. Infrastructure cleanup never generates ledger receipts.
Prior Art
#1076 design record and the preceding receipt-schema slice.
Source
Part of #1076 and #972. Blocked by the receipt-schema slice.
Activity