Stack/graceful deletion/02 deletion api

[dzdidi]

Summary

Part 2 of the graceful-deletion stack. Depends on Part 1.

Introduces the durable content-lock deletion model and creator-authorized API without executing destructive deletion phases yet.

The change:

• persists deletion jobs and immutable frozen lock manifests;
• snapshots verification tasks at the deletion admission cutoff;
• serializes deletion admission against proof admission and lock publication;
• adds durable publication intents;
• adds creator-authenticated deletion initiation and status routes;
• adds Rust SDK and WASM request/response support;
• exposes only a redacted public lifecycle.

Deletion that commits first blocks later proof admission. Proof admission that commits first is included in the frozen deletion snapshot.

Contract and risk impact

• Public API or SDK contract
• Persisted data or migration
• Authentication, authorization, identity, or secret handling
• Payment or entitlement behavior
• Runtime, deployment, or observability
• No contract/risk impact

Public routes:

• DELETE /creator/content-locks/{lock_id}
• GET /creator/content-locks/{lock_id}/deletion

The creator is derived from the authenticated frontend session. Public responses omit internal job IDs, task IDs, claim tokens, frozen manifests, and credentials.

Migrations:

• 0011_content_lock_deletions.sql
• 0012_content_lock_deletion_task_snapshot.sql
• 0013_content_lock_publication_intents.sql

Verification

The following commands were run successfully on the final combined stack:

• cargo fmt --all -- --check
• cargo test --workspace --all-targets --all-features
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• git diff --check codex/bitkit-local-e2e-fixes..stack/graceful-deletion/05-execution

The final run included:

• locks-service library: 355 passed;
• deletion integration: 29 passed;
• PostgreSQL E2E: 12 passed.

This intermediate slice was not independently rerun after restacking; its isolated CI result should be recorded before merge.

Documentation

Updated:

• docs/API.md
• docs/DOMAIN_MODEL.md
• docs/RUNTIME.md
• docs/ADRs/0020-locks-paykit-v1-integration-boundary.md
• docs/plans/2026-08-10-graceful-content-lock-deletion.md

The documentation covers the authenticated routes, redacted lifecycle, durable job model, admission cutoff, and publication fencing.

Checklist

• The change is focused and self-reviewed.
• Regression tests were added where practical.
• No credentials, identities, private content, payment material, or generated local state are included.
• Formatting and relevant tests/lints pass.

[dzdidi]

Summary

Part 2 of the graceful-deletion stack. Depends on Part 1.

Introduces the durable content-lock deletion model and creator-authorized API without executing destructive deletion phases yet.

The change:

• persists deletion jobs and immutable frozen lock manifests;
• snapshots verification tasks at the deletion admission cutoff;
• serializes deletion admission against proof admission and lock publication;
• adds durable publication intents;
• adds creator-authenticated deletion initiation and status routes;
• adds Rust SDK and WASM request/response support;
• exposes only a redacted public lifecycle.

Deletion that commits first blocks later proof admission. Proof admission that commits first is included in the frozen deletion snapshot.

Contract and risk impact

• Public API or SDK contract
• Persisted data or migration
• Authentication, authorization, identity, or secret handling
• Payment or entitlement behavior
• Runtime, deployment, or observability
• No contract/risk impact

Public routes:

• DELETE /creator/content-locks/{lock_id}
• GET /creator/content-locks/{lock_id}/deletion

The creator is derived from the authenticated frontend session. Public responses omit internal job IDs, task IDs, claim tokens, frozen manifests, and credentials.

Migrations:

• 0011_content_lock_deletions.sql
• 0012_content_lock_deletion_task_snapshot.sql
• 0013_content_lock_publication_intents.sql

Verification

The following commands were run successfully on the final combined stack:

• cargo fmt --all -- --check
• cargo test --workspace --all-targets --all-features
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• git diff --check codex/bitkit-local-e2e-fixes..stack/graceful-deletion/05-execution

The final run included:

• locks-service library: 355 passed;
• deletion integration: 29 passed;
• PostgreSQL E2E: 12 passed.

This intermediate slice was not independently rerun after restacking; its isolated CI result should be recorded before merge.

Documentation

Updated:

• docs/API.md
• docs/DOMAIN_MODEL.md
• docs/RUNTIME.md
• docs/ADRs/0020-locks-paykit-v1-integration-boundary.md
• docs/plans/2026-08-10-graceful-content-lock-deletion.md

The documentation covers the authenticated routes, redacted lifecycle, durable job model, admission cutoff, and publication fencing.

Checklist

• The change is focused and self-reviewed.
• Regression tests were added where practical.
• No credentials, identities, private content, payment material, or generated local state are included.
• Formatting and relevant tests/lints pass.

