Phase 184FAEDA-EVIDENCE-EXTERNAL-AUDITOR-ACCESS-DESIGN-001retention register design only

Evidence Audit Retention Register Design

A design-only register for evidence retention classes, access windows, expiry, legal holds, tombstones, revocation history, and lifecycle reporting before any retention database, purge job, archive worker, or deletion automation exists.

Auditor access Export policy Exception review FAEDA OS

No retention runtime

Design lifecycle rules without deleting or archiving anything

Phase 184 defines retention behavior only. It creates no database table, purge job, archive worker, deletion job, legal hold automation, signed URL, export, download, or notification.

Retention lanes

8

demo to legal hold

Lifecycle states

10

draft to tombstone

Legal hold classes

6

incident to dispute

Runtime jobs

0

no purge or archive

Retention lanes

Where evidence belongs before lifecycle decisions

founder_demo_snapshot30 days

Keep demo-safe proof summaries temporarily for founder review and investor walkthroughs.

Owner: Founder/Admin

raw screenshotsprivate dataprovider URLspayment references
internal_qa_report90 days

Keep route, build, mobile, closure, and UX correction summaries for sprint proof.

Owner: QA Lead

private notesunredacted customer datasecurity-only payloads
security_incident_reportmanual release or legal hold

Keep security incident summaries, restricted holds, revocation events, and access breach evidence.

Owner: Security

production secretsraw exploit payloadsunapproved personal data
external_auditor_packetcontract-specific

Keep approved external auditor access summary, scope, expiry, revocation, and access log evidence.

Owner: Sponsor plus checker

public linksraw evidence filesother auditor logsinternal threat notes
export_compliance_packetcertification-specific

Keep source-chain, export claim, document readiness, and redacted compliance proof summaries.

Owner: Compliance

raw customs payloadsprivate buyer termssupplier secrets
finance_settlement_evidencepolicy-specific

Keep ledger, reconciliation, maker-checker, callback evidence summaries for finance review.

Owner: Finance and payment ops

raw bank detailspartner secretswallet PINunmasked payment references
data_protection_registerprivacy-policy specific

Keep privacy class drift, redaction status, forbidden category blocks, and deletion request summaries.

Owner: Data Protection

unredacted personal dataraw transcriptsfull screenshots
legal_hold_registeruntil hold release

Freeze expiry and deletion for disputes, investigations, regulator requests, or litigation readiness.

Owner: Legal or founder-approved authority

data outside hold scopepublic linksunapproved export files

Lifecycle states

Evidence should move through explicit states

draft_registered

Evidence metadata is planned or drafted but no storage object exists.

capture_requested

A reviewer or QA user requested proof capture under an approved scope.

redaction_pending

Evidence summary cannot be shown until privacy checks and redaction rules are applied.

redacted_summary_ready

Only safe summary, caption, status, timestamp, and approved labels are viewable.

review_open

Evidence is part of an active review queue or correction loop.

review_closed

Reviewer has closed the item with safe proof references and decision state.

export_policy_ready

The item can be considered by export policy but no export file exists.

auditor_scoped

The item is visible in a future scoped auditor view only if approved and redacted.

legal_hold

Expiry, purge, deletion, and external changes are frozen until hold release.

tombstoned

Future evidence is no longer accessible, but a non-sensitive audit marker remains.

Access windows

Expiry must be intentional

1

fixed_start_and_expiry

Every future external or sensitive report access must have approved start and expiry timestamps.

2

timezone_normalized

Access windows must record timezone and normalized UTC values to prevent expiry confusion.

3

inactivity_timeout

Future auditor sessions should expire after inactivity; Phase 184 only designs the rule.

4

renewal_requires_checker

Extending a retention or access window requires independent checker approval.

5

emergency_revoke_anytime

Founder, security, or data protection can revoke future access with mandatory reason.

6

legal_hold_overrides_expiry

Legal hold freezes expiry until a release approval exists.

Legal holds

Hold classes freeze expiry safely

contract_dispute

Scope: Contract, audit, buyer, supplier, or implementation dispute evidence summaries.

Release: Release only after dispute owner and checker approve closure.

payment_dispute

Scope: Ledger, partner callback, reconciliation, COD, payable, receivable, or settlement evidence summaries.

Release: Release only after finance and payment ops close the exception.

privacy_incident

Scope: Privacy drift, forbidden category, redaction failure, or personal data exposure evidence summaries.

Release: Release only after data protection approval.

security_incident

Scope: Suspicious access, breached scope, credential exposure, provider risk, or incident quarantine summaries.

Release: Release only after security approval.

regulatory_request

Scope: Future regulator observer or official review packets within formal scope.

Release: Release only after legal basis expires or formal closure is recorded.

litigation_hold

Scope: Court, counsel, formal claim, or legal investigation readiness evidence summaries.

Release: Release only through legal authority and founder approval.

