doberman decision-log-prune (#461, #502) deletes rows, but nothing records the retention policy an operator chose or proves it ran. An auditor asking "what is your retention and when was it last enforced" (NIST 800-53 AU-11, PCI DSS 10.5) has nothing to point at.
Persist a retention record (max age or max rows, when it was set, and who set it). Shortening retention is a loosening, so it crosses the same possession-factor gate as other weakenings and keeps raise-only semantics. Log each prune run (timestamp, rows deleted, policy in force) to the append-only policy_changes ledger, and add a doberman doctor row showing the retention policy and the last prune. Tests: the retention record survives a prune; shortening retention crosses the gate; the doctor row is present.
doberman decision-log-prune(#461, #502) deletes rows, but nothing records the retention policy an operator chose or proves it ran. An auditor asking "what is your retention and when was it last enforced" (NIST 800-53 AU-11, PCI DSS 10.5) has nothing to point at.Persist a retention record (max age or max rows, when it was set, and who set it). Shortening retention is a loosening, so it crosses the same possession-factor gate as other weakenings and keeps raise-only semantics. Log each prune run (timestamp, rows deleted, policy in force) to the append-only
policy_changesledger, and add adoberman doctorrow showing the retention policy and the last prune. Tests: the retention record survives a prune; shortening retention crosses the gate; the doctor row is present.