cadrumo.application.user_profile.custody_hold_models module

Canonical hold evidence models used by profile custody transactions.

CUSTODY_HOLD_EVIDENCE_SCHEMA_VERSION: Final[Literal[1]]

Current write version for ProfileCustodyHoldEvidence. This format is REGENERABLE (see the campaign’s nested-persisted-format-boundary ADR): its refresh() writer unconditionally recomputes and overwrites, and nothing reads its on-disk file back through the typed model, so no upgrader or durability floor applies – naming the constant is the outstanding half of its classification.

class ProfileCustodyRetentionOverride(**data)[source]

Bases: BaseModel

One operator authorisation to erase despite an asserted filing hold.

A model rather than a boolean because a bare True can be defaulted or passed by accident, while this cannot be constructed empty: the mandatory non-empty reason the CLI promises is enforced by the type at every entry instead of re-checked per caller. It is persisted into the digest-bound delete journal, so the authorisation travels with the transaction as durable evidence rather than as a transient argument, and cannot be edited in afterwards.

It authorises exactly one thing: proceeding past a FILING hold, which is the statutory retention floor. It carries no power over a legal hold.

Parameters:

data (Any)

reason: str
approved_at: datetime
retained_record_count: int
latest_safe_erase_date: datetime | None
hold_permits_local_deletion(assessment, *, retention_override)[source]

The ONE place a gate decides whether holds permit this deletion.

Single-sited on purpose. Two custody gates ask this question – delete preparation and the pre-effect re-validation – and inlining the boolean at both is how one of them silently keeps refusing an authorisation the other honours, which is the defect this function exists to end.

A legal hold is absolute: no operator authorisation clears it, which is why it short-circuits first. A filing hold is the statutory retention floor, and the reset’s own backstop has always let a recorded override past it – so an override presented here clears that half and only that half.

Return type:

bool

Parameters:
class ProfileCustodyHoldAssessment(**data)[source]

Bases: BaseModel

The bound outcome from the independent legal and filing hold owners.

Parameters:

data (Any)

profile_id: UUID
legal_hold: bool
filing_hold: bool
assessed_at: datetime
assessor: Literal['application-custody-hold-owner']
evidence_digest: PrefixedContentDigest
property permits_local_deletion: bool

do both owners currently permit local deletion?

Deliberately override-blind. This is what the owners assessed, and the evidence record must keep saying filing_hold=True when a filing hold exists – an override is a decision ABOUT that fact, never a different fact, and falsifying the assessment to clear a gate would make evidence_digest attest something the owners never found.

Every gate deciding whether a deletion may PROCEED calls hold_permits_local_deletion() instead, which weighs this fact against a recorded operator authorisation. A gate reading this property directly would silently ignore that authorisation.

Type:

The RAW owner fact

classmethod from_owner_evidence(*, legal, filing)[source]

Build an assessment from the legal and filing owner evidence.

Return type:

ProfileCustodyHoldAssessment

Parameters:
class ProfileCustodyHoldEvidence(**data)[source]

Bases: BaseModel

One immutable canonical answer from a legal or filing hold owner.

Parameters:

data (Any)

schema_version: Literal[1]
owner: ProfileDeletionHoldOwnerValue
profile_id: UUID
disposition: Literal['cleared', 'held']
source_record_id: str
source_record_digest: PrefixedContentDigest
assessed_at: datetime
authority: Literal['application-legal-hold-owner', 'application-filing-hold-owner']
evidence_digest: PrefixedContentDigest
property blocks_local_deletion: bool

Return whether this owner’s disposition blocks local deletion.

property canonical_payload: dict[str, object]

Return the evidence fields excluding the digest.

property computed_evidence_digest: str

Compute the canonical digest for this evidence payload.

evidence_from_owner_projection(projection)[source]

Create derived custody evidence from a read-only external owner projection.

Return type:

ProfileCustodyHoldEvidence

Parameters:

projection (ProfileDeletionHoldOwnerProjection)