Tombstone rules

A tombstone is proof, not payload

no_raw_payload

Tombstones keep safe metadata only, never raw screenshots, original files, transcripts, secrets, or signed URLs.

immutable_marker

A future tombstone marker should not be editable without a correction audit trail.

reason_category_required

Every expiry, deletion, revoke, or retention change needs a safe reason category.

replacement_pointer_safe

If evidence is superseded, point only to an approved replacement reference, not raw storage paths.

legal_hold_blocks_tombstone

Legal hold prevents tombstoning until the hold is formally released.

audit_survives_access

Access can expire while the non-sensitive audit history remains reportable.

Actor permissions

Who can request retention actions later

Founder/Admin

Can request

retention overviewlegal hold summaryexpiry pressuretombstone register

Cannot do

silent purgeraw evidence exportself-approve legal release

Data Protection

Can request

privacy retention reviewredaction statusdeletion/tombstone readiness

Cannot do

view unrelated finance secretsbypass maker-checkerpublish external links

Security

Can request

incident holdaccess revokesuspicious access retention

Cannot do

delete incident historyexpose raw payloadsoverride legal hold release

QA Lead

Can request

QA proof retentionstale proof reviewclosure evidence expiry

Cannot do

access security-only datarelease legal holddelete records

Finance/Payment Ops

Can request

settlement evidence holdpayment exception retentionreconciliation proof window

Cannot do

see raw identity docsexport partner secretspurge finance disputes

External Auditor

Can request

own access window summaryapproved redacted retention view

Cannot do

extend own accessrelease holdscreate tombstonesview raw evidence

Lifecycle reporting

Future views without raw evidence

retention_health

Shows counts by retention lane, lifecycle state, expiry bucket, and legal hold status.

expiry_queue

Shows items nearing expiry, expired items needing tombstone decision, and renewal candidates.

legal_hold_board

Shows active holds by class, owner, scope, review date, and release requirements.

tombstone_register

Shows future tombstone markers, reason category, replacement pointer, and non-sensitive audit trail.

auditor_access_windows

Shows future auditor scopes, start/expiry, revoked status, and blocked attempts in aggregate.

retention_exception_watch

Shows policy conflicts such as expired but legal-held, redaction pending but export requested, or scope breach.

Audit fields

Future retention register evidence contract

retentionRegisterId

string

Stable future retention register record id.

sourceAuditorAccessPolicyId

string

References Phase 183 auditor access design when applicable.

sourceExportPolicyId

string

References Phase 182 export policy design when applicable.

evidenceRef

string

Safe evidence reference, never raw storage object or signed URL.

retentionLane

enum

Founder demo, QA, security, external auditor, export compliance, finance, data protection, or legal hold.

lifecycleState

enum

Draft, capture requested, redaction pending, redacted ready, review open, review closed, export ready, auditor scoped, legal hold, tombstoned.

ownerRole

enum

Founder, QA, security, data protection, finance, legal, compliance, or sponsor.

privacyClass

enum

Public-safe, internal, restricted, forbidden, legal-hold, or incident.

legalHoldClass

enum|null

Contract, payment, privacy, security, regulatory, litigation, or null.

legalHoldRef

string|null

Future legal hold reference, not legal document payload.

retentionPolicyRef

string

Policy reference controlling retention duration.

accessWindowRef

string|null

Future access window policy reference.

retainUntil

datetime|null

Future retention expiry date unless legal hold overrides it.

reviewDueAt

datetime|null

Future retention review due date.

expiredAt

datetime|null

Future expiry timestamp.

tombstonedAt

datetime|null

Future tombstone timestamp.

tombstoneReason

string|null

Safe tombstone reason category.

replacementEvidenceRef

string|null

Approved replacement reference if superseded.

makerApprovalRef

string|null

Maker approval reference for sensitive retention actions.

checkerApprovalRef

string|null

Independent checker approval reference.

status

enum

draft, active, expiring, expired, held, release_pending, tombstoned, rejected.

createdAt

datetime

Future register creation timestamp.

updatedAt

datetime

Future register update timestamp.

Hard rules

Retention register design is not retention automation

1

Phase 184 is retention register design only.

2

Do not create retention databases, migrations, API routes, purge jobs, archive workers, deletion jobs, scheduler tasks, storage buckets, legal hold automation, notifications, emails, exports, signed URLs, downloads, or public links here.

3

Retention register design must never expose raw screenshots, original evidence files, provider URLs, signed URLs, storage keys, credentials, CNIC, OTP, PIN, bank details, customer transcripts, private notes, or payment references.

4

Tombstone is not deletion runtime. It is a future safe audit marker design.

5

Legal hold overrides expiry until formally released by authorized roles.

6

External auditors can view only approved redacted retention views later; they cannot extend access, release holds, create tombstones, or mutate evidence.

7

Every future retention action must be scoped, reasoned, maker-checker controlled where sensitive, and auditable.

8

Phase 184 does not delete, archive, purge, retain, or hold anything; it only designs how those controls may work later.

