Q127: erasure removes the subject's content and keeps only a receipt

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/main/database/migrations/090-erasure-receipts.ts

@@ -0,0 +1,23 @@
+// Deletion records made before receipts copied the erased data into themselves; that copy is removed here.
+// Audit events stay immutable except for one change: an erasure may replace a payload with the redaction marker, nothing else.
+export const erasureReceiptsSchema = `
+  update compliance_exports
+  set payload_json = '{"erased":null,"note":"This record once held a copy of the erased data; it was removed."}'
+  where export_type = 'gdpr_delete';
+
+  drop trigger if exists trg_audit_events_no_update;
+  create trigger trg_audit_events_no_update
+  before update on audit_events
+  for each row
+  when not (
+    new.payload_json is '{"redacted":true}'
+    and new.id is old.id and new.org_id is old.org_id and new.entity_type is old.entity_type and new.entity_id is old.entity_id
+    and new.actor_type is old.actor_type and new.actor_id is old.actor_id and new.action is old.action and new.created_at is old.created_at
+  )
+  begin
+    select raise(abort, 'Audit events are immutable.');
+  end;
+
+  insert into schema_migrations(version, name, applied_at)
+  values (90, 'erasure_receipts', datetime('now'));
+`;

src/main/database/schema.ts

@@ -88,6 +88,7 @@ import { heldDeliverablesSchema } from "./migrations/086-held-deliverables";
 import { goalAuditorSchema } from "./migrations/087-goal-auditor";
 import { hostAccessNoteSchema } from "./migrations/088-host-access-note";
 import { fileVersionsSchema } from "./migrations/089-file-versions";
+import { erasureReceiptsSchema } from "./migrations/090-erasure-receipts";
 
 interface Migration {
   version: number;
@@ -185,6 +186,7 @@ const MIGRATIONS: Migration[] = [
   { version: 87, name: "goal_auditor", sql: goalAuditorSchema },
   { version: 88, name: "host_access_note", sql: hostAccessNoteSchema },
   { version: 89, name: "file_versions", sql: fileVersionsSchema },
+  { version: 90, name: "erasure_receipts", sql: erasureReceiptsSchema },
 ];
 
 const SCHEMA_VERSION = MIGRATIONS[MIGRATIONS.length - 1].version;

src/main/services/compliance-service.ts

@@ -24,8 +24,11 @@ export class ComplianceService {
     this.assertEmployee(input.orgId, input.requestedByEmployeeId, "Requesting employee was not found.");
     this.assertSubject(input.orgId, input.subjectType, input.subjectId);
     if (input.exportType === COMPLIANCE_EXPORT_TYPE.GDPR_DELETE) this.assertDeleteAllowed(input);
-    const payload = this.subjectPayload(input.orgId, input.subjectType, input.subjectId);
-    if (input.exportType === COMPLIANCE_EXPORT_TYPE.GDPR_DELETE) this.applyGdprDelete(input.orgId, input.subjectType, input.subjectId);
+    const gathered = this.subjectPayload(input.orgId, input.subjectType, input.subjectId);
+    const erasing = input.exportType === COMPLIANCE_EXPORT_TYPE.GDPR_DELETE;
+    // A deletion keeps a receipt of what it erased, never a copy of it.
+    const payload = erasing ? erasureReceipt(gathered) : gathered;
+    if (erasing) this.applyGdprDelete(input.orgId, input.subjectType, input.subjectId);
     const requestedByEmployeeId = deletedEmployeeRequestor(input) ? null : input.requestedByEmployeeId;
     const id = createId("cmp");
     const now = new Date().toISOString();
@@ -51,7 +54,7 @@ export class ComplianceService {
       entityType: "compliance_export",
       entityId: id,
       actorType: "employee",
-      actorId: input.requestedByEmployeeId,
+      actorId: requestedByEmployeeId,
       action: input.exportType === COMPLIANCE_EXPORT_TYPE.GDPR_DELETE ? "gdpr_deleted" : "created",
       payload: { subjectType: input.subjectType, subjectId: input.subjectId, exportType: input.exportType },
     });
@@ -150,7 +153,7 @@ export class ComplianceService {
     if (subjectType === "employee") {
       return {
         profile: this.one("employees", orgId, subjectId),
-        chatMessages: this.db.prepare("select * from chat_messages where org_id = ? and sender_type = 'employee' and sender_id = ? order by created_at").all(orgId, subjectId),
+        chatMessages: this.db.prepare("select * from chat_messages where org_id = ? and sender_type in ('employee', 'board') and sender_id = ? order by created_at").all(orgId, subjectId),
         approvalsRequested: this.db.prepare("select * from approvals where org_id = ? and requested_by_type = 'employee' and requested_by_id = ? order by created_at").all(orgId, subjectId),
         approvalsDecided: this.db.prepare("select * from approvals where org_id = ? and decided_by_employee_id = ? order by created_at").all(orgId, subjectId),
         employeeIdentities: this.db.prepare("select * from employee_identities where org_id = ? and employee_id = ? order by created_at").all(orgId, subjectId),
@@ -173,11 +176,10 @@ export class ComplianceService {
   }
 
