#511 storage: a retention-policy record with enforcement proof for the decision log

[Anonymous]

Originally created by: fu351

doberman decision-log-prune (#461, [#502]) deletes rows, but nothing records the retention policy an operator chose or proves it ran. An auditor asking "what is your retention and when was it last enforced" (NIST 800-53 AU-11, PCI DSS 10.5) has nothing to point at.

Persist a retention record (max age or max rows, when it was set, and who set it). Shortening retention is a loosening, so it crosses the same possession-factor gate as other weakenings and keeps raise-only semantics. Log each prune run (timestamp, rows deleted, policy in force) to the append-only policy_changes ledger, and add a doberman doctor row showing the retention policy and the last prune. Tests: the retention record survives a prune; shortening retention crosses the gate; the doctor row is present.