From 3d56c0d47318e9a2995aba0058f8eb6873e482f2 Mon Sep 17 00:00:00 2001
From: minereda <84080887+minereda@users.noreply.github.com>
Date: Tue, 14 Jul 2026 14:21:55 +0200
Subject: [PATCH] =?UTF-8?q?infra(35):=20reap=20pre-flight=20probe=20leftov?=
 =?UTF-8?q?ers=20=E2=80=94=20prefix-scoped=20lifecycle=20rule?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The archive-repo CLIs (earnings-archive 944d6fa) write a unique per-invocation
credential-probe object under earnings/_preflight/ before touching any source
feed; the cleanup delete is deliberately best-effort, so probe leftovers can
accumulate when deletes fail (codex review P3, 2026-07-14).

Add ONE lifecycle rule scoped by matches_prefix to earnings/_preflight/ only
(age 1 day -> Delete). This does not touch the D-27.9 retained-archive
decision (35-01 gate, no retention cap): probe objects are ~9-byte ephemeral
credential probes, not archive artifacts — audio (earnings/audio/) and
transcripts (earnings/transcripts/) match no part of the prefix.

tofu fmt/validate clean; remote plan shows exactly one in-place bucket update
(plus the known cosmetic perma-drift on budgets/launch-stage).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 infra/earnings_archive.tf | 27 +++++++++++++++++++++++----
 1 file changed, 23 insertions(+), 4 deletions(-)

diff --git a/infra/earnings_archive.tf b/infra/earnings_archive.tf
index 3c3b1d50..07bbc8aa 100644
--- a/infra/earnings_archive.tf
+++ b/infra/earnings_archive.tf
@@ -51,10 +51,29 @@ resource "google_storage_bucket" "earnings_archive" {
   force_destroy               = false
   public_access_prevention    = "enforced"
 
-  # NO lifecycle_rule: the 35-01 gate was signed `approve` with NO retention cap
-  # (D-27.9 amendment, no conditions) — the archive is retained indefinitely.
-  # Contrast the transient earnings-audio-handoff bucket (cloud_run.tf) which
-  # reaps at age = 1 day.
+  # NO general lifecycle-delete rule: the 35-01 gate was signed `approve` with NO
+  # retention cap (D-27.9 amendment, no conditions) — the ARCHIVE is retained
+  # indefinitely. Contrast the transient earnings-audio-handoff bucket
+  # (cloud_run.tf) which reaps at age = 1 day.
+  #
+  # ONE narrow exception, scoped by prefix to `earnings/_preflight/` ONLY: the
+  # archive-repo CLIs (earnings-archive commit 944d6fa) write a unique
+  # per-invocation credential-probe object (`probe-<uuid>.txt`, ~9 bytes) before
+  # touching any source feed, and the cleanup delete is deliberately
+  # best-effort — so probe leftovers can accumulate when deletes fail (codex
+  # review P3, 2026-07-14). These are ephemeral credential probes, NOT archive
+  # artifacts (audio lives under `earnings/audio/`, transcripts under
+  # `earnings/transcripts/` — neither matches this prefix), so reaping them
+  # does not touch the D-27.9 retained-archive decision.
+  lifecycle_rule {
+    condition {
+      age            = 1
+      matches_prefix = ["earnings/_preflight/"]
+    }
+    action {
+      type = "Delete"
+    }
+  }
 
   labels = {
     phase = "35"