cadrumo.application.evidence.profile_legal_hold module

Canonical legal-case owner facts for local profile-deletion holds.

This module owns legal-case snapshots. It deliberately exposes no cleared/held switch: the custody transaction can only project whether the authoritative snapshot names any open case. The user-profile facade does not re-export this mutation owner.

LEGAL_HOLD_OWNER_DIRNAME: Final[str]

This owner’s directory name, read from its one declaration in the taxonomy.

The storage path registry spells the same segment in this format’s grammar, so the name is declared once and read in both places rather than typed in each.

LEGAL_HOLD_SNAPSHOT_SCHEMA_VERSION: Final[int]

Current on-disk schema version of LegalHoldCaseSnapshot documents.

class LegalHoldCaseSnapshot(**data)

Bases: BaseModel

Durable legal-owner fact: exactly the known open case identifiers.

Parameters:

data (Any)

schema_version: int

profile_id: UUID

open_case_ids: tuple[str, ...]

observed_at: datetime

self_digest: PrefixedContentDigest

property canonical_payload: dict[str, object]

Return this snapshot’s canonical JSON-shaped payload, digest field excluded.

property computed_self_digest: str

Return the digest recomputed from this snapshot’s canonical payload.

canonical_json_bytes()

Return this snapshot serialised as canonical JSON bytes.

Return type:

bytes

classmethod from_open_cases(*, profile_id, open_case_ids, observed_at)

Build a snapshot from the given open case identifiers, computing its digest.

Return type:

LegalHoldCaseSnapshot

Parameters:

• profile_id (UUID)

• open_case_ids (tuple[str, ...])

• observed_at (datetime)

class LegalHoldCaseAuthority(*, root=None, local_record_store=None)

Bases: object

Legal-owner mutation and projection surface, outside deletion ownership.

Parameters:

• root (Path | None)

• local_record_store (ProfileCustodyLocalRecordStore | None)

record_open_case_snapshot(*, profile_id, open_case_ids, observed_at)

Persist a legal case-owner observation; outcome derives from the cases.

Return type:

LegalHoldCaseSnapshot

Parameters:

• profile_id (UUID)

• open_case_ids (tuple[str, ...])

• observed_at (datetime)

project(profile_id, *, now)

Load canonical legal facts and derive the hold without caller disposition input.

Return type:

ProfileDeletionHoldOwnerProjection

Parameters:

• profile_id (UUID)

• now (datetime)

path(profile_id)

Return the on-disk path of the legal case snapshot for profile_id.

Return type:

Path

Parameters:

profile_id (UUID)

try_record_legal_hold_snapshot(*, bucket_id, open_case_ids, observed_at)

Record one profile’s known open legal cases, and never raise doing it.

The deletion preflight cannot read a profile’s encrypted records – it runs against profiles it has not unlocked – so this plaintext snapshot is how the legal-hold position stays knowable without the key. Mirrors try_record_filing_retention_snapshot() exactly: same best-effort contract, same reason a caller that exists to do something else must never be refused over a deletion-support record.

The sole caller today is profile registration, recording () – and that empty tuple is a fact, not a shrug. Genuinely external legal holds (a court order, live litigation, an adviser instruction) are unknowable to this system and must never be defaulted to cleared; writing an empty snapshot for THAT kind of hold at registration would be manufacturing consent nobody gave. But a profile at the instant of registration has no filings, no expedientes, no records of any kind – there is structurally nothing yet for an outside hold to be a hold ON. “Zero known open cases” is therefore not an unverified assumption of clearance at registration the way it would be later; it is the same class of fact try_record_filing_retention_snapshot already records for a brand-new profile’s filing history (“no filings exist” rather than “nobody checked”).

This does NOT close the legal-hold gap for a profile’s later life. Once a profile has real filings or captured AEAT expedientes, “zero known open cases” recorded once at registration goes stale the moment either changes, and nothing today refreshes it – there is no capture-time producer for AEAT expedientes and no operator affirmation surface for a genuinely external hold. A future producer at expedientes-capture time, and an operator-affirmation surface with a freshness bound, remain open work; this function only ever asserts what is true at the instant it is called.

Swallowing is safe only while absence fails CLOSED: with no snapshot the hold assessment refuses, which blocks a deletion rather than permitting one. An empty RECORDED snapshot is a different thing from an absent one and must stay so.

Return type:

bool

Returns:

True when the snapshot was written, False when it was not. The caller is expected to ignore it; it exists so a test can assert the write happened rather than inferring it.

Parameters:

• bucket_id (str)

• open_case_ids (Iterable[str])

• observed_at (datetime)