[dzdidi]

Summary

Part 2 of the graceful-deletion stack. Depends on Part 1.

Introduces the durable content-lock deletion model and creator-authorized API without executing destructive deletion phases yet.

The change:

• persists deletion jobs and immutable frozen lock manifests;
• snapshots verification tasks at the deletion admission cutoff;
• serializes deletion admission against proof admission and lock publication;
• adds durable publication intents;
• adds creator-authenticated deletion initiation and status routes;
• adds Rust SDK and WASM request/response support;
• exposes only a redacted public lifecycle.

Deletion that commits first blocks later proof admission. Proof admission that commits first is included in the frozen deletion snapshot.

Contract and risk impact

• Public API or SDK contract
• Persisted data or migration
• Authentication, authorization, identity, or secret handling
• Payment or entitlement behavior
• Runtime, deployment, or observability
• No contract/risk impact

Public routes:

• DELETE /creator/content-locks/{lock_id}
• GET /creator/content-locks/{lock_id}/deletion

The creator is derived from the authenticated frontend session. Public responses omit internal job IDs, task IDs, claim tokens, frozen manifests, and credentials.

Migrations:

• 0011_content_lock_deletions.sql
• 0012_content_lock_deletion_task_snapshot.sql
• 0013_content_lock_publication_intents.sql

Verification

The following commands were run successfully on the final combined stack:

• cargo fmt --all -- --check
• cargo test --workspace --all-targets --all-features
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• git diff --check codex/bitkit-local-e2e-fixes..stack/graceful-deletion/05-execution

The final run included:

• locks-service library: 355 passed;
• deletion integration: 29 passed;
• PostgreSQL E2E: 12 passed.

This intermediate slice was not independently rerun after restacking; its isolated CI result should be recorded before merge.

Documentation

Updated:

• docs/API.md
• docs/DOMAIN_MODEL.md
• docs/RUNTIME.md
• docs/ADRs/0020-locks-paykit-v1-integration-boundary.md
• docs/plans/2026-08-10-graceful-content-lock-deletion.md

The documentation covers the authenticated routes, redacted lifecycle, durable job model, admission cutoff, and publication fencing.

Checklist

• The change is focused and self-reviewed.
• Regression tests were added where practical.
• No credentials, identities, private content, payment material, or generated local state are included.
• Formatting and relevant tests/lints pass.

[dzdidi]

Summary

Part 2 of the graceful-deletion stack. Depends on Part 1.

Introduces the durable content-lock deletion model and creator-authorized API without executing destructive deletion phases yet.

The change:

• persists deletion jobs and immutable frozen lock manifests;
• snapshots verification tasks at the deletion admission cutoff;
• serializes deletion admission against proof admission and lock publication;
• adds durable publication intents;
• adds creator-authenticated deletion initiation and status routes;
• adds Rust SDK and WASM request/response support;
• exposes only a redacted public lifecycle.

Deletion that commits first blocks later proof admission. Proof admission that commits first is included in the frozen deletion snapshot.

Contract and risk impact

• Public API or SDK contract
• Persisted data or migration
• Authentication, authorization, identity, or secret handling
• Payment or entitlement behavior
• Runtime, deployment, or observability
• No contract/risk impact

Public routes:

• DELETE /creator/content-locks/{lock_id}
• GET /creator/content-locks/{lock_id}/deletion

The creator is derived from the authenticated frontend session. Public responses omit internal job IDs, task IDs, claim tokens, frozen manifests, and credentials.

Migrations:

• 0011_content_lock_deletions.sql
• 0012_content_lock_deletion_task_snapshot.sql
• 0013_content_lock_publication_intents.sql

Verification

The following commands were run successfully on the final combined stack:

• cargo fmt --all -- --check
• cargo test --workspace --all-targets --all-features
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• git diff --check codex/bitkit-local-e2e-fixes..stack/graceful-deletion/05-execution

The final run included:

• locks-service library: 355 passed;
• deletion integration: 29 passed;
• PostgreSQL E2E: 12 passed.

This intermediate slice was not independently rerun after restacking; its isolated CI result should be recorded before merge.

Documentation

Updated:

• docs/API.md
• docs/DOMAIN_MODEL.md
• docs/RUNTIME.md
• docs/ADRs/0020-locks-paykit-v1-integration-boundary.md
• docs/plans/2026-08-10-graceful-content-lock-deletion.md

The documentation covers the authenticated routes, redacted lifecycle, durable job model, admission cutoff, and publication fencing.

Checklist

• The change is focused and self-reviewed.
• Regression tests were added where practical.
• No credentials, identities, private content, payment material, or generated local state are included.
• Formatting and relevant tests/lints pass.

