Skip to main content

​
Artifact reference

​
Private hosted access

Cloudflare R2 stores private review artifacts; D1 stores review metadata. The viewer authorizes workspace access before evidence delivery. Signing in does not grant access to every workspace or repository. Artifact access also checks review identity, target association, expiry, and deletion status. Agent evidence operations return an index before fetching selected bytes. Downloads check recorded size, MIME type, and digest. A metadata entry alone does not prove the underlying object is still readable. Large artifacts and video/trace content require authenticated download rather than inline MCP image/text content. GitHub summaries link to the authorized viewer; they do not make the underlying recordings public. Share review links with people who have appropriate workspace access. Product analytics and PostHog diagnostics are separate from the customer evidence store.

​
Retention and expired reviews

The hosted retention policy is 30 days. Completed runs use their completion time; abandoned captures use capture time. Untracked uploaded artifact objects are cleaned up 30 days after upload. Cleanup is scheduled in bounded batches, so physical deletion need not occur at the exact expiry second. Expired evidence cannot receive a new access grant. Once a review expires and its artifact deletion succeeds, detailed plans, findings, comments, replay data, and per-run context/check/test results are removed. A minimal review identity remains so old links can explain expiry. Accounting and repository instructions remain; already-posted GitHub summaries are unchanged. Retention is not currently a per-repository setting.

​
Local-source uploads

The hosted CLI’s review-local uploads selected working-tree files privately. It is distinct from the contributor harness that runs on your machine. Source uploads have a separate one-day cleanup policy; queued or active jobs keep the source they need until it can be safely removed. The resulting review artifacts follow the 30-day evidence policy. Inspect review-local --dry-run --json before uploading. Tracked files are included subject to mandatory exclusions and .diffractionignore; untracked files require explicit selection. Secret-pattern checks are bounded and cannot prove that arbitrary source contains no private information.

​
Capture privacy

Use synthetic test data. Declaring a secret reference in repository configuration does not provision test credentials. Native raw videos/traces require dedicated synthetic-data confirmation; semantic replay masking does not sanitize them. Comparisons also require explicit synthetic state. General authenticated customer capture is not established by these guarded fixture workflows.

​
Contributor recordings

Local PR harness runs write to .diffraction/local-reviews/ in the Diffraction checkout. Local artifact routes require loopback development access and are disabled in production. A hosted deployment cannot read your local run directory.