up the blokcing tasks

docs/schemas/replay-retention.schema.json

@@ -0,0 +1,92 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://stellaops.dev/schemas/replay-retention.schema.json",
+  "title": "ReplayRetention",
+  "description": "Retention and legal-hold declaration for replay bundles; frozen for offline deterministic processing.",
+  "type": "object",
+  "additionalProperties": false,
+  "properties": {
+    "retention_policy_id": {
+      "type": "string",
+      "description": "Stable identifier for the retention policy version (e.g., r1, r2).",
+      "minLength": 1,
+      "maxLength": 32,
+      "pattern": "^[A-Za-z0-9_.-]+$"
+    },
+    "tenant_id": {
+      "type": "string",
+      "description": "Tenant scoped identifier; required for multi-tenant isolation.",
+      "minLength": 1,
+      "maxLength": 128
+    },
+    "dataset": {
+      "type": "string",
+      "description": "Logical dataset name (e.g., evidence_bundle, replay_log, advisory_payload).",
+      "minLength": 1,
+      "maxLength": 64
+    },
+    "bundle_type": {
+      "type": "string",
+      "description": "Bundle classification informing purge/hold behavior.",
+      "enum": [
+        "portable_bundle",
+        "sealed_bundle",
+        "replay_log",
+        "advisory_payload"
+      ]
+    },
+    "retention_days": {
+      "type": "integer",
+      "description": "Minimum days content must be retained before eligible for purge.",
+      "minimum": 1,
+      "maximum": 3650
+    },
+    "legal_hold": {
+      "type": "boolean",
+      "description": "True when a legal hold is active; overrides retention_days until cleared."
+    },
+    "purge_after": {
+      "type": "string",
+      "description": "ISO-8601 UTC timestamp when purge may begin (computed from ingest + retention_days unless legal_hold=true).",
+      "format": "date-time"
+    },
+    "checksum": {
+      "type": "object",
+      "description": "Deterministic checksum of the retention declaration for audit trails.",
+      "additionalProperties": false,
+      "properties": {
+        "algorithm": {
+          "type": "string",
+          "enum": [
+            "sha256",
+            "sha512"
+          ]
+        },
+        "value": {
+          "type": "string",
+          "pattern": "^[A-Fa-f0-9]{64,128}$"
+        }
+      },
+      "required": [
+        "algorithm",
+        "value"
+      ]
+    },
+    "created_at": {
+      "type": "string",
+      "description": "ISO-8601 UTC timestamp when this retention declaration was generated.",
+      "format": "date-time"
+    }
+  },
+  "required": [
+    "retention_policy_id",
+    "tenant_id",
+    "dataset",
+    "bundle_type",
+    "retention_days",
+    "legal_hold",
+    "purge_after",
+    "checksum",
+    "created_at"
+  ]
+}