ADR-0002: Retention enforced by destroying per-session keys

Status: superseded in part by ADR-0005 (per-(day, rung) keys replace per-session keys)
Date: 2026-10-12
Requirements touched: P-07, S-03, S-04

Context

Flash memory doesn't reliably erase (wear levelling leaves stale copies). Deleting files is not forgetting.

Options

Option	For	Against
Delete files on expiry	Easy	Recoverable by chip-off forensics
Encrypt each session with its own key; destroy the key on expiry	Unrecoverable once key is gone; key lives in a secure element that does erase	Needs a secure element and a trustworthy clock

Decision

Per-session keys held in a secure element. Expiry = key destruction.

Clock trust: the RTC runs off a backup cell rated for well over 30 days. The secure element's monotonic counter is advanced on every boot and every hour. If the RTC is ever found reset or behind the last counter checkpoint, the device fails closed: every session whose expiry can't be proven still in the future is shredded.

Consequences

Retention can be shortened at any time (destroy key earlier) but never extended past the agreed day.
A dead battery may lose memories early. That's the right failure.
Need a forensics test in DVT (see 09-validation/plan.md).

# ADR-0002: Retention enforced by destroying per-session keys - **Status:** superseded in part by ADR-0005 (per-(day, rung) keys replace per-session keys) - **Date:** 2026-10-12 - **Requirements touched:** P-07, S-03, S-04 ## Context Flash memory doesn't reliably erase (wear levelling leaves stale copies). Deleting files is not forgetting. ## Options | Option | For | Against | |---|---|---| | Delete files on expiry | Easy | Recoverable by chip-off forensics | | Encrypt each session with its own key; destroy the key on expiry | Unrecoverable once key is gone; key lives in a secure element that does erase | Needs a secure element and a trustworthy clock | ## Decision Per-session keys held in a secure element. Expiry = key destruction. Clock trust: the RTC runs off a backup cell rated for well over 30 days. The secure element's monotonic counter is advanced on every boot and every hour. If the RTC is ever found reset or behind the last counter checkpoint, the device **fails closed**: every session whose expiry can't be proven still in the future is shredded. ## Consequences - Retention can be shortened at any time (destroy key earlier) but never extended past the agreed day. - A dead battery may lose memories early. That's the right failure. - Need a forensics test in DVT (see `09-validation/plan.md`).