feat: add account roles audit and task authorization

control-plane/src/retention.ts

@@ -2,21 +2,24 @@ import { loadConfig } from './config.js';
 import { closePool, withTransaction } from './db.js';
 import { writeEmergencyDiagnostic } from './diagnostics.js';
 
-export async function runRetention(): Promise<{ deletedTasks: number; deletedAuditEvents: number; deletedSessions: number }> {
+export async function runRetention(): Promise<{
+  archivedTasks: number;
+  deletedTasks: number;
+  deletedAuditEvents: number;
+  deletedSessions: number;
+}> {
   const config = loadConfig();
   if (!config.DATA_RETENTION_ENABLED) {
-    return { deletedTasks: 0, deletedAuditEvents: 0, deletedSessions: 0 };
+    return { archivedTasks: 0, deletedTasks: 0, deletedAuditEvents: 0, deletedSessions: 0 };
   }
   return withTransaction(config, async (client) => {
-    const deletedTasks = await client.query(
-      `DELETE FROM tasks
+    const archivedTasks = await client.query(
+      `UPDATE tasks
+          SET archived_at = now(), archived_by = NULL,
+              archive_reason = 'retention_policy', updated_at = now()
        WHERE created_at < now() - ($1 * interval '1 day')
-         AND status IN ('completed', 'cancelled', 'parse_failed')`,
-      [config.DATA_RETENTION_DAYS]
-    );
-    const deletedAuditEvents = await client.query(
-      `DELETE FROM audit_events
-       WHERE created_at < now() - (($1 * 2) * interval '1 day')`,
+         AND status IN ('completed', 'cancelled', 'parse_failed')
+         AND archived_at IS NULL`,
       [config.DATA_RETENTION_DAYS]
     );
     const deletedSessions = await client.query(
@@ -26,8 +29,9 @@ export async function runRetention(): Promise<{ deletedTasks: number; deletedAud
       []
     );
     return {
-      deletedTasks: deletedTasks.rowCount || 0,
-      deletedAuditEvents: deletedAuditEvents.rowCount || 0,
+      archivedTasks: archivedTasks.rowCount || 0,
+      deletedTasks: 0,
+      deletedAuditEvents: 0,
       deletedSessions: deletedSessions.rowCount || 0
     };
   });