Files
Snow LeeandClaude Fable 5 3b16ca3c74 feat(hub): deletes are tombstoned, audited, and reported to PostHog
Deleting a project no longer removes its registry row: Delete(id, by)
marks it with Deleted/DeletedBy and every live-project read path skips
tombstones, so the name is immediately reusable, no content route
answers for one, and who-deleted-what-when stays queryable — the row is
the audit record. GET /api/projects?deleted=1 lists tombstones through
the same permission resolver as the live list (hub admins additionally
see tombstones of deleted orgs, the only audience left once the
memberships are gone). Each delete also writes an audit: log line and a
project_deleted / org_deleted PostHog event through the existing
Server.capture — ids only, a no-op unless analytics is configured.

The SQL backend grows deleted/deleted_by columns via the idempotent
addColumns migration, guarded: a rolled-back deleted column would
resurrect every deleted project as live with its storage already
purged. The file backend stores the whole row and needs nothing.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
2026-08-16 10:00:19 -07:00
..