Task 14.8 is implemented as one fail-closed lifecycle contract over uploaded attachments, generated artifacts/media, shares, and exports. Admission requires an exact session, subject, tenant, plane, sensitivity, clean scan evidence, minimization evidence, reviewed provider transfers, bounded retention, and an explicit data-subject export disposition.
The canonical record is
eve-sota-attachment-artifact-lifecycle/2026-09-16.json,
validated by
eve-sota-attachment-artifact-lifecycle.schema.json.
Lifecycle boundary#
- Uploads use magic-byte detection, application-derived object keys, byte/session quotas, storage-derived SHA-256 digests, malware scanning, decompression/polyglot checks, and content-policy scanning. Missing scanner seams block admission.
- Every record declares its kind, plane, sensitivity, retained/excluded fields, primary expiry, backup-deletion deadline, provider-transfer reviews, and export inclusion or exclusion evidence.
- Raw public object access is prohibited. A permalink retains only a token digest and expires within 24 hours and before the asset itself.
- Biometric material is capped at 30 days by this engineering policy.
- Session deletion first revokes permalinks, then erases object storage, metadata, memory, traces, backups, shares, and exports. Every partition must return an exact zero residual before registry evidence and the session row may be removed.
- Existing subject erasure still purges every S3/MinIO object version before metadata and covers generation jobs, catalogs, galleries, living-scene shares, and customer export bundles under the generation barrier.
- Data-subject export includes exact-subject generated artifacts or reports the owning-service coverage gap honestly.
Sources and claim boundary#
The record uses the OWASP File Upload Cheat Sheet for defense-in-depth upload guidance, AWS presigned-URL documentation for bearer/expiry semantics, the NIST Privacy Framework as a voluntary risk-management reference, and the official GDPR text for legal context.
This is not legal advice or a compliance certification. Provider acknowledgements, backup-media operations, lawful basis, jurisdictional applicability, and final data-subject-request decisions remain owned by their named human and service authorities.