feat(retention): ASVS 14.2.7 — retention classification, automatic deletion, and the legacy outbox PHI leak - #71

Merged

wshallwshall merged 15 commits into

mainfrom

claude/asvs-14-2-7-retention-classification

Aug 3, 2026

Commits on Jul 30, 2026

test(14.2.7): land the no-DB guards FIRST, so the retirement cannot ship half-done
wshallwshall
committed
5e2e1a3
feat(retention): purge orphaned reference snapshots (ASVS 14.2.7 part 1)
wshallwshall
committed
0868c47
docs(phi): reference snapshots gain a bounded window — and the limit is stated (14.2.7)
wshallwshall
committed
df13c01
Merge remote-tracking branch 'origin/main' into claude/asvs-14-2-7-retention-classification
wshallwshall
committed
1c36e33
Merge remote-tracking branch 'origin/main' into claude/asvs-14-2-7-retention-classification
wshallwshall
committed
77d80f6
docs(phi): the anchor that would catch tail-truncation is unreachable from the CLI
wshallwshall
committed
ce06f99
docs(phi): classify all 38 at-rest tiers — and four of them are UNBOUNDED (14.2.7)
wshallwshall
committed
6741460
feat(retention): generate the serve gate from the classification, not a literal (14.2.7)
wshallwshall
committed
346fa83
fix(store): the legacy SQL Server `outbox` table held PHI nothing could purge (14.2.7)
wshallwshall
committed
1cd441b
Merge remote-tracking branch 'origin/main' into claude/asvs-14-2-7-retention-classification
wshallwshall
committed
4fe0f62
docs(ci): three workflow comments still pointed at the pre-archive plan path
wshallwshall
committed
0cffaac
Merge remote-tracking branch 'origin/main' into claude/asvs-14-2-7-retention-classification
wshallwshall
committed
4c8b388

Commits on Aug 3, 2026