   private applyGdprDelete(orgId: string, subjectType: string, subjectId: string): void {
+    this.eraseAuthoredContent(orgId, subjectType, subjectId);
     if (subjectType === "employee") {
-      this.db.prepare("update employees set display_name = ?, role = ? where id = ? and org_id = ?")
+      this.db.prepare("update employees set display_name = ?, role = ?, avatar_emoji = null, avatar_color = null, avatar_image = null where id = ? and org_id = ?")
         .run("Deleted employee", "Deleted", subjectId, orgId);
-      this.db.prepare("update chat_messages set sender_id = null where org_id = ? and sender_type = 'employee' and sender_id = ?")
-        .run(orgId, subjectId);
       this.db.prepare("update approvals set requested_by_id = null where org_id = ? and requested_by_type = 'employee' and requested_by_id = ?")
         .run(orgId, subjectId);
       this.db.prepare("update approvals set decided_by_employee_id = null where org_id = ? and decided_by_employee_id = ?")
@@ -212,12 +214,27 @@ export class ComplianceService {
         .run(orgId, subjectId);
       return;
     }
-    this.db.prepare("update agents set name = ?, role = ?, lifecycle = ?, model_provider_id = null, model_id = null where id = ? and org_id = ?")
+    this.db.prepare("update agents set name = ?, role = ?, lifecycle = ?, model_provider_id = null, model_id = null, avatar_emoji = null, avatar_color = null, avatar_image = null where id = ? and org_id = ?")
       .run("Deleted agent", "Deleted", "archived", subjectId, orgId);
     this.db.prepare("update tasks set assignee_agent_id = null where org_id = ? and assignee_agent_id = ?").run(orgId, subjectId);
     this.db.prepare("update task_runs set agent_id = null where org_id = ? and agent_id = ?").run(orgId, subjectId);
-    this.db.prepare("update chat_messages set sender_id = null where org_id = ? and sender_type = 'agent' and sender_id = ?")
-      .run(orgId, subjectId);
+  }
+
+  /** What the subject wrote and what the log says about them: message text, its attachment links and command arguments, and audit payloads. */
+  private eraseAuthoredContent(orgId: string, subjectType: string, subjectId: string): void {
+    // An employee also speaks and acts as the board under the same id.
+    const roles = subjectType === "employee" ? ["employee", "board"] : [subjectType];
+    const marks = roles.map(() => "?").join(", ");
+    const authored = `select id from chat_messages where org_id = ? and sender_type in (${marks}) and sender_id = ?`;
+    this.db.prepare(`delete from chat_attachments where message_id in (${authored})`).run(orgId, ...roles, subjectId);
+    this.db.prepare(`delete from chat_slash_invocations where message_id in (${authored})`).run(orgId, ...roles, subjectId);
+    // A thread is titled from its first message, so threads the subject started lose that title too.
+    this.db.prepare(`update chat_threads set title = '[deleted]' where org_id = ? and root_message_id in (${authored})`).run(orgId, orgId, ...roles, subjectId);
+    this.db.prepare(`update chat_messages set body_md = '[deleted]', body_structured_json = '{}', sender_id = null, deleted_at = ? where org_id = ? and sender_type in (${marks}) and sender_id = ?`)
+      .run(new Date().toISOString(), orgId, ...roles, subjectId);
+    // The events stay, so the log still shows what happened and when; only what they carried about the subject goes.
+    this.db.prepare(`update audit_events set payload_json = '{"redacted":true}' where org_id = ? and ((actor_type in (${marks}) and actor_id = ?) or entity_id = ?)`)
+      .run(orgId, ...roles, subjectId, subjectId);
   }
 
   private assertDeleteAllowed(input: CreateComplianceExportInput): void {
@@ -233,7 +250,7 @@ export class ComplianceService {
               select 1 from chat_messages
               where org_id = ?
                 and thread_id = legal_holds.entity_id
-                and sender_type = ?
+                and (sender_type = ? or (? = 'employee' and sender_type = 'board'))
                 and sender_id = ?
             )
           )
@@ -256,6 +273,7 @@ export class ComplianceService {
       input.orgId,
       input.orgId,
       input.subjectType,
+      input.subjectType,
       input.subjectId,
       input.orgId,
       input.subjectType,
@@ -272,7 +290,7 @@ export class ComplianceService {
               select 1 from chat_messages
               where org_id = ?
                 and space_id = retention_freezes.scope_id
-                and sender_type = ?
+                and (sender_type = ? or (? = 'employee' and sender_type = 'board'))
                 and sender_id = ?
             )
           )
@@ -293,6 +311,7 @@ export class ComplianceService {
       input.orgId,
       input.orgId,
       input.subjectType,
+      input.subjectType,
       input.subjectId,
       input.orgId,
       input.subjectType,
@@ -353,3 +372,10 @@ function deletedEmployeeRequestor(input: CreateComplianceExportInput): boolean {
     && input.subjectType === "employee"
     && input.subjectId === input.requestedByEmployeeId;
 }
+
+/** A deletion's record: how much of each kind it erased, with no content. */
+function erasureReceipt(gathered: Record<string, unknown>): { erased: Record<string, number> } {
+  const erased: Record<string, number> = {};
+  for (const [kind, value] of Object.entries(gathered)) erased[kind] = Array.isArray(value) ? value.length : value ? 1 : 0;
+  return { erased };
+}