Report confirmed deletions privately and bind approved Laya policy #34

Merged

backmeupplz merged 2 commits from fix/69-approved-audit into main

2026-10-10 22:48:23 +00:00

backmeupplz commented

2026-10-10 22:42:12 +00:00

(Migrated from github.com)

Scope

Implements #69 Decision3196: private confirmed-deletion reporting to the sole authorized sink and matching approved ckpt-v2 rules/examples identity. User explicitly accepted the disclosed prompt tradeoff; tests do not relabel the benchmark.

Durable PostgreSQL bounded outbox, pre-delete snapshot/intent, confirmed-success delivery, actor/context preservation, sink exclusion, escaped bounded reports, rate/backoff/ambiguous-send handling and finite retention.
New policy/cache identity rejects old model responses; preserves .80 deletion and .75 history selection, user capture configuration.
Harmless labeled integration report uses same outbox/transport; no destructive live tests.

Verification

Typecheck; 476 tests passed, 249 live-only skipped. Model companion has 12 offline tests. Independent Astra/high exact-head privacy/correctness review pending; this is not merge approval.

Coupled rollout

Companion model branch fix/69-approved-policy in backmeupplz/jev-laya. Both managed services currently pinned to release/69-pre-rollout at old deployed commits, preserving env/mount/deploy bytes. Stop old bot, deploy/verify model, deploy/start matching bot, verify source/prompt/checkpoint/cache/gates/capture and harmless audit receipt. No model-only rollout while old bot runs. Additive migration004; DATABASE_URL mandatory. Details in docs/audit-outbox.md and docs/approved-policy-rollout.md.

No raw production data or secrets included. No exactly-once claim; unknown deletion/send outcomes are explicit, bounded and not blindly retried.

## Scope Implements #69 Decision3196: private confirmed-deletion reporting to the sole authorized sink and matching approved ckpt-v2 rules/examples identity. User explicitly accepted the disclosed prompt tradeoff; tests do not relabel the benchmark. - Durable PostgreSQL bounded outbox, pre-delete snapshot/intent, confirmed-success delivery, actor/context preservation, sink exclusion, escaped bounded reports, rate/backoff/ambiguous-send handling and finite retention. - New policy/cache identity rejects old model responses; preserves .80 deletion and .75 history selection, user capture configuration. - Harmless labeled integration report uses same outbox/transport; no destructive live tests. ## Verification Typecheck; 476 tests passed, 249 live-only skipped. Model companion has 12 offline tests. Independent Astra/high exact-head privacy/correctness review pending; this is not merge approval. ## Coupled rollout Companion model branch fix/69-approved-policy in backmeupplz/jev-laya. Both managed services currently pinned to release/69-pre-rollout at old deployed commits, preserving env/mount/deploy bytes. Stop old bot, deploy/verify model, deploy/start matching bot, verify source/prompt/checkpoint/cache/gates/capture and harmless audit receipt. No model-only rollout while old bot runs. Additive migration004; DATABASE_URL mandatory. Details in docs/audit-outbox.md and docs/approved-policy-rollout.md. No raw production data or secrets included. No exactly-once claim; unknown deletion/send outcomes are explicit, bounded and not blindly retried.