What AfterDelete does
A customer record can be deleted correctly and still return later when an old queue job, retry or index rebuild writes stale data back. AfterDelete is a scoped erasure-safety gate for synthetic identities. It detects that race before an unsafe change ships.
This is an erasure-safety demonstration, not a complete GDPR or CCPA compliance product.
How it works
AfterDelete keeps a deletion tombstone, locks writes around the customer record and checks the event generation before materializing a downstream copy. Its deterministic gate replays three known resurrection races and two safe controls against a known-broken reference, a known-good reference and the current source.
A separate static scanner checks changed Python code for literal destination calls and SQL inserts that are not declared in the reviewed destination policy. Declaring a destination does not prove its deletion behavior is correct, so the replay gate remains independent.
The project includes a supervised GitLab Duo Agent Platform custom flow. Public flow 1019599 ran as session 10014015 against controlled unsafe MR !2 in the event project. It inspected the real diff and failed pipeline evidence, restored the guard in a separate branch and opened repair MR !3. Fresh pipeline 2986106940 passed all five jobs. A person still decides whether to merge or release.
What works today
Transactional deletion tombstones and generation-fenced worker writes Replays for delayed jobs, old retries and snapshot rebuilds Known-bad and known-good controls Bounded Python AST and static SQL destination discovery SQLite tests plus a PostgreSQL and pgvector CI canary JSON, HTML and JUnit evidence with integrity manifests Public GitLab pipeline history for passing and blocked changes Read-only FastAPI evidence viewer deployed on Google Cloud Run Human approval required before merge or release
GitLab lifecycle
AfterDelete covers Plan, Create, Verify, Package, Secure, Release, Configure and Govern. A developer opens a merge request, GitLab CI scans for undeclared destinations, the replay suite tests late events against database state and unsafe changes are blocked. A supervised Duo flow can then investigate and propose a repair. Fresh CI runs on the repaired commit before a person approves it.
Try it
Public repository: https://gitlab.com/aidash-group1/afterdelete
Live evidence viewer: https://afterdelete-gate-293866068182.us-central1.run.app
Run locally with Python 3.11 or newer: git clone https://gitlab.com/aidash-group1/afterdelete.git cd afterdelete python3 -m venv .venv source .venv/bin/activate python -m pip install -e '.[dev]' python -m pytest -q afterdelete gate --output evidence/gate python -m afterdelete.cli serve --evidence evidence/gate/report.json --port 8080
The verified checkout reports 58 passing tests. The gate reports PASS with five of five current-source scenarios passing and zero blocking destinations.
Limits
Static discovery covers literal Python sink calls and static SQL inserts. It is not a general data-flow or taint-analysis engine. The safety claim applies to writers that follow the supported transaction and locking protocol. Third-party SDKs, dynamic SQL, backups and undeclared systems still need manual review. All examples use synthetic identities.
Built With
- docker
- fastapi
- gitlab-ci/cd
- gitlab-duo-agent-platform
- google-cloud-run
- pgvector
- postgresql
- python
- sqlalchemy