Repair the restricted-export protection plan

Objectives

Halcyon's draft says a public TLS listener makes every copy compliant and that annual rotation permits immediate key deletion. Write a replacement plan for the restricted export service using the requirements in the fixture, not those claims.

Keep machine fields exact, use YAML booleans, and supply short rationale text for wrapping and deletion review. The retention hold is active: this exercise needs a recoverable archive, not cryptographic erasure. Key administration must remain separate from the reader's duties.

dataset: identifiable patient exports
classification: restricted
approved_jurisdiction: J1 (primary and every backup)
transport: TLS 1.2 minimum on every hop
storage: encrypted at rest
key_control: customer-managed
key_roles: data key encrypts payload; wrapping key protects data key
rotation_interval_days: 365 (internal policy, not a universal standard)
reader_can_delete_key: prohibited
retained_backup: requires old key version; active retention hold
deletion: prohibited while hold or key dependency remains

Step-by-step hints

The guided walkthrough, in full. It is free: no XP cost, and it does not touch the paid hint ladder or the reveal gate.

1. Step 1

   Start with the records

   Use the handling scheme for the underlying data, not its current encoding.

   Preserve the sensitivity label

2. Step 2

   Follow every copy

   Compare each location field with the single permitted jurisdiction in the fixture.

   Constrain primary and backup jurisdiction

3. Step 3

   Separate media from connections

   Fill the storage switch and the protocol floor independently; include internal connections in scope.

   Protect storage and every transport hop

4. Step 4

   Describe the key hierarchy

   Use the required control model and describe what the wrapping operation protects, not what bulk encryption protects.

   Assign customer control and the wrapping role

5. Step 5

   Limit lifecycle authority

   Read the policy interval and compare a reader's duties with an administrator's destructive powers.

   Apply rotation without reader deletion rights

6. Step 6

   Test the destruction gate

   Decide whether destruction is currently permissible. In the review text, name both the legal preservation blocker and the surviving cryptographic dependency.

   Block deletion and review both blockers

Rules summary

• XP on pass

  40 bonus XP the first time every check goes green.

• Paid hints

  2 available. Each costs 25% of the lab XP (about 10 XP).

• Reveal solution

  Scores 0 XP and unlocks only after 3 check runs.

• Attempt cap

  60 check runs per learner. The runner warns you in the last 10.

• Drafts

  Your editor content is saved in this browser, so a reload will not lose work.

• Walkthrough

  Always free and never penalised: use it before spending a hint.