[Safety] Orchestrate destructive tenant erasure with preview, approvals, and evidence #5

New Issue

2026-07-31T01:22:04+02:00

zemion commented

2026-07-31 01:22:04 +02:00

Moved from Core #138. Tenancy owns the tenant lifecycle; modules contribute bounded erase/export/retain steps through capabilities.

Outcome

Provide a fail-closed, resumable tenant-erasure workflow that respects retention, legal hold, immutable evidence, external resources, and optional modules.

Acceptance criteria

\n- [x] Preview inventories affected module data, retained/legal-hold data, external resources, encryption keys, backups, and unavailable providers without exposing secrets.\n- [x] Execution requires explicit authorization, recent authentication, typed confirmation, an idempotency key, and configurable multi-party approval for production profiles.\n- [x] Every enabled module either contributes export/erase/retain steps or explicitly reports that erasure cannot proceed; absence and timeout never count as success.\n- [x] The orchestrator supports cancellation before destructive work, resumable checkpoints, retries, partial-failure recovery, and irreversible-step warnings.\n- [x] Tenant access is suspended before erasure, and completion emits durable lifecycle/audit evidence without retaining erased personal data.\n- [x] Backup expiry, key destruction, external connector cleanup, and reconciliation remain visible until their guarantees are satisfied.

> Moved from [Core #138](https://git.add-ideas.de/GovOPlaN/govoplan-core/issues/138). Tenancy owns the tenant lifecycle; modules contribute bounded erase/export/retain steps through capabilities. ## Outcome Provide a fail-closed, resumable tenant-erasure workflow that respects retention, legal hold, immutable evidence, external resources, and optional modules. ## Acceptance criteria \n- [x] Preview inventories affected module data, retained/legal-hold data, external resources, encryption keys, backups, and unavailable providers without exposing secrets.\n- [x] Execution requires explicit authorization, recent authentication, typed confirmation, an idempotency key, and configurable multi-party approval for production profiles.\n- [x] Every enabled module either contributes export/erase/retain steps or explicitly reports that erasure cannot proceed; absence and timeout never count as success.\n- [x] The orchestrator supports cancellation before destructive work, resumable checkpoints, retries, partial-failure recovery, and irreversible-step warnings.\n- [x] Tenant access is suspended before erasure, and completion emits durable lifecycle/audit evidence without retaining erased personal data.\n- [x] Backup expiry, key destruction, external connector cleanup, and reconciliation remain visible until their guarantees are satisfied.

zemion added the area/api area/tenancy area/db codex/ready module/tenancy source/backlog-import area/security area/governance

labels 2026-07-31 01:22:04 +02:00

zemion commented

2026-07-31 01:22:07 +02:00

Moved here from Core #138; the source issue is closed to keep Tenancy as the canonical owner.

Moved here from [Core #138](https://git.add-ideas.de/GovOPlaN/govoplan-core/issues/138); the source issue is closed to keep Tenancy as the canonical owner.

zemion referenced this issue from GovOPlaN/govoplan-core

2026-07-31 01:22:10 +02:00

[Task] Destructive tenant erasure orchestration #138

zemion added

and removed

labels 2026-08-24 15:40:13 +02:00

zemion commented

2026-08-24 15:40:13 +02:00

Implementation started 2026-08-24.

Current autonomous slice:

Core provider-neutral tenant-erasure resource/step/result contract and dedicated system:tenants:erase permission;
durable Tenancy operations with digest-bound previews, configurable production policy, recent authentication, exact slug confirmation, distinct approvals, cancellation boundary, checkpoints, and outcome reconciliation;
Access as the first real idempotent provider, retaining shared global accounts/identities while erasing only target-tenant credentials and authorization projections;
fail-closed fallback for modules that report tenant data without an erasure provider.

Target conformance and full workspace verification are in progress.

