DATA-002: GDPR Compliance #164

New issue

Closed

opened 2026-04-11 05:50:55 +00:00 by Mark · 1 comment

Mark commented

2026-04-11 05:50:55 +00:00

Owner

Required

User data export
Right to be forgotten
Consent management
Data processing records

Acceptance Criteria

Export user data endpoint
Delete all user data
Consent tracking
Audit trail of deletions

## Required - User data export - Right to be forgotten - Consent management - Data processing records ## Acceptance Criteria - [ ] Export user data endpoint - [ ] Delete all user data - [ ] Consent tracking - [ ] Audit trail of deletions

Mark added the

feature-request

label

2026-05-12 23:53:03 +00:00

Mark added

blocked:needs-decision

and removed

feature-request

labels

2026-05-18 00:21:28 +00:00

Mark commented

2026-05-18 00:21:28 +00:00

Author

Owner

Feature Triage Assessment

Scope: medium
Risk: medium
Spec Alignment: misaligned
Summary: Adds GDPR data protection features (user data export, right to be forgotten, consent tracking, and audit trail of deletions) to the mesh system.
Recommendation: Implement as a separate compliance service/contract that intercepts data-accessing operations at the backplane layer rather than weaving GDPR logic into mesh_node itself. Define a data inventory first to understand what personal data exists across workers, ledger, and logs.
Rationale: Medium scope because it requires a new compliance module but doesn't touch core infrastructure paths (bidding, spawning, worker lifecycle). Risk is medium because distributed data deletion has consistency challenges across worker processes, ledger, and logs — but the operations are additive and don't refactor existing paths. Misaligned because the project spec describes a distributed compute + agent orchestration + ledger economics system with no mention of user data management, privacy, or compliance; this introduces an entirely new concern orthogonal to current milestones.

Labeled blocked:needs-decision — unblock on Forgejo to dispatch to the fixer pipeline.

## Feature Triage Assessment **Scope:** medium **Risk:** medium **Spec Alignment:** misaligned **Summary:** Adds GDPR data protection features (user data export, right to be forgotten, consent tracking, and audit trail of deletions) to the mesh system. **Recommendation:** Implement as a separate compliance service/contract that intercepts data-accessing operations at the backplane layer rather than weaving GDPR logic into mesh_node itself. Define a data inventory first to understand what personal data exists across workers, ledger, and logs. **Rationale:** Medium scope because it requires a new compliance module but doesn't touch core infrastructure paths (bidding, spawning, worker lifecycle). Risk is medium because distributed data deletion has consistency challenges across worker processes, ledger, and logs — but the operations are additive and don't refactor existing paths. Misaligned because the project spec describes a distributed compute + agent orchestration + ledger economics system with no mention of user data management, privacy, or compliance; this introduces an entirely new concern orthogonal to current milestones. Labeled `blocked:needs-decision` — unblock on Forgejo to dispatch to the fixer pipeline.

Mark removed the

blocked:needs-decision

label

2026-05-28 07:19:05 +00:00

Mark referenced this issue

2026-06-07 04:51:36 +00:00

TEST-003: Chaos Engineering Tests #170

Mark added the

triage-approved

label

2026-06-07 05:03:44 +00:00

Mark closed this issue