# V2 Themis Privacy DSR Routing

V2 data-subject requests route through shared Oshun and Themis packages rather
than a V2-local DSR operations console.

## Ownership

- `@themis/privacy` owns the access, erasure, portability, and rectification
  workflow contract, including 2FA admission, jurisdictional SLA, fulfillment
  actions, and DSR audit event names.
- `@oshun/data-residency` owns the subject-home route decision, residency
  headers, route-zone queue name, and explicit cross-region transfer mechanism
  handling.
- `@v2/themis-privacy-dsr-routing` composes both packages and exposes the V2
  service contract. It is off rollback and never affects deterministic gameplay.
- `@oshun/audit-platform` retains and exports the DSR audit publication. V2
  publishes `v2.dsr.workflow_published` with the workflow, route zone, home
  zone, and queue metadata.

## Route Contract

1. V2 authenticates the account with 2FA.
2. `@themis/privacy` builds the canonical DSR workflow for `access`, `erasure`,
   `portability`, or `rectification`.
3. `@oshun/data-residency` resolves the account home zone and returns a route
   decision plus canonical residency headers.
4. V2 enqueues the workflow to `themis.privacy.dsr.<routeZone>`.
5. V2 publishes the DSR audit event to `@oshun/audit-platform`.
6. Cross-region fulfillment stays pinned to the subject home zone unless an
   explicit transfer mechanism is acknowledged.

The shipped surface has `standaloneDsrOpsConsoleReplaced: true` and
`standaloneDsrOpsConsoleAllowed: false` in the source-of-truth workflow.

## Erasure Audit Trail

Erasure requests also publish a documented erasure scope and audit trail. Every
erasure logs request -> action -> confirmation, retains an anonymized audit
record under `v2-dsr-erasure-audit-retention`, and records the affected scope:

- account
- profile
- replay anonymization
- telemetry purge
- cosmetic ledger

The V2 composition package exposes `erasureScope` and `erasureAuditTrail` on the
routing surface. The same data is included in the `@oshun/audit-platform`
metadata for erasure requests. Access, portability, and rectification requests
keep `erasureAuditTrail` null and `erasureScope` empty.

## Verification

`V2/ue/Tools/check-v2-dsr-routing.py` pins the package wiring, CI workflow,
docs, and architecture contract. Targeted tests cover the Themis privacy
workflow, data-residency route decision, and V2 composition package.