AI Ingestion
Tombstoning Data
The Tombstone operation is the protocol's mechanism for the targeted redaction of sensitive data while maintaining the integrity of the cryptographic chain.
Unlike a standard database DELETE, a Tombstone nullifies specific payload values within existing StatusUpdate records without removing the record's position in the property sequence.
Targeting Logic
Tombstoning leverages the exact same sourcing logic as StatusUpdate.lookup_many. This ensures consistency across the platform: if you can query it, you can tombstone it.
The Lookup Parity
To initiate a redaction, you provide the same criteria used for state observation:
- 1 context_slug
- 2 slug
- 3 code
Payload Redaction Rules
The Ledger treats different data types with varying levels of aggression during a Tombstone event to balance privacy with system performance.
:status_text_value
Full Purge: Because text values often contain PII (Names, Emails, Notes), the protocol will check the global string dictionaries.
If the redacted value is no longer referenced by any other record, it is permanently removed from the dictionary.
:status_slug
Reference Nullification: Slugs are treated as system-level constants (e.g., ACTIVE, PENDING).
Tombstoning will nil out the field on the record, but the slug remains in the system dictionary as it is presumed to be a reused architectural value.
Chain Integrity
It is important to note that property_sequence_no and chain_hash remain untouched. The Ledger preserves the "shape" of history—knowing that a change occurred and who witnessed it—while removing the content of the change.
status_text_values, the data cannot be recovered via the Ledger.
Next Step: Learn how to verify the remains of a redacted record in Auditing Redacted Chains.
Tombstoning Data
The Tombstone operation is the protocol's mechanism for the targeted redaction of sensitive data while maintaining the integrity of the cryptographic chain.
Unlike a standard database DELETE, a Tombstone nullifies specific payload values within existing StatusUpdate records without removing the record's position in the property sequence.
Targeting Logic
Tombstoning leverages the exact same sourcing logic as StatusUpdate.lookup_many. This ensures consistency across the platform: if you can query it, you can tombstone it.
The Lookup Parity
To initiate a redaction, you provide the same criteria used for state observation:
- 1 context_slug
- 2 slug
- 3 code
Payload Redaction Rules
The Ledger treats different data types with varying levels of aggression during a Tombstone event to balance privacy with system performance.
:status_text_value
Full Purge: Because text values often contain PII (Names, Emails, Notes), the protocol will check the global string dictionaries.
If the redacted value is no longer referenced by any other record, it is permanently removed from the dictionary.
:status_slug
Reference Nullification: Slugs are treated as system-level constants (e.g., ACTIVE, PENDING).
Tombstoning will nil out the field on the record, but the slug remains in the system dictionary as it is presumed to be a reused architectural value.
Chain Integrity
It is important to note that property_sequence_no and chain_hash remain untouched. The Ledger preserves the "shape" of history—knowing that a change occurred and who witnessed it—while removing the content of the change.
status_text_values, the data cannot be recovered via the Ledger.
Next Step: Learn how to verify the remains of a redacted record in Auditing Redacted Chains.