Epic 12 — WORM evidence storage (ops)

Application-layer WORM enforcement lives in app/lib/evidence/wormStoragePolicy.ts. Cloud buckets must mirror the same immutability contract.

Environment

Variable	Default	Purpose
`EVIDENCE_STORAGE_BUCKET`	`evidence-locker`	Primary Supabase bucket for forensic uploads (`worm/<tenant>/…`)
`EVIDENCE_WORM_BUCKET`	`<EVIDENCE_STORAGE_BUCKET>-worm`	Optional dedicated WORM bucket (reserved for future split)
`INCIDENT_REPORTS_BUCKET`	same as evidence bucket	Post-mortem PDFs under `incident-reports/<tenant>/…`
`EVIDENCE_WORM_OBJECT_LOCK`	enabled (set `false` to disable app guard)	Fail-closed delete/overwrite checks in shredder and storage helpers

Deletes and shredder expunge are blocked when the stored reference matches:

Create bucket evidence-locker (or your EVIDENCE_STORAGE_BUCKET value).
Enable Object versioning and Object lock (Compliance mode) on the bucket if your Supabase project tier supports it; otherwise use RLS policies that deny DELETE and deny UPDATE on existing objects.
RLS policy sketch: allow INSERT for service role only; deny DELETE on all objects; allow SELECT for authenticated tenant-scoped reads.
Uploads from the app use upsert: false and immutable cache headers — duplicate object keys return an error instead of overwriting.

If evidence is mirrored to S3 (AWS_EVIDENCE_PREFIX):

Enable Bucket Versioning.
Apply a Object Lock retention policy (Compliance mode) on ironframe/evidence/ and ironframe/incident-reports/ prefixes.
Deny s3:DeleteObject and s3:PutObject with overwrite semantics for locked prefixes via bucket policy.

Remote migration on Ironframe-GRC: epic12_worm_evidence_locker_rls (20260529154334).

Local mirror:

supabase/migrations/20260529154334_epic12_worm_evidence_locker_rls.sql

Re-apply on another project:

supabase db push
# or paste the SQL in Dashboard → SQL Editor

npm run test:integration:epic12

Expect attestation guard tests plus WORM path delete blocks (10 tests in the Epic 12 matrix).