# Eve attachment and generated-artifact lifecycle — 2026-09

Task 14.8 is implemented as one fail-closed lifecycle contract over uploaded
attachments, generated artifacts/media, shares, and exports. Admission requires
an exact session, subject, tenant, plane, sensitivity, clean scan evidence,
minimization evidence, reviewed provider transfers, bounded retention, and an
explicit data-subject export disposition.

The canonical record is
[`eve-sota-attachment-artifact-lifecycle/2026-09-16.json`](eve-sota-attachment-artifact-lifecycle/2026-09-16.json),
validated by
[`eve-sota-attachment-artifact-lifecycle.schema.json`](eve-sota-attachment-artifact-lifecycle.schema.json).

## Lifecycle boundary

- Uploads use magic-byte detection, application-derived object keys,
  byte/session quotas, storage-derived SHA-256 digests, malware scanning,
  decompression/polyglot checks, and content-policy scanning. Missing scanner
  seams block admission.
- Every record declares its kind, plane, sensitivity, retained/excluded fields,
  primary expiry, backup-deletion deadline, provider-transfer reviews, and
  export inclusion or exclusion evidence.
- Raw public object access is prohibited. A permalink retains only a token
  digest and expires within 24 hours and before the asset itself.
- Biometric material is capped at 30 days by this engineering policy.
- Session deletion first revokes permalinks, then erases object storage,
  metadata, memory, traces, backups, shares, and exports. Every partition must
  return an exact zero residual before registry evidence and the session row may
  be removed.
- Existing subject erasure still purges every S3/MinIO object version before
  metadata and covers generation jobs, catalogs, galleries, living-scene shares,
  and customer export bundles under the generation barrier.
- Data-subject export includes exact-subject generated artifacts or reports the
  owning-service coverage gap honestly.

## Sources and claim boundary

The record uses the
[OWASP File Upload Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/File_Upload_Cheat_Sheet.html)
for defense-in-depth upload guidance,
[AWS presigned-URL documentation](https://docs.aws.amazon.com/AmazonS3/latest/userguide/using-presigned-url.html)
for bearer/expiry semantics, the
[NIST Privacy Framework](https://www.nist.gov/privacy-framework) as a voluntary
risk-management reference, and the official
[GDPR text](https://eur-lex.europa.eu/eli/reg/2016/679/oj/eng) for legal
context.

This is not legal advice or a compliance certification. Provider
acknowledgements, backup-media operations, lawful basis, jurisdictional
applicability, and final data-subject-request decisions remain owned by their
named human and service authorities.