heddle redact purge

Redaction is the soft form — bytes leave materialized views, the tombstone and the blob stay. Purge is the hard form. heddle redact purge apply --path --force deletes the loose blob and appends a Purge entry to the oplog. It refuses if no redaction has declared the blob first, since purge can only act on what redact apply already marked.

Authorization and confirmation are different things, and the CLI is explicit about it. From redact purge apply --help, verbatim: The active signing key must be authorized by [purge].trusted_keys; --force confirms intent but does not grant destructive authority. --force is the acknowledgement that the operation is irreversible; without it the command refuses and lists what would be removed. It is not the permission.

The keys that carry that permission are managed by heddle redact purge trust — add (with --from-pem, or --public-key plus --algorithm), list, and remove. Its own help states the rule that catches people out: Manage the independent list of keys authorized to destroy bytes. Redaction trust does not imply purge trust. A key on the redact trust list is not thereby allowed to purge.

Two honest gotchas remain. If the blob lives inside a pack file, purge removes the loose copy but the packed copy persists until you repack. And heddle undo refuses to unwind a purge regardless of flags — the bytes are gone.

Examples

Authorize a key to destroy bytes, then purge

bash# purge authority is its own list — redaction trust does not imply it$ heddle redact purge trust add --from-pem ~/.heddle/keys/ops.pem --label "ops-laptop"$ heddle redact purge trust list$ heddle redact purge apply HEAD --path src/test-fixtures/auth.json --force

List every purge that has happened in this repo

bash$ heddle redact purge list --output json

See also

• heddle redact
• heddle fsck
• heddle verify