# Chat Audit, Retention, and Export

`GH-498-CHAT-AUDIT-RETENTION` defines the compliance layer for workspace chat records.

## Defaults

- Local chat storage persists under `.agent-workflow/chat/v1`.
- New threads and messages default to `redacted_only` retention and export policy.
- Logical delete uses tombstones instead of physical removal so evidence actions remain auditable.
- Export defaults to redacted output.

## Export Scope

The compliance/export layer supports three evidence scopes inside a tenant/workspace:

- `thread`
- `task`
- `run`

Exports produce:

- JSON records suitable for machine processing and evidence attachment
- Markdown suitable for human review and release evidence

For local mode, exports are redacted-only. Even if future retention policies allow raw storage, export policy must explicitly allow raw export before any non-redacted content can leave the store.

Restricted-data detections are export-safe only when represented as sanitized
metadata. Export JSON and Markdown may include category, rule id, occurrence
count, redaction marker, decision id, source message id, provider-egress
decision, and raw-persistence decision. They must not include raw passwords,
tokens, private keys, payment data, sensitive PII, request bodies, prompt
samples, ciphertext blobs, wrapped keys, or KMS/vault internals.

If an export encounters restricted values in legacy or future raw-allowed
records, the export copy is reclassified and redacted before rendering. The
stored record is not mutated by export, and the export audit event records only
the sanitized restricted event summary.

## Delete Behavior

- Delete is logical, not physical.
- Tombstoned threads and messages keep audit metadata.
- Tombstoned content is not raw exportable.
- Workspace isolation remains enforced by the chat storage path model and scope filtering.

## Audit Trail

Sensitive lifecycle actions append workflow events:

- `CHAT_EXPORT_RECORDED`
- `CHAT_DELETE_RECORDED`
- restricted detections/blocks as sanitized restricted-data audit summaries

Audit metadata should include:

- requesting actor id and role
- tenant and workspace
- selected scope kind (`thread`, `task`, `run`)
- affected task/run/thread identifiers
- timestamps
- affected thread/message counts
- restricted event count and sanitized category/count/marker summaries when
  restricted values are detected or blocked

## SaaS vs Local

Local mode uses workspace-local files and workflow events as the audit ledger.

SaaS mode will need stronger policy inputs:

- tenant-configured retention classes
- export authorization policy
- delete/legal-hold policy
- centralized audit retention and access control

This story keeps the contract and local behavior explicit so the SaaS implementation can reuse the same policy concepts without changing the chat domain model.