[dzdidi]

Summary

Part 2 of the graceful-deletion stack. Depends on Part 1.

Introduces the durable content-lock deletion model and creator-authorized API without executing destructive deletion phases yet.

The change:

• persists deletion jobs and immutable frozen lock manifests;
• snapshots verification tasks at the deletion admission cutoff;
• serializes deletion admission against proof admission and lock publication;
• adds durable publication intents;
• adds creator-authenticated deletion initiation and status routes;
• adds Rust SDK and WASM request/response support;
• exposes only a redacted public lifecycle.

Deletion that commits first blocks later proof admission. Proof admission that commits first is included in the frozen deletion snapshot.

Contract and risk impact

• Public API or SDK contract
• Persisted data or migration
• Authentication, authorization, identity, or secret handling
• Payment or entitlement behavior
• Runtime, deployment, or observability
• No contract/risk impact

Public routes:

• DELETE /creator/content-locks/{lock_id}
• GET /creator/content-locks/{lock_id}/deletion

The creator is derived from the authenticated frontend session. Public responses omit internal job IDs, task IDs, claim tokens, frozen manifests, and credentials.

Migrations:

• 0011_content_lock_deletions.sql
• 0012_content_lock_deletion_task_snapshot.sql
• 0013_content_lock_publication_intents.sql

Verification

The following commands were run successfully on the final combined stack:

• cargo fmt --all -- --check
• cargo test --workspace --all-targets --all-features
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• git diff --check codex/bitkit-local-e2e-fixes..stack/graceful-deletion/05-execution

The final run included:

• locks-service library: 355 passed;
• deletion integration: 29 passed;
• PostgreSQL E2E: 12 passed.

This intermediate slice was not independently rerun after restacking; its isolated CI result should be recorded before merge.

Documentation

Updated:

• docs/API.md
• docs/DOMAIN_MODEL.md
• docs/RUNTIME.md
• docs/ADRs/0020-locks-paykit-v1-integration-boundary.md
• docs/plans/2026-08-10-graceful-content-lock-deletion.md

The documentation covers the authenticated routes, redacted lifecycle, durable job model, admission cutoff, and publication fencing.

Checklist

• The change is focused and self-reviewed.
• Regression tests were added where practical.
• No credentials, identities, private content, payment material, or generated local state are included.
• Formatting and relevant tests/lints pass.

[dzdidi]

Summary

Part 2 of the graceful-deletion stack. Depends on Part 1.

Introduces the durable content-lock deletion model and creator-authorized API without executing destructive deletion phases yet.

The change:

• persists deletion jobs and immutable frozen lock manifests;
• snapshots verification tasks at the deletion admission cutoff;
• serializes deletion admission against proof admission and lock publication;
• adds durable publication intents;
• adds creator-authenticated deletion initiation and status routes;
• adds Rust SDK and WASM request/response support;
• exposes only a redacted public lifecycle.

Deletion that commits first blocks later proof admission. Proof admission that commits first is included in the frozen deletion snapshot.

Contract and risk impact

• Public API or SDK contract
• Persisted data or migration
• Authentication, authorization, identity, or secret handling
• Payment or entitlement behavior
• Runtime, deployment, or observability
• No contract/risk impact

Public routes:

• DELETE /creator/content-locks/{lock_id}
• GET /creator/content-locks/{lock_id}/deletion

The creator is derived from the authenticated frontend session. Public responses omit internal job IDs, task IDs, claim tokens, frozen manifests, and credentials.

Migrations:

• 0011_content_lock_deletions.sql
• 0012_content_lock_deletion_task_snapshot.sql
• 0013_content_lock_publication_intents.sql

Verification

The following commands were run successfully on the final combined stack:

• cargo fmt --all -- --check
• cargo test --workspace --all-targets --all-features
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• git diff --check codex/bitkit-local-e2e-fixes..stack/graceful-deletion/05-execution

The final run included:

• locks-service library: 355 passed;
• deletion integration: 29 passed;
• PostgreSQL E2E: 12 passed.

This intermediate slice was not independently rerun after restacking; its isolated CI result should be recorded before merge.

Documentation

Updated:

• docs/API.md
• docs/DOMAIN_MODEL.md
• docs/RUNTIME.md
• docs/ADRs/0020-locks-paykit-v1-integration-boundary.md
• docs/plans/2026-08-10-graceful-content-lock-deletion.md

The documentation covers the authenticated routes, redacted lifecycle, durable job model, admission cutoff, and publication fencing.

Checklist

• The change is focused and self-reviewed.
• Regression tests were added where practical.
• No credentials, identities, private content, payment material, or generated local state are included.
• Formatting and relevant tests/lints pass.

