Close + archive — the 7-year SHA-256 vault

What "close" actually does

For a full audit walkthrough of the closing acts (sign, issue, lock, archive) see Phase 13 of the audit manual. Here's the job-mechanics view:

1. Pre-flight checks

   System verifies: status=completed, all tasks done|skipped, all workpapers EQCR-signed (audit only), audit report PDF present, issuance email sent. Failure = explicit blocker list shown.

2. Build archive ZIP

   VaultBackupService::buildArchive($jobId) walks every related table, exports artefacts as PDF, packages the folder structure, computes SHA-256 per file, builds the ZIP at storage/archives/{client-code}-{fy}-{job-id}.zip.

3. Compute manifest

   Per-file SHA-256 + size + path → written to _manifest.json inside the ZIP. Top-level ZIP SHA-256 stored in jobs.archive_sha256.

4. Stamp retention

   jobs.retention_until = report_date + 7 years (configurable per m16.retention_years setting). Auto-purge cron checks this column nightly.

5. Off-site sync

   Nightly cron bin/cron-offsite-backup.sh rclone-syncs new archives to the configured remote (B2 / S3 / Wasabi). Email alert on failure.

6. Status flips to archived

   Job is now read-only. All workpapers, AJEs, FS, notes, disclosures, comments — all uneditable. Audit-log captures the lock event.

Archive contents (TPL-AA Annual Audit example)

CL0042-FY2025-{JOB-ID}.zip   ·   sha256: a3f8b2...e201
├── 01-Engagement/
│   ├── engagement-letter-signed.pdf
│   ├── independence-confirmation.pdf
│   └── client-acceptance-memo.pdf
├── 02-Trial-Balance/
│   ├── tb-original-uploaded.csv  (sha256: ...)
│   ├── tb-adjusted.csv
│   └── ajes-register.pdf
├── 03-Workpapers/
│   ├── A-100-Planning.pdf
│   ├── B-100-Cash.pdf
│   ├── C-100-AR.pdf
│   ├── D-100-Inventory.pdf
│   ├── E-100-PPE.pdf
│   ├── F-100-Payables.pdf
│   ├── G-100-Revenue.pdf
│   ├── H-100-OpEx.pdf
│   ├── I-100-Equity.pdf
│   ├── J-100-Tax.pdf
│   ├── K-100-GoingConcern.pdf
│   ├── L-100-SubsequentEvents.pdf
│   └── _signoffs-matrix.csv
├── 04-FS-pack/
│   ├── SFP.pdf · SPL.pdf · SCF.pdf · SOCIE.pdf
│   ├── notes-1-to-24.pdf
│   └── disclosure-checklist.pdf
├── 05-Audit-Report/
│   └── Audit-Report-{ClientCode}-FY2025-SIGNED.pdf
├── 06-Completion/
│   ├── completion-summary.pdf
│   └── readiness-pdf.pdf
├── 07-Audit-Trail/
│   └── audit-log-{JOB-ID}.csv  (every action timestamped)
└── _manifest.json   (SHA-256 + size per file)

Non-audit template archives

Smaller jobs produce smaller archives — the framework is the same but only the relevant folders populate:

Restore from archive

Quarterly restore drill — pick a random archive, restore, verify, log.

1. Pull from off-site

   rclone copy {remote}:archives/CL0042-FY2025-X.zip ./restore-test/

2. Verify top-level SHA-256

   sha256sum CL0042-FY2025-X.zip → compare to jobs.archive_sha256 for that job. Match required.

3. Extract + verify manifest

   unzip CL0042-FY2025-X.zip → walk _manifest.json, recompute each file's SHA-256, compare. Report any mismatch.

4. Open the audit report PDF

   Confirm it's readable, the firm letterhead renders, partner signature visible.

5. Log the drill result

   Drop a row in backup_drills with date + drill-runner + outcome. Some firms also email a brief to the partner.

Auto-purge after retention

The M16 retention cron (bin/cron-m16-retention.php) runs nightly and:

• Soft-flags any archive past retention_until with legal_hold=0 for partner review
• NEVER auto-purges — legal hold + partner approval required for physical delete
• Hard-purge happens only after partner approves + 30-day grace period elapses
• Audit-logs the purge action (last record of the file's existence)

That's the lifecycle

From "client called" → "lead captured" → "job created" → "tasks ticked" → "files attached" → "status flipped to completed" → "invoice drafted + sent + paid" → "engagement archived in SHA-256 vault for 7 years". One template, ~430 rows, full audit trail. The next engagement starts fresh.

Now jump into a specific template walkthrough — TPL-AA Annual Audit is the deepest: