# 3. The cleanup workflow builds cp9 purge from the current checkout

Status: Accepted

## Context

Cloud cleanup behavior must match the workflow commit that runs it. Using a
preinstalled or released `cp9` binary would let binary drift change cleanup
behavior independently of the reviewed code.

## Decision

The cleanup workflow sets up Go and builds `bin/cp9` from the current checkout,
then calls `bin/cp9 purge` for both the dry-run and destructive paths. It does
not use a preinstalled or release binary for cleanup.

The workflow `name` and `run-name` contract stays stable
(`cp9 Session Cleanup`; `cp9 cleanup owner={owner} session={session}
region={region}` for `workflow_dispatch`, `cp9 cleanup scheduled expired
resources` for schedule) so `cp9 destroy` run observation keeps finding cleanup
runs.

## Consequences

- Cleanup behavior is reproducible from the commit under review.
- The destroy handoff observation contract is preserved.
- Cutover of the production workflow from the shell script to `bin/cp9 purge`
  proceeds only after a real dry-run validation in the cleanup account
  (`804837308162`).