[dzdidi]

Summary

Part 2 of the graceful-deletion stack. Depends on Part 1.

Introduces the durable content-lock deletion model and creator-authorized API without executing destructive deletion phases yet.

The change:

• persists deletion jobs and immutable frozen lock manifests;
• snapshots verification tasks at the deletion admission cutoff;
• serializes deletion admission against proof admission and lock publication;
• adds durable publication intents;
• adds creator-authenticated deletion initiation and status routes;
• adds Rust SDK and WASM request/response support;
• exposes only a redacted public lifecycle.

Deletion that commits first blocks later proof admission. Proof admission that commits first is included in the frozen deletion snapshot.

Contract and risk impact

• Public API or SDK contract
• Persisted data or migration
• Authentication, authorization, identity, or secret handling
• Payment or entitlement behavior
• Runtime, deployment, or observability
• No contract/risk impact

Public routes:

• DELETE /creator/content-locks/{lock_id}
• GET /creator/content-locks/{lock_id}/deletion

The creator is derived from the authenticated frontend session. Public responses omit internal job IDs, task IDs, claim tokens, frozen manifests, and credentials.

Migrations:

• 0011_content_lock_deletions.sql
• 0012_content_lock_deletion_task_snapshot.sql
• 0013_content_lock_publication_intents.sql

Verification

The following commands were run successfully on the final combined stack:

• cargo fmt --all -- --check
• cargo test --workspace --all-targets --all-features
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• git diff --check codex/bitkit-local-e2e-fixes..stack/graceful-deletion/05-execution

The final run included:

• locks-service library: 355 passed;
• deletion integration: 29 passed;
• PostgreSQL E2E: 12 passed.

This intermediate slice was not independently rerun after restacking; its isolated CI result should be recorded before merge.

Documentation

Updated:

• docs/API.md
• docs/DOMAIN_MODEL.md
• docs/RUNTIME.md
• docs/ADRs/0020-locks-paykit-v1-integration-boundary.md
• docs/plans/2026-08-10-graceful-content-lock-deletion.md

The documentation covers the authenticated routes, redacted lifecycle, durable job model, admission cutoff, and publication fencing.

Checklist

• The change is focused and self-reviewed.
• Regression tests were added where practical.
• No credentials, identities, private content, payment material, or generated local state are included.
• Formatting and relevant tests/lints pass.

[dzdidi]

Summary

Part 2 of the graceful-deletion stack. Depends on Part 1.

Introduces the durable content-lock deletion model and creator-authorized API without executing destructive deletion phases yet.

The change:

• persists deletion jobs and immutable frozen lock manifests;
• snapshots verification tasks at the deletion admission cutoff;
• serializes deletion admission against proof admission and lock publication;
• adds durable publication intents;
• adds creator-authenticated deletion initiation and status routes;
• adds Rust SDK and WASM request/response support;
• exposes only a redacted public lifecycle.

Deletion that commits first blocks later proof admission. Proof admission that commits first is included in the frozen deletion snapshot.

Contract and risk impact

• Public API or SDK contract
• Persisted data or migration
• Authentication, authorization, identity, or secret handling
• Payment or entitlement behavior
• Runtime, deployment, or observability
• No contract/risk impact

Public routes:

• DELETE /creator/content-locks/{lock_id}
• GET /creator/content-locks/{lock_id}/deletion

The creator is derived from the authenticated frontend session. Public responses omit internal job IDs, task IDs, claim tokens, frozen manifests, and credentials.

Migrations:

• 0011_content_lock_deletions.sql
• 0012_content_lock_deletion_task_snapshot.sql
• 0013_content_lock_publication_intents.sql

Verification

The following commands were run successfully on the final combined stack:

• cargo fmt --all -- --check
• cargo test --workspace --all-targets --all-features
• cargo clippy --workspace --all-targets --all-features -- -D warnings
• git diff --check codex/bitkit-local-e2e-fixes..stack/graceful-deletion/05-execution

The final run included:

• locks-service library: 355 passed;
• deletion integration: 29 passed;
• PostgreSQL E2E: 12 passed.

This intermediate slice was not independently rerun after restacking; its isolated CI result should be recorded before merge.

Documentation

Updated:

• docs/API.md
• docs/DOMAIN_MODEL.md
• docs/RUNTIME.md
• docs/ADRs/0020-locks-paykit-v1-integration-boundary.md
• docs/plans/2026-08-10-graceful-content-lock-deletion.md

The documentation covers the authenticated routes, redacted lifecycle, durable job model, admission cutoff, and publication fencing.

Checklist

• The change is focused and self-reviewed.
• Regression tests were added where practical.
• No credentials, identities, private content, payment material, or generated local state are included.
• Formatting and relevant tests/lints pass.