Documentation

Appearance

This addresses point 2 (release-build scan collection) and point 3 (data retention), not point 4 (provider/hosting/transfers), which has a separate owner. The product owner confirmed the Apple binary has not yet been created and delegated the engineering retention choices.

See the build privacy and retention register for the verified runtime, target policy, release gates and restoration procedure. No production purge or deployment was performed during this implementation.

Implemented Source Controls ​

  • Mobile PR #735, source 92fe2fb: release builds reject new diagnostic ledger writes and optional diagnostic uploads. Development tooling remains. No identification request or collection holding is removed. Existing 50-entry local history and OS-managed image files are not retrospectively purged.
  • Backend PR #499, source 4544a5f: production diagnostic routes and automatic archives require explicit SCAN_DEBUG_PRODUCTION_OPT_IN; the historical auto-archive switch is insufficient. This blocks new storage after deployment, not historical data.
  • Both PRs target staging and remain separate from account-deletion PRs #733 and #497.
  • Backend PR #501 supplies the bounded, default-simulation retention command. Diagnostics use an explicitly selected 30-day target and statistics 90 days, with conservative completed-day criteria and documented scheduling/batch lag. Unsafe filesystem paths, active writers and unexpected cases fail closed or require review. No production command, scheduler or expiry for other stores is implied.
  • Backend PR #503 removes OCR text, photo hashes and card/match diagnostics from the production scan.engine source log before it reaches Docker. Correlation, statuses, durations and counts remain. Response diagnostics and development logging are unchanged. This is not disposal of historical logs or all-stream minimization.

Verified Runtime And Policy Status ​

Read-only selected flags showed production automatic scan archival and account-linked statistics enabled. Dated archive directories include July and September. No expiry was implemented for statistics or scan archives. Loki configures 168 hours plus a 2-hour deletion delay, but physical expiry was not verified and original Docker API/proxy logs lacked rotation settings. Manual backup copies existed with no verified expiry/recovery-erasure replay.

The selected engineering targets are request-lifetime-only ordinary scans, 30-day explicit diagnostics, 90-day account statistics, 30-day operational logs, six-month security logs, support for 12 months after closure and rolling 30-day backups with erasure replay before restored service is exposed. These targets are not reported as current or enforced. Actual support records, all backup copies and original log sinks still need scoped operational verification.

Verification ​

  • Mobile: lint/typecheck green; 2,638 tests passed, 11 existing skips. TDD observed release upload/callback/history writes before the guards, then passing tests. Maestro/native device E2E could not run (CLI unavailable; no connected device).
  • Backend: 1,196 API tests and 553 ingest tests passed; TypeScript passed. Local unit execution used Node 22.11 with type stripping, below the declared minimum; CI on its supported runtime passed all six jobs including complete API E2E and Compose smoke. Existing storage/auth/development behaviour remains covered.
  • VitePress build and tracking-index generation are checked separately in the documentation PR. The workbook is a tracking artifact, not execution evidence.
  • No binary creation, App Store submission, provider audit or legal compliance certification is asserted.
  • Retention follow-up #501: 1,203 API and 553 ingest tests passed, 12 focused tests and two real disposable PostgreSQL tests passed; TypeScript passed. Existing cached Node 22.23.3 and PostgreSQL binaries were reused without a download. The synthetic local cluster was stopped. Full local Docker E2E was unavailable; all six provisioned CI jobs passed in run 39131800490, including complete API E2E and Compose smoke.
  • Logging follow-up #503: 1,193 API tests passed and TypeScript passed. A route-level Red reproduced retained private OCR text before the projection; Green verifies its absence from the source log and its presence in the scan response. Full local Docker E2E was unavailable; all six provisioned CI jobs passed in run 39132003218, including complete API E2E and Compose smoke.