Note

Cross-replica propagation requires signing. A purge ships over the wire as a Redaction with purged_at set, and receivers refuse unsigned, tampered, or untrusted-key records at the receive boundary. The signature is bound to the underlying redaction, so sign it when you declare it (heddle redact apply --sign-with <key.pem> …), then stamp it with heddle redact purge apply <state> --path <path> --force (purge always requires --force as the irreversibility confirmation; it carries no --sign-with of its own). Make sure each receiving replica has the signer's public key in [redact] trusted_keys (managed via heddle redact trust add --from-pem <key.pem>). An unsigned purge still applies locally. It just doesn't propagate. After a wire-purge, each replica drops the loose blob; packfile repack to remove a packed copy remains an operator follow-up.

CLI reference

heddle redact purge

Shipped

heddle redact purge apply <STATE> --path <PATH> --force | heddle redact purge list

Physically remove the bytes of a previously-redacted blob from local storage. Lives under `heddle redact purge` (not a top-level `heddle purge`). Irreversible. The Redaction tombstone stays in the DAG forever; only the underlying bytes leave.

Redaction (heddle redact apply) is the soft form: bytes leave materialized views, the Redaction object (tombstone) and the underlying blob bytes stay on disk. Purge is the hard form: heddle redact purge apply --path --force deletes the loose blob and appends an OpRecord::Purge to the oplog. The Redaction tombstone is unchanged and continues to record who, what, when, and why.

Purge always requires --force because the operation is irreversible; without it the command refuses and lists what would be removed. It also refuses if no redaction has been declared for the (state, path), since purge can only act on what heddle redact apply has already marked.

Signing happens on heddle redact apply --sign-with , not on purge. redact purge apply has no --sign-with flag. Two honest gotchas remain. First, if the blob lives inside a pack file, purge can remove the loose copy but the packed copy persists until you repack. Second, the workspace-owner capability check is wired through Biscuit as the capability surface lands; today --force is the explicit confirmation step.

Examples

Physically remove the bytes of a prior redaction

bash# redaction r0a1b2c3 already declared by heddle redact apply$ heddle redact purge apply HEAD --path src/test-fixtures/auth.json --forcepurged blob b3a8e201 at src/test-fixtures/auth.json in d01a8b4e (1 redaction(s) marked)

List every purge that's happened in this repo

bash$ heddle redact purge list1 purge(s):  r0a1b2c3 blob=b3a8e201 state=d01a8b4e path=src/test-fixtures/auth.json at 2026-05-11T14:34:11Z

Examples

See also