Review the invented audit-retention copy (audRecKeepN)

Cordy commented

2026-08-27 22:44:49 +00:00

Owner

Copy review, deferred deliberately so Nikola can look at it on a running instance after the tag cut.

What this is

The Audit log "The record" panel (#342) has a Retention row. The handoff mockup only covers the indefinite case:

Retention — Kept indefinitely. Nothing in Cairn deletes an audit month file.

That sentence is only true when audit.retainMonths is 0. When an operator configures a non-zero retention, pruneLocked really does delete month files older than the cut, so showing the mockup's sentence would be a false statement about the instance's own evidence trail — on the one page where that matters most.

So a second variant was written to cover it:

audRecKeepN: "Kept for {n} months. Older month files are removed when the log rotates."

Nikola did not write this string. It is the only piece of copy on that page that is not a verbatim transcription of the handoff, and it is filed here rather than shipped silently under the design-handoff rules (see the repo wiki page "Design handoff rules", rule 4: deviate only for impossibility, and ask).

Why it is not visible on the dogfood

cairn-enc runs with retention 0, so the panel shows the mockup's sentence verbatim. To see the variant, set a non-zero audit.retainMonths in the cairn-enc-config secret and reopen Audit log → Settings.

What to decide

Is the English wording right, or should it be reworded?
Should the row say anything additional when retention is on — for instance naming the cut-off month, which Info() could return but currently does not?
The de/fr/it translations of the variant follow whatever the English becomes.

Also worth a second look at the same time: the sibling composition denied · <reason> on the Query tab result chips. The reason itself is the server's own recorded refusal string, but the "denied" prefix is likewise not transcribed from the mockup — it was inferred from the mockup's denied — legal hold chip.

Blocked on: nothing. Purely a copy review after v0.7 deployment.

Copy review, deferred deliberately so Nikola can look at it on a running instance after the tag cut. ## What this is The Audit log "The record" panel (#342) has a Retention row. The handoff mockup only covers the indefinite case: > **Retention** — Kept indefinitely. Nothing in Cairn deletes an audit month file. That sentence is only true when `audit.retainMonths` is 0. When an operator configures a non-zero retention, `pruneLocked` really does delete month files older than the cut, so showing the mockup's sentence would be a false statement about the instance's own evidence trail — on the one page where that matters most. So a second variant was written to cover it: audRecKeepN: "Kept for {n} months. Older month files are removed when the log rotates." **Nikola did not write this string.** It is the only piece of copy on that page that is not a verbatim transcription of the handoff, and it is filed here rather than shipped silently under the design-handoff rules (see the repo wiki page "Design handoff rules", rule 4: deviate only for impossibility, and ask). ## Why it is not visible on the dogfood `cairn-enc` runs with retention 0, so the panel shows the mockup's sentence verbatim. To see the variant, set a non-zero `audit.retainMonths` in the `cairn-enc-config` secret and reopen Audit log → Settings. ## What to decide 1. Is the English wording right, or should it be reworded? 2. Should the row say anything additional when retention is on — for instance naming the cut-off month, which `Info()` could return but currently does not? 3. The de/fr/it translations of the variant follow whatever the English becomes. Also worth a second look at the same time: the sibling composition `denied · <reason>` on the Query tab result chips. The reason itself is the server's own recorded refusal string, but the "denied" prefix is likewise not transcribed from the mockup — it was inferred from the mockup's `denied — legal hold` chip. Blocked on: nothing. Purely a copy review after v0.7 deployment.

Cordy added this to the v0.7 — Closed beta (dogfood + hardening) milestone

2026-08-27 22:44:49 +00:00

Cordy referenced this issue

2026-08-27 23:56:11 +00:00

Configure the IdP admin client on the dogfood and verify Users & access end to end #346

Cordy commented

2026-09-03 23:54:31 +00:00

Author

Owner

Copy review decisions (Nikola, 2026-09-04):

audRecKeepN English approved as shipped. de/fr/it keep the current shape for now — a broader translation deep-dive is planned separately and will revisit all locales at once.
Cut-off month: build it. Info() gains the pruning cut-off (the month boundary below which files are removed at rotation — distinct from the Oldest row, which shows what actually survives). UI mockup first, per design-first; implementation follows the chosen variant.
The inferred denied · <reason> chip prefix on the Query tab is blessed unchanged.