Implementation started 2026-08-24. Current autonomous slice: - Core provider-neutral tenant-erasure resource/step/result contract and dedicated system:tenants:erase permission; - durable Tenancy operations with digest-bound previews, configurable production policy, recent authentication, exact slug confirmation, distinct approvals, cancellation boundary, checkpoints, and outcome reconciliation; - Access as the first real idempotent provider, retaining shared global accounts/identities while erasing only target-tenant credentials and authorization projections; - fail-closed fallback for modules that report tenant data without an erasure provider. Target conformance and full workspace verification are in progress.

zemion commented

2026-08-24 16:34:20 +02:00

Implemented and published the governed tenant-erasure workflow.

Implementation evidence:

Core 9a30080 / v0.1.43: strict provider-neutral inventory and step contracts, fail-closed provider discovery/validation, and dedicated system:tenants:erase permission mapped to access:tenant:erase.
Access 0f8a05f / v0.1.24: tenant-bounded credential revocation and authorization erasure, with shared global accounts and identities retained.
Tenancy e412c7d + bfc38a7 / v0.1.21: durable preview digests, configurable production approval policy, recent interactive authentication, exact slug confirmation, idempotent creation and provider effects, distinct approvers, pre-effect suspension, committed checkpoints, cancellation boundary, retry/reconciliation, final inventory and veto checks, durable minimized lifecycle evidence, migration/uninstall guards, and DSAR export/retention behavior.
Workspace 6edaaad / v0.1.43: coordinated release pins, endpoint declarations, and updated DSAR coverage evidence.

Direct DELETE ... mode=destroy now fails closed and points callers to the governed workflow, preventing the former bypass. Provider absence, stale previews, policy drift, pending/unknown outcomes, retained/legal-hold resources, external cleanup, key destruction, and backup expiry remain visible and block completion until reconciled.

Verification:

tools/checks/check-focused.sh passed, including 72 manifests, 49 DSAR providers / 23 reviewed no-store modules, strict endpoint declarations, 63 WebUI module permutations, bundle budgets, and 12 browser conformance tests.
Core: 681 passed, 3 skipped, 302 subtests passed.
Access: 80 passed, 4 subtests passed.
Tenancy: 21 passed.
Release composition alignment passed for 78 repositories.
Remote main and peeled release tags were verified against each published commit.

Implemented and published the governed tenant-erasure workflow. Implementation evidence: - Core `9a30080` / `v0.1.43`: strict provider-neutral inventory and step contracts, fail-closed provider discovery/validation, and dedicated `system:tenants:erase` permission mapped to `access:tenant:erase`. - Access `0f8a05f` / `v0.1.24`: tenant-bounded credential revocation and authorization erasure, with shared global accounts and identities retained. - Tenancy `e412c7d` + `bfc38a7` / `v0.1.21`: durable preview digests, configurable production approval policy, recent interactive authentication, exact slug confirmation, idempotent creation and provider effects, distinct approvers, pre-effect suspension, committed checkpoints, cancellation boundary, retry/reconciliation, final inventory and veto checks, durable minimized lifecycle evidence, migration/uninstall guards, and DSAR export/retention behavior. - Workspace `6edaaad` / `v0.1.43`: coordinated release pins, endpoint declarations, and updated DSAR coverage evidence. Direct `DELETE ... mode=destroy` now fails closed and points callers to the governed workflow, preventing the former bypass. Provider absence, stale previews, policy drift, pending/unknown outcomes, retained/legal-hold resources, external cleanup, key destruction, and backup expiry remain visible and block completion until reconciled. Verification: - `tools/checks/check-focused.sh` passed, including 72 manifests, 49 DSAR providers / 23 reviewed no-store modules, strict endpoint declarations, 63 WebUI module permutations, bundle budgets, and 12 browser conformance tests. - Core: 681 passed, 3 skipped, 302 subtests passed. - Access: 80 passed, 4 subtests passed. - Tenancy: 21 passed. - Release composition alignment passed for 78 repositories. - Remote `main` and peeled release tags were verified against each published commit.

zemion closed this issue

2026-08-24 16:34:21 +02:00

zemion removed the

status

in-progress

codex/ready labels 2026-08-24 16:34:21 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: GovOPlaN/govoplan-tenancy#5