Skip to content

pg_hardstorage_approval_purge-expired.md

Latest commit

 

History

History
68 lines (52 loc) · 3.92 KB

pg_hardstorage_approval_purge-expired.md

File metadata and controls

68 lines (52 loc) · 3.92 KB
Raw
title pg hardstorage approval purge-expired
description CLI reference for the pg hardstorage approval purge-expired command.
tags
cli
reference

pg_hardstorage approval purge-expired

Record expiry for approval requests past their TTL (audited)

Synopsis

Sweep every approval request that has passed its TTL without reaching its approval threshold (and was not revoked), and record the expiry in the audit chain as an approval.expire event — one per request.

A request's status is otherwise a DERIVED state (computed from its TTL), so an expired request leaves no audit-chain record and the compliance report's expired-request count stays zero. This sweep gives expiry a trail, mirroring hold purge-expired for legal holds.

The sweep is idempotent: a request whose expiry has already been recorded is skipped, so re-running emits nothing new.

pg_hardstorage approval purge-expired --dry-run # preview only pg_hardstorage approval purge-expired --yes # record expiry

pg_hardstorage approval purge-expired [flags]

Options

      --dry-run       preview the requests that would be recorded as expired (no mutations, no audit emits)
  -h, --help          help for purge-expired
      --repo string   repository URL — must already exist (required)
      --yes           confirm the sweep — required unless --dry-run is set

Options inherited from parent commands

      --airgapped airgapped: strict                                                       refuse outbound endpoints (LLM providers, sinks, OTLP collectors) outside loopback / RFC1918 / explicit airgap.allowlist. Also enabled by PG_HARDSTORAGE_AIRGAPPED=1 or airgapped: strict in the config file.
  -c, --config string                                                                     path to config file (default: XDG/FHS lookup)
      --cpu-profile go tool pprof <path>                                                  write a pprof CPU profile to this path for the duration of the command (go tool pprof <path> to analyse). Off when empty.
      --mem-profile string                                                                write a pprof heap profile to this path at command exit. Off when empty.
      --no-color                                                                          disable ANSI color in text output
      --on-error-llm                                                                      on a structured-error failure, drop into the matching LLM helper skill (auto_on_error trigger). Also enabled by PG_HARDSTORAGE_ON_ERROR_LLM=1.
      --otel-endpoint string                                                              OpenTelemetry OTLP/HTTP endpoint (e.g. http://otel-collector:4318); empty disables tracing
      --otel-stdout                                                                       also export OpenTelemetry traces to stderr (useful for dev)
  -o, --output string                                                                     output format: text|json|ndjson|yaml|template|csv|markdown|html|tap|junit|pdf (default: text on TTY, json off-TTY)
      --profile-port go tool pprof http://127.0.0.1:6060/debug/pprof/profile?seconds=30   if non-zero, expose net/http/pprof on 127.0.0.1:<port> for live profiling of long-running commands (e.g. go tool pprof http://127.0.0.1:6060/debug/pprof/profile?seconds=30). Off when zero.
  -q, --quiet                                                                             suppress non-essential output
      --template string                                                                   Go text/template applied when --output template (or implied if --template is set without --output)

SEE ALSO