Issue stays open until 2 ships.

**Copy review decisions (Nikola, 2026-09-04):** 1. `audRecKeepN` English **approved as shipped**. de/fr/it keep the current shape for now — a broader translation deep-dive is planned separately and will revisit all locales at once. 2. **Cut-off month: build it.** `Info()` gains the pruning cut-off (the month boundary below which files are removed at rotation — distinct from the Oldest row, which shows what actually survives). UI mockup first, per design-first; implementation follows the chosen variant. 3. The inferred `denied · <reason>` chip prefix on the Query tab is **blessed unchanged**. Issue stays open until 2 ships.

Cordy referenced this issue from a commit

2026-09-04 00:01:20 +00:00

scout: audit record panel anchors (#343)

Cordy referenced this issue from a commit

2026-09-04 00:02:52 +00:00

oneshot scaffold: audit retention cut-off (#343); removed by oneshot-ac

forgejo-actions referenced this issue from a commit

2026-09-04 00:03:26 +00:00

#343: retention row names the pruning cut-off month; precise lazy-rotation wording x4 locales

Cordy referenced this issue from a pull request that will close it,

2026-09-04 00:06:01 +00:00

#343: audit retention row names the pruning cut-off month #418

Cordy closed this issue

2026-09-04 00:07:54 +00:00

Cordy referenced this issue from a commit

2026-09-04 00:07:54 +00:00

Merge pull request '#343: audit retention row names the pruning cut-off month' (#418) from audit-cutoff into main

Cordy referenced this issue from a commit

2026-09-04 00:31:28 +00:00

oneshot scaffold: retention config-provenance footer, variant B (#343 follow-up); removed by oneshot-ah

forgejo-actions referenced this issue from a commit

2026-09-04 00:32:05 +00:00

#343 follow-up: retention config-provenance chip + footer with audit-guide link (variant B)

Cordy referenced this issue

2026-09-04 00:34:27 +00:00

#343 follow-up: retention config-provenance chip + footer (variant B) #419

Cordy referenced this issue from a commit

2026-09-04 00:36:18 +00:00

Merge pull request '#343 follow-up: retention config-provenance chip + footer (variant B)' (#419) from audit-cfghint into main

Cordy commented

2026-09-04 00:41:49 +00:00

Author

Owner

Follow-up shipped in v0.6.123 (PR #419, dogfoods rolled): variant B from audit-retention-config-hint-mockup.html — quiet Config chip on the Retention row, footer bar on the record box naming audit.retainMonths + restart requirement, Audit guide ↗ linking the future-canonical swisscairn.ch/docs/audit#retention. Footer copy flips at retention 0 to the enabling direction.

Tier decision recorded alongside: audit retention stays config-only by design — the runtime UI can stop recording, but nothing reachable from an admin session may destroy recorded evidence; the one destructive knob lives at infrastructure trust level, same tier as the encryption identities.

**Follow-up shipped in v0.6.123** (PR #419, dogfoods rolled): variant B from `audit-retention-config-hint-mockup.html` — quiet Config chip on the Retention row, footer bar on the record box naming `audit.retainMonths` + restart requirement, `Audit guide ↗` linking the future-canonical `swisscairn.ch/docs/audit#retention`. Footer copy flips at retention 0 to the enabling direction. Tier decision recorded alongside: audit retention stays config-only by design — the runtime UI can stop recording, but nothing reachable from an admin session may destroy recorded evidence; the one destructive knob lives at infrastructure trust level, same tier as the encryption identities.

Rows
Columns

Review the invented audit-retention copy (audRecKeepN) #343

What this is

Why it is not visible on the dogfood

What to decide