mirror of
https://github.com/luxfi/aml.git
synced 2026-09-24 00:25:20 +00:00
zeekayandHanzo Dev
0faf15d14a
The case store evicted. Ninety days after a case was closed it was dropped, with its timeline, once the store held more than a hundred thousand of them — and both the count and the sweep were taken across every tenant at once, so one institution's volume destroyed another institution's evidence, and neither of them was told. A case is the record that an alert was considered and what was decided, kept whichever way the decision went (AMLR Art. 77(1)(b); JMLSG 6.32), for five years (Dir. (EU) 2015/849 Art. 40). This repo already has a plane that keeps that clock: pkg/retention counts in years, per tenant, refuses a date its own clock has not reached, and proves what it destroyed before it reports a count. A second clock here, counting in days, could not be reconciled with it — whichever was shorter was the real retention period, and nobody wrote that one down. So the durable shelf has no bound, and no constructor that could give it one. What eviction remains is the memory shelf's, only this package's tests build it, and it is scoped to one org. The sweep is scoped at the seam rather than at its callers: shelf.each now names the org whose cases it visits, so counting, triage and eviction are each a tenant's own by construction. That closed two more crossings of the same boundary that were not eviction at all — the stale-case sweep escalated every institution's cases on any tenant's cycle, which is a write on another institution's investigation, and least-loaded assignment counted another institution's queue into this one's analyst load. Case numbering is per tenant too: drawn from one sequence for the deployment, the gaps in one institution's file references counted another's cases. Opening a case now takes no census. The count that decided whether to evict was a full scan of every case in the store, under the store lock, on every Create — the path the replay gate calls the request that must not wait — and once the store was over the threshold with nothing old enough to drop, every Create paid two of those scans forever. pkg/cases/evict_test.go is what says so, and each of these tests was checked against the defect it describes: reinstating the bound fails the two durable tests, un-scoping the sweeps fails the four tenant tests, and restoring the census fails the ingest one. Co-authored-by: Hanzo Dev <[email protected]>