decision(dredger): define rehearsal behaviour before deletion consent
Owner ruling: allow a read-only dry-run preview before deletion consent. The preview must hold no real deletion or cursor-write capability. Missing consent must not stop candidate enumeration and prospective measurement when the operator has the necessary read access.
Report consent, store classification, and other prerequisites separately from the hypothetical removal counts. Those counts do not prove that the deployment can perform real deletion. Real sweeps retain all existing consent, classification, provenance, first-party, target-authority, and cap guards. A preview does not grant or persist consent.
The rehearsal replaces deletion and cursor writes, but preserves consent and classification checks. Verdaccio can refuse boot without permitDeletion before that replacement exists. CodeArtifact can halt before enumeration. The manual says only a store fault stops the combined once/dry-run invocation.
See Plan.hs:111, Maintenance.hs:187, and dredger.md:148.
Accepted direction: construct the read-only rehearsal capability before any deletion-consent-specific boot refusal. Preserve target parsing and read-access requirements. Expose incomplete enumeration or unavailable evidence explicitly instead of claiming a complete count. Do not implement dry-run as an ordinary delete path that relies solely on a late boolean check.
The owner accepts that would-delete counts describe hypothetical policy reach, not proof of real deletion authority. The earlier alternative of requiring real consent before rehearsal is not selected.
Completion: support previews without deletion consent on CodeArtifact and Verdaccio. Test read-only credentials, absent consent, preserved-store classification reporting, first-party exclusions, incomplete reads, and unchanged real-sweep refusal. Assert zero deletion, cursor writes, and consent mutations in every preview path. Keep completion status distinct from whether real-sweep prerequisites are met and document exit semantics for complete versus incomplete previews. Update operator guidance so operators can inspect proposed effects before opting in.
Validation: source and existing tests reviewed. No store mutation or process-boot experiment ran.
Audit baseline: 1357c9c6a1f87af1b90182973d6a179f840c5917. Read-only preview before consent is accepted. needs-decision is removed, implementation remains open, and no runtime code changed. Assisted-by: Codex (OpenAI).
decision(dredger): define rehearsal behaviour before deletion consent
Owner ruling: allow a read-only dry-run preview before deletion consent. The preview must hold no real deletion or cursor-write capability. Missing consent must not stop candidate enumeration and prospective measurement when the operator has the necessary read access.
Report consent, store classification, and other prerequisites separately from the hypothetical removal counts. Those counts do not prove that the deployment can perform real deletion. Real sweeps retain all existing consent, classification, provenance, first-party, target-authority, and cap guards. A preview does not grant or persist consent.
The rehearsal replaces deletion and cursor writes, but preserves consent and classification checks. Verdaccio can refuse boot without permitDeletion before that replacement exists. CodeArtifact can halt before enumeration. The manual says only a store fault stops the combined once/dry-run invocation.
See Plan.hs:111, Maintenance.hs:187, and dredger.md:148.
Accepted direction: construct the read-only rehearsal capability before any deletion-consent-specific boot refusal. Preserve target parsing and read-access requirements. Expose incomplete enumeration or unavailable evidence explicitly instead of claiming a complete count. Do not implement dry-run as an ordinary delete path that relies solely on a late boolean check.
The owner accepts that would-delete counts describe hypothetical policy reach, not proof of real deletion authority. The earlier alternative of requiring real consent before rehearsal is not selected.
Completion: support previews without deletion consent on CodeArtifact and Verdaccio. Test read-only credentials, absent consent, preserved-store classification reporting, first-party exclusions, incomplete reads, and unchanged real-sweep refusal. Assert zero deletion, cursor writes, and consent mutations in every preview path. Keep completion status distinct from whether real-sweep prerequisites are met and document exit semantics for complete versus incomplete previews. Update operator guidance so operators can inspect proposed effects before opting in.
Validation: source and existing tests reviewed. No store mutation or process-boot experiment ran.
Audit baseline:
1357c9c6a1f87af1b90182973d6a179f840c5917. Read-only preview before consent is accepted. needs-decision is removed, implementation remains open, and no runtime code changed. Assisted-by: Codex (OpenAI).