#196: audit-trail retention job #251

fable-5 · 2026-07-30T14:59:44+02:00

fable-5 commented

2026-07-30 14:59:44 +02:00

Implements #196:

audit.retentionDays (instance setting, default 365 days) bounds audit_log; the daily audit-retention job deletes entries past the period.
The deletion itself lands on the trail: audit.pruned with count, cutoff and period - a gap is always explainable.
Separate AuditRetentionService: the settings service audits its own writes, so folding retention into AuditService would close a constructor DI cycle.
The read-access trail (#222-#225) is explicitly NOT covered - it gets its own period (per the AC).
security.md gains the Logging section the schema has cited for a while (stdout/redaction/SIEM division, audit scope, retention); operations.md job table + maintenance-job fence 6 -> 7 (deliberate new row, same pattern as #194).

Tested: new audit-retention.e2e.db.test.ts (old entries pruned, fresh kept, audit.pruned recorded with details; no-op run) - the retention override is written to the settings row BEFORE app boot (in-process cache); api full suite 464 green vs fresh DB; typecheck + lint green.

Refs #196 (close manually after green CI + merge).

Generated with Claude Code (Claude Fable 5)

Implements #196: - audit.retentionDays (instance setting, default 365 days) bounds audit_log; the daily audit-retention job deletes entries past the period. - The deletion itself lands on the trail: audit.pruned with count, cutoff and period - a gap is always explainable. - Separate AuditRetentionService: the settings service audits its own writes, so folding retention into AuditService would close a constructor DI cycle. - The read-access trail (#222-#225) is explicitly NOT covered - it gets its own period (per the AC). - security.md gains the Logging section the schema has cited for a while (stdout/redaction/SIEM division, audit scope, retention); operations.md job table + maintenance-job fence 6 -> 7 (deliberate new row, same pattern as #194). Tested: new audit-retention.e2e.db.test.ts (old entries pruned, fresh kept, audit.pruned recorded with details; no-op run) - the retention override is written to the settings row BEFORE app boot (in-process cache); api full suite 464 green vs fresh DB; typecheck + lint green. Refs #196 (close manually after green CI + merge). Generated with Claude Code (Claude Fable 5)

fable-5 added 1 commit 2026-07-30 14:59:44 +02:00

#196 : audit-trail retention job

CI / Lint, typecheck, test (pull_request) Successful in 5m5s

Details

CI / Build container images (pull_request) Successful in 2m48s

Details

CI / Auth e2e pack (pull_request) Successful in 7m50s

Details

CI / Import/export fidelity gate (pull_request) Successful in 56s

Details

CD / Build and push images (push) Successful in 15s

Details

CD / Deploy to Test (push) Successful in 16s

Details

CD / Smoke tests against Test (push) Successful in 1m20s

Details

CD / Promote to Int (push) Successful in 11s

Details

CI / Lint, typecheck, test (push) Successful in 5m11s

Details

CI / Build container images (push) Has been skipped

Details

CI / Auth e2e pack (push) Successful in 7m38s

Details

CI / Import/export fidelity gate (push) Successful in 56s

Details

ed2225bb77

audit.retentionDays (instance setting, default 365) bounds the audit_log:
the daily audit-retention job deletes entries past the period and records
the deletion itself (audit.pruned with count, cutoff and period) so a gap
in the trail is always explainable. Lives in its own AuditRetentionService
because the settings service audits its writes - folding retention into
AuditService would close a constructor cycle. The read-access trail
(#222-#225) is deliberately not covered; it gets its own period.

security.md gains the Logging section the schema has cited for a while;
the maintenance-job fence moves 6 -> 7 (the deliberate new row).

Refs #196

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0168Ph5uBmHm8X28CSVpbpnJ

fable-5 merged commit ed2225bb77 into main

2026-07-30 15:14:27 +02:00

fable-5 referenced this pull request

2026-07-30 15:14:28 +02:00

[VS-NfD] Add a retention job for `audit_log` #196

Sign in to join this conversation.

No reviewers