Retention register packet

JSON preview

{
  "retentionRegisterDesignId": "evidence_audit_retention_register_design_184",
  "phase": "Phase 184",
  "route": "/business-pro/evidence-audit-retention-register-design",
  "sourceAuditorAccessPolicy": "evidence_external_auditor_access_design_183",
  "sourceGate": "FAEDA-EVIDENCE-EXTERNAL-AUDITOR-ACCESS-DESIGN-001",
  "designOnly": true,
  "createsRetentionDatabase": false,
  "createsMigration": false,
  "createsApi": false,
  "createsPurgeJob": false,
  "createsArchiveWorker": false,
  "createsDeletionAutomation": false,
  "createsLegalHoldAutomation": false,
  "createsStorageObject": false,
  "createsSignedUrl": false,
  "createsDownload": false,
  "createsExport": false,
  "inheritedAuditorAccessFields": [
    "auditorAccessRequestId",
    "auditorType",
    "auditorOrganizationRef",
    "auditorIdentityRef",
    "sponsorRole",
    "legalBasisRef",
    "scopeMatrixRef",
    "redactionPolicyRef",
    "allowedViewKeys",
    "blockedViewKeys",
    "makerApprovalRef",
    "checkerApprovalRef",
    "accessStartsAt",
    "accessExpiresAt",
    "revokedAt",
    "revocationReason",
    "lastViewedAt",
    "blockedAttemptCount",
    "status",
    "createdAt",
    "updatedAt"
  ],
  "inheritedAuditorRevocationTriggers": [
    "time_expired",
    "scope_breach_attempt",
    "contract_or_nda_end",
    "identity_or_role_change",
    "suspicious_download_pattern",
    "privacy_incident",
    "founder_or_security_revoke",
    "legal_hold_change"
  ],
  "inheritedAuditorScopedViews": [
    "audit_home_summary",
    "redacted_report_packet",
    "closure_and_reopen_summary",
    "redaction_status_view",
    "retention_register_view",
    "route_build_mobile_proof_summary",
    "access_log_self_view"
  ],
  "inheritedAuditorApprovalGates": [
    "Auditor access request draft",
    "Founder or authorized sponsor approval",
    "Identity and organization verification",
    "Legal basis and NDA confirmation",
    "Scope matrix approval",
    "Privacy and security redaction review",
    "Maker approval",
    "Checker approval",
    "Time-boxed access instruction"
  ],
  "inheritedRedactedEvidenceViews": [
    "report header",
    "metric summary",
    "proof summary",
    "decision trail",
    "retention trail",
    "access trail"
  ],
  "retentionLanes": [
    "founder_demo_snapshot",
    "internal_qa_report",
    "security_incident_report",
    "external_auditor_packet",
    "export_compliance_packet",
    "finance_settlement_evidence",
    "data_protection_register",
    "legal_hold_register"
  ],
  "lifecycleStates": [
    "draft_registered",
    "capture_requested",
    "redaction_pending",
    "redacted_summary_ready",
    "review_open",
    "review_closed",
    "export_policy_ready",
    "auditor_scoped",
    "legal_hold",
    "tombstoned"
  ],
  "accessWindowPolicies": [
    "fixed_start_and_expiry",
    "timezone_normalized",
    "inactivity_timeout",
    "renewal_requires_checker",
    "emergency_revoke_anytime",
    "legal_hold_overrides_expiry"
  ],
  "legalHoldClasses": [
    "contract_dispute",
    "payment_dispute",
    "privacy_incident",
    "security_incident",
    "regulatory_request",
    "litigation_hold"
  ],
  "tombstoneRules": [
    "no_raw_payload",
    "immutable_marker",
    "reason_category_required",
    "replacement_pointer_safe",
    "legal_hold_blocks_tombstone",
    "audit_survives_access"
  ],
  "actorPermissions": [
    "Founder/Admin",
    "Data Protection",
    "Security",
    "QA Lead",
    "Finance/Payment Ops",
    "External Auditor"
  ],
  "reportViews": [
    "retention_health",
    "expiry_queue",
    "legal_hold_board",
    "tombstone_register",
    "auditor_access_windows",
    "retention_exception_watch"
  ],
  "auditFields": [
    "retentionRegisterId",
    "sourceAuditorAccessPolicyId",
    "sourceExportPolicyId",
    "evidenceRef",
    "retentionLane",
    "lifecycleState",
    "ownerRole",
    "privacyClass",
    "legalHoldClass",
    "legalHoldRef",
    "retentionPolicyRef",
    "accessWindowRef",
    "retainUntil",
    "reviewDueAt",
    "expiredAt",
    "tombstonedAt",
    "tombstoneReason",
    "replacementEvidenceRef",
    "makerApprovalRef",
    "checkerApprovalRef",
    "status",
    "createdAt",
    "updatedAt"
  ],
  "hardRules": 8,
  "nextAllowedGate": "phase_185_evidence_audit_exception_review_design"
}

Next build gate

Phase 185 is evidence audit exception review design

After retention is designed, the next safe move is an exception review gate for policy conflicts, expired-but-held records, missing approvals, and risky lifecycle transitions.

Open exception review