Define cleanup authorization and targets

internal/config/storage_publish_test.go

@@ -307,6 +307,46 @@ func TestSpoolAndPublishDefaults(t *testing.T) {
 	}
 }
 
+func TestCleanupPoliciesRequireEnabledRunPublication(t *testing.T) {
+	tests := []struct {
+		name             string
+		spoolCleanup     bool
+		workspaceCleanup bool
+		publishEnabled   bool
+		uploadRun        bool
+		wantError        bool
+	}{
+		{name: "spool cleanup rejects disabled publish", spoolCleanup: true, uploadRun: true, wantError: true},
+		{name: "workspace cleanup rejects disabled publish", workspaceCleanup: true, uploadRun: true, wantError: true},
+		{name: "spool cleanup rejects disabled run upload", spoolCleanup: true, publishEnabled: true, wantError: true},
+		{name: "workspace cleanup rejects disabled run upload", workspaceCleanup: true, publishEnabled: true, wantError: true},
+		{name: "spool cleanup accepts enabled run publication", spoolCleanup: true, publishEnabled: true, uploadRun: true},
+		{name: "workspace cleanup accepts enabled run publication", workspaceCleanup: true, publishEnabled: true, uploadRun: true},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			pipelinePath, sessionPath := writeConfigFiles(t, testPipelineBaseYAML, testSessionBaseYAML)
+			cfg, err := Load(pipelinePath, sessionPath)
+			if err != nil {
+				t.Fatalf("Load() error = %v", err)
+			}
+			cfg.Pipeline.Spool.DeleteAudioAfterPublish = test.spoolCleanup
+			cfg.Pipeline.Workspace.CleanupAfterPublish = test.workspaceCleanup
+			cfg.Pipeline.Publish.Enabled = &test.publishEnabled
+			cfg.Pipeline.Publish.UploadRun = &test.uploadRun
+
+			err = Validate(cfg)
+			if test.wantError && err == nil {
+				t.Fatal("Validate() error = nil")
+			}
+			if !test.wantError && err != nil {
+				t.Fatalf("Validate() error = %v", err)
+			}
+		})
+	}
+}
+
 func TestPublishOutputValidation(t *testing.T) {
 	tests := []struct {
 		name    string

internal/config/validate.go

@@ -85,6 +85,9 @@ func validatePipeline(cfg *PipelineConfig) error {
 	if err := validatePublish(cfg.Publish, cfg.Scriptorium, cfg.Notarius); err != nil {
 		return err
 	}
+	if err := validateCleanupPublishPolicy(cfg); err != nil {
+		return err
+	}
 	if err := validateWhisperX(cfg.WhisperX); err != nil {
 		return err
 	}

internal/config/validate_publish.go

@@ -86,6 +86,19 @@ func validatePublish(cfg *PublishConfig, scriptorium *ScriptoriumConfig, notariu
 	return nil
 }
 
+func validateCleanupPublishPolicy(cfg *PipelineConfig) error {
+	if cfg == nil || (!cfg.Spool.DeleteAudioAfterPublish && !cfg.Workspace.CleanupAfterPublish) {
+		return nil
+	}
+	if cfg.Publish == nil || (cfg.Publish.Enabled != nil && !*cfg.Publish.Enabled) {
+		return fmt.Errorf("post-publish cleanup policies require pipeline.publish.enabled=true")
+	}
+	if cfg.Publish.UploadRun != nil && !*cfg.Publish.UploadRun {
+		return fmt.Errorf("post-publish cleanup policies require pipeline.publish.upload_run=true")
+	}
+	return nil
+}
+
 func scriptoriumOutputPathMap(scriptorium *ScriptoriumConfig) map[string]string {
 	out := map[string]string{}
 	if scriptorium == nil || len(scriptorium.Artifacts) == 0 {