Prompt & Configuration Registry · View 10 of 21 · Data
The sort order
- Two zones cannot be rebuilt: released bundles and the audit ledger. They carry RPO 0 and write-once storage, and they are the only things that do.
- Control state is small and linearisable but rebuildable from the audit ledger, which is why a three-node etcd quorum is sufficient rather than a replicated database.
- The authoring store is transactional and important and still rebuildable from Git — which is what allows a 5-minute RPO on the part of the system people spend most of their day in.
Assumptions
- Audit retention 7 years, aligned to a general financial-audit horizon (stated assumption). Exposure telemetry 90 days hot, 400 days cold, then deleted.
- MinIO Object Lock is available and the operator cannot disable it for an already-written object — the property the audit claim depends on.
Risks
- The resident bundle in each pod is a cache with a longer name, but a pod that cold-starts during an artefact-store outage has nothing to rebuild from except the image-baked default. That default's age is nobody's job by default; making it one is a Phase 2 item.
- Erasure of user content and immutable retention of released versions do not conflict here only because prompts are not user content. A confidential key containing customer-derived text would reopen this.
