Fred 2.0.2 — RGPD-ready increment (CTRLP-12)

[dimitri-tombroff]

2.0.1 made Fred C3-ready; 2.0.2 makes it RGPD-ready. All core capabilities
already exist — this increment wires them together so erasure is complete and
provable, retention is team-governed, and evaluation is authorised.

RFC: docs/swift/rfc/FRED-2.0.2-RGPD-READY-RFC.md
Backlog: docs/swift/backlog/BACKLOG.md §6.4.H

Headline feature: the retention window is the evaluation window — a team
evaluates its agents on real conversations without compromising RGPD.

Definition of done (RGPD-ready)

• Erasure is complete & provable (all stores, auditable receipt — no shadow copies)
• "Delete" means delete (personal: immediate; team: deferred for the eval window)
• Retention bounded & team-governed (platform caps, team may only tighten)
• Evaluation authorised & scoped (ReBAC; real conversations need CAN_READ_CONVERSATIONS)
• Identity stays pseudonymised (stored user_id = Keycloak sub, no email)

Work — A: complete erasure

• ConversationErasureService + StoreEraser registry → ErasureReceipt
• checkpoint_thread_owner table (per-user erase + age sweep) + backfill
• KPI delete/anonymise method (only store lacking one)
• Reuse delete_document_and_artifacts; session_metadata.deleted_at + sidebar filter
• Delete button → erase_session (personal immediate / team deferred); USER_DELETED + IDLE_EXPIRED triggers
• Lifecycle purge action → erase_team_member

Work — B: team governance console

• team_policy_override table + resolver clamp (team ?? rule ?? default, ≤ cap)
• GET/PATCH /teams/{id}/retention (CAN_READ / CAN_UPDATE_INFO)
• Evaluation authz: CAN_READ / CAN_UPDATE_AGENTS / CAN_READ_CONVERSATIONS
• TeamSettingsRetention.tsx tab + governance copy; regenerate control-plane client

Coordinate: checkpoint schema with MEMORY-02 (Marc); eval authz with EVAL-01 (Odélia).