Archive old audit entries

tovio audit archivetovio audit archive --older-than 365dtovio audit archive --older-than 90d --dry-run

Moves old entries out of the active chain, behind a signed checkpoint. The retention window defaults to one year; --older-than takes a duration such as 90d or 24h.

Preview first

--dry-run reports the eligible suffix and writes nothing. It does not even load the signing key, so it is safe to run anywhere, including on a machine where the keychain is locked. Run it before the real pass; the boundary it names is the boundary the real pass will use.

Why a checkpoint

Simply deleting old entries would break the chain — the whole property is that links are continuous. A checkpoint is a signed statement summarising what was archived, so the remaining chain still verifies end to end and the archived entries stay independently verifiable.

What it actually does, in order

1. Verifies the live chain and every prior archive checkpoint. If that fails, nothing is archived.
2. Selects only the oldest contiguous suffix older than the window. It never carves entries out of the middle.
3. Writes the immutable archive bytes and the signed checkpoint, and flushes both to disk.
4. Advances the checkpoint pointer atomically.
5. Removes the loose copies last.

If the pass is interrupted, the next one resumes the cleanup idempotently rather than redoing the archive. Objects already folded into a pack wait for a verified aggressive garbage collection.

When to archive

When the chain grows enough that verification gets slow, and after those entries have been exported somewhere durable. Archive after exporting, not instead of it.

Verify on both sides

tovio audit verify

Run it before archiving and again afterwards. Afterwards, verification authenticates the retained entries plus the archived count through the checkpoint, so the total should still add up. If it passed before and fails after, stop.

If a retention check fails

A checkpoint signature, an archive digest, an internal archive link, or the exact retained boundary that cannot be authenticated is a retention failure, and no subsequent artefact is published or removed after the failing step. Preserve the archive directory, the checkpoint directory, and the checkpoint pointer as they are — they are the evidence — and verify without modifying the repository.

Retention obligations

Archiving is not deletion — the records still exist. If you are under a retention obligation, keep the archives for the required period, and note that hosted plans have their own retention windows.