Bilko — RetentionPurgeWorker DRY-RUN (B2, MC #105881)

RetentionPurgeWorker DRY-RUN (B2)

MC: #105881 (parent #105872) · Autor: Bruce Momjian (CodeCraft) + Graff red-zone review · Verdict: PASS (FORGE MLX peer-verify PASS) · Grana: azdo (rebase tip 844fc11c, NIJE main-merge dok red-zone gate ne prođe)

Šta radi

Dry-run purge worker: čita document_retention_manifest + entity_type_mapping (V133) + entity_type_retention_policy + legal_retention_years, LOGUJE kandidate za purge, NIŠTA NE BRIŠE. Sada kad je #105965 mapping integrisan, dry-run NALAZI kandidate (prije: fail-safe skip → 0).

Dokaz

39/39 Testcontainers (postgres:16) zeleno end-to-end na merge-anoj grani: V131(9)+V132(9)+V133(5)+RetentionPurgeWorkerTest(16), uklj. candidatesFound > 0 asertaciju + V121 companion "ukloni mapping → test pada". Evidence: ~/system/evidence/105881/verdict-b2-finalization-2026-07-19.md.

Cron mehanizam

RetentionPurgeCronRoutes.kt — POST /api/v1/internal/retention/purge-dry-run, PURGE_CRON_SECRET header auth, fail-closed 503, mounted u Routing.kt (isti pattern kao InvoiceCronRoutes/ComplianceCronRoutes). INERTAN dok se ne provisionira PURGE_CRON_SECRET + eksterni trigger. Odluka: app-cron fallback; pg_cron (Azure Flexible) optimizacija odgođena do #105964 RBAC.

🔴 Red-zone invarijante (7, svaka grep-verifikovana, ne pretpostavljena)

1. DRY_RUN hard-coded true, nema override. 2. Nula DELETE/UPDATE/DROP dodano #105965 integracijom (samo read-only SELECT lookup). 3. purge_expired_partition() i dalje bez ijednog caller-a, bez novog EXECUTE granta. 4. bilko_purge_worker write grant nepromijenjen/uzak. 5. mapping-miss fallback matchuje samo human-authored policy redove (companion test). 6. cron ruta fail-closed/inert. 7. entity_type_mapping + entity_type_retention_policy read-only kroz worker (svaki ref = .selectAll()). Graff review: ~/system/evidence/105881/graff-review.md.

Odnos prema B3

B3 live purge (#105882) = jedina preostala CEO-sign-off tačka cijelog programa. B2 ne dodaje nijedan EXECUTE/DELETE/DROP grant (grep-potvrđeno). Živi purge se ne može desiti dok CEO eksplicitno ne odobri B3 + ne provisionira live flag + PURGE_CRON_SECRET.