H.1.5 Information Lifecycle

Deleting a path from the current tree does not remove it from repository history or the services that copied it.

• Define retention, archival, legal-hold, export, and deletion requirements for source, history, reviews, attachments, large objects, and generated material.
• Treat history rewriting as a coordinated boundary change with identity, consumer, mirror, workspace, and audit consequences.
• Remove exposed secrets or personal data according to an incident and legal process rather than promising that one Git edit erases every copy.
• Inventory indexes, mirrors, caches, snapshots, backups, and exports that derive from authoritative repository state.
• Verify propagation and record known residual copies, access restrictions, and retirement evidence.