heddle redact

Heddle is content-addressed and immutable on purpose. Sometimes a credential or PII slips into a capture; redaction reconciles both facts: the blob is replaced by a stub in every materialized view, and a Redaction object records who did what when, with an optional signature over the canonical payload.

redact apply --path --reason declares a redaction, and signs it when --sign-with is passed. redact list enumerates active redactions; redact show reports the full tombstone including signature status. redact trust (add, list, remove) manages the list of operator keys this replica accepts signed redactions from over the wire. That list is fail-closed: an empty one rejects every signed redaction.

Redaction trust and purge trust are two independent lists, and one does not imply the other. The keys authorized to destroy bytes live under heddle redact purge trust. See heddle redact purge.

After redact apply, reads of the blob's address return the stub, and the bytes remain on disk for the audit trail. Physically removing them is a separate, irreversible command. Every redact and redact purge writes an oplog entry, so the audit trail is part of the same append-only record as everything else.

Examples

Redact a leaked API key from a test fixture

bash$ heddle redact apply HEAD --path src/test-fixtures/auth.json --reason "leaked API key" --sign-with ~/.heddle/keys/ops.pem

Accept signed redactions from an operator key on a replica

bash# the redaction trust list — separate from the purge trust list$ heddle redact trust add --from-pem ~/.heddle/keys/ops.pem --label "ops-laptop"

See also

• heddle redact purge
• heddle undo
